Privacy Policy

Last updated 1 September 2026

Lengthywaves is a party game. It has no advertising, no analytics, no tracking pixels, and no third party is sent your data to profile you. This page says exactly what is stored, where, and how to remove it.

Who runs this. Lengthywaves is operated by Matthew Huang (“we”, “us”). For anything on this page — a question, a request to delete your data, or a report about a deck somebody has shared — write to contact@lengthywaves.com.

The short version

You can play without an account, and if you do, nothing you type leaves your device. Pass the phone, Open table and Quick play store the game in your own browser and never send it anywhere.
An account exists so your decks can follow you between devices. Sign-in is handled by Clerk; we store your display name and an account id, and the decks you write.
Online rooms are temporary. A room holds the display name you typed and the prompts in play, and deletes itself a few minutes after the last person leaves.
Deleting your account deletes your data. One action, described below, and no waiting period.

What is stored on your own device

This is not data we hold — it is in your browser, we cannot read it, and clearing your browser data for this site removes all of it.

What	Why	Where
A paused Pass the phone game — the roster, the scores, the round	So a refresh or a walk to the pub does not lose the game	`localStorage`
Decks you write on this device, and which one is selected	So they are still there next time	`localStorage`
The name you last played online under	So you do not retype it every game	`localStorage`
A room seat token	So a dropped connection can take your seat and score back	`localStorage`
The screen you were on	So a refresh puts you back, and only a refresh	`sessionStorage`
A copy of public decks you have opened	So a deck you have played still works with no signal	`IndexedDB`
A copy of decks from your own account, while you are signed in	So reopening the app resumes the deck you were playing without asking you to sign in again. Erased when you sign out, and when you delete your account, so a shared device does not keep your private prompts for whoever picks it up next.	`IndexedDB`

What we store on our servers

If you have an account

Sign-in is provided by Clerk, which holds your email address and login credentials. We never receive your password. From Clerk we receive and store, in our own database:

your Clerk account id;
the display name on your account;
the date the profile row was created.

We do not store your email address. If you write to us from the address on your account, we will have it in that email — that is the only copy we hold.

Decks you write

The title, description and prompts of every deck you save to your account, and whether you have chosen to share it publicly. A private deck is visible to you alone. A deck you publish is visible to everybody, together with your display name as its author — that is the whole point of publishing, and it is the only place your display name is shown to strangers.

Games finished

When a signed-in player finishes a game with a public deck, we record one row: the deck, your account id, and the time. It exists to sort the community shelf by how much a deck is actually played. It is capped at one row per person per deck per few minutes, it is never shown to anybody as a list, and playing your own deck does not count.

If you subscribe to a paid plan

We never see your card. Payments are processed by Stripe, through Clerk's billing integration. Your card number, expiry and security code go from your browser to Stripe and never touch our servers — we could not store them if we wanted to, and we do not.

What we can see is whether an account has an active plan and which one, which is what decides how many decks it may hold. Stripe holds the billing record itself — the card, the payment history, and any billing address or tax information it needs to collect — as its own controller, under its own privacy policy. Clerk holds the link between your account and its Stripe customer; see Clerk's privacy policy.

If you write to us about a payment, we will see whatever you tell us in that email. We do not ask for card details by email and you should never send them.

Online rooms

While a room is open it holds the display name each player typed, a random seat token per player, the prompts in play and the state of the game. It is not linked to an account for guests — you do not need one to join. The room deletes itself, entirely, a few minutes after the last person disconnects. Nothing from a room is archived.

Server logs

This site runs on Cloudflare Workers. Cloudflare processes requests on our behalf and produces the ordinary operational records that involves — IP address, timestamp, requested path, user agent — which are used to keep the service running and to deal with abuse. See Cloudflare's privacy policy. We do not join those records to your account and we do not use them to build a profile of you.

Cookies

There are no advertising or analytics cookies on this site, and so there is no consent banner — none of the cookies here are optional, because the only ones set are the ones sign-in cannot work without. Clerk sets them (names beginning __session, __client_uat and __clerk) to keep you signed in. If you never sign in, the local modes set no cookies at all.

Who your data is shared with

Nobody, in the sense that matters: we do not sell it, rent it, trade it, or hand it to advertisers or data brokers. We do not “sell” or “share” personal information as those terms are defined under California law. The only third parties involved are the ones that make the site work — Clerk for sign-in and billing, Cloudflare for hosting and the database, and Stripe for taking payment if you subscribe — and each receives only what its job requires. Stripe is involved only if you buy something; if you never do, it never receives anything about you. We will disclose data if a law requires it, and we will say so publicly unless we are forbidden to.

How long things are kept

Your profile and decks: until you delete them or delete your account.
Room state: minutes. It is deleted when the room empties.
Play records: until the deck or the account is deleted.
Server logs: per Cloudflare's retention, which is short and not under our control.

Deleting your account and your data

Delete your account from the account menu inside the app. When you do, automatically and immediately:

your profile row is deleted;
your private decks are deleted, with their prompts;
your play records are deleted;
decks you chose to publish stay up, with the author removed. Other people may have shared links to them or be part-way through a game with one, and breaking those was the worse of the two options. They are no longer attributed to you and are no longer yours to edit.

If you want a published deck taken down as well, ask us at contact@lengthywaves.com before you delete the account — or unshare it in the app first, which removes it from the shelf and from its link, and then delete the deck. We will also remove a published deck on request afterwards; tell us the deck's title and roughly when you published it.

Your rights

If you live in California, you have the right to know what personal information we have collected about you, to get a copy of it, to have it deleted, and to correct it — and the right not to be discriminated against for exercising any of them. We do not sell or share personal information, so there is nothing to opt out of. Almost everything we hold about you is already visible to you inside the app; for anything else, write to contact@lengthywaves.com and we will answer within 45 days.

We may need to check that a request really comes from you. For an account, replying from the email address on it is enough.

Children

This is not a service for children. It is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has created an account here, write to contact@lengthywaves.com and we will delete it.

Where your data is

Cloudflare and Clerk both operate globally, so data may be processed outside the state or country you are in. The service is offered to users in the United States.

Security

Sign-in is handled entirely by Clerk and verified cryptographically; we never see a password. Every request for private data is checked against the account making it. No system is perfect, and we do not pretend otherwise — if you find a security problem, please tell us at contact@lengthywaves.com before telling anyone else.

Changes to this policy

If this changes, the date at the top changes with it. If a change is a material one — collecting something new, or using something for a new purpose — we will say so in the app rather than quietly editing this page.