Privacy policy

What we collect when you play

Name and mascot. When you start or join a room, you choose a name (a nickname is fine, up to 14 characters) and a mascot. Everyone in the room sees them, including the audience. It doesn’t need to be your real name.

Answers, votes, medals and scores. We process these on our server to run the game. During voting, answers are shown without names. At the reveal, everyone in the room sees who wrote each answer and which players voted for it. Audience votes are only ever shown as a group total.

Live typing in On Call. While it’s your turn in On Call, what you type is shown live to your room. It isn’t stored.

Emails you send us. If you write to us, we get your email address and whatever you include. We use it to reply.

We don’t ask for your email address, real name, phone number or location, and we don’t use your answers to train AI models.

How long game data lasts

Rooms live in our server’s memory, not in a database. A room and everything in it (nicknames, mascots, answers, votes and scores) is deleted within 60 minutes after the last person leaves, and within about 10 minutes if nobody played in it. No room lasts longer than 12 hours.

When we update or restart the server, we save the open rooms to a file on the server’s disk (nicknames, answers and rejoin tokens included) so games can pick up where they left off. The server loads that file back and deletes it as soon as it starts again, usually within seconds. A file older than 10 minutes is never loaded: when the server next starts it deletes the file, and the saved rooms are thrown away instead. If the server is down, the file stays on its disk until then. We have turned off the scheduled snapshots of that disk, so no automatic copy of it is kept.

We don’t keep a history of past games.

What stays in your browser

We use your browser’s local storage, not cookies, to remember:

• your nickname and mascot, so you don’t have to retype them;
• your sound and motion settings;
• a rejoin token for each room you join: a random code that puts you back in your seat if your browser crashes or you reload;
• the rejoin token of the last room you created, for 14 days, so we can count people who come back to run another (see “Counting how the site is used”);
• drafts of answers you’re typing, so a crash doesn’t cost you your joke. A draft is deleted when you submit it.

This stays on your device. Your nickname and mascot are sent to our server when you join a room, and a rejoin token only when you reconnect to its room. Tokens stop working once their room closes. You can delete all of it by clearing this site’s data in your browser settings. If your browser blocks storage, you can still play. You just can’t rejoin after a crash.

Technical data and logs

Like any website, our servers receive technical information when your browser connects: your IP address, browser type and version, the pages and files requested, and the time. We use it to deliver the site, keep your connection working and prevent abuse. For example, we limit how many rooms one IP address can create per minute.

Our servers log errors and basic events so we can find and fix problems. Logs are kept for [Log retention] and then deleted. Our hosting provider, Fly.io, processes this information for us to run the servers, which are located in the United States (Ashburn, Virginia).

Counting how the site is used

We want to know whether the games get played and finished, not who plays them. So our server keeps daily totals, counted on the server itself. It adds one to a tally when:

• a room is created;
• a game starts, finishes, or is abandoned (and which stage it was in when it was);
• a game starts with a certain number of players (so we know whether rooms are big or small);
• one of our public pages is opened: the home page, a game page, a guide, About or this page.

The tallies are per day and per game, kept in a file on the server’s disk, and they are not tied to anyone. We store no IP address, browser details, nickname, answer or room code in them. We use no analytics service, no tracking script, no cookies and no third party for this.

People who come back. To see whether the people who run rooms return, your browser keeps the rejoin token of the last room you created for 14 days and sends it with the next one. Our server never saves it. It scrambles it one way, with a random value that is replaced every day, and keeps only the scrambled result, for 14 days at most. After that the day’s random value and its scrambled results are deleted, and nobody, including us, can match them to anything. All we can learn is that a room was started by someone who had started one in the last 14 days. Clearing this site’s data in your browser removes the token.

Cookies

Coworker Games doesn’t set any cookies of its own. A third-party ad network might, if we turn one on. See the next section.

Ads

Ads pay for the games. They only appear in natural pauses (on our web pages, in the lobby and between games), never while a round is being played.

House ads (the default). Usually the ads you see are our own: a tip, a promotion for Coworker Games, or a sponsor message we’ve placed ourselves. They come from our own server, with no third-party scripts, no cookies and no tracking.

Third-party ad networks (only if enabled). We may switch on one of the networks below. When one is on, its script loads only when an ad space scrolls into view. The network then receives information from your browser, such as your IP address, browser details and the page you’re on, so it can show the ad and count it. Each network follows its own privacy policy.

• Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this and other websites. Google’s advertising cookies let Google and its partners show you ads based on your visits to our site and other sites on the internet. Where the law requires it, including in the European Economic Area and the UK, we ask for your consent first through a Google-certified consent tool. You can change your choice at any time with the “Privacy and cookie settings” link at the bottom of every page. You can turn off personalized ads in Google’s Ads Settings, or opt out of many third-party vendors’ cookies at aboutads.info. More: How Google uses information from sites or apps that use its services.
• EthicalAds, run by Read the Docs, Inc. It picks ads based on the page’s content and your general location, not on tracking you, and it doesn’t give visitors identifying cookies. EthicalAds privacy policy.
• Carbon Ads. Shows one small ad aimed at developers and designers. It may use cookies, and it collects non-identifying information such as your browser, operating system, the page you’re viewing and your approximate location. Carbon Ads privacy policy.

If an ad doesn’t load, or you use an ad blocker, the games work exactly the same.

Why we use it (EEA and UK)

If you’re in the European Economic Area or the UK, the law asks us to name a legal basis for each use:

• Running your game (nickname, mascot, answers, votes, rejoin token): to provide the service you asked for.
• Technical data, logs and abuse prevention: our legitimate interest in keeping the service working and safe.
• Daily usage totals: our legitimate interest in knowing whether the service works and is used, with nothing in them that identifies you.
• Third-party advertising cookies: your consent, where it’s required.
• Replying to your emails: our legitimate interest in answering you.

Our servers are in the United States (Ashburn, Virginia). If you play from somewhere else, your data is processed there.

Who can see what

• Everyone in your room (players and audience) sees your nickname, mascot and answers. At the reveal, they see who wrote each answer and which players voted for it.
• Anyone with your room’s code or link can join, so share it only with people you want to play with.
• The VIP (the person running the room) can remove players and censor answers.
• We don’t watch games. We may look at server logs to fix a problem.

Children

Coworker Games is made for teams at work. It isn’t directed at children under 13, and we don’t knowingly collect personal information from them. If you think a child has given us personal information, email [Contact email] and we’ll delete it.

Your choices and rights

• Clear this site’s data in your browser to delete everything stored on your device.
• Leave a room whenever you like. When the room closes, its data is gone.
• Depending on where you live (the EEA, the UK or California, for example), you may have the right to access, correct or delete your personal information, or to object to how we use it. There are no accounts, so we usually can’t tie data to you, but email [Contact email] and we’ll help however we can. You can also complain to your local data protection authority.
• When Google ads are on, you can change your ad consent with “Privacy and cookie settings” at the bottom of any page.

Security

The site is served only over HTTPS. Rejoin tokens are random. They exist in your browser and, while your room is open, in our server’s memory. When we restart the server they are also in the file described above, for as long as it lasts. No system is perfectly secure, but there’s very little here to take: no accounts, no passwords, no game history.

Changes

If we change how we handle data, we’ll update this page and the effective date at the top. If a change is significant, we’ll also say so on the site.