Privacy Policy

We Had a TIME is a multiplayer party game web platform operated by W.H.A.T. Entertainment LLC, a Georgia limited liability company (principal office: 600 W Peachtree St NW, Ste 1700 PMB 430, Atlanta, GA 30308). In this policy, “we,” “us,” and “our” refer to W.H.A.T. Entertainment LLC. “You” means anyone who visits the site, hosts a room, joins as a player, or purchases a subscription or event pack.

We only collect what we need to run the games and bill subscriptions:

• Account info. Email address (required for magic-link sign-in). If you sign in with Google, we receive your name, email, and profile picture.
• Gameplay data. Room codes, display names, votes, drawings, photos you capture during a game, and final scores. This is the content of the game and is visible to other players in your room in real time.
• Payment info. Subscriptions and event-pack purchases are processed by Stripe, Inc. We never see or store your full card number — Stripe handles it and sends us a customer ID plus the last four digits and brand for receipts.
• Device + session data. A randomly generated device token stored in your browser (so a host can resume hosting after closing the tab, and so the game knows which phone is which player), basic browser info, and the IP address logged by our infrastructure providers for security and abuse prevention. We store only a scrambled (hashed) form of the token, never the token itself.
• Ratings and reviews. Guests can rate a party 1 to 5 stars from its recap without an account. A rating is stored without your name, nickname or device token: only the stars, which party, whether you played or watched, and a one-way key that stops the same browser rating the same party twice. Written reviews need an account; they show your display name, and any photos you add appear after we check them.
• Diagnostics. Crash reports and performance traces via Sentry, sampled and scrubbed of obvious personal data before transmission.
• Visit analytics. Anonymous page-view counts and referring sites via Vercel Web Analytics, which sets no cookies. We also note how you first found us (the referring site and any campaign tag in the link) and attach it to purchases, so we know which channels bring customers.

We do not sell personal information, run third-party ad networks, or use behavioral tracking pixels.

We use the data above only for these purposes:

• Authenticating sign-ins and keeping you logged into your account.
• Running rooms in real time so players see each other's submissions.
• Processing subscription payments and granting access to packs you own.
• Sending transactional email (magic links, receipts, lapse notices, venue invites).
• Diagnosing crashes and improving game balance using aggregated results.
• Preventing fraud, abuse, and violations of our Terms of Service.

We share data with a small set of vetted service providers, each contractually bound to use it only on our behalf:

• Supabase — database, authentication, and real-time sync infrastructure.
• Vercel — application hosting, edge delivery, and anonymous visit analytics.
• Stripe — payments, subscriptions, and the customer billing portal.
• Resend — transactional email (magic links, receipts, venue invites).
• Sentry — error monitoring and performance tracing.
• Google — only if you choose Google as your sign-in method.

We may disclose information if required by law, subpoena, or to protect the rights and safety of users and the public. In a merger, acquisition, or sale of substantially all assets, account data may transfer to the successor entity subject to this policy.

We use cookies and browser local storage to make the product work, plus one first-party cookie noting how you found us. No advertising or cross-site tracking cookies are set by us:

• Auth session cookies set by Supabase to keep you signed in.
• Signed invite cookies for venue booking flows (HMAC-signed, short-lived).
• sessionStorage for room state so you can resume a game after a page refresh.
• A referral cookie (wht_src, 90 days) holding the referring site, campaign tag, and landing page from your first visit. It is read only by us, at checkout.

You can clear cookies and local storage at any time in your browser settings; doing so will sign you out and may end any in-progress room.

Anything you submit during a game — display name, votes, drawings, captions, photos taken in-game — is visible in real time to other players in your room and to anyone you've granted Watch Mode access to (for example, a TV in the same room). This is the core function of the product. Don't submit content you wouldn't want the rest of your party to see.

We may use anonymized, aggregated, or de-identified gameplay content — for example, screenshots or short reaction clips — to promote the Services in our own marketing materials. We will not use recognizable images of you in marketing materials without your separate written consent. See Section 10.3 of our Terms of Service for the matching license terms.

We Had a TIME is intended for users 13 and older. We do not knowingly collect personal information from children under 13. If we learn we have collected personal information from a user under 13 without verifiable parental consent, we will delete that information in accordance with the Children's Online Privacy Protection Act (COPPA). If you believe a child under 13 has created an account, contact us at play@wehadatime.com and we'll delete the account.

The Intimacy Collection is rated 18+ and requires an in-product age confirmation before play. You agree not to launch Intimacy Collection content for anyone under 18.

We keep account and subscription records for as long as your account is active and for a reasonable period afterward to comply with tax, accounting, and dispute-resolution obligations.

Rooms expire automatically; game results and photos may be retained tied to your account so you can revisit them, until you delete your account or request deletion.

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to certain processing. This includes residents of California (CCPA/CPRA) and the European Economic Area, United Kingdom, and Switzerland (GDPR).

To exercise these rights, email play@wehadatime.com from the address associated with your account. We'll verify the request and respond within the time required by applicable law (generally 30–45 days). You will not be discriminated against for exercising these rights.

We do not “sell” or “share” personal information in the sense those terms are defined under California law, and we have not done so in the past 12 months.

We operate the service from the United States. If you access the site from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data-protection laws than your country. By using the service you consent to that transfer.

We use industry-standard practices to protect data in transit (TLS) and at rest (encrypted database storage), enforce row-level security policies in our database, and require multi-factor authentication on operator accounts. No system is perfectly secure — if we ever detect a breach that affects your information, we'll notify you in accordance with applicable law.

If you have a dispute about how we've handled your personal information, please start by contacting play@wehadatime.com so we can try to resolve it directly. Any formal dispute is subject to the dispute resolution and arbitration terms in our Terms of Service, including the right to opt out of arbitration within the first 30 days.

We may update this Privacy Policy from time to time. When we make material changes, we'll update the “Last updated” date at the top and, where appropriate, notify you by email or in-product banner. Continued use of the service after changes take effect means you accept the revised policy.

W.H.A.T. Entertainment LLC
600 W Peachtree St NW, Ste 1700 PMB 430
Atlanta, GA 30308
Email: play@wehadatime.com

For our terms of service, see the Terms page.