Privacy Notice

The short version

• What you type into the Tools stays in your browser. Your documents are built on your own device and are not sent to our server.
• No ads, no tracking. We don’t use advertising cookies, tracking pixels, analytics services or third-party scripts, and we don’t sell personal data.
• Card details go to Stripe, not to us.
• You can delete your account yourself from your Account page at any time.

Who this covers

This notice covers everything on funfor.you: guest and registered accounts, the Tools, Playbooks and articles, the games and chat, and anything you buy.

We handle personal data in accordance with Singapore’s Personal Data Protection Act 2012 (PDPA).

Data Protection Officer

Our Data Protection Officer is responsible for how personal data is handled here, and you can contact them about anything in this notice.

Data Protection Officer, FUNFOR.YOU
Email: admin@funfor.you

Please write "Data protection" in the subject line so your message is routed correctly.

What we keep

Your account

• Guest accounts are created with a random name and no email address. A guest account and everything attached to it is removed after 14 days without a visit.
• Username: chosen by you, and shown publicly on scoreboards, at tables and in chat.
• Email address: needed to keep a registered account, and used to reset a forgotten password. It is never shown to other players.
• Password: stored only as a one-way cryptographic hash. We never hold your password itself and cannot read it.
• Your chosen language, and any support messages you send us.

Tools

• The Tools build your recaps, spreadsheets and classroom materials in your own browser. What you type into a tool is not sent to our server.
• When you export, we record your account, which tool, the file format and theme, and whether a token or subscription was used. That is how clean exports and token balances work.
• We keep your export-token balance and a record of how each token was bought, swapped from chips, or used.

Games

• Your chip balance and its history, hands and rounds played, results, and scoreboard position.
• A history of recent rounds at each game room, which other players in that room can see.
• Any game-balancing setting an operator has applied to your account; see How FUNFOR.YOU works.
• Records of admin actions taken on an account, where any were taken.
• Table chat is kept in memory while the room is open (the last 200 messages) and is never written to our database.

Flood reports (Bangkok flood map)

• The “Neighbours helping neighbours” form on the Bangkok flood map needs no account and is not linked to any game account. It keeps what you send: the road or public landmark, the district, the conditions you saw, optional notes, when you saw them, and, if you choose to add it, an approximate location rounded to about 1 km.
• Reports are reviewed by an administrator before they appear. Approved reports are shown publicly for 6 hours.
• To limit spam we keep a one-way, keyed hash of the sending network address, not the address itself. It is deleted after 24 hours.
• Please do not include names, phone numbers or home addresses in a report.

Purchases

• Lucky Charms, Tools token packs, the Pro subscription and Playbooks are paid for on a checkout page hosted by Stripe. Your card number never reaches our server.
• Stripe sends us a signed confirmation with a transaction reference, amount, currency, payment status, the item bought, and the time. For Pro, we also keep the Stripe customer and subscription references and the subscription’s status and renewal date.
• We keep what you own: charms, tokens, subscription status, and the Playbooks you can download.

Technical data

• A session cookie that keeps you signed in. It holds a random token, not your details.
• Your IP address, used at the moment of a request to limit abuse and protect accounts. When you ask for a password reset, we keep a one-way hash of the requesting IP address with the request. We do not use IP addresses to build a profile of you.

Why we keep it

• To create your account, sign you in, and keep you signed in.
• To run the games, track your chips, and produce the scoreboard.
• To give you clean exports, tokens and subscriptions you have paid for or swapped chips for.
• To deliver Lucky Charms and Playbooks you bought, and to handle refunds, duplicate charges and disputes.
• To let you reset a password you have forgotten.
• To keep the site working and secure, by preventing abuse, cheating and unauthorised access.
• To answer you when you contact us.
• To meet legal, tax and record-keeping obligations.

We do not sell personal data. We do not use it for advertising, and we do not send marketing email unless you ask us to.

Consent, and withdrawing it

By creating an account and using the site, you consent to us collecting and using your personal data for the purposes above.

You may withdraw consent at any time by writing to our Data Protection Officer. We will tell you what withdrawing means in practice before acting on it. In most cases it means closing your account, because an account cannot be run without the data that identifies it. Withdrawing consent does not affect anything lawfully done beforehand, and we may keep records we are required to keep.

Who sees it

• Stripe: payment processing for everything sold on the site, under Stripe’s own terms and privacy policy.
• Our hosting provider: stores the site and its database on our behalf. Password-reset emails are sent from our own server.
• Other players can see your username, scoreboard position, chip totals, chat messages, and the rounds you played in a room they are in. They never see your email address.
• Visitors to the flood map can see approved flood reports: the place, district, conditions, notes and approximate location, never who sent them.
• Authorities, where we are required by law to disclose.

The Buy Me a Coffee button takes you to buymeacoffee.com. Anything you give there is handled by that site under its own privacy policy, not by us.

Some of these providers process data outside Singapore. Where they do, we take reasonable steps to ensure a standard of protection comparable to the PDPA, as the Act requires for overseas transfers.

How we protect it

• Passwords are stored as bcrypt hashes and are never recoverable in readable form.
• Sign-in sessions use random tokens, stored hashed, that expire after seven days.
• Traffic to the site is encrypted in transit over HTTPS.
• Card details are handled entirely by Stripe and never stored on our server.
• Playbook files are kept outside the public site and sent only to the account that bought them.
• Administrative access to accounts is restricted and logged.

No system is perfectly secure. If a data breach occurs that is likely to result in significant harm, we will notify the Personal Data Protection Commission and affected individuals as the PDPA requires.

How long we keep it

• Guest accounts: removed after 14 days without a visit.
• Registered accounts (username, email, chips, game and export history): kept while your account is open.
• Deleting your account: you can do this yourself from your Account page. It permanently removes your profile, chip wallet, game progress, Lucky Charms and personal account data. You can also ask our Data Protection Officer to do it.
• Sign-in sessions: expire after 7 days.
• Chat messages: held in memory only while the room is open.
• Flood reports: deleted 7 days after they are sent; the spam-limit hash is deleted after 24 hours.
• Purchase records: kept for as long as required for tax, accounting and dispute purposes, which may be several years, even after an account is deleted, and then deleted.

We stop keeping personal data once the purpose it was collected for has ended and no legal or business need to retain it remains.

Your rights: access and correction

Under the PDPA you may ask us:

• for access: a copy of the personal data we hold about you, and how it has been used or disclosed in the past year;
• to correct anything inaccurate or incomplete;
• to delete your account and the data attached to it.

Write to admin@funfor.you. We will respond as soon as reasonably possible, and ordinarily within 30 days. If we need longer we will tell you why and when to expect an answer. We may need to verify who you are first, and there are narrow cases where the PDPA allows a request to be refused. If that happens, we will explain why.

Younger visitors

The games are intended for adults, and the site asks you to confirm you are 21 or older before you play. The site is not directed at children, and we do not knowingly collect personal data from a child. If you believe a child has created an account, contact our Data Protection Officer and we will remove it.

Cookies and browser storage

We use one cookie to keep you signed in. Your browser also stores a few preferences on your device, such as your language, theme, music setting, age confirmation, and which notices you have already seen. We do not use advertising cookies, tracking pixels, or analytics services. Clearing this data will sign you out and reset your preferences.

Complaints

If you are unhappy with how we have handled your personal data, please tell our Data Protection Officer first so we can put it right. If you remain dissatisfied, you may raise the matter with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

Changes to this notice

We may update this notice as the site changes. The date at the top shows when it was last revised, and continuing to use the site after a change means the current version applies.

Nothing in this notice limits privacy or consumer rights that cannot lawfully be excluded.