Privacy Policy

1. Introduction

Welcome to Slideparty.app (“Slideparty”, “we”, “us”, or “our”), operated by Lab 37, Entrepreneur individuel, operated by William BRISA, registered under SIREN 988 777 744 (France). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the “Service”). We are committed to protecting your personal data and respecting your privacy rights, including those granted by the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679.

By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Data Controller

For the purposes of the GDPR, the data controller is:

Lab 37 — Entrepreneur individuel
Operated by William BRISA
SIREN: 988 777 744
Contact: contact@williambrisa.fr
Slideparty contact: hey@slideparty.app

3. Information We Collect

We may collect the following types of personal data:

• Account Information: When you register for an account (via Clerk, our authentication provider), we collect your email address and profile information provided during sign-up.
• Usage Data: Information about how you access and use the Service, including pages visited, features used, session duration, and interactions within party rooms.
• Analytics Data (only with your consent): We use PostHog for product analytics and session replays. PostHog may collect your IP address (anonymized), browser type, device information, pages visited, and user interactions. This data reaches PostHog via a reverse proxy operated by Cloudflare on PostHog's behalf, so Cloudflare processes it in transit (see Sections 5, 6 and 9). Nothing is collected until you accept analytics in the cookie banner, and collection stops as soon as you withdraw that consent.
• User-Generated Content: Slides, topics, text, and images you create within the Service. This content is stored in our database (Convex) and on our storage provider (Vercel Blob).
• Cookies and Tracking Data: Information collected via cookies and similar technologies, as detailed in Section 5.

Voice Chat: Slideparty's voice chat uses peer-to-peer (P2P) WebRTC connections. Voice data travels directly between participants' browsers and is not routed through, recorded, or stored by Slideparty. We only act as a signaling server to establish the connection.

Because the connection is direct, WebRTC necessarily discloses IP addresses: when you join voice chat, your public IP address is shared with the other participants in your party, and with Google's public STUN server (stun.l.google.com), which we use to discover how to reach you through your network. This is inherent to peer-to-peer voice and cannot be avoided while the feature is in use — if you would rather not disclose your IP address to the other players, do not join voice chat. The connection details we relay (“signalling messages”, which contain those addresses) are deleted as soon as they are delivered, and in any case within one hour.

4. How We Use Your Information & Legal Basis (GDPR)

We use the information we collect for the following purposes, with corresponding legal bases under Article 6 GDPR:

• To provide and maintain the Service: Processing account information, user-generated content, and necessary cookies to operate the platform, manage accounts, and facilitate party sessions. Legal basis: Performance of a contract (Art. 6(1)(b)).
• To improve and analyze the Service: Using PostHog analytics to understand how our Service is used, monitor performance, and make improvements. Legal basis: Consent (Art. 6(1)(a)) for non-essential analytics cookies, or legitimate interest (Art. 6(1)(f)) for aggregated, anonymized analysis.
• For security and authentication: Using Clerk authentication cookies and Convex auth tokens to secure accounts and prevent fraud. Legal basis: Legitimate interest (Art. 6(1)(f)) and performance of a contract (Art. 6(1)(b)).
• To communicate with you: Responding to inquiries, providing support, and sending service-related notices. Legal basis: Performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)).
• For sharing party results: When a party finishes, its result card (party name, player initials and scores) can be retrieved by anyone holding the party link, so that shared links show a preview. See Section 7. Legal basis: Legitimate interest (Art. 6(1)(f)).
• To comply with legal obligations: Processing data when required by law. Legal basis: Legal obligation (Art. 6(1)(c)).

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies. Nothing outside the strictly necessary category runs until you have chosen to allow it.

Strictly necessary (no consent required — the Service does not work without them):

• Clerk Authentication: Manages user login sessions.
• Convex Auth Token (JWT): Authenticates requests to the backend.
• Your cookie choice itself: stored in your browser's local storage so we do not ask again, together with the date of your choice and the version of this policy it applied to.

Analytics (consent required):

• PostHog: Collects product analytics data including page views, feature usage, and reports of uncaught errors in your browser (error message, stack trace, and the page it happened on) to help us improve the Service. These requests go to z.vivredart.com, a domain we operate for this purpose, which forwards them to PostHog through Cloudflare. It is not a page you would recognise as ours, and the data still ends up at PostHog either way — we name it because this routing means tracker blockers will not stop these requests. Your choice in the cookie banner is what stops them, and it does.
• Vercel Analytics and Speed Insights: Collects anonymous data about website traffic and performance.

Session replay (separate consent required):

• PostHog Session Replay: records a playback of the app screen so we can see where people get stuck. It is a separate choice from analytics because it is more intrusive, and it only records if you have also allowed analytics. Whatever you type, and the free-text content on screen — your slides, topics, party names and player names — are masked in the recording, so they are not sent to PostHog. It uses the same z.vivredart.com route as analytics above.

Embedded media (consent required):

• YouTube (Google): Our promo video is hosted on YouTube. Loading it sends your IP address and browser information to Google and allows Google to set its own identifiers. Until you allow it, no request is made to YouTube at all — you will see a placeholder with a “Load video” button instead.

Fonts and other assets: the fonts used across the site and in the slide editor are served from our own servers. No request is made to Google Fonts, so your IP address is not disclosed to Google for typography.

Anonymous statistics, collected whatever your cookie choice: We also record anonymous statistics about games — how many were played, how long they ran, which modes were used, how many players took part and what scores were given. These records are created on our servers and contain no names, no account identifiers, no IP addresses, and nothing you typed: not the party name, not the topic, not your slides. They cannot be traced back to you or to any other player. Because they involve no cookies and no storage on your device, and because they are not personal data, we collect them regardless of the choices above. We are telling you plainly rather than leaving you to assume that rejecting cookies stops all measurement.

The full list. Every cookie and browser-storage key we use, what it is for, and how long it lasts. Anything in the Analytics or Session-replay rows is set only after you allow it; decline and none of them are written.

Vercel Analytics and Speed Insights are cookieless — they set nothing on your device — but they only run once you have allowed analytics.

Changing or withdrawing your choice: select Cookie settings in the footer of any page. You can turn each category on or off, or reject everything, at any time and as easily as you accepted it (Art. 7(3) GDPR). Withdrawing consent does not affect processing that already took place while consent was valid.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with the following categories of recipients:

• Service Providers (processors): Third-party vendors who perform services on our behalf — Vercel (hosting and image storage), Clerk (authentication), Convex (database and real-time backend; your game data is stored in the European Union — see Section 9), PostHog (analytics, with your consent), Cloudflare (which carries that analytics traffic to PostHog on its behalf, and receives nothing if you decline analytics), Unsplash (image search API), and Klipy (GIF/sticker search API). These providers access your information only to perform their services and are contractually obligated not to use it for other purposes. When you search for an image or sticker, your search term is sent to Unsplash or Klipy. Klipy additionally requires a per-user identifier; we send a one-way salted hash that is stable for you but cannot be traced back to your account.
• Google: If you join voice chat, your IP address is disclosed to Google's public STUN server (see Section 3). If you allow embedded media, loading the promo video discloses your IP address and browser information to Google / YouTube. Neither happens unless you use the feature concerned.
• Other participants: Your display name, avatar, slides and the ratings you give are visible to the other people in your party. If you join voice chat, your IP address is also disclosed to them, as explained in Section 3.
• Administrators: Authorized Slideparty administrators have access to user email addresses, user feedback, and user-generated content for operational, support, and moderation purposes.
• Publicly Shared Information: The result card of a finished party — its name, the players' initials and their scores — can be retrieved by anyone who has the party link, so that a shared link renders a preview image. Everything else you create (slides, topics, full display names, uploads) is visible only to participants in the same party and to administrators.
• Legal Requirements: If required by law or in response to valid requests by public authorities.
• Business Transfers: In the event of a merger, acquisition, or asset sale, personal data may be transferred. We will provide notice before such transfer.

7. Data Retention

We retain personal data only as long as it is needed for the purposes set out in this policy:

• Parties and everything in them (players, slides, ratings, rounds, uploaded images): 12 months after the party finishes, after which they are deleted automatically. Parties that are never finished are deleted 12 months after they were created.
• Voice-chat signalling messages (which contain IP addresses): deleted as soon as they are delivered, and in any case within one hour.
• Your cookie choice: kept in your browser until you change it or clear your browser storage.
• Account information (held by Clerk): until you delete your account.
• Anonymous game statistics (see Section 5): kept indefinitely. These contain no personal data, so there is nothing in them to expire — and keeping them is precisely what allows us to delete the parties above on schedule rather than holding on to real player data for the sake of our own statistics.

You do not have to wait for these periods: you can delete your data yourself at any time from Your data, or ask us at hey@slideparty.app.

8. Data Security

We use administrative, technical, and physical security measures to help protect your personal data. However, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against interception or misuse. Content created within the Service should not be considered secure — users should not input any PII or confidential information.

9. International Data Transfers

Where your personal data is held depends on the provider, and we would rather be precise than sweep it all into “the US”:

• Stored in the European Union. Your game data — everything in Section 3's User-Generated Content, plus party records — lives in our Convex database, whose deployment is hosted in the EU (AWS eu-west-1, Ireland). If you consent to analytics, PostHog stores that data on its EU cloud. Convex and PostHog are US-incorporated companies, so their staff may access this EU-hosted data for support and operations; that residual access is covered by the safeguards below.
• Transferred to the United States. Some providers process data in the US: Clerk (authentication), Vercel (hosting, image storage, and traffic analytics), Unsplash and Klipy (media search, when you use them), and Google (STUN and YouTube, only if you use voice chat or load the promo video).

If you are located in the European Economic Area (EEA) or the United Kingdom, we ensure that transfers of personal data to, or access from, the United States are protected by appropriate safeguards, including Standard Contractual Clauses approved by the European Commission (Decision 2021/914), in accordance with Chapter V of the GDPR.

One transfer does not have a fixed destination and we would rather say so than imply otherwise: if you consent to analytics, those requests pass through Cloudflare's network on their way to PostHog, and Cloudflare may handle them from any of its locations rather than from one country we can name in advance. Cloudflare acts here as a subcontractor of PostHog and is covered by the same contractual safeguards. If you decline analytics, no such transfer happens at all.

10. Your Data Protection Rights (GDPR)

If you are a resident of the EEA or the United Kingdom, you have the following rights under the GDPR:

• Right of Access (Art. 15): Request copies of your personal data.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of your personal data, under certain conditions.
• Right to Restrict Processing (Art. 18): Request restriction of processing, under certain conditions.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Data Portability (Art. 20): Request transfer of your data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent (Art. 7(3)): Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Access, portability and erasure are self-serve. Go to Your data to download everything we hold about you as a JSON file, or to delete it. Deleting your data removes your slides, the ratings you gave and your uploaded images, and strips your name and avatar from every party you joined. Parties shared with other people are kept without you in them — erasing them outright would delete other players' results, which is their personal data, not yours. To close your sign-in account as well, use your account settings with Clerk; that also triggers deletion here.

For rectification, restriction, objection, or any question about the above, contact us at hey@slideparty.app. We will respond within one month, as required by Article 12(3) GDPR. You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) or your local Data Protection Authority.

Ratings are not anonymous. When you rate another player, we store which player gave which score, and the party organizer can see who has voted while a round is open. Scores are shown to other players in aggregate, but the underlying record is attributable to you. We tell you this here rather than implying an anonymity the Service does not provide.

11. Children's Privacy

Our Service is not intended for use by children under the age of 16. We do not knowingly collect personally identifiable information from children. If we become aware that we have collected personal data from a child without verification of parental consent, we will take steps to remove that information in accordance with Article 8 GDPR.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated policy on this page and updating the effective date. You are advised to review this Privacy Policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

hey@slideparty.app
Lab 37 — William BRISA
contact@williambrisa.fr