Cluejack is a party trivia game. A host signs in, builds boards and runs a game on a TV; players join from their phones with a room code and never sign in. This policy says what Cluejack collects from each of them, why, how long it is kept, and how to get rid of it. It describes what the service does today. There is no advertising, no sale of data, and no tracking across other sites.
Cluejack is in an invite-only beta. The only way in as a host is an invitation; the public part of the site is the landing page and its waitlist.
2. Hosts: signing in
Hosts sign in with a Google account or a passkey. There are no passwords and Cluejack never emails you a sign-in link.
What we store about your account
From Google: your Google account ID, name, email address and profile picture URL, and the OAuth tokens (access token, refresh token and ID token) Google issues so the sign-in can complete. We request the openid, email and profile scopes and nothing else. We do not read your Gmail, contacts, calendar or anything beyond your basic profile.
From a passkey: the passkey's public key, credential ID, a counter, the authenticator type and whether it is backed up, and the name you gave it. The private key never leaves your device.
Account record: your email, the room code players use to join your games, your settings, and when the account was created and last signed in.
Sessions: each signed-in session stores a session token, the IP address and browser user-agent string it was created from, and when it expires. Sessions last 30 days and refresh while you keep using the app. Your Google email is also checked against our invite list on every request.
An account can have several Google accounts and passkeys linked to it from Settings. We use this information to sign you in, keep you signed in, show who you are, and keep the service invite-only.
3. Hosts: boards, media and games
Everything you make in Cluejack is stored under your account so you can use it later.
Boards: the categories, clues, answers and settings you write or import. Deleting a board moves it to the trash; trashed boards are removed for good after 60 days.
Media: pictures, audio and video you upload or import by URL for clues, along with the file's type, size, a content hash, the original file name, and the URL it came from if it was imported. When you import by URL, our server downloads the file from that address on your behalf. Files are stored privately; they are only served to you while signed in, or to players in your game while it is running.
Game history: when a game ends, we save a record of it: the board name, start and end time, the winner's name and top score, final standings, a timeline of what happened, and any note you add. We also save a replay log of the game, which is the room as it stood when the game started followed by every accepted action and when it happened. You can download the replay log from your game history.
TV pairing: when you pair a TV, a short pairing code is stored with the address of the TV page that requested it until it is claimed or expires.
Game records and replay logs include what your players did (see the next section). Together they let you look back at a night, and they let us test and balance the game's rules against real games. We do not use your boards or media for anything other than running the service for you.
4. Players and the TV
Players never create an account and we never ask them for an email address or a phone number. To play, a player opens the room link, enters the room code (or scans the QR code on the TV) and types a display name.
During a game, the room records the display name a player chose and what they do: buzzes and how fast they were, answers, wagers, callouts, cards played, scores, and when they joined or disconnected. This is what makes the game work and what is shown on the TV and the host's phone. When the game ends it is saved to the host's game history and replay log, as described above, and it belongs to the host's account. If you played in someone's game and want something about you changed or removed, ask the host, who can delete their account's data.
A player's phone keeps a small record in the browser (the player's room entry and display name) so it can rejoin the same game if the page reloads. The TV page keeps its pairing token the same way. Neither is a cookie and neither is sent anywhere except back to the game it belongs to.
If a host puts a YouTube video on a clue, the TV and phones load YouTube's player from YouTube while that clue is shown. That is governed by Google's privacy policy, not ours.
5. The waitlist
If you join the waitlist on cluejack.com we store your email address, where the sign-up came from (a short code from the link you followed, or “landing”), and the time. We use the address to contact you about an invite, and for nothing else. The form is protected by Cloudflare Turnstile, a bot check: your browser talks to Cloudflare to pass it, and we send Cloudflare the check result together with your IP address to confirm it. Requests to the waitlist are rate-limited by IP address; the limit does not store the address.
You can ask to be taken off the waitlist when we contact you about an invite.
6. Cookies and browser storage
The landing page sets no cookies of its own. The Turnstile bot check on the waitlist form is run by Cloudflare and may set its own.
The app at app.cluejack.com uses cookies only for signing in:
__Secure-cj.session_token: identifies your signed-in session. Lasts up to 30 days.
__Secure-cj.session_data: a signed copy of your session that saves a database read, refreshed every five minutes.
Short-lived cookies that exist only while a Google or passkey sign-in is in progress, to tie the request to the response.
All are first-party, marked Secure and HttpOnly, and are not used for tracking. Both sites use Cloudflare Web Analytics to count visits and measure page performance. It sets no cookies, uses no local storage or fingerprinting, and collects only technical information: the page visited, the referring page, the browser and device type, the country, and load-time measurements. It does not collect names, email addresses or anything else that identifies you. There are no advertising pixels or other third-party trackers. Players and the TV, as described above, use the browser's local storage rather than cookies.
7. Who else handles the data
We run Cluejack on Cloudflare and use Google only for sign-in. We do not sell personal data, share it with advertisers, or give it to anyone else except as listed here.
Cloudflare hosts the whole service: the web servers (Workers), the database (D1), file storage for media and replay logs (R2), live game rooms (Durable Objects), the Turnstile bot check, Web Analytics (see section 6) and the network in front of it all. Like any host, Cloudflare sees the IP address and request details of everyone who connects. We keep brief error logs from the server in Cloudflare's logging; they do not record the contents of requests.
Google handles Google sign-in. When you choose “Continue with Google”, Google shows you what is shared and sends us the profile information in section 2. Google's use of your data is covered by Google's privacy policy. YouTube, also part of Google, is only involved when a host puts a YouTube clue on a board.
We may also disclose information if the law requires it, or to protect the service or someone's safety.
8. How long data is kept
Your account, boards, active media and game history: until you delete them or your account.
Trashed boards: deleted 60 days after they were trashed.
Media that no board uses: a file more than 7 days old that none of your boards (including trashed ones) refers to is deleted.
Sessions: 30 days, then deleted. Signing out ends a session straight away.
Sign-in state and TV pairing codes: minutes to a day, then deleted.
Waitlist entries: until you are invited or ask to be removed.
A nightly job removes the expired items above.
9. Your choices
See and export: your boards can be exported from the app as board files, and each game's replay log can be downloaded from your game history.
Delete your account: Settings → Delete account. This removes your boards, media, games and replay logs, sessions, linked Google accounts and passkeys, and your account record, and closes your live room. It takes effect immediately and cannot be undone.
Unlink a sign-in method: Settings → Sign-in lets you remove Google accounts and passkeys (keeping at least one).
Revoke Google's access at any time from your Google account's connected apps page. You will then need another way to sign in.
Depending on where you live you may have legal rights to access, correct, delete or restrict the use of your personal data, or to complain to a supervisory authority.
10. Children
Cluejack is not directed at children under 13, and we do not knowingly collect personal information from them. Hosting requires an invitation and an adult's Google account or passkey. Families do play Cluejack together; when a host invites players to a game, the host is responsible for who joins, for the display names they use and for the content of the board. Players give us nothing but a display name and their moves in the game. If we learn that a child has given us personal information, we will remove it.
11. Security
All traffic uses HTTPS. Session cookies are signed, Secure and HttpOnly. Media files have no public address and are served only to their owner or to players holding a pass for the current game. Writes to the API from other websites are refused, and the API, sign-in and media endpoints are rate-limited. No system is perfectly secure.
12. Changes
If Cluejack starts collecting something new or using data differently, we will update this page and change the date at the top. For a change that matters, we will also tell hosts in the app before it takes effect.