Privacy Policy

Last updated: October 16, 2026

1. Who we are

Cackle is operated by Midwest Capital Solutions, based in the United States ("we," "us"). This policy explains what information the Cackle website and games handle, and your choices. It should be read with our Terms of Use and Safety page.

2. What we collect

We do not ask for your name, email address, phone number, location, or contact list, and we do not need you to create an account. Our content filter blocks personal information such as phone numbers and emails in player-typed text. Please do not enter your own or anyone else's personal details.

If we add paid features, payments would be handled by Stripe on the web. We would not receive or store your full card number. We would receive limited details such as payment status and, where needed, an email for a receipt.

2a. The mobile app (iOS and Android)

Our mobile app is a wrapper around the same web game and handles the same information described in this policy. It adds a few device features:

• Camera: used only to scan a QR code to join a room. The camera image is processed on your device to read the code. We do not capture, save, or upload photos or video. You can deny or revoke camera permission in your device settings and join by typing the room code instead.
• Haptics: vibration feedback during play. No data is collected.
• Share sheet: if you choose to share a results card, your device's share sheet opens and you pick where it goes. We do not see where you share it.

Crash reporting and analytics. The app and website may include crash and error monitoring and privacy-friendly analytics. These help us fix bugs and see which games are used. They do not use advertising identifiers, do not track you across other apps or websites, and are not used for advertising. We do not sell data. For Apple's App Privacy details, we do not use data to track you, as Apple defines tracking. Any diagnostics and usage data that are collected are not linked to your identity.

3. How we use information

• To run rooms and games: show names, answers, drawings, and results to the people in the room.
• To moderate: our server-side filter checks text for slurs, explicit content, and personal information, and hosts can remove players.
• To keep the Service secure, prevent abuse, and fix bugs.
• To understand, in aggregate, how the Service is used and improve it.
• To respond to you and to meet legal obligations.

We do not use your content to build advertising profiles, and we do not show ads.

4. How long we keep it

• Room data (names, answers, drawings, votes, scores): kept only while the room is active, and automatically deleted about 5 hours after the last activity. After that we do not keep it.
• Device ID: stored on your own device until you clear your browser data. We do not keep a copy that identifies you.
• Server logs (such as IP addresses): kept by Cloudflare under its own retention practices, which vary by feature and plan. We do not control how long Cloudflare keeps its logs.
• Analytics and error reports (if enabled): kept for the period set by the provider and our settings, then deleted or aggregated.
• Emails to us: kept as long as needed to handle your request and for our records.

We may keep information longer if the law requires it, or if we need it to investigate abuse or protect people. Content other people have already seen or captured, for example in a screenshot, is outside our control.

5. Who we share it with, and what we do not do

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We use a small number of service providers who process data for us:

• Cloudflare: hosts the site and stores live room state in Cloudflare Durable Objects. It also handles network traffic and logs. See Cloudflare's privacy policy.
• Google Fonts: these pages load fonts from Google. Google may receive your IP address when it serves them. See Google's privacy policy.
• Stripe (only if and when payments launch): processes payments. See Stripe's privacy policy.
• Error monitoring and analytics providers (only if enabled): we will name them here if we turn them on.

We may also disclose information if required by law, to protect people's safety, or to protect our rights, and as part of a merger, sale, or similar transaction. The other people in your room see your display name and what you submit; that is how the game works.

6. Cookies and localStorage

Cackle does not use advertising or tracking cookies. It uses your browser's localStorage to save an anonymous device ID and a few settings, such as sound preferences. This is needed for the game to work, for example so you can rejoin after a dropped connection. You can clear it any time in your browser settings, but you may then lose your seat in a room. If we add analytics, we will describe any cookies or storage they use here. Some browsers offer "Do Not Track" or Global Privacy Control signals; we treat a Global Privacy Control signal as an opt-out of sale or sharing, though we do not sell or share personal information for advertising.

7. Children

Cackle is for people 13 and over. It is not directed to children under 13, and we do not knowingly collect personal information from them (see the U.S. Children's Online Privacy Protection Act, COPPA). For teens 13 to 17: there are no accounts, no email, and no precise location, and room data is deleted automatically. A parent or guardian who believes a child under 13 has used Cackle, or who has questions about a teen's use, can contact us and we will help. We will remove anything we can identify on request.

8. Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have rights over your personal information, subject to legal limits:

• the right to know what personal information we collect, use, and disclose, and to get a copy;
• the right to delete personal information we hold about you;
• the right to correct inaccurate information;
• the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in California law;
• the right to limit the use of sensitive personal information. We do not collect sensitive personal information to infer characteristics;
• the right not to be treated unfairly for using these rights.

To make a request, email us at the address in section 11. Because we have no accounts, we may not be able to link a request to you without extra details, such as the room code and roughly when you played. Room data is normally deleted automatically within about 5 hours. You may use an authorized agent to make a request. Other US states give similar rights, and we will honor valid requests where required.

9. Visitors from the EU, UK, and similar regions (GDPR basics)

We are based in the United States, and the Service is not designed to target people in the EU or UK, but we welcome visitors from anywhere. If the GDPR or UK GDPR applies to you:

• Who is responsible: Midwest Capital Solutions is the controller of the personal data described here.
• Legal bases: we process data to provide the game you asked to play (contract), for our legitimate interests in running, securing, and improving a simple, safe service, to comply with law, and, where we ask, with your consent.
• Your rights: access, correction, deletion, restriction, objection, portability, and to withdraw consent, plus the right to complain to your local data protection authority.
• Transfers: your data is processed in the United States and in other countries where Cloudflare and our other providers operate. Those providers use safeguards such as standard contractual clauses where required.

10. Security

We use reasonable safeguards: encrypted connections (HTTPS/WSS), server-side checks on what players can send, a random room code, and automatic deletion of rooms. No system is perfectly secure, and we cannot guarantee absolute security. Anyone with a room's code can try to join it, so do not share a code with people you do not want in the room, and hosts can remove players. If we learn of a security incident that affects you, we will act as the law requires.

11. Changes and contact

We may update this policy. When we do, we will change the "Last updated" date. If a change is significant, we will try to make it visible on the site.

Questions, requests, or complaints: contact@cackleparty.com.

Midwest Capital Solutions, United States. [Mailing address TBD]