1. Who is responsible
The controller is Dashboard Executive, LLC, a United States company. We offer ParishGames to youth group leaders in the United States, the European Economic Area (EEA), the United Kingdom, and elsewhere.
Privacy and data-rights contact: the contact form.
2. What we collect and why
We collect only what we need to run ParishGames. We do not buy lists, and we do not run advertising pixels. We do use Google Analytics 4 (GA4) for pageviews and basic usage, as described below.
- Host account. Your email, an optional display name, and sign-in identifiers from our account service (Amazon Cognito, at auth.parishgames.com). If you use Google or LinkedIn sign-in, that provider sends us an identifier and the email it holds for you. Legal basis (GDPR): contract (Art. 6(1)(b)).
- Lifetime purchase. When you buy Lifetime, Stripe processes the payment. We may receive the Stripe customer, payment, or checkout ids, the email used at checkout, the amount, and the date. We never receive or store full card numbers. Basis: contract, and legal obligation for records and tax where they apply (Art. 6(1)(c)).
- Contact form. Your name, email, topic, message, and your tick that we may reply. Basis: consent (Art. 6(1)(a)). You can withdraw by writing to us; that does not undo a reply already sent.
- Usage analytics. Pageviews and basic game events (for example a game opened, started, or finished, and how long it ran) via GA4. Google may set cookies on your device for this. Basis: legitimate interests (Art. 6(1)(f)) in understanding how ParishGames is used so we can improve it. You may object.
- Saved games in your account. When you are signed in, the games you save (FaithGrid boards, Saint Who? rounds, Verse Race games) and games in progress (including TheWord rounds) are stored with your host account so they appear on any device where you sign in. This includes what you typed into them: board and round names, questions, clues, answers, your review edits, team or player names, and scores. Each account’s saved games are private to that account; no other host can see them. Your browser keeps a temporary copy for speed and offline play, and signing out removes that copy from the browser. We keep at most 100 saved games per game in an account. Basis: contract (Art. 6(1)(b)).
- On your device. Essential browser storage (localStorage) holds your sign-in session, the Lifetime unlock flag for this device, the host name you type, and simple on-device usage counters. Games you save while signed out stay only in that browser and are not sent to us, unless you later sign in and choose to add them to your account.
- Security logs. Short-lived technical records (for example errors, failed sign-in, or contact-form abuse checks) so we can keep the service up and stop abuse. Basis: legitimate interests (Art. 6(1)(f)) in running a secure product. You may object.
Sources: you, your device (essential storage, and analytics cookies where set), our sign-in service, Google or LinkedIn if you choose that button, Stripe if you buy Lifetime, and Google Analytics.
Players in the room do not need an account, and we do not ask the host to enter players’ personal details. Team names and scores you type stay on your device when you are signed out, and are stored with your saved games when you are signed in. Please use first names or team names only.
We do not use your games or contact messages to profile you for ads. We do not make solely automated decisions that produce legal or similarly significant effects (GDPR Art. 22).
3. Who we share with
We use other companies only to run ParishGames:
- Amazon Web Services (United States): website hosting (Amazon S3 and CloudFront), sign-in (Amazon Cognito), saved-game storage for signed-in hosts (Amazon API Gateway, AWS Lambda, and Amazon DynamoDB, encrypted at rest), email delivery (Amazon SES), and contact-form storage.
- Stripe: payment for Lifetime. Stripe is an independent controller for the card and payment details.
- Google or LinkedIn: only if you tap that sign-in button. Each is an independent controller for your account with them.
- Google Analytics (GA4): pageviews and usage analytics, as described in Google’s privacy materials.
Processors may use data only to provide their service to us, except where they act as independent controllers for their own sign-in or payment. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
4. Transfers outside the EEA and UK
Dashboard Executive, LLC and our providers are in the United States. When we move EEA or UK data to the US we rely on:
- the EU–US Data Privacy Framework and its UK Extension, where the recipient is certified, and/or
- the European Commission’s standard contractual clauses (and the UK addendum) with the provider.
You can ask for more detail about a transfer through the contact form.
5. How long we keep it
- Host account: while the account is open. When you use Delete account on the Account page, your sign-in record is removed and saved boards and game data on that device are cleared. A short security log may remain.
- Lifetime purchase records: as long as the law requires for payment, tax, and accounting records. Stripe keeps its own records as the law requires.
- Contact messages: long enough to reply and keep a limited record, typically up to 24 months unless a dispute needs longer.
- Saved games in your account: until you delete them or delete your account. Deleting your account erases all of its saved games and games in progress from our servers. A deleted game leaves a small marker without its contents for up to 90 days so your other devices also remove it.
- On-device storage: until you sign out (for account games), clear your browser storage, or delete the account on that device.
- Google Analytics: per the GA4 retention setting for the ParishGames property. We do not keep a separate long-term copy of those events.
6. Your rights in the EEA and United Kingdom
You may access your data, correct it, erase it, restrict or object to some processing, port it in a common format, withdraw consent, and not be subject to prohibited automated decisions. Use the contact form, or Delete account on the Account page. We will respond within one month (we may extend by two months for a complex request, and we will tell you).
You may complain to your supervisory authority. In the UK that is the Information Commissioner’s Office (ICO). In the EEA it is the authority in the member state where you live.
7. Your rights in the United States
If a state privacy law applies to you (including California’s CCPA/CPRA and similar laws in other states), you may ask to know, correct, or delete personal information, and to receive a copy. We will not discriminate against you for using these rights. We may need to verify that the request comes from the email on the account. An authorized agent may make a request where state law allows; we may still need to verify you.
The categories we collect are in section 2. We disclose them to the providers in section 3 for the business purposes of running ParishGames, taking payment, security, and answering you. Retention is in section 5. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you.
To appeal a refused request, reply to our decision through the contact form.
8. Cookies and local storage
We use essential local storage and session tokens so you stay signed in, so Lifetime stays unlocked on this device, and so boards and games work. These are strictly necessary for the service. We also use GA4 for pageviews and usage analytics; Google may set cookies for that. We do not set advertising cookies, and we do not use a marketing pixel. You can clear cookies and storage in your browser settings at any time; doing so signs you out and removes boards saved on that device.
9. Children and youth groups
ParishGames is a tool for adult youth group leaders. Host accounts are for adults (18 or older). The games are meant to be played by youth groups in the room, under the supervision of the adult host. Players do not create accounts and do not give us personal information.
We do not knowingly create accounts for, or collect personal information from, children (including children under 13 under the US COPPA rule, or under the age set by your country under the GDPR). If you believe a child has given us personal information, contact us and we will delete it.
10. Security
Sign-in is handled by Amazon Cognito. Payments are handled by Stripe. The site is served over HTTPS, storage is encrypted at rest, and access to our systems is limited. No method is perfect. If you think an account was misused, tell us through the contact form.
11. Changes
If we change this notice in a material way, we will update the date above. If a change needs your consent under the GDPR, we will ask for it.