Privacy Policy

House Deck is operated by Syed Athar Saeed, based in Ontario, Canada. The operator is responsible for personal information under its control and designates its legal contact as the privacy contact for questions, requests, and complaints.

syedathersaeed1@gmail.com

• Room information: display names, room codes, temporary player identifiers, readiness, selected game, house rules, connection status, and public gameplay activity.
• Private game information: your own hand or private selections and the authoritative hidden game state needed to run the game. Opponents receive only the public or personalized view required by that game.
• Reconnect credentials: a temporary player ID and rejoin token. Treat the token like a password for that room.
• Technical information: IP address, request time, browser or device information, connection metadata, and security or service logs that hosting providers ordinarily process.
• Optional product analytics: only after this browser grants permission, House Deck may send allowlisted room and game events, a pseudonymous browser identifier, and limited browser/device properties to PostHog. It does not intentionally send names, room codes, player IDs, rejoin tokens, card IDs, full URLs, or raw game state.
• User-submitted reports: if you copy and submit a bug report, it may include the current URL, room code, display name, browser user agent, visible error, game, player counts, and backend host. You can review the text before submitting it.

House Deck uses room and technical information to create and join rooms, restore seats, enforce game rules, synchronize players, keep the service secure, diagnose failures, respond to requests, and meet legal obligations. Optional analytics are used only to understand aggregate product usage and improve the service.

House Deck does not sell personal information, use gameplay data for targeted advertising, or require analytics permission to play.

• Active rooms and game state are held in backend memory, not a permanent gameplay database. An empty room is deleted; a room where every human is disconnected is deleted after approximately 20 minutes; a backend restart also clears rooms. A room can remain longer while a human stays connected.
• This browser stores each room code, display name, player ID, rejoin token, and save time under a house-deck:room: key for up to seven days. Leaving intentionally clears that room record.
• The browser stores legal and privacy choices. Analytics permission is renewed after 180 days. Tab-scoped storage may prevent duplicate analytics events during a single browser session.
• House Deck currently uses local and session storage rather than an application cookie for these features. After analytics permission, PostHog persistence is configured for local storage; hosting and security providers may still use essential edge or security cookies under their own documented settings.
• If analytics are allowed, PostHog persistence and historical events follow the operator's configured PostHog retention. The release checklist requires raw-event retention of no more than 12 months.
• Hosting, security, and support records follow the applicable provider's configured retention and may be preserved longer when required for security, a legal request, or a dispute.

House Deck relies on a frontend host, a WebSocket-capable backend host, and—only when enabled and permitted—PostHog US for analytics. The optional report link may open Google Forms. Socket.IO is the software used to transport realtime messages; the selected backend host operates the network service.

Providers may process information outside Canada, including in the United States, where it can be subject to local law and lawful access demands. The current provider list, regions, subprocessors, and retention must be recorded in House Deck's processor register before publication.

Optional analytics remain off unless you choose “Accept analytics.” You can reject them or change your choice through “Privacy choices” in the footer. Rejecting or withdrawing permission stops future capture and clears House Deck's local PostHog persistence. It does not automatically erase events already retained by PostHog.

“Clear saved data” removes House Deck room credentials and preferences from this browser. Doing so can prevent you from rejoining a saved seat.

Contact the privacy contact to ask whether House Deck holds personal information about you, request access, correct inaccurate information, withdraw optional consent, or request deletion. Include only the minimum details needed to locate the information. House Deck may ask you to demonstrate control of a room or analytics identifier and will not ask for a rejoin token by ordinary email unless a secure verification method is provided.

Some information may already have expired from memory, may be held only by a provider, or may need to be retained for security, legal, fraud-prevention, or access-request obligations. The operator will explain any applicable limitation and available complaint route.

House Deck uses personalized game updates, server-side move validation, restricted CORS, environment-managed configuration, and transport encryption when deployed over HTTPS. No Internet service is perfectly secure. Rejoin tokens should not be shared, included in bug reports, or exposed through screenshots or browser extensions.

The operator maintains an incident process for containment, investigation, breach records, and legally required notifications.

House Deck is intended for people aged 13 or older. Do not use the service if you are under 13. Users who cannot provide meaningful consent or enter an enforceable agreement must have a parent or legal guardian act for them where required. Notices and privacy choices are designed to be readable by teenagers, and optional analytics are off by default.

A parent or guardian can contact the privacy contact about a young person's information. House Deck will consider the young person's rights and verify authority before disclosing information.

Material changes will receive an updated effective date and an appropriate notice or renewed choice. Questions and complaints should first be sent to the privacy contact. You may also have the right to contact the Office of the Privacy Commissioner of Canada or another applicable regulator.