Privacy Policy

Gambits is operated by Witit Media Inc. For anything in this policy, write to support@gambitparty.com.

Postal contact address: to be confirmed before launch.

This policy covers the Gambits web app, the iOS and Android apps that wrap it, and the Gambits extension inside Apple Messages.

Only what the app needs to work. There is no advertising SDK, no fingerprinting, and no third-party analytics service.

We do not ask for your date of birth, your contacts, your precise location, or access to your photo library beyond the single photo you pick when you submit hunt proof or set an avatar.

The iOS app includes an optional Messages extension. It can show an invitation and let you join or make a play without leaving the conversation. The extension uses the Gambits account already signed in on that iPhone. The app and extension share the minimum session credentials in Apple's device-only Keychain; non-secret preferences and an unfinished Ranker order can be shared through the app's local App Group. An unfinished Ranker order stays on that device and is not sent to our server.

Gambits does not read your conversations, Contacts, phone number, or the participant identifiers Apple assigns to a Messages chat. It does not use chat participants as Gambits identities and does not link accounts by phone number. An interactive invitation contains only the gambit link and, for a private gambit, its private invite capability. Your play is sent directly to Gambits and confirmed inside your copy of the bubble; making a play does not post another chat message or put the play in the invitation URL.

When you send an invitation from Messages we record that a share happened, the same way we record one sent from the app's share sheet: the gambit, that the method was Messages, and when. We do not record who you sent it to, and nothing is recorded if you build an invitation and then delete it without sending.

You can join a gambit as a guest without giving us an email address. A guest account is an anonymous account tied to the browser on that device — we store the display name you type and the plays you make, but nothing in your Gambits account that directly identifies you. Our host still receives standard request logs described below.

Because there is no email or password on it, a guest account cannot be recovered. Clearing site data or switching devices loses it. Saving the account (adding Apple, Google, or an email and password) keeps your history and brings it under the rest of this policy.

Gambits is free to play and does not collect, hold, transfer, or distribute money. There is no entry fee, no price, no pot, no payment processor, no wallet, no escrow, and no payout. There is nothing in Gambits to buy.

We therefore hold no payment information of any kind — no card details, no bank details, and no payment handles. Earlier versions of Gambits let a commissioner label an informational pot and let you save a Venmo handle, Cash App cashtag, or payment note so a group could settle up on its own; those fields have been removed from the product and any values previously stored have been erased. An optional phone number is the only contact detail we still keep, and it is there so players in your gambits can reach you.

This is the part worth reading closely, because Gambits is built around shareable links.

• Gambits, Series, and Seasons are unlisted, and the link is the key. There is no public game directory and no way to browse for a group. Anyone who has a public link can open it, see the board, the player display names and avatars on it, and the result. A private group additionally requires its separate invite capability. Treat every link like the invitation it is — anyone you send it to can forward it.
• Link previews and results cards. When a gambit link is pasted into a group chat, that chat app fetches the page to build a preview card. For a finished gambit, Gambits can also render the final standings as a shareable image — player display names and scores, with no profile photos. Anyone holding the link can generate that image without signing in, including the preview crawler itself. Pages and images are marked not-to-be-indexed, so they should not turn up in a search engine, but that is a request search engines honour rather than a lock.
• Profile photos are publicly readable. Avatar images are stored in a public bucket, so anyone with the image URL can load it without signing in. Pick an emoji instead if you would rather not have a photo out there.
• Hunt proof photos are private. They are stored in a private bucket and are only ever served through short-lived signed links to people in that gambit. They are not public and are not indexed.
• Collection Race labels stay private while play is live. Other players and the commissioner see your total, not your labels. After finalization, signed-in members of that gambit can browse everyone's final labels. They are never part of an anonymous result card.
• Your player profile has a visibility switch. Public means other players can find you by your player tag and send a friend request. Friends-only keeps you out of that search. Either way, your display name and avatar are visible inside the gambits you have joined — that is how a board works.
• Commissioners see more. The commissioner of a gambit sees its managed play data, including legacy Hunt photos. They cannot browse another player's live Collection Race labels or edit another player's Counter or collection.

We do not sell personal data and we do not share it for advertising. We use a small number of service providers to run the app:

We may also disclose data if we are legally required to, or to investigate abuse of the service.

We keep our own log of in-app actions — a square was claimed, a gambit was locked, a result was shared — in our own database. There is no third-party analytics service, no advertising pixel, and no vendor SDK, so this data is never handed to anyone else.

Each entry records:

• the name of the action, from a fixed list
• which gambit, Series, or Season it happened in, and your account
• whether you were playing as a guest at the time, and whether the app was installed to your home screen
• a per-tab identifier kept only in that tab's sessionStorage and discarded when you close the tab. It is not a cookie and cannot link two visits together
• a small set of pre-declared, non-identifying details, such as how many items a gambit had

What it never records: your IP address, your user agent, your screen size, or the content of your play — never which square, which option, or which side you picked. The database rejects any detail that has not been declared in advance, so this list cannot quietly grow.

Individual entries are deleted on a schedule — 30 days for high-frequency ones, 90 days for most, and at most 400 days. What outlives them is a per-day count with no accounts attached, and the anonymous commissioner-action replay frozen when a gambit finishes.

Push notifications are off until you turn them on. When you do, your browser or device creates a push subscription and we store it, along with the device type and browser user agent, so we know where to send alerts and can drop registrations that stop working.

Notification content is limited to what happened in a gambit — that it is about to lock, that a result is in. Delivery runs through the push service that belongs to your browser or device maker. You can turn notifications off in Profile settings or in your device settings, and turning them off deletes the subscription.

If you set quiet hours, we store your time zone so that “10pm” means your ten o’clock. That is a coarse location signal — a region-wide zone name such as America/Chicago, never a precise position — and it is taken from what your browser already reports. We also keep a short record of which kind of notification went to which device and whether it arrived, so we can stop sending to registrations that have stopped working. That record holds no message text and is deleted after 30 days.

Alongside the sign-in cookie, Gambits keeps a small amount of state in your browser that never leaves the device:

• A session cookie that keeps you signed in. It is required for the app to function and is not used for tracking.
• A service worker that serves an offline page. Gameplay is never queued offline — claims and picks are first-come-first-served, so they always go straight to the server.
• Local leaderboard state, so a standings list can show whether you moved up or down since you last looked. It holds row positions and scores only, is capped, and is wiped when a different account signs in on that device.

There is no advertising cookie and no cross-site tracker, which is why Gambits has no cookie consent banner.

Your account data stays until you delete it. Because a gambit is a shared record, deleting your account does not erase the board other people played on — see below for exactly what happens.

Server request logs are kept by our host on their own schedule, in the order of weeks. Backups are retained on a rolling window, so deleted content can persist in a backup for a short period after it disappears from the app.

• Edit or remove your display name, tag, photo, and phone number at any time in Profile settings.
• Export everything we hold about you as a single JSON file, from Profile settings.
• Delete your account from Profile settings. This is immediate and cannot be undone.
• Ask us at support@gambitparty.com if you want a copy of your data in another form, want something corrected, or want to object to how we are handling it. Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA; write to us and we will work through it with you.

Immediately, and without needing to contact us:

• Your name, player tag, profile photo, and phone number are erased.
• Your sign-in credentials are destroyed — password, linked Apple or Google account, and active sessions — and your email address is released. If you used Sign in with Apple, Gambits also asks Apple to revoke the grant. You cannot sign back in, and we cannot restore the account.
• Your uploaded photos are deleted: avatars and hunt proof images.
• Your Collection Race labels and duplicate-check text are erased. Their numeric totals remain so a finalized result does not change.
• Your friendships, blocks, invites, notification registrations, and reports you submitted are deleted.
• Any live gambit you were running is handed to another player in it, so nobody is left with a gambit no one can finish. If you were the only person in it, the whole gambit is deleted.

What remains is the numeric play itself — which square was claimed, which pick won, or the final Counter/Collection total — attached to an anonymous placeholder with no name, tag, photo, or contact details on it. We keep that because it is not only your data: it is the board your friends played on and the result they were crowned by. Removing it would rewrite finished gambits for everyone else in them.

Gambits is not directed to children. You must be at least 13 years old to create an account. If you believe a child under 13 has given us personal information, write to support@gambitparty.com and we will delete it.

Traffic is encrypted in transit. Every table in our database enforces row-level access rules, and gameplay writes go through server-side functions that check who you are rather than trusting the app. Private hunt photos are served only through short-lived signed links.

No system is perfectly secure, and the unlisted-link model means the practical boundary on a gambit is who holds its link.

Our hosting and database providers operate globally, so your data may be processed in a country other than your own, including the United States.

If we change something that matters, we will update the date at the top of this page and, for a significant change, tell you in the app.

Privacy questions and everything else: support@gambitparty.com, or the support page.