Privacy Policy

• Your sign-in details. When you sign in with Google, Google shares your name, email address and profile photo with us. We do not get your password and we cannot see your Gmail, Drive, contacts or calendar.
• Party details. The party name, date, budget, invite code, the display name you choose, and your company email domain if the host limits the party to coworkers.
• Your gift. The product link, title, picture and price you drop in, your reveal note, the GIF you pick and your wrapping choices. Other players cannot see what is inside your gift until it is opened in the game.
• Game activity. Turns, opens, steals, votes and reactions during the game, so the game can run and the recap can show what happened.
• Shipping details, only if you give them. If your party ships gifts to players, the address you enter for delivery.
• Basic technical data. Standard server logs such as IP address, browser type and error reports, used to keep the service secure and working.

• To sign you in and keep your account secure.
• To run your party: the lobby, the live game, the recap and gift delivery.
• To send you messages about your party, such as invites, reminders that it is your turn, and the recap. You can ask us to stop non-essential messages at any time.
• To fix problems, prevent abuse and improve the game.

• We never sell or rent your personal information.
• We never use your data for advertising or share it with ad networks.
• We never show your gift contents, votes or messages to your employer outside of the game itself.

Stealmas uses Google sign-in only to confirm who you are. We request your basic profile and email address and nothing else. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not transfer Google user data to others except to run the service, and we do not use it to train AI models.

We use a small number of service providers, who may only use your data to provide their service to us:

• Supabase, for our database and sign-in (United States).
• Lovable and Cloudflare, to host the website.
• Google, for sign-in.
• ImprovMX, to deliver email sent to stealmas.com addresses.
• GIPHY, to search and show reveal GIFs.
• Amazon and product data providers, to show gift titles, pictures and prices from the links you share.
• Stripe, to process payments when a host buys a paid plan.

We may also share information if the law requires it, or to protect the safety of our players or the service.

• Players in your party can see your display name, profile photo, your gift once it is opened, and your moves in the game.
• The party host can see who joined, who has dropped a gift, and shipping status. The host cannot see what is inside your gift before the game.
• People outside your party cannot see your party at all.

We keep party data, including gifts and game activity, for 12 months after the party ends so hosts can look back at the recap, then delete it. Shipping addresses are deleted 30 days after gifts are delivered. You can ask us to delete your account and data sooner at any time.

You can ask to see, correct, export or delete your data by emailing hello@stealmas.com from the address you sign in with. We will respond within 30 days. You can also remove Stealmas from your Google account at any time at myaccount.google.com/permissions. Depending on where you live, you may have additional rights under local law, and we will honor them.

Data is encrypted in transit and at rest. Every game rule and permission is checked on our servers, players only ever see data from their own party, and access to our systems is limited to the people who run Stealmas. No system is perfectly secure, and if a breach affects you we will tell you promptly.

Stealmas is made for workplaces and is not intended for anyone under 18. We do not knowingly collect data from children.

If we make a material change, we will update the date above and let active hosts know by email before it takes effect.

Stealmas, Pennsylvania, USA. hello@stealmas.com