Sub-processors
Who else handles data
Last updated October 9, 2026
Four companies handle data so the game can run. None of them is given your town unless you do something that needs it, and none may use what it sees for its own purposes. This is the whole list.
Sub-processors
These companies process data on our behalf, under their own data processing terms.
| Company | What it does for us | What it sees | Where |
|---|---|---|---|
| Cloudflare, Inc. | Delivers the site and runs our server and its storage. Counts visits (Web Analytics). Forwards mail sent to our addresses. | Every request, with its internet address, as any host must. Whatever our server stores: counts, keys and what they open, towns saved with a key, open phone rooms, published town pages. Emails you send us. | United States; its network runs worldwide, and a request is handled at a location near you. |
| Anthropic, PBC | Writes the live townsfolk's lines. | Only when live townsfolk are seated: which case it is, the place's name, and the alibis written at the table. No players' names. | United States |
| Resend (Plus Five Five, Inc.) | Sends the one kind of email we send: a key, to the address that asked for it, or a gift's key with the giver's name and note. | The recipient's address and the email itself. | United States |
A company you deal with directly
| Company | What it does | What it sees | Where |
|---|---|---|---|
| Stripe (Stripe, Inc. and its affiliates) | Takes payment for paid seasons. Stripe is the seller of record: it runs the checkout, handles the tax and makes refunds. | Your name, email address, card and billing details, which you give to Stripe, not to us. We receive only a reference to the payment and, when a refund is made, a notice of it. | United States and other countries, as its own policy describes. |
Stripe decides for itself how it handles what you give it at the checkout, under its own privacy policy.
Not on this list, and why
- The tools used to make the game's pictures, voice and code. They were used to make the game and never see anything about the people who play it.
- Advertising or marketing companies. There are none.
Outside the UK and the EU
All of these companies are based in the United States. Where UK or EU law requires a safeguard for sending personal data there, we rely on the ones these companies provide in their data processing terms, such as the standard contractual clauses. See UK and EU.
Changes
If a company is added to or removed from this list, this page changes on the same day and the date at the top with it. An organisation that has a data processing addendum with us is told beforehand, as that document says.