Privacy Policy

PalLoop helps friends run game nights: start a game, track buy-ins and results, see who owes whom and settle up. This policy explains what we collect, who can see it and what you can do about it. PalLoop is made by Superintelligent Labs ("we", "us").

What we collect

• Your account: your name, email address and profile picture. If you sign in with Apple or Google we get the name and email they share with us. If you sign up with email we keep a secure hash of your password, never the password itself.
• Your age confirmation: that you confirmed you are 18 or older, and when you agreed to the Terms.
• Groups and games: the groups you create or join, your role, game nights, who played, buy-ins, cash-outs, results, rounds, RSVPs and schedules.
• Money between friends: who owes whom, what was marked paid and settlement history. If you pay a friend with a card, the payment is handled by Stripe on its own secure page. We receive the amount and whether it went through, never your card number.
• Things you share: group chat messages, reactions, photos and videos you add to a game night ("moments"), feature requests, comments, feedback and reports.
• Voice commands, if you use them: when you tap the microphone, your recording is sent to our servers and turned into text. We keep the text of the command, not the recording.
• Device and usage: a device identifier, device model, operating system, app version, language and time zone, which screens and features you use, and errors, so we can fix problems. On the website we use PostHog to understand how pages are used, which can include recordings of page sessions.
• Notifications: if you turn them on, a push token from Apple or Google so we can reach your device.

We don't collect your location, your contacts, your phone number or your date of birth. We don't use advertising identifiers.

Who can see it

• People in your groups: your name and picture, the games you played in that group, your results, what you owe or are owed in that group, and the messages and moments you post there.
• Everyone using PalLoop: feature requests and comments you post, with your name.
• Anyone with a replay link: when a game ends, PalLoop can make a replay page for it. Anyone with the link can open it without signing in. It shows player names, moments and results, so only share it with people you'd show the game to.
• Us: a small team can see account and group data to run the service, answer support requests and review reports of abuse.

Profile pictures and moments are stored at web addresses that are hard to guess but not password protected.

How we use it

• To run the app: your groups, games, balances, reminders and notifications.
• To power the assistant and summaries: when you ask the assistant a question, or a feature writes a game recap or caption, we send the details it needs (for example your question, names, groups and game results) to an AI provider to write the answer.
• To keep PalLoop safe: to review reports, stop spam and abuse, and protect accounts.
• To fix and improve the app, using usage and error information.
• To email you about your account, such as a password or PIN reset. We don't send marketing email.

Companies that help us

We share information only with companies that run parts of PalLoop for us, and only what they need:

• Supabase: accounts, sign-in, database and file storage.
• Anthropic: the AI that writes assistant answers, recaps and captions and understands voice commands.
• OpenAI: turns voice recordings into text.
• Google: the live voice dealer, when that feature is turned on for your account, and Google sign-in.
• Apple: Sign in with Apple and notifications on iPhone.
• Expo: delivers push notifications to your device.
• Stripe: card payments between friends.
• Resend: account emails.
• PostHog: website usage analytics.
• Spotify: only if you connect it on the website to play music during a game.

We never sell your information or share it for advertising. We may disclose information if the law requires it, or to protect people from harm.

Google sign-in and Google user data

You can sign in to PalLoop with your Google account. This section explains exactly what we get from Google and what we do with it.

• What we get: only your name, email address and profile picture, through Google's basic sign-in permissions (openid, email and profile). We don't ask for access to your Gmail, Google Drive, Calendar, Contacts or any other Google data.
• How we use it: to create your PalLoop account, sign you in, contact you about your account, and show your name and picture to the people in your groups. Nothing else.
• Who we share it with: Supabase stores it as part of your account. Your name may be included when the assistant answers a question about your games, as described in "How we use it" above. We don't share Google user data with anyone else, except where the law requires it.
• What we never do: we never sell Google user data, use it for advertising or ad targeting, use it to build profiles for anyone else, or use it to train AI models. People on our team see it only to run the service and answer your support requests, to investigate abuse or a security problem, or when the law requires it.
• No images of people: PalLoop does not use Google APIs to create, edit or generate images of people, and never uses them for AI-generated intimate or sexual imagery of anyone.
• Gemini voice commands: if the voice dealer is turned on for your account, we send what you say during a game to Google's Gemini AI so it can turn it into a game action, such as adding a buy-in. We use the result only to run that game.
• Keeping and deleting it: we keep your Google name, email and picture only while you have an account. When you delete your account they are removed. You can also remove PalLoop's access at any time from your Google Account under Security, then Third-party apps and services.

PalLoop's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

• Your account information stays until you delete your account.
• When you delete your account, we remove your name, email, picture, password and notification tokens and sign you out everywhere. Your past games and balances stay in your groups' history under "Deleted User", so your friends' records still add up.
• Payment and settlement records are kept as financial records.
• Error and usage logs are kept only as long as they're useful for fixing problems.

Your choices

• Edit your name and picture in the app.
• Turn notifications and the microphone off in the app or in your phone's settings.
• Leave a group at any time.
• Block someone, or report a message, moment or person, from the app.
• Delete your account in the app under Settings → Delete account. See how to delete your account.
• Ask for a copy of your data, or for any correction, by emailing [email protected]. Depending on where you live, you may have more rights, such as the right to object or to complain to your data protection authority. We honour these requests wherever you live.

Security

Information travels over encrypted connections. Your wallet PIN is stored as a secure hash and can be unlocked with Face ID on your device. No system is perfect, so please use a strong password and tell us if anything looks wrong.

Age

PalLoop is for adults. You must be 18 or older to use it. We don't knowingly collect information from anyone under 18; if you think we have, tell us and we'll delete it.

Changes

If this policy changes, the date at the top changes too. We'll tell you in the app about any big change.

Contact us

Email [email protected] or see Support.