Privacy Policy

Who is responsible

Big Night is operated by Web Smith – FZCO, a free-zone company licensed by the Dubai Integrated Economic Zones Authority (IFZA), licence no. 90841, registered at DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates. Contact: hello@bignight.games. Web Smith – FZCO is responsible for your personal data (the "controller"). For any question, request or complaint about your data, email hello@bignight.games.

Players

To play you type a nickname (up to 14 characters) and pick an emoji. What you type, draw and vote during a game, and your score, are kept with the room.

That's all. No account, email, phone number or location. Your phone keeps a random player ID so you can reconnect if the page reloads.

Room data is held on our server — in memory and in a file so a restart doesn't end the party — and is deleted automatically within 12 hours of the room's last activity.

Children and young players

Players under 18 may play only with a parent's or guardian's permission, and children under 13 only with a parent or guardian present. Host accounts are for adults (18+).

From a player we collect only a nickname and what they submit during the game, deleted within 12 hours. There are no public profiles, no chat with strangers and no way to contact a player outside the room, which is private to people given its code.

If you think a child has given us personal data without a parent's permission, tell us and we'll delete it.

Hosts who sign in

• Your email address, and the date you signed up.

• Your plan, its end date, and whether it was set by sign-up or by us.

• A sign-in session for each device you're signed in on: a random token, valid 30 days.

• Sign-in links, valid for one hour.

• Which question sets you've been served, so you don't get repeats.

• When the AI wrote something for you and for which game — this counts the free nightly allowance.

• The categories, themes and instructions you type, and what the AI wrote from them (see "Personal information in AI prompts").

We don't collect your name, a password, phone number, address, payment card, location or contacts.

Hosts who don't sign in

Your browser gets a random ID in a cookie. It carries no name or email. The same question history, AI usage log and written content as above are linked to that ID instead of an account.

Personal information in AI prompts

When a host asks for AI-written questions, what they type into themes and instructions is sent to Anthropic's AI model. Please don't include personal information about other people — full names, phone numbers, health, family or private details — unless they're happy with it.

If a request is about specific real people (a roast, an inside joke, "people in this room"), the AI marks it as personal. Those questions are kept private, shown only back to the host who asked, and deleted when that host deletes their data (or after 12 months for a browser that never signed in).

We never send player nicknames, answers, emails or IP addresses to the AI — with one exception the host chooses: when someone asks The Referee to settle a disputed answer, the clue, the official answer, what the team said and any argument typed in are sent to Anthropic to get a ruling. We keep only the verdict and when it happened (12 months), not what anyone said.

Reports

If you report content, we store what you choose to tell us: the type of problem, your description, the room code and game, and a contact detail only if you give one. We keep reports and what we did about them for 12 months, then delete them.

Technical data

Your IP address is used, in memory only, to stop anyone flooding the service with requests. It is never saved to our database and is discarded within an hour.

Our hosting provider keeps server logs for running and fixing the service. They can contain IP addresses and error messages.

Why we use it

• To run the games you ask for, sign you in, remember what you've played, and apply your plan — this is necessary to provide the service you requested.

• To keep the service safe, handle reports and prevent abuse.

• To meet our legal obligations.

We don't sell or rent your data, show ads, build profiles, or make automated decisions about you.

Cookies and browser storage

We use essential cookies only, so there is no cookie banner: bn_host (the anonymous host ID, 1 year), bignight_lang (your language, 1 year), and while signed in the authjs session cookie (30 days) plus short-lived security cookies used during sign-in.

Your browser also stores, and never sends to us: light or dark mode, sound on or off, whether you've seen the intro, the last room you were in, your player ID for each room, saved games with the team names you typed, and packs you wrote.

There are no advertising, analytics or tracking cookies.

Who else sees it

• Anthropic, PBC (United States) writes and judges questions. It receives the themes and instructions a host types, the difficulty and language, a list of answers to avoid repeating, and in Face-Off the guess being judged. Under its commercial terms it does not use this to train its models and keeps it only for a limited period.

• Resend (United States) delivers sign-in emails, so it receives the host's email address and the sign-in link.

• Railway (cloud hosting) runs the service and its database, which hold all the data described in this policy. Its servers may be outside the UAE.

• Wikimedia Foundation (United States) hosts the pictures. The TV's browser loads them directly, so Wikimedia sees that screen's IP address and browser type.

• UAE authorities, only where the law requires us to disclose.

No one else. We never sell data.

Transfers outside the UAE

The providers above process data outside the UAE, including in the United States, which does not currently have a UAE adequacy decision. We transfer data to them only as needed to provide the service you asked for, and under contracts that require them to keep it confidential, secure it and use it only on our instructions, as the UAE PDPL permits.

We send each provider the minimum it needs: no player data goes to Anthropic or Resend, and no host email goes to Anthropic. When the PDPL's executive regulations set further transfer rules, we will follow them and update this page.

How long we keep it

• Room data (nicknames, answers, drawings): deleted within 12 hours of the room's last activity.

• Sign-in links: one hour, or until used. Sessions: 30 days, or until you sign out.

• AI usage log: 30 days.

• History of a browser that never signed in, and personal questions written for it: 12 months.

• Content reports: 12 months.

• Account data: until you delete your account.

• IP addresses: under an hour, in memory only.

• Server logs: the short period set by our hosting provider.

Questions on public subjects ("90s cartoons") join a shared library so other hosts get them instantly. When your data is deleted, anything linking them to you — and the words you typed — is removed.

Deletion is automatic: a sweep runs every hour and removes anything past its period.

Your rights

Under the UAE Personal Data Protection Law you can: find out what we hold about you and get a copy; have it corrected; have it deleted; restrict or object to how it's used; ask us to stop processing it; withdraw consent you've given; and receive it in a portable format. You can also complain to the UAE Data Office.

Delete your data yourself

Signed in: open your account page and choose "Delete my account and data". It happens immediately.

Not signed in: go to bignight.games/delete-my-data and delete everything linked to your browser.

Playing in a room: your data is deleted within 12 hours automatically. To leave sooner, quit the room or ask the host to remove you.

For anything else — a copy of your data, a correction, a question — email hello@bignight.games. We'll reply within 30 days, and may ask you to confirm from your account's email that the request is yours.

Security

Everything travels over HTTPS. There are no passwords to steal. Sign-in links expire in an hour. Session cookies can't be read by scripts on the page. Access to the database is limited to what runs the service.

If a breach ever affects your personal data, we'll tell you and the UAE Data Office as the law requires.

Changes and contact

When anything here changes we'll update this page and the date at the top, and show significant changes on the site before they apply. Questions: hello@bignight.games.