Privacy notice

SuspectParty is a United States-facing service that turns a host's guest list into a private, fictional murder-mystery party. This notice covers the website, the builder, checkout, the hosted party experience, and the printable kits. It applies to two kinds of people: hosts, who buy a party and give us information, and guests, whose first names and traits a host enters. Guests never need an account and we never contact them except with links the host chooses to share.

When you build and buy a party we collect:

• Your email address, used for order confirmation, delivery, and account recovery. If you leave it in the builder without buying, we also send at most two reminders about that draft, each with a one-click unsubscribe.
• Your party configuration: occasion, theme, tone, player count, whether you play, and the tier you buy.
• Order records: what you bought, the price, refund status, and the payment identifiers Stripe gives us. We never see or store card numbers.
• Service and security logs: rate-limit counters and abuse-prevention records derived from network information, and error reports needed to keep the service working.

To personalize a mystery, the host enters for each guest: a first name, two or three personality traits, an optional fun detail, and optionally whether the guest is a minor (which locks the party to Family tone rules). That is the entire guest profile - no emails, no photos, no accounts.

This is information about other people, so two commitments apply. The host confirms they reasonably believe every guest will enjoy taking part. And we use guest details for exactly one thing: casting and delivering that host's private game. Guest details are never used for marketing, never sold, and never combined across parties. Any guest can ask us to remove their details from a party - see Contact below.

The story is written by AI using the details the host provides. Guest first names and traits are sent to Anthropic (Claude) to write the fictional narration, character files, and clues. On the Deluxe tier, each guest's fictional character brief - character name, archetype, and the traits the host entered, never a photo - is sent to Google's Gemini API to draw a fictional illustrated portrait. We use both through their commercial API terms, under which content submitted through the API is not used to train or improve their models.

A moderation layer screens inputs before generation, and the game logic itself is decided by our own deterministic engine - the culprit is always a fictional role chosen before any personal detail is considered. Personality traits color the prose; they never determine who "did it."

Checkout happens on Stripe's hosted payment page. Card details go directly to Stripe and never pass through SuspectParty servers. Stripe collects and remits sales tax where required and issues the official payment receipt. We keep the order and refund records a business is required to keep.

We set no third-party cookies, and nothing optional runs until you allow it. What we use:

• Essential, no consent needed. One HttpOnly cookie set during checkout, scoped to the payment-return endpoint, which proves your browser started the purchase; it expires with the checkout session. And browser storage (localStorage) on your own device: your builder draft, your host access keys, your guest-link list, and your cookie choices. These stay in your browser so that a closed tab or lost connection never loses your party; clearing site data removes them.
• Analytics, only with your consent. A random visitor id for this browser session (sessionStorage), so the steps of one visit count as one journey in our funnel. Without consent no id is created.
• Advertising, only with your consent. A first-visit attribution note - the campaign link that brought you here - kept for 30 days in a cookie so a later purchase can be credited to that campaign. Withdrawing consent deletes it.

Which rule applies depends on where you are. Where the law asks for consent first - the European Union and EEA, the United Kingdom, Switzerland, Canada, Brazil, Turkey, South Korea, South Africa, India and China - nothing optional runs until you allow it and nothing is pre-selected. Elsewhere, including the United States, where privacy laws give you a right to opt out rather than a duty to opt in, analytics and advertising measurement run unless you turn them off. Either way the banner offers Accept all, Reject all, and Manage options with equal weight, Reject all stops everything optional at once, and your choice is kept for six months before we ask again.

Two optional categories exist, each with its own switch. Analytics: we measure the purchase funnel with PostHog. Without your consent PostHog receives only anonymous, unlinkable page and step counts - no visitor id, no IP address, no device details, and no profile is created. With it, the steps of one visit are linked through the session id described above. Advertising: only when advertising campaigns are running, Meta and TikTok receive conversion events (a visit, a checkout, a purchase) to match against their own pixels. With it, each event they receive carries the click id from the ad link that brought you here, a browser id we assign, your IP address and browser details, and - for a sign-up or a purchase - a hashed form of your email that the platform matches against its own users; the address itself is never sent. Without this consent they receive nothing about you at all.

You can change or withdraw either choice at any time, as easily as you gave it, from Cookie settings in the footer of every page or right here: Cookie settings. Changes take effect immediately. We also honor the Global Privacy Control browser signal as an opt-out of advertising sharing, whatever the switch says.

We use a small set of providers, each doing one job:

• Vercel - application hosting (United States).
• Supabase - database for orders, parties, and saved builder drafts (hosted in Canada, ca-central-1).
• Cloudflare R2 - private file storage for generated kits, served only through short-lived signed links.
• Stripe - payments, receipts, and sales tax (United States).
• Resend - email dispatch (United States and the EU).
• Anthropic - story text generation (United States).
• Google (Gemini API) - fictional portrait generation from each guest's character brief, Deluxe only (United States).
• PostHog - purchase-funnel analytics (United States); anonymous counts only unless you consent.
• ElevenLabs - text-to-speech for the detective briefing, Deluxe only. It receives the briefing text, never a guest's voice, and no guest voice is ever recorded or cloned.
• Sentry - error monitoring, with emails, names, tokens, and authorization headers scrubbed before storage.
• Inngest - background job queue for reliable generation and delivery.

Each provider processes data only to provide its service to us.

SuspectParty operates from the United States. As the list above shows, some processing happens outside the US: the database is hosted in Canada and some email dispatch runs in the EU. Wherever the data sits, the same access rules in this notice apply.

Data lives as long as the party needs it and no longer:

• Builder drafts live in your browser. When you give us your email in the builder - to save a draft for later or to open your preview - we also keep an encrypted copy of that draft, guest names included, so the link in our reminder email can reopen it on any device. The copy is deleted when you buy, and otherwise 30 days after you last saved it.
• Party and guest data persist so your group can play and revisit the case; the host can delete the party and its guest data at any time.
• Emailed links expire: a sign-in link you request yourself lasts 24 hours, the link in your purchase email lasts 30 days, and kit download links are short-lived and re-signed on demand.
• A refund closes guest links and file access when it is processed.
• Order, payment, and tax records are retained as law requires. Error logs are scrubbed of personal detail and age out on the monitoring provider's schedule.

Every private surface is token-gated: each guest link carries a hard-to-guess signed token and the server returns only that guest's visible fields - one guest can never read another's secrets, and no spoiler leaves the server before the host unlocks it. Host controls require a separate host token. All API routes sit behind rate limiting with brute-force lockouts, secrets are stored as environment configuration rather than code, and error reports are scrubbed before they leave the application.

SuspectParty is sold to adults (18+). Hosts may include minors as guests only with the party in Family tone and with a parent or guardian's knowledge; the only child data involved is the first name and traits the host types. We do not knowingly collect personal information directly from children under 13, and a parent or guardian can have a child's details removed from any party by contacting us.

Depending on your state (including under the California Consumer Privacy Act and similar laws in Virginia, Colorado, Connecticut, Texas, and others), you may have the right to:

• Know and access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information;
• Receive a portable copy of it;
• Opt out of sale, sharing, or targeted advertising - noting that we do not sell personal information, and in the United States advertising measurement runs by default and stops the moment you choose Reject all in Cookie settings or send the Global Privacy Control browser signal, which we treat as an opt-out of sharing;
• Not be discriminated against for exercising any of these rights.

To exercise a right, email us from the address on your order so we can verify you. We respond within the timelines your state law sets, and we will not require an account to honor a request.

Privacy questions, guest removal requests, and rights requests: support@suspectparty.com. If this notice changes in a way that matters, we update the date above and, for material changes affecting existing orders, notify hosts by email.