Privacy Policy

Last updated: June 10, 2026

DRAFT — for founder review with counsel. This document is a working draft prepared to reflect the app's current data practices. It has not been reviewed or approved by an attorney, makes no legal guarantees, and asserts no certifications or regulatory compliance. Do not publish until reviewed and the placeholders below are completed.

TODO for founder (complete before publishing)

Replace [LEGAL ENTITY] with the operating legal entity name (e.g., the LLC/Inc. that owns CheckPlease).
Replace [BUSINESS ADDRESS] with the registered business mailing address.
Replace [privacy@phonesdown.net] with a monitored privacy contact inbox (a working alias is recommended over a personal address).
Confirm the governing-law / jurisdiction with counsel (referenced in the Terms of Service).
Confirm the minimum age (this draft uses 13; counsel may require 16/18 given location + messaging features).
Confirm which third-party processors are actually live at launch (Google/Firebase, Google Analytics, Google Places, Expo, Apple, and any SMS provider).
Confirm the data-deletion turnaround you can actually meet (this draft says 30 days; Support currently states 48 hours).

This Privacy Policy explains how [LEGAL ENTITY] ("we," "us," or "our"), the operator of the CheckPlease mobile application and the website at phonesdown.net (together, the "Service"), collects, uses, shares, and protects information about you. CheckPlease is a social game in which friends place their phones down during a meal and the first person to pick theirs up "loses." By using the Service, you agree to the practices described here.

1. Information we collect

We aim to collect only what we need to run the game. The categories below reflect the app's current behavior.

Category	What it includes & how it's collected
Phone number	Collected when you sign up using SMS one-time-passcode (OTP) verification through Firebase Authentication. Your verified phone number is stored in an owner-only record and is not made visible to other players.
Profile / identity	A display name you choose, and an optional avatar — either a selected emoji or a photo you upload (stored in Firebase Storage). Crews and other players in your games can see your display name and avatar.
Account type & email	Most accounts are tied to your verified phone. Some sessions (for example, joining a browser-based game from a shared link) can be anonymous and identified only by a display name. You may optionally link an email and password to an account.
Location	Precise GPS, used while you actively use location-based features. See Section 2 for the full breakdown, including optional background location during a live game.
Motion / sensors	Accelerometer ("phone pickup") readings, used to detect when a phone is lifted during a game. Processed on your device; see Section 3.
Game & social data	Crews and crew membership, games you join, ready/eliminated status, wins/losses/streaks, game invites, and any IOU / stakes tracking entries. See Section 4.
Push token	If you enable notifications, an Expo push token is stored in an owner-only record so we can deliver game notifications to your device.
Usage & analytics	In-app events such as screen views, taps, and game events are logged to our database to understand how the app is used. The marketing website also uses Google Analytics.
Diagnostics / error logs	When the app hits an error, we may record the error name, message, and stack trace together with your user ID (if any) and device details — platform, device model, OS name/version, app version, build number, and a device identifier.

2. Location data (including background location)

Location is used only in connection with location-based gameplay, and only with the permissions you grant. We use it in three ways:

Foreground location to join a venue game. When you join a venue-hosted game on-premises, the app takes a precise location fix to confirm you are physically at the venue (an on-site join gate).
Crew "radar" / nearby presence (optional). When you mark yourself available to a crew, the app may share a coarse, reduced-precision location (a geohash cell roughly 150 meters across — not an exact point) so crew members can see who is nearby. This is opt-in and is cleared when you go unavailable or leave the crew.
Background location during a live game (optional). While a game is active, the app may request background location so the game can keep running while your phone is locked and face-down. This uses low-accuracy updates. The current build is designed not to persist this in-game background location to our database.

Background location is sensitive. The app requests "Always / background" location permission (declared on iOS and Android) and only while a game is active. You can decline or revoke this permission in your device settings; declining limits the ability to keep a game running while the phone is locked but does not block ordinary play. Apple App Store and Google Play impose specific disclosure and consent requirements for background location — counsel/founder should confirm this section and the in-app permission prompts satisfy them.

3. Motion & sensor data

The core of the game is detecting when a phone is picked up. The app reads your device's accelerometer (motion sensor) to detect sustained movement that indicates a pickup. This is ordinary device-motion data — it is not biometric data and is not used to identify you. Motion readings are processed on your device in real time to decide whether a pickup occurred; we do not store the raw accelerometer stream.

4. Game stakes, IOUs & "no real money"

CheckPlease is a social game. When a game records a "stake" (for example, "loser buys lunch") or an IOU between players, this is a social record only. The Service does not process payments, hold funds, charge cards, or move money between users. Any settling-up happens off-platform, directly between the people involved, entirely at their discretion. Venue-hosted games are promotions that may let you earn a venue's perk — they are not wagers and involve no payout from us.

Money-adjacent language flag. Although no money moves through the app, terms like "stakes," "wager," "IOU," and "owes" appear in the product. Counsel should confirm this framing does not implicate money-transmission, gambling, or consumer-finance rules in the launch jurisdictions, and that the in-app copy consistently reinforces the "no real money" position.

5. SMS, invites & push notifications

We use SMS to deliver one-time passcodes for sign-in. CheckPlease also lets you invite friends to games and crews, and plans to offer SMS invitations and unique join codes. If we send you marketing or invitation text messages, we will do so only with the consent and under the terms described on our Messaging & SMS Terms page, including how to opt out (reply STOP) and get help (reply HELP). Standard message and data rates may apply.

If you enable push notifications, we store an Expo push token to deliver game-related alerts. You can turn push notifications off at any time in your device settings.

6. How we use information

To create and secure your account and verify your phone number.
To run gameplay — start games, detect pickups, track ready/eliminated status, and record results, streaks, and stakes/IOU entries.
To power location features you choose to use (venue join, crew nearby presence, and keeping a live game running).
To deliver invites, game notifications, and (where you consent) SMS messages.
To understand usage, fix bugs, and improve the Service through analytics and diagnostics.
To protect against fraud and abuse and to comply with legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Within the app, your display name, avatar, and game activity are visible to the crews and games you participate in. We share data with the service providers ("processors") that operate the Service on our behalf:

Google / Firebase — Authentication (including SMS OTP delivery), Firestore database, Cloud Storage (avatar photos), Cloud Functions, and Hosting.
Google Analytics — usage analytics on the marketing website (phonesdown.net).
Google Places — to suggest nearby restaurants when a game resolves.
Expo — delivery of push notifications via Expo push tokens.
Apple — App Store distribution and Apple Push Notification service.
SMS provider(s) — to send verification and (planned) invitation text messages. [Founder/counsel to confirm and name the live provider(s).]

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users or the public, and in connection with a merger, acquisition, or sale of assets.

8. Data retention

We keep information for as long as your account is active or as needed to provide the Service, then delete or de-identify it within a reasonable period unless a longer retention is required by law. Specifically:

Account, profile, game, and IOU records are retained while your account exists.
Crew "nearby" presence is transient and removed when you go unavailable or leave a crew.
In-game background location is not persisted by the current build.
Analytics and error logs are retained for a limited period for diagnostics and product improvement.
On account-deletion request, we aim to delete your personal data within 30 days (founder to confirm achievable turnaround), except where retention is legally required.

9. Your rights & choices

Depending on where you live, you may have some or all of the following rights:

Access / portability — request a copy of the personal data we hold about you.
Correction — update your display name, avatar, and profile in the app at any time.
Deletion — request deletion of your account and associated personal data.
Restriction / objection — ask us to limit or stop certain processing.
Withdraw consent — revoke location, motion, notification, or SMS permissions at any time (via device settings or by replying STOP to texts).

California (CCPA/CPRA): California residents have the right to know, delete, and correct personal information, and to opt out of "sale" or "sharing." We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising your rights.

EEA/UK (GDPR): our legal bases include performance of our contract with you (to run the game), your consent (for location, motion, push, and SMS), and our legitimate interests (security, analytics, and product improvement). You may have the right to lodge a complaint with your local supervisory authority.

To exercise any right, contact us at [privacy@phonesdown.net]. We may need to verify your identity before acting on a request.

10. Children's privacy

CheckPlease is not directed to children. You must be at least 13 years old to use the Service (founder/counsel to confirm — a higher minimum age may be appropriate given location and messaging features). We do not knowingly collect personal information from children under the applicable minimum age. If you believe a child has provided us personal information, contact us and we will delete it.

Minors flag. Precise/background location and SMS to minors carry heightened obligations (COPPA in the U.S., GDPR age-of-consent rules in the EEA/UK, and app-store policies). Counsel should set the final minimum age and any age-gate requirements.

11. Security

We use Google Firebase's managed infrastructure and access-control rules to protect your data, and we separate sensitive contact data (such as your phone number and push token) into owner-only records. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. International users

The Service is operated using Google Cloud / Firebase infrastructure and may process and store data in the United States and other countries. By using the Service, you understand your information may be transferred to and processed in countries with different data-protection laws than your own.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

14. Contact us

Questions or requests about this policy or your data:
[LEGAL ENTITY]
[BUSINESS ADDRESS]
Email: [privacy@phonesdown.net]