Your game. Your privacy.
Straightforward help and clear choices, so you can get back to your people.
Privacy notice · updated 17 October 2026
No player account needed.
Pick a nickname, share a room with people you trust, and keep personal information out of messages and drawings. Playing without an account does not mean no personal information is processed.
Who runs Heygang?
Damola Akinsola operates Heygang as an individual in the United Kingdom. For privacy questions or requests, contact dazco777@gmail.com.
Your seat and saved games
A secure browser cookie recognizes your seat and helps restore it after a disconnect. Its maximum age is 30 days. The server stores a protected credential representation, nickname, avatar, player number, connection status and saved game state.
Saved state includes accepted actions, results, private cards and secret Spectrum targets, optional clues and chat, and drawings. Other room members see shared content and public outcomes. Private cards are limited to the appropriate seats until the game reveals them. People can still copy or screenshot what they see.
The host can close admission, but anyone receiving a forwarded invitation may be able to join while it is open. Use invitations only with your trusted group. A nickname or invitation alone cannot restore a lost seat cookie.
Why we use this information
We rely on legitimate interests to provide the games you request, protect seats and saved actions, prevent abuse, answer support requests and understand content-free gameplay outcomes. We limit this use to what each purpose needs and give particular weight to children’s privacy. We use consent for optional browser measurements. Essential play does not depend on allowing them.
Hosting and retention
Cloudflare hosts the service and processes technical request metadata to deliver and protect it. Its hosting logs are separate from optional product analytics. Emailing support also sends your correspondence through Google’s Gmail service. We do not use support messages for advertising or gameplay analytics.
Inactive lobbies expire after 24 hours without action. Ongoing rooms expire after everyone has been disconnected for 24 hours. Active untimed matches have no fixed lifetime. Expiry schedules batched deletion, which can be delayed; a minimal expired-room record remains for seven further days. Rematches schedule old artwork for cleanup.
Sampled Cloudflare Workers logs can contain request URLs, technical metadata and error categories. On Workers Free, their published retention is three days. This release redacts URL query strings from those logs; invitation paths can remain. Provider security and account records follow separate provider policies, not the room deletion schedule. Reporting-owner Access login logs have a published Free retention of 24 hours; administrative audit logs have 18 months.
Routine support correspondence is manually deleted within 90 days after the request closes. A justified safety or legal exception is recorded and reviewed separately. Gmail deletion is not automated, and provider backups or legal obligations can delay final removal.
Providers and international processing
Cloudflare processes hosted room data on our behalf under its Data Processing Addendum and handles its own security and account data under its privacy policy, including derived network statistics and service improvement. Google handles Gmail under its own privacy terms; we do not claim this personal mailbox has a Google Workspace processing agreement. These services operate internationally, including in the United States. Their published transfer safeguards include the EU–US Data Privacy Framework and its UK Extension, with contractual safeguards where applicable. This is not UK-only hosting.
Read Cloudflare’s privacy policy, its processing terms, and Google’s privacy policyfor their separate processing and retention.
Analytics and choices
Optional browser traffic analytics is for visitors aged 18 or older who choose Allow. Choosing Allow confirms that you are 18 or older; no date of birth or ID is requested. Everyone can play with collection Off. Earlier age-blind Allow choices need confirmation. When the operator activates collection, it measures page views, referral sources, device and country categories and loading performance. Standard traffic measurements may include invitation paths and room codes. This covers opted-in browsers, not total site traffic. Visits are not unique people. Dismissing the choice is not permission; choose Off or change Analytics preferences at any time. Cloudflare provides six months of traffic history, with aggregation and sampling. Its RUM service receives your IP address to handle the request and derive a country, and says it discards that IP at the edge rather than storing it in RUM databases or logs. We do not guarantee that records are anonymous or that other provider security processing has the same retention.
When enabled by the operator, separate server-side gameplay statistics record content-free room and match events to report aggregate game types, starts, outcomes, rematches and entry results. They exclude player names, credentials, room codes, chat, clues, secrets, bids and artwork. Stored timestamped events are not necessarily anonymous merely because they omit these fields. They are controlled separately from your browser preference. Events are retained by Cloudflare Analytics Engine for three months, with no separate event archive. Delivery can be incomplete and reports use sampling weights.
No advertising tracker, session replay or analytics cookie is added by this integration. Essential seat cookies and hosting metadata still apply.
Playing with care
Heygang is intended as a family-friendly place to play with people you know, not a promise that every room is safe for every age. Chat, clues, nicknames and drawings come from players and are not screened before other room members see them. Keep personal details out, share invitations carefully, and leave or report a concern if something feels wrong. There is no public player directory, direct messaging, advertising profile or precise location tracking.
Questions, concerns and requests
You can contact us about access, correction, deletion or objections to processing, restriction and portability where applicable. You may object to our legitimate-interest processing. We normally respond within one month and explain any lawful extension. We may need limited information to locate records and confirm your authority. Do not email credentials or identity documents. A parent or guardian may contact us concerning a child; the child’s rights and the requester’s authority still matter. We do not collect extra identifiers just to identify a person in content-free statistics, and may be unable to isolate your event from aggregates. There are no automated decisions with legal or similarly significant effects. Mandatory legal disclosures may sometimes be required.
You can also contact the UK Information Commissioner’s Office.