Privacy Policy

What this is

MudkipSlagvivor is an asynchronous Survivor-style party game played in the browser. This page explains what information we collect to run the game, what we use it for, and who else sees it.

The service is currently operated as a friends-and-family hobby project. It is not a commercial product. If that changes, this policy will be updated.

What we collect

Account information. When you sign in we receive your email address from your auth provider (Google, Discord, or the email-based magic-link flow). If you sign in via Google or Discord, we also receive your display name and avatar URL from the provider — these are used to populate your initial profile and can be changed later in your profile.

Gameplay state. Every action you take in the game (votes, challenge submissions, confessionals, advantages played, camp searches, etc.) is stored in a database so the game can resolve correctly. Other players, hosts, and spectators see only what the visibility rules permit at any given moment (votes are private until publication; confessionals are private until the season ends; etc.).

Optional profile fields. You can choose to add a display name, first/last name, hometown, occupation, birth year, and a short bio. All of these are optional and visible to other signed-in users in contexts where your profile appears.

Technical logs. We log basic operational events like email delivery status and Supabase usage metrics. We do not run third-party analytics or advertising trackers.

How we use it

To run the game. Your email is used to log you in, send invitation emails when a host adds you to a season, and notify you of game events. Your gameplay state is used to compute results, render views to other players within visibility rules, and produce end-of-season summaries.

We do not sell or rent your information. We do not share it with third parties for marketing.

Who else sees it

The data lives with these service providers:

• Supabase — Postgres database, authentication, and file storage (avatar images).
• Vercel — Next.js application hosting and edge request handling.
• Resend — transactional email delivery (invitations, magic links).
• Google and Discord — OAuth sign-in providers, used only if you choose them. They give us your email + basic profile after you authorize.
• Cloudflare — DNS for our domain.

Each of these has their own privacy practices; we recommend reviewing theirs if you have specific concerns.

How long we keep it

We keep your data for as long as your account exists. You can request account deletion at any time (see below). Completed seasons may be retained for historical purposes (leaderboards, career stats) unless you request your participation be removed.

Your choices

• Update your profile at any time on the profile page.
• Stop receiving invitation emails by asking the host who invited you not to invite you again, or by deleting your account.
• Request account deletion by emailing the address below. We'll remove your profile and unlink your participation from active and historical seasons within a reasonable period.

Contact

For questions or to request account deletion, email [email protected].