Privacy Policy

This Privacy Policy explains how Get Social Ltd (company number 12415409), trading as Popularity™ the Game ("we", "us") collects and uses personal data when you use Popularity and popularitythegame.com. We are the data controller. Our registered office address is on the public register at Companies House — look up company number 12415409 at find-and-update.company-information.service.gov.uk. ICO registration number: ZC255651.

1. What we collect

Players (free, no account):

• A display name you choose and a chosen token/avatar (may be a nickname — you need not use your real name).
• A randomly generated session identifier stored in your browser's localStorage to keep you in your game across reloads.
• Technical data: device/browser type, IP address (transiently, for connectivity and abuse prevention).

Hosts / purchasers:

• The above, plus payment-related data processed by Stripe (we receive confirmation and limited billing metadata; we do not store full card numbers).
• Email address if you create an account or contact support.
• If you buy the boxed game: your name, email address and delivery address, which we use to post it and to email you about the order. We email you news only if you choose "Yes please" at checkout.

Press, shops and partners: if you work for a shop, publication, venue or other business we might work with, we hold your business contact details — name, job title, employer, work email and work phone — and what we have said to each other. We find some of these through Apollo.io, a business contact database, and some from your organisation's own public pages.

Everyone: basic analytics about how the Service is used (e.g. games started/completed) — see Cookies & analytics.

2. Why we use it (lawful bases)

Purpose	Lawful basis
Running a game session	Contract / legitimate interests
Processing payments & licences	Contract
Preventing abuse, fraud, overload	Legitimate interests
Product analytics & improvement	Legitimate interests / consent
Support & communications	Contract / legitimate interests
Contacting press, shops and partners about the game	Legitimate interests — tell us to stop and we will, straight away

3. Who we share it with (processors)

• Stripe — payments
• Resend — sends our emails about your order (the confirmation and the dispatch note, with tracking when there is a number) and sign-in links. It receives your email address, your name, what you ordered and the delivery address the order email shows. US-based; transfers rely on its Data Processing Addendum.
• Supabase — database & realtime hosting (game state, rooms, players)
• Vercel — application hosting (region: London lhr1)
• Sentry — error monitoring (client exception telemetry)
• PostHog (EU-hosted) — product analytics and session recording. Consent-gated: we load no analytics in your browser, and record no analytics about how you use the game, unless you accept analytics cookies. The one exception is a small number of server-side records of completed transactions — that a purchase, refund or physical order happened, and which plan it was. These are created by our payment provider's webhook rather than by your browser, they set nothing on your device, and they are keyed on a payment reference or your account id, never on your email address. We keep them because we need a reliable record of sales and refunds; our lawful basis is our legitimate interest in running the shop accurately.
• Meta (Meta Pixel) — not currently active. The integration exists in our codebase but is switched off in every environment and has never run. It will only be enabled once a valid UK international data transfer mechanism is in place — see below
• Kit (formerly ConvertKit) — email marketing: if you join the waitlist or the news list, or opt in when buying, we pass your email address, first name where given, and tags describing what you signed up for (for example whether you bought the physical game or a digital pass). Not currently active — the integration is built but switched off, and no data has been sent to Kit. It will be enabled around launch, and the same transfer mechanism requirement below applies to it
• Vercel Analytics — aggregate, cookieless page-view metrics
• Apollo.io — holds the business contact details of press, shop and partner contacts, and records the emails we send them; it is also where some of those details come from. Our hello@popularitythegame.com mailbox, and hello@getsocial.uk, the company inbox our mail is forwarded to, are connected to Apollo, so if you email us, Apollo can read your message and its details (your name, email address and when you wrote), and under its own privacy policy may add business contact details from it to its contact database. Nothing else about players or customers goes into Apollo: no purchases, accounts or game data. If you would rather Apollo did not process your email, tell us at privacy@popularitythegame.com, or contact Apollo at privacy@apollo.io. US-based; transfers rely on its Data Processing Addendum.

We do not sell personal data. The Meta Pixel and Kit are both inactive, so no data is currently transferred to either. Before either is enabled we will put a valid UK international transfer mechanism in place (UK IDTA or Standard Contractual Clauses) and update this policy to state which. Other providers may process data outside the UK/EEA under their own appropriate safeguards.

4. Retention

• Game/room data is transient and deleted or anonymised after a game ends or a room expires (rooms auto-purge 30 days after creation).
• Payment and accounting records are kept as required by law (typically 6 years).
• PostHog session recordings are retained for up to 12 months, then deleted.
• Email addresses captured with your consent (e.g. "email me my results") are retained until you withdraw consent or after 3 years of inactivity, whichever is sooner.
• Analytics data is retained in aggregate.
• Business contacts at press, shops and partners are kept while we are working together or talking about it, and removed after 2 years with no contact, or straight away if you ask.

5. Your rights (UK GDPR)

You have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability. To exercise these rights contact privacy@popularitythegame.com. You may also complain to the ICO (ico.org.uk).

6. Children

The Service is not intended for children under 16. We do not knowingly collect data from children under that age.

7. Cookies & analytics

See our Cookie Policy. We use essential storage (localStorage session ID) to run the game and, with your consent where required, analytics cookies.

8. Security

We use access controls, server-side authorisation, and encrypted transport. No system is perfectly secure; report concerns to support@popularitythegame.com.

9. Changes

We may update this policy; the "Last updated" date will change.

10. Contact

Data queries: privacy@popularitythegame.com · Get Social Ltd (company number 12415409), trading as Popularity™ the Game