Privacy Policy

1. Who is responsible for your data?

Street Bingo is operated by Streetbingo. Contact help@streetbingo.gg for support or questions about these policies.

Streetbingo is the controller of the personal information used to operate this game. This notice covers the Street Bingo website, guest play, accounts, community features and memberships.

2. Information we use

• Accounts: your email address, display name, chosen avatar colour, account identifiers and sign-in information. If you choose Google sign-in, we receive your Google account identifier, email and basic profile information used to create or link your account. Supabase provides account authentication.
• Guest play: your chosen nickname and a room session identifier. An account is not required for all game modes, but some features and saved progress require one.
• Games and progression: rooms, teams, scores, approved finds, evidence votes, wins, levels, XP, achievements, equipped rewards and daily challenge entries and results.
• Content you share: chat messages, submitted Street View URLs and the location and viewing direction in those links, any supported evidence images, custom boards, descriptions, upvotes and reports. A Street View scene location is not a request for your device’s current location.
• Billing: subscription status, renewal and payment dates, Stripe customer and transaction references, and refund or billing correspondence. Stripe handles payment information; Street Bingo does not store full card numbers or security codes. Membership settings may display the card brand, last four digits and expiry provided by Stripe.
• Technical and support information: IP address, browser and device information, request and error logs, session cookies, abuse-prevention records and information you send to support. Our account rate limiting uses hashed IP addresses and identifiers.

Please do not put your email, home address, phone number or sensitive personal information in your nickname, boards, chat or evidence.

Basic service analytics

Our admin-only dashboard shows aggregate game activity, account growth, page views and visits. Optional PostHog analytics measures first-game completion, playing again, returning on later days, lobby waiting and broad technical error categories, only after you allow it. We send pseudonymous browser or account identifiers, visit and game identifiers, coarse device category, traffic-source category and game settings. We do not send names, emails, chat, clue text, evidence URLs or images. This optional processing relies on your consent; change your choice using Analytics preferences in the footer. Traffic records contain a general page category, UTC date, a random event ID and whether it was a fresh page load; they do not contain account identifiers, room codes, URL query strings, chat content or IP addresses. Reloads count as new visits, so these figures do not identify unique people. Traffic and multiplayer summary records are scheduled for removal after 90 days during routine collection. The basic aggregate traffic counter uses no analytics cookies. When you allow optional PostHog analytics, svb_analytics holds a random browser token for up to 90 days and svb_analytics_choice remembers your on/off choice for up to 90 days. Our server stores a hash of the token. Declining or withdrawing disables optional capture and stops queued events being sent; withdrawal does not automatically remove events already delivered. Contact us for an erasure request. Local event and journey records are scheduled for removal after 90 days; PostHog’s free plan guarantees one year of event retention; older data may remain in cold storage under its published policy. Contact us to request deletion of delivered analytics records. We respect Do Not Track and Global Privacy Control for traffic collection. Separate short-lived hashed network counters help prevent abuse of the collection endpoint.

3. Why we use it and our legal bases

Where a feature needs information, we explain it in the relevant form. Without an email we cannot provide an email-based account; without a nickname we cannot identify you in a multiplayer room. Optional profile and social features are your choice. We do not use your information for decisions with legal or similarly significant effects based solely on automated processing. Game scoring and achievement rules are automated.

You can object to processing based on legitimate interests. Email us explaining your situation. We will stop unless we have an overriding lawful reason to continue.

4. Who can see your information?

Players in your lobby or game can see your name, avatar, level, equipped rewards, team and relevant scores and evidence. Chat is shown to the applicable room, match or team. Team chat can still be included in a report reviewed by moderators. Content can be copied by people who can view it, so do not treat a private room as confidential storage.

Published community boards, their creator names and public game listings are visible to visitors. Daily Discovery entries are visible on the relevant day’s gallery; names and voting totals may be hidden while voting is open and shown with results. Moderators can access reports and the information needed to investigate them. Your email and billing details are not included in these public game displays.

5. Service providers and international processing

We share the information needed to deliver these services with:

• Supabase for account authentication and sign-in emails. Supabase privacy notice.
• Stripe for Checkout, subscriptions, billing management, payment security and refunds. Stripe also handles some information for its own legal and fraud-prevention purposes. Stripe privacy notice.
• OpenAI Sites and Cloudflare for website hosting, delivery, application databases and file storage.
• OpenAI API, when AI judging is selected: we send the submitted Street View snapshot and tile clue for automated evidence review. We do not include account emails, chat messages or player names in that request. The verdict, estimated confidence and short explanation are kept with the game evidence. Uncertain results and service failures are passed to lobby voting. We request that API responses are not stored as application state; provider security and abuse-monitoring retention may still apply. OpenAI API data information.
• PostHog, for optional product analytics if you allow it. It receives pseudonymous gameplay and visit events to help us improve the game. The project’s selected EU or US region determines where these analytics are hosted. See PostHog’s privacy information.
• Google when you choose Google sign-in, load a Street View preview or follow a Maps link. Google receives information such as your IP address, browser details and the requested scene when its content loads. For AI-judged games, our server also requests the submitted panorama and camera view from the Street View Static API. We process this snapshot for the review without saving it in our image storage. Its services have their own privacy and cookie practices. Google privacy policy.

We may also disclose information where legally required, to deal with fraud or safety concerns, or to professional advisers under appropriate confidentiality arrangements. We do not sell personal information to advertisers.

These providers operate internationally, so information may be processed outside the UK. UK data-transfer rules require an applicable adequacy decision or appropriate safeguards, such as approved contractual safeguards, where required. Contact us for information about the arrangements applicable to your data.

6. How long information is kept

We keep information for its stated purpose and any necessary security, dispute or legal requirements. Different records have different lifetimes:

• Account and progression: retained to maintain your account, XP, achievements and game history while you use the service. You can request account deletion from account settings or by email; it is a reviewed request, not an immediate automatic erasure.
• Room access and chat: room records expire from normal play after seven days. Chat is limited to the current round, up to 500 messages, and a 24-hour visibility window; starting a new round clears the room chat. Expiry and background cleanup are not a guarantee that every backup or reported copy is erased at that instant.
• Reported game content: saved multiplayer report snapshots and related evidence are scheduled to expire after 30 days, with deletion handled during routine cleanup. Separate moderation decisions, sanctions, appeals and Daily Discovery reports may be kept longer where needed to investigate or prevent abuse.
• Boards, daily entries and results: kept to provide shared content, game history, fair scoring and rewards. Delete your own boards using their controls, or contact us about other content. Shared results may need to be retained or anonymised rather than removing other players’ history.
• Payments and support: kept for as long as needed to resolve the issue, administer purchases and refunds, meet accounting or legal duties, or handle disputes. Required financial records may remain after an account is deleted.

Where there is no fixed deletion period, we consider whether the record is still needed for the service, an open report or dispute, a current sanction or a legal requirement. Providers may retain security logs and backups under their own retention arrangements.

7. Your rights and choices

You may have rights to access a copy of your information, correct it, ask for deletion, restrict processing, object to certain uses, and receive or transfer data in a portable format. These rights have exceptions, including records we must keep by law. Contact help@streetbingo.gg and tell us what you need. We may need proportionate information to verify your identity; never send a password or full card number.

We normally respond to a valid data-rights request within one month. If a lawful extension is needed because the request is complex, we will explain it. Updating your profile, changing alert settings, deleting your boards and requesting account deletion are also available in the product.

Opening a tile’s evidence or a Daily Discovery entry automatically loads its Google Street View preview, where available. Closing the evidence window removes the preview. This does not undo information already sent to Google or remove cookies it may have set. See our Cookie Policy for browser storage controls.

If you are unhappy with our response, you can complain to the UK Information Commissioner’s Office (ICO), or your local data-protection authority. You do not have to contact us first.

8. Young players, security and changes

Street Bingo is for people aged 13 and over. Players under 18 need a parent or guardian’s permission; a parent or guardian must authorise paid purchases. We do not knowingly allow accounts for children under 13. If you believe a child under 13 has supplied personal information, please contact us so we can investigate and take appropriate action.

We use account authentication, access controls and secure connections to help protect information. No online service can promise absolute security. We may update this notice as the game changes; the date above identifies this version, and we will draw significant changes to your attention where appropriate.