Privacy
Privacy Policy
Effective 25 September 2026. Covers the ParkBrawl iOS app and parkbrawl.com.
Previous version: 18 September 2026
No signup is required to play. We use identifiers and game content to operate ParkBrawl, and optional features have additional data flows explained below. We do not sell personal information or use it for cross-app advertising tracking.
The short version
- Game Center can link and recover your packs and history. Uninstalling is not a server deletion request.
- Names, challenges and notes are shared with your game. Avoid putting private information in them.
- Camera, photos, location and notifications are optional. Their permissions are requested separately.
- OpenAI receives your request only after you confirm sending it.
- Use About & legal → Delete my data before uninstalling. Shared records and separate copies can remain.
Who is responsible
ParkBrawl is published by Mike Blom, 13059 Penshurst Lane, Windermere, FL 34786. Contact support@parkbrawl.com about privacy, support or data requests.
What we process and why
| Information | Purpose and handling |
|---|---|
| Session and recovery identifiers | A random session identifier connects games, packs, preferences and purchases. Credentials are held in device secure storage. If you are signed in to Game Center, the app can automatically verify and link the app-scoped player identifier Apple provides. This lets packs and game history move to another installation. We do not receive your Apple Account email or password through Game Center. These identifiers recognize a returning player; they are not a guarantee of anonymity. |
| Names, challenges, notes and game events | We store player and team names, custom challenges, pack settings, claims, timing, scores and activity. Notes are shared with the room when saved; edits can leave earlier versions in the activity history. We also receive a flag indicating a memory has a photo, but not the photo itself. Do not enter private information about yourself or anyone else. |
| Saved packs and shared cards | Saved packs are associated with your session and can be recovered through a linked Game Center identity. Anyone with a pack code can import an independent copy. Sharing a card sends the content shown in its preview, including a photo if selected, to the destination you choose. Recipients control their copies. |
| Optional location | Locate me requests foreground location access to show your position on the map. The app holds fixes in memory while that map session is active and clears them when you leave or background the app. ParkBrawl does not store GPS coordinates on its servers or send them to teammates. The map provider receives tile requests and your IP address; requests can indicate the area you view. You can play without location permission. |
| Optional camera and photos | You may take or select a photo for a memory. Photos are stored locally and are not uploaded to ParkBrawl. Sharing a card can send a selected photo to another app. Device backups may include local files according to your settings. Removing a memory from this phone does not recall shared or backed-up copies or remove notes already shared with the room. |
| Suggestion requests | Before sending, the app asks you to confirm that your answers and existing challenge text may go to OpenAI for moderation and generation. This includes your description of the place, group age category, activity preferences and things to avoid. Public venue names may be used for web research. We do not attach your session or Game Center identifier, but your text can identify you. Avoid names, private addresses, health information and other personal details. Your request is cached locally for retries. Our server stores request hashes, allowance records and generated results. |
| Notifications | If you allow notifications, Expo and our server receive a push token. We also store platform and notification preferences and activity needed to avoid sending notifications while you are looking at the game. Disabling notifications in system settings stops their display, but does not immediately delete a previously stored token. |
| Subscriptions | Apple handles billing. RevenueCat processes your session identifier and purchase information. ParkBrawl stores entitlement status, product and store identifiers, expiry and related subscription events. We do not receive your payment-card details or billing address from Apple. |
| Support and moderation | Emailing support gives us your email address and message, and any details or screenshots you send. Reports can retain the reported text, reason and identifiers needed to investigate. Telling us a square is closed, wrong or unsafe sends the square, the reason, anything you type in the note and the room code to our support inbox through our email provider; it is a correction about the challenge, not a report about a player, and it carries no session or Game Center identifier. A room code helps locate a game, but is not by itself proof that a requester owns another player’s data. |
| Technical information | Our hosting, update and map services process network requests, including IP addresses and technical metadata, to deliver and secure the service and diagnose faults. We also use game history to understand game usage. No advertising or attribution SDK is used in the app. |
You do not need to provide a name, email address, phone number or password to register. That does not mean that text you submit, support correspondence, or persistent identifiers cannot be personal information. We do not request contacts or microphone access. We do not use the advertising identifier for tracking.
Services and other disclosures
| Service | What it receives or does |
|---|---|
| Supabase | Hosts sessions, game data, recovery links, subscriptions, reports and live updates. It processes database and technical request information. |
| RevenueCat | Manages subscriptions using session identifiers and purchase information supplied through the store. |
| Expo | Delivers notifications using tokens and notification content. App-update requests also involve technical information, whether or not notifications are enabled. |
| Apple | Distributes the app, handles purchases and operates Game Center under its own privacy terms. Game Center provides an app-scoped identifier and verification material for recovery. |
| OpenAI | Processes the text you confirm for moderation, suggestions and, where applicable, public-venue research. We disable response storage on generation requests; this does not disable provider abuse-monitoring logs. Under its standard API data controls, OpenAI may retain prompts and responses in safety logs under its applicable data controls and exceptions. API content is not used for model training by default. |
| OpenFreeMap / OpenStreetMap | OpenFreeMap serves map tiles and fonts directly to your device, receiving IP addresses and requested tiles. OpenStreetMap supplies the underlying map data. |
| Resend | Delivers our support email. A square correction reaches our support inbox through Resend, carrying the square, the reason, any note you typed and the room code. We do not include session or Game Center identifiers. |
| Vercel | Hosts parkbrawl.com and processes website requests and technical logs. |
| ThemeParks.wiki | Our server retrieves public park information. We do not include player identifiers or player content in those park-data requests. |
Provider handling also depends on their applicable terms and privacy policies, including Apple privacy and OpenAI API data controls. A provider may have its own legal or security obligations; accepting our terms does not waive your rights concerning those providers.
We may disclose information where legally required or reasonably necessary to investigate abuse, protect people or enforce rights. If the service is transferred to a new operator, relevant information may transfer with it, subject to applicable privacy obligations and notice requirements.
Retention
- A room nobody plays closes after 12 hours. Once anyone joins or starts, it closes after 14 days without successful play or an explicit resume. Viewing history does not extend this timer. Completed games close immediately.
- Closed live room records become eligible for scheduled cleanup after a period without updates. Before cleanup, boards, names, challenge text, notes, scores, timing and activity are archived. Removing live records does not remove this archived content.
- Archived game history currently has no fixed expiry. It supports revisiting games, support, disputes and understanding game usage. Delete my data removes your history access and replaces associated team names; shared records, including notes and challenges, can remain for other participants. Contact us to request removal of personal information in retained content.
- Saved packs remain until you delete them or they are removed by inactivity cleanup. Deleting your data deletes your original packs, but does not recall independent copies previously imported by others.
- Push tokens are disabled and subsequently deleted after extended inactivity. In-app data deletion removes the tokens associated with that session.
- Session identifiers and Game Center recovery links remain until data deletion. Reinstalling may restore access and does not automatically remove either from our servers.
- Photos and cached requests remain locally until removed or app data is cleared. Backups and copies shared to other apps are separate.
- Suggestion results and request hashes support retries and allowance enforcement. Moderation and support records may remain for investigation and follow-up. Provider logs, backups and billing records have separate retention governed by the applicable service settings, security needs and legal obligations; they are not covered by the live-room cleanup period. Contact us for information about records relevant to your request.
Deleting data and controlling optional features
Use About & legal → Delete my data before uninstalling. This removes your session, Game Center recovery link, original saved packs, history access, push tokens, preferences and local memories. Associated team names are replaced. It does not recall shared cards, imported pack copies or every shared game record. It does not itself erase all provider backups, billing, support or moderation records. Identifying text can remain in shared notes or challenges; contact us for a content-specific removal request.
Uninstalling alone does not ask our servers to delete anything. Game Center may recover linked packs and history after reinstalling, but cannot restore the session data removed by Delete my data. Without a recovery link, keep pack codes before uninstalling. We do not promise recovery of local photos.
Turn camera, location and notifications off in device settings. Decline a suggestion confirmation to avoid sending that request. Previously transmitted requests and shared copies are not recalled by withdrawing a permission. Cancel ParkBrawl Plus separately through Settings → your name → Subscriptions; deletion or uninstalling does not cancel billing.
Rights and requests
Depending on applicable law, you may request access, correction, deletion, restriction, portability or an objection to processing, and withdraw consent where processing relies on it. Email support@parkbrawl.com. We may request proportionate evidence to connect you to the relevant session; a shared room code alone does not authorize access to another player’s information. We will explain any applicable exception or inability to verify a request. You may complain to your local data-protection authority, including the UK ICO where applicable.
Where data-protection law requires a lawful basis, we use information needed to provide the service you request to perform our agreement; operate security, abuse handling and service improvement for legitimate interests; and meet legal obligations where applicable. Optional permissions and third-party request confirmations are separate choices. You may object to processing based on legitimate interests by contacting us. These purposes do not authorize unrelated advertising use.
Children and families
A parent or guardian should supervise children participating in park activities and review what is entered or shared. Do not enter a child’s real name, contact details, precise whereabouts or health information into shared content or suggestion requests. If you believe a child’s information has been submitted inappropriately, contact support@parkbrawl.com so we can investigate and handle a deletion request. See the terms for eligibility.
Security and international processing
Session credentials use device secure storage. Connections to our servers are encrypted in transit and access controls restrict game records. No service can guarantee perfect security. Treat room and pack codes as information you should share only with intended participants.
Providers operate internationally, including in the United States, so information may be processed outside your country. Applicable transfer protections depend on the provider, service and jurisdiction. Contact us for information about the processing locations and safeguards relevant to your data; this policy is not itself a transfer safeguard.
Changes
We update the date when this policy changes. Material changes are summarized in the app with an updated notice version when the corresponding app update reaches you. We request separate permission where required for a new use; accepting terms does not provide blanket consent.
See support and Terms of Use.