← Back to The Council

Privacy Policy

Last updated: 9 October 2026

The Council is a party game. We keep what the game needs to run, and nothing else. This page tells you exactly what that is, why we need it, who helps us run it, how long we keep it and what you can ask of us.

1. Who is responsible

The Council is made by NovaVita Games, a private, non-commercial project run by M J C Huys. NovaVita Games is not a registered company yet. As soon as it is, its details will appear here. M J C Huys is the controller of your personal data under the General Data Protection Regulation (GDPR).

• Email: hello@thecouncil.games
• Postal address: not public yet. You can reach us for anything, including legal matters, at the email address above.

We are a small team and not required to appoint a Data Protection Officer. Every privacy question reaches the person responsible through the email address above.

2. What we process, why, and on what legal basis

Solo games

A solo game against bots runs entirely on your phone or computer. Your moves, the bots and the result stay on your device. We receive nothing from it.

Your seat at the table (guest or account)

• What: a random player ID, the name you choose (up to 20 characters) and a sign-in token that keeps you signed in. Your portrait at the table is drawn from your name. We never ask for a photo.
• With an account, also: your email address and your password, which we only store as a secure hash.
• Why: to seat you at a table, show your name to the other players and let you come back to your record.
• Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR).

Your record

• What: games played, games won, wins as Mafia and as Town, level and experience points.
• Why: to show your progress. Your name and your record can be seen by other players.
• Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR).

Party and online games

• What: the table code, who sits at the table, the role you were dealt, your night actions, claims, nominations and votes, the timers and the outcome.
• Why: our server runs the game so nobody can cheat. Each player only ever receives what their own seat is allowed to know.
• Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR).

In a party in one room, you talk face to face. That conversation never touches our servers.

Voice chat (online games only)

• What: your microphone audio, relayed live to the other players at your table through our own voice server, plus the technical connection data a call needs (such as your IP address).
• What we do not do: we never record, store, transcribe or analyse the audio. When the call ends, nothing of what was said is left on our side.
• When: your browser or phone asks for microphone permission when your first online game starts. Your microphone is on while you play an online game, and the mute button switches it off at any time. Party and solo games never use the microphone.
• Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR). You control microphone access in your browser or phone settings.

Keeping the service safe

• What: technical logs with your IP address, the time and the type of request, for example a sign-in or a failed sign-in attempt. Our hosting provider for the website keeps similar short-lived request logs.
• Why: to keep the game running, stop abuse such as mass sign-ups, and investigate security problems.
• Legal basis: our legitimate interest in a secure, working service (Article 6(1)(f) GDPR). We keep these logs short and use them for nothing else.

Emails

• Account emails: if you add an email, we can send you messages about your account, such as confirming a new email address. We never send marketing or newsletters.
• When you write to us: we use your email address and message to answer you. Legal basis: our legitimate interest in helping you (Article 6(1)(f) GDPR), or our agreement with you when it is about your account.

Reports about other players

• What: your email, the name of the player you report, the table and what happened.
• Why: to look into it, act on it and tell both sides what we decided.
• Legal basis: our legitimate interest in a safe game for everyone, and our legal duties under the EU Digital Services Act (Article 6(1)(c) and (f) GDPR).

3. What we never do

• No advertising, no analytics tools, no tracking pixels, no social media plugins.
• No profiling and no selling or renting of data. Ever.
• No access to your location, contacts, photos or camera.
• No use of your data or your voice to train AI models.

4. Who else is involved

A few companies help us run The Council. They act on our instructions under a data processing agreement and may not use your data for their own purposes.

• Hostinger (Hostinger International Ltd, Cyprus, EU). Runs the server in Frankfurt, Germany that holds accounts and game data and hosts our voice server. Also hosts our mailbox hello@thecouncil.games.
• Vercel (Vercel Inc., USA). Delivers the website and the web app files through servers around the world, so pages load fast wherever you are. Vercel sees your IP address and the pages you request. It does not receive your account or game data.
• Resend (Resend Inc., USA). Sends account emails, only if you added an email address.

Our voice server runs the open source LiveKit software on our own server. The LiveKit company receives nothing.

Other players see your name, your portrait, your record and whatever the game reveals during play, and they hear you in online voice chat. If you download the app, Apple or Google handle the download under their own privacy terms. We only share data with authorities when the law requires it.

5. Data outside the EU

Game data and accounts stay in the EU. Vercel and Resend are US companies. Transfers to them are covered by the EU-US Data Privacy Framework where the company is certified, and by the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards.

6. How long we keep it

• Email accounts: until you delete the account.
• Guest accounts: until you delete them, or 12 months after the last game you played, whichever comes first. If you sign out as a guest, you cannot get back into that guest account, and it is removed after those 12 months.
• Finished games: up to 12 months, then removed. The totals on your record stay until your account is deleted.
• Tables that never started: removed within 7 days.
• Voice: never stored.
• Security logs: up to 90 days. The website host's request logs are kept for a few days at most.
• Emails and reports: as long as needed to handle them, and no longer than 2 years after the last contact.
• Backups: deleted data can remain in our daily server backups for up to 30 days before those backups are overwritten.

When you delete your account, your profile, your seats, the tables you host and your personal view of every game are deleted with it. Games still in progress carry on without you.

7. Your rights

Under the GDPR you have the right to:

• see the data we hold about you and get a copy (access),
• correct it (you can change your name yourself on the Record tab),
• delete it (Record tab, then Delete my account),
• take it with you in a machine-readable format (portability),
• limit what we do with it (restriction),
• object to processing based on our legitimate interest.

Email hello@thecouncil.games from the address on your account. If you play as a guest, tell us your player name and roughly when you played. We may ask a question to make sure the request really comes from you. We answer within one month. For complex requests this can take up to two months longer, and we tell you if it does.

You can also file a complaint with a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens. You can also go to the authority in the EU country where you live or work. We would appreciate the chance to fix it first, but that is your choice.

How to delete your account

• In the game: open the Record tab and tap Delete my account, then confirm. It happens straight away.
• Without the app: email hello@thecouncil.games with the subject "Delete my account", from the address on your account, or with your player name if you play as a guest. We delete it within 30 days and confirm by email.

Deleting removes your account, your name, your record and your personal view of every game. Only short-lived copies remain: security logs for up to 90 days and backups for up to 30 days, after which they are gone too.

8. Do you have to give us data?

No law requires you to. To play with other people you need a name, because the game cannot seat you without one. An email is optional and only needed to keep your record on more than one device. Solo play needs nothing at all.

9. Automated decisions

We make no automated decisions about you and do no profiling. The bots in the game are characters at the table. They judge your moves in the game, not you as a person. Quick match simply seats you at the oldest open public table.

10. Age

The Council is for players aged 13 and up. Online tables, with live voice chat, are for players aged 16 and up. We do not knowingly process data of children under 13. If you are a parent and think your child under 13 uses The Council, email us and we will delete the account.

11. Security

All traffic is encrypted (HTTPS and encrypted voice). Passwords are stored as secure hashes. The full game state is only readable by our game server, and each player can only read their own view. If a data breach puts your data at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours, and we tell you without delay if it poses a high risk to you.

12. Cookies and device storage

We use no cookies and no trackers. The game keeps a few small items on your device that it needs to work, such as your sign-in and your language. The cookie and storage notice lists every one of them.

13. Changes

If we change how we handle your data, we update this page and the date at the top. If the change matters, we also tell you in the game before it takes effect.

14. Contact

Questions, requests or worries: hello@thecouncil.games. A real person reads every email.

Privacy · Terms · Cookies