Privacy Policy

Overview

PlayParty.io ("PlayParty.io", "we", "us", "our") operates a real-time synchronized media watch-party platform, companion browser extension, and supporting server infrastructure. We are committed to transparency in how we collect, process, and safeguard your personal data.

While PlayParty provides synchronization, communication tools, and media compatibility utilities, video and audio playback is rendered directly in each participant's web browser. We do not permanently host, transcode, or store proprietary video libraries on our servers. This policy explains what information we process, the purposes of processing, and your statutory privacy rights.

Information We Collect & Process

1. Account & Profile Information

When you create an account or authenticate via third-party sign-in (such as Google OAuth or Google One Tap), we store your account profile securely in our database:

• Identity & Profile Details: Email address, chosen username, display name, and unique account identifier.
• Authentication Data: Securely hashed authentication tokens or federated authentication identifiers.
• Profile Avatars: Selected default preset identifiers or custom avatar images uploaded through our secure media storage provider (Cloudflare R2 Object Storage).
• Account Lifecycle State: Verification status, account preferences, and scheduled deletion grace period timestamps.

2. Room Synchronization & Watch History

To maintain real-time playback synchronization and provide room management features:

• Room Metadata & Presence: Room identifiers, titles, access settings, host permissions, and real-time participant presence.
• Playback Coordination State: Active media URLs, provider type (e.g. standard video, streaming playlists, third-party embeds), current playback timestamp, and playback status (playing/paused).
• Watch History: For authenticated users, recently visited room details and media titles are stored in your account history (capped at 20 entries and automatically purged after 90 days). Guest users have watch history stored solely on their local device.
• Room Moderation Records: Temporary cooldown records and ban status entries to protect rooms against unauthorized re-entry and spam.

3. Direct Client-to-Source Streaming & Zero Media Hosting

PlayParty.io is architected for privacy and zero server-side media processing:

• Direct Client Decoding: All video and audio streams decode natively within each participant's local web browser directly from the original source (e.g. YouTube, Twitch, Vimeo, or user-provided links).
• Zero Media Relaying & Zero Storage: Our servers do not proxy, download, transcode, relay, or store third-party video or audio files. Only lightweight playback synchronization timestamp signals (<1 KB JSON packets) pass through our synchronization infrastructure.
• Domain Protection: Our application validates media URLs to protect users against malicious endpoints and prevent server-side network abuse.

4. Search & Media Discovery

Our platform includes search and content exploration features:

• When you perform a search or browse media suggestions, queries and public media identifiers are processed to retrieve titles, thumbnails, and stream metadata.
• Search queries are processed transiently to fulfill the immediate request and are not linked to your user profile or used to construct behavioral advertising profiles.

5. Real-Time Communications & Messaging Architecture

PlayParty.io provides two distinct messaging and communications systems, engineered with data minimization and encryption at their core:

• Watch Room Communications (Strictly Ephemeral in RAM): Watch Room interactions—including group text chat, emoji reactions, and WebRTC voice and video streams—are transmitted in real time between participants using LiveKit SFU data channels and real-time WebSocket broadcast channels. Audio/video streams and room chat messages exist solely in volatile memory (RAM) in transit and within participants' active browser tabs. Watch Room chat messages are never written to databases, disk, or server logs. When a Watch Room session terminates or all participants depart, all room chat data is permanently discarded.
• Direct Friends Messages (End-to-End Encrypted & Stored as Ciphertext): One-on-one private messaging between friends is protected by client-side End-to-End Encryption (E2EE) utilizing WebCrypto ECDH (Elliptic Curve Diffie-Hellman P-256) for shared key agreement and AES-GCM-256 for message payload encryption. Messages are encrypted locally on the sender's device before transmission. PlayParty servers receive and store only the encrypted ciphertext, cryptographic initialization vectors (IVs), sender and recipient account identifiers, and delivery timestamps in our database to facilitate asynchronous cross-device delivery. Plaintext message contents are never stored on, inspected by, or decipherable by PlayParty servers.
• User Safety & In-App Abuse Reporting: While PlayParty servers never inspect or decrypt communications in transit, users hold the right and capability to report harassment, spam, hate speech, threats, or illegal content. When a participant submits an in-app report against a specific message or user in Watch Rooms or Direct Messages, the reporting user's client decrypts and securely transmits the flagged message along with up to 10 preceding messages from that conversation to the PlayParty Trust & Safety team. This limited conversational context is used strictly to investigate and substantiate misconduct claims, prevent out-of-context misattribution, and enforce disciplinary actions (such as account termination or room bans). Unreported messages remain strictly end-to-end encrypted and inaccessible to PlayParty.
• Cryptographic Key Material: Users' public cryptographic keys and encrypted key-backup containers are maintained in our database to enable contact discovery and multi-device key agreement. Private encryption keys remain stored locally within browser IndexedDB or native secure storage on the user's local device.

6. Law Enforcement & Legal Disclosure Boundaries

We believe in complete transparency regarding what data our technical architecture can and cannot produce in response to lawful legal processes (such as subpoenas, court orders, or search warrants):

• Watch Room Transcripts & Media: PlayParty is technically incapable of producing Watch Room chat transcripts, message logs, or voice/video recordings under any subpoena or court order because the data does not exist on our servers.
• Direct Message Content: Because Direct Messages are end-to-end encrypted client-side, PlayParty cannot produce plaintext message transcripts or intercept conversations. In response to valid, legally binding process with proper jurisdiction, PlayParty can only produce raw encrypted ciphertext and associated transmission metadata (sender ID, recipient ID, message timestamp, message ID).
• Metadata Footprint: The metadata we maintain is strictly limited to: user account profile records (email address, username, display name, account creation timestamp), mutual friendship associations, active room ownership records, and server watch history (capped at 20 entries, automatically purged after 90 days). Transient IP address hashes used for anti-abuse rate limiting reside in volatile memory and are not stored in database records.

7. Local Device & Browser Storage

We store certain essential and functional data locally in your browser (via local storage and session storage):

• Display names, guest identifiers, and cached profile details.
• Audio volume preferences, interface layout settings, and room host credentials.
• Cookie preferences and Google Consent Mode settings.
• Secure authentication session tokens (cleared upon sign-out).

8. Companion Browser Extension

If you install the optional PlayParty companion extension, it operates strictly on demand:

• Detects public video stream URLs on the active browser tab when you choose to start or join a party.
• Temporarily retains detected stream references in local browser session storage (automatically cleared when your browser closes).
• Adjusts network request headers (specifically setting media-origin Referer and Origin, and removing fetch-metadata headers) via Chrome's local declarativeNetRequest session rules solely to allow the player to fetch and decode user-selected HLS/DASH media streams across domains, without modifying DRM or circumventing subscription access controls.
• Does not collect, track, or transmit your broader browsing history or navigation data to PlayParty servers.

9. Privacy-Preserving Security & Rate Limiting

To protect our infrastructure against distributed denial-of-service (DDoS) attacks, brute-force attempts, and automated abuse:

• We use privacy-preserving, cryptographically hashed representations of IP addresses in volatile memory to calculate request rates. These volatile memory rate-limiting counters are automatically cleared within 15 minutes.
• Raw IP addresses are not stored in our application database records. Standard connection logs may be processed transiently by our content delivery and network security providers for infrastructure defense.

10. Transactional Notifications

We use reputable transactional email delivery providers (such as Resend and Brevo) to send critical account notifications, email verification links, and password reset instructions. We do not send unsolicited marketing emails or sell your contact information.

11. Performance Telemetry & Error Monitoring

• PostHog (Product Analytics & Diagnostics): Measures user interaction workflows, records anonymized session replays to reproduce technical glitches, and captures client error diagnostics. All sensitive form fields and private credentials are automatically masked on-device. PostHog respects your consent preferences and is completely disabled if analytics cookies are declined.
• Google Analytics 4 (GA4): Measures aggregated traffic patterns and device metrics. GA4 operates under Google Consent Mode v2 and is only loaded when consent is granted.
• Application Error Diagnostics: We use specialized error-tracking tools (such as Sentry and PostHog Error Tracking) to monitor unhandled application errors and system crashes to improve software stability.
• Bug Submissions: When you voluntarily submit feedback or bug reports, the details you provide (description, technical context) are reviewed to diagnose and resolve software bugs.

How We Use Information

• Facilitate real-time playback synchronization and ephemeral room chat between participants.
• Provide low-latency voice and video communication channels.
• Deliver end-to-end encrypted direct messages between mutual friends.
• Authenticate user accounts, enforce account security, and manage user profiles.
• Prevent platform abuse, mitigate DDoS threats, and maintain server reliability.
• Troubleshoot application crashes and improve service performance.

We never sell, rent, or monetize your personal data. We do not use your personal information for targeted advertising.

Legal Bases for Processing (GDPR & UK GDPR)

For individuals in the European Economic Area (EEA) and the United Kingdom (UK), our legal bases for processing personal data include:

• Contract Performance (Art. 6(1)(b) GDPR): Providing core features, user accounts, room synchronization, and real-time communication.
• Legitimate Interests (Art. 6(1)(f) GDPR): Ensuring platform security, preventing abuse and fraud, debugging errors, and maintaining operational stability.
• Consent (Art. 6(1)(a) GDPR): Where you have provided express consent for non-essential analytics tracking. You may withdraw consent at any time.

International Data Transfers

PlayParty.io operates globally using distributed cloud infrastructure located in the European Union, the United States, and the Asia-Pacific region. Where personal data belonging to individuals in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland is transferred internationally, we ensure adequate protection standards are enforced:

• Standard Contractual Clauses (SCCs): We execute European Commission-approved Standard Contractual Clauses (and UK Addenda) with third-party infrastructure providers and sub-processors (including Supabase, Cloudflare, Oracle Cloud Infrastructure, PostHog, and Resend) to bind them to rigorous data protection requirements.
• Data Privacy Framework (DPF): Where applicable, we rely on certified participating entities under the EU-U.S. Data Privacy Framework, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF.
• Technical Safeguards: End-to-end encryption for direct message payloads, volatile in-memory processing for room communications, and cryptographic hashing for IP address calculations in transit.

Data Retention & Erasure

• Account Data: Retained for the lifetime of your account. Deletion requests undergo a 30-day grace period, after which all account records and associated profile data are permanently erased.
• Watch Room Communications: Strictly ephemeral in volatile RAM; 0 seconds retention after session ends (never written to disk or database logs).
• Direct Friends Messages: Stored as encrypted ciphertext in our database until deleted by conversation participants or upon account deletion. Users may permanently delete individual messages or clear entire chat threads at any time.
• Friendship Records & Public Keys: Retained for the lifetime of the account, or deleted upon account deletion.
• Server Watch History: Retained for a maximum of 90 days or up to 20 recent entries per account, whichever occurs first.
• Room State: Active playback state is cleared and marked closed once participants depart or session heartbeats cease; inactive room records may be retained for platform security, audit trails, and abuse prevention.
• Voice & Video Streams: Routed in real time with zero persistent storage or archiving.
• Diagnostics & Analytics: Aggregated telemetry and error logs are retained for up to 30 days before automatic purge.
• Abuse Reports & Investigation Records: Reports submitted via in-app reporting tools (including the reported message and up to 10 context messages) are retained securely solely for trust, safety, and abuse review purposes, and are automatically purged after the moderation investigation is concluded or within 90 days.
• Local Browser Data: Persists on your local device until cleared via browser settings or through the in-app Settings → Data & Privacy menu.

Third-Party Service Providers

We work with trusted infrastructure and service providers to operate PlayParty.io under strict confidentiality and data protection standards:

Your Rights & Self-Service Controls

You have extensive control over your data directly within the application:

• Data Export: Generate and download a complete JSON export of your profile information, watch history, and local preferences via Settings → Data & Privacy.
• Account Deletion: Request immediate deletion of your account and associated profile records via Settings → Data & Privacy or by contacting our privacy team.
• Local Data Reset: Clear all device-stored identifiers, preferences, and cached session data via the settings menu.
• Consent Preferences: Modify or withdraw your analytics cookie preferences at any time.

To submit a formal data subject request or contact our privacy team, email privacy@playparty.io.

California Privacy Disclosures (CCPA / CPRA Notice at Collection)

This Notice at Collection informs California residents of the categories of personal information collected, the business purposes for which it is used, and the applicable retention criteria pursuant to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Notice on Sale or Sharing: PlayParty.io has never sold, rented, or shared personal information for cross-context behavioral advertising, and has no intention of doing so in the future.

California residents hold the right to know, delete, correct inaccurate personal information, and be free from discrimination for exercising these rights. Self-service controls are available within your account under Settings → Data & Privacy, or requests may be submitted to privacy@playparty.io.

Children's Privacy

PlayParty.io is not directed to children under 13 (or under 16 where required by local law). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take immediate steps to delete it.

Policy Updates

We may update this Privacy Policy periodically. Significant changes will be noted on this page along with an updated "Last updated" date.