Phony is operated by Toby Johnson (trading as TJCreate), Lincoln, United Kingdom ("we", "us"). This policy explains what data Phony collects, why, and your rights under UK GDPR. If you have any questions, contact us at hello@tjcreate.co.uk.

The short version

There is no account. You never give us an email address, a password, or your real name.
We store the display name you type and an anonymous ID, so the people in your game can tell each other apart.
Game data is deleted when the room closes, and any room left idle for a day is deleted automatically.
No analytics, no advertising, no trackers, and nothing is sold or shared for marketing.

1. What we collect

An anonymous ID.

The first time you open Phony, our backend provider (Supabase) creates an anonymous identifier for your device. It is what lets the server tell one player in a room from another. It is not linked to your Apple ID, your email address, or anything else that identifies you, and we cannot use it to work out who you are.

The name you choose.

You type a display name so the rest of the room knows which card is yours. It is stored on your device so you do not have to type it again, and it is stored with the room while you are in a game. Pick whatever you like. It does not have to be your real name.

Game data.

While a game is running we store the room code, who is in the room, the secret word for the round, who was given the imposter card, and who voted for whom. This is the game itself. Without it the app cannot work.

What we do not collect.

Phony does not ask for or use your location, contacts, photos, camera, microphone, health data, or payment details. There is nothing to buy in the app. We do not run analytics, we do not use advertising identifiers, and we do not track you across other apps or websites.

2. Who processes your data

Supabase is the only third party involved. It provides the anonymous sign-in and the database that holds the game while it is being played. Data is stored in Supabase's Ireland region (eu-west-1), inside the EEA. Nothing is sent anywhere else, and no other service receives your data.

3. How long we keep it

Game data lives as long as the game does. When the last player leaves a room, the room and everything in it is deleted. Any room that sits untouched for 24 hours is deleted automatically, players included. Your display name stays on your own device until you change it or delete the app.

4. Legal basis

We process this data under legitimate interests (UK GDPR Article 6(1)(f)), specifically running a game you asked to play. The amount involved is the minimum the game needs to function, and none of it is used to build a profile of you.

5. Your rights

Under UK GDPR you have the right to access, correct, or erase your personal data, to object to processing, and to complain to the Information Commissioner's Office.

In practice, leaving a room deletes your player record from it immediately, and deleting the app removes the name stored on your device. Because there is no account, we hold nothing that outlives your last game. If you want to make a request anyway, email hello@tjcreate.co.uk and we will respond within 30 days. Be aware that without an account there may be nothing left for us to look up.

6. Children

Phony is a party word game suitable for a general audience. It does not collect data for profiling or advertising, and it has no chat, no user-uploaded content, and no way to contact strangers. Players type a display name that is visible only to the people in their own room.

7. Changes

If this policy changes, the date at the top of this page changes with it. Material changes will be noted in the app's release notes.

Phony Privacy Policy