Last updated: August 9, 2026
The short version: we collect what we need to ship you games, answer your messages, and know which pages people like. No ad trackers, no selling data, and nothing at all collected from kids.
When you buy something
The payment form on our checkout page is provided and operated by Stripe, running inside Stripe’s own secure frame. Your card number, expiry and security code go straight from your browser to Stripe — they never reach our servers and we never store them. Opening the checkout page loads Stripe’s software, so Stripe sees a request from your browser even if you decide not to buy.
Once you pay, Stripe passes us the order and we keep:
- Your email address, and the name and shipping address you entered.
- What you bought and what it cost — a snapshot, so the order stays readable even if we later rename or reprice the product.
- Stripe’s reference numbers for the payment, so an order can be matched to the transaction.
- How that visit began: any campaign tags in the link you followed, the website that referred you (its domain only), and the first page you landed on. We use this to tell whether the free online game actually sells boxes. These same tags are attached to the Stripe payment session, so Stripe receives them too — including when a checkout is never completed.
Your order confirmation and shipping notification are sent through Resend, our email provider, and a copy of each order — including your address — is emailed to us so we can pack it.
When you message us
The contact form stores your name, email, the topic you picked, an order number if you give one, and your message, so we can reply. A copy is emailed to us through Resend with your address as the reply-to. The “make your own card” form saves the same way but sends no email. The “notify me” forms store only your email, and send exactly one message when that game ships.
Alongside each form submission we store a scrambled one-way code derived from your IP address— never the address itself — purely to stop the same source flooding us with spam.
Counting visitors, without identifying them
We run our own measurement on our own servers. No third-party analytics company is involved, and it uses no cookies. We record that someoneviewed a page or clicked “play free”, using a scrambled code derived from your connection that resets every dayand cannot be turned back into you. We never store your IP address or your browser’s user-agent. Page addresses are recorded without anything after the question mark, and referring sites as a bare domain only.
One honest exception: when a purchase completes we record the amount and Stripe’s checkout reference, and that reference also appears on your order — so that single row could be matched back to a named order. It carries no name or email itself.
Your cart lives in your own browser’s storage, not on our servers.
The free online game
Sotally Tober at play.partyprogames.comhas no accounts, no logins and no email addresses. To play you pick a nickname, an avatar and a “vibe”. The nickname is free text and is shown to everyone else at the table — you can type anything, so use a made-up name if you’d rather not be identifiable.
While a game is running we store the room, its settings, and what happens in it — whose turn it is, the cards dealt, and each player’s answers. On some cards an answer is a personal disclosure about yourself or a vote about another player. Rooms are deleted automatically about an hour after the last activity, along with everything in them.
Two things outlive the room. When a game finishes we keep a summary indefinitely — nicknames, avatars and end-of-game statistics — so we can see how the game is actually played. And we keep counts of how often each card is drawn or skipped, which are about the cards, not about players.
The game stores a reconnect token in your browser so a refresh doesn’t lose your seat, and loads its fonts from Google, which means Google sees a request from your browser. The storefront does not: its fonts are served from our own domain.
Kids
The Kids’ Corner pages carry no advertising, no analytics, no tracking scripts and no forms of any kind, and they do not link out to the grown-up games. That is built into how the site is put together rather than being a rule someone has to remember, and an automated test fails our build if it is ever broken. We do not knowingly collect personal information from children under 13; purchases are made by adults at checkout. If you believe a child has sent us personal information, contact us and we will delete it.
What we don’t do
- We don’t sell or rent your information to anyone.
- We don’t run third-party advertising or ad trackers on this site.
- We don’t email you marketing unless you explicitly asked for a heads-up.
- We don’t store card numbers, and we never see them.
Who else touches your data
- Stripe — takes the payment and holds its own copy of your details.
- Resend — delivers our order, shipping and contact emails.
- Vercel — hosts the shop; Railway hosts the game server.
- Neon — hosts our database.
- Vercel Blob — stores our product and card images.
- Sentry— receives error reports when something breaks. Personal details are stripped out before anything is sent.
- Google Fonts — serves the fonts on the game only.
Each holds only what its job requires.
Your choices
Want your contact messages or notify-me signup deleted? Ask, and it’s done.
Orders are the exception, and we’d rather say so than pretend otherwise: once an order exists we deliberately cannot delete it, because it is the record of money changing hands and bookkeeping law expects us to keep it. A refund or cancellation is recorded on the order rather than erasing it.
Game data needs no request: leave a room and it disappears with the room within about an hour. The end-of-game summaries we keep hold only the nickname and avatar you chose, with nothing linking them to you.