Privacy Policy

Effective: September 26, 2026 · Last updated: October 31, 2026

The short version

No account needed. We don't collect your name, phone number, email, or contacts.
Room content (chat, whiteboard, video links) lives only in server memory and is gone when the room closes. It is never written to a database.
Voice and screen sharing are never recorded or stored. They usually connect devices directly, and then other people in the room can technically see your IP address; when a direct connection fails, encrypted data is relayed through our server, which can't read it.
Badges, watch history, your watch list and your block list stay on your own phone.
We don't sell data, don't show ads, and use no third-party analytics SDKs.

1. Who we are

ScreenParty ("the Service") is developed and operated by the individual developer CadeEmber (the developer name shown on Google Play), who is the data controller (and, under Indian law, the data fiduciary) for the purposes of this policy.

This policy covers the Android app ScreenParty (package com.huitongdesk.screenparty) and the web version at screenparty.huitongdesk.com in desktop and mobile browsers. If an iOS version is released, we will update this policy before launch.

Contact (also our privacy contact and the person in charge of personal information protection): [email protected]

The web version currently offers synced video, chat, reactions, voice chat, screen sharing (desktop browsers), reporting, blocking, room lock and removing members. The whiteboard, badges/journey, memory cards and the PRO subscription are currently Android-app only; the parts of this policy about those features apply to the app.

2. What we process

We collect as little as possible. This table lists everything the Service processes:

Data	When	Where it's kept, and for how long	Why
Device identifier (a random ID)	Generated randomly the first time you open the app or site; contains no hardware information	On your device (the web version clears it when you close the tab); sent to the server when you enter a room and removed from memory when the room closes. Except for PRO devices, see "Membership records"	Recognizing you after a reconnect; identifying PRO members
Anonymous ID	Derived one-way from the device identifier	In memory for the room's lifetime	It's all other room members see. Your device identifier can't be seen or worked out from it
Nickname	Typed by you when creating or joining a room	Server memory, cleared when the room closes; your device remembers your last nickname	Shown in the member list and chat
Time zone (e.g. America/New_York)	Provided by your device settings when you enter a room	Server memory, cleared when the room closes; shown to others in the room	Showing "it's 1am for them" to friends in other time zones
Room content: chat, reactions, highlights, whiteboard strokes, video links, playback position	When you send or do something in a room	Server memory, cleared when the last person leaves; never written to a database. During the few seconds of a server update restart, room info other than chat and whiteboard (nicknames, device identifiers, video link, playback position, etc.) is briefly written to the server's disk, then read back and deleted as soon as it restarts; anything older than 2 minutes is discarded	Letting everyone in the room see the same thing in real time
Room password	When a host sets one	Only a hash, never the plain text; cleared when the room closes	Checking who may join
Reports	When you report a message, user or room	Written to the server's report log: room code, reported message text, reason, reporter's and target's IDs and nicknames, time. Deleted automatically after 12 months. New reports are also emailed to the developer's work mailbox (Gmail) so they're handled promptly	Human review of abuse
Membership records (PRO only)	When you buy or restore PRO via Google Play	Device identifier + membership expiry, deleted 90 days after the membership ends; a hash of the purchase token (never the token itself) + the device identifiers using that membership and when each was last used, each device removed after 180 days unused	Verifying the subscription with Google; enforcing "up to 3 devices per membership"
Server access logs	Every network request	Time, URL requested (may include a room code), browser/OS type, and the IP address of a Cloudflare node (not your own IP). Deleted automatically after 14 days	Troubleshooting and defending against attacks
Your IP address	Every connection	Handled by Cloudflare; our server only uses it briefly in memory (e.g. to rate-limit room creation) and never logs or stores it	Delivering traffic; preventing abuse
Voice and screen-share audio/video	Only when you turn them on	Never recorded or stored. Encrypted with WebRTC's DTLS-SRTP and usually sent directly between devices; when a direct connection isn't possible it's relayed through our TURN server, which forwards only encrypted data we can't read and keeps no logs	Real-time voice and screen sharing

Data that stays on your device (never uploaded)

Your journey (badges, level, watch-time stats), watch list and history, block list, your language and appearance settings, your record of accepting the terms, and any memory-card images you save or share. Uninstalling the app or clearing its data deletes all of it.

What we don't collect

Real name, phone number, email, government ID, contacts, SMS, call logs, photos (unless you save a memory card yourself), precise or approximate location, advertising ID, or payment card details (Google Play handles all payments).

When you contact us

If you email us (support, feedback or a privacy request), we receive your email address, your message and anything you include, such as the app version, Android version, phone model and language that the in-app feedback email fills in for you (you can delete them before sending). We use them only to reply and to fix problems, and delete them within 12 months after the conversation ends.

3. App permissions (Android)

Microphone: only used after you tap "Voice" to join voice chat. When voice is off, the app answers no voice connections and doesn't use the microphone.
Screen capture: only when the host turns on screen sharing, confirmed in a system dialog every time; a notification stays visible the whole time and sharing can be stopped at any moment.
Notifications: for the ongoing "voice chat" and "screen sharing" notices.
Network, Google Play Billing: joining rooms and buying membership.

4. How we use information

Only to run rooms and sync playback, identify PRO members, handle reports and abuse, keep the Service secure, and fix problems.

We do not use your information for advertising or profiling, we do not track or profile children, we do not sell or rent it, and we do not use it to train AI models.

5. Who can see your information

People in the same room: your nickname, anonymous ID, time zone, the messages and reactions you send, and what you draw on the whiteboard. The host sees the member list and can remove members. Everyone in a room can see whether it's a PRO room (we never show who subscribed, but members may be able to infer it). While you use voice or screen sharing, other devices can technically obtain your IP address.
Service providers listed in section 6, only as needed to run the Service.
When the law requires it, or to protect users' safety (for example, evidence of crimes involving minors), we may disclose necessary information to authorities.

We do not sell your personal information and do not "share" it for cross-context behavioral advertising.

6. Third-party services

These services process data under their own privacy policies, which we don't control:

Google Play Billing (Android, when buying membership): Google processes the payment; the Play Billing library itself sends billing diagnostics to Google. Google Privacy Policy
YouTube player (when a host shares a YouTube link): videos load in YouTube's official embedded player, and YouTube may collect viewing data. Governed by the YouTube Terms of Service and the Google Privacy Policy.
Cloudflare STUN server (voice and screen sharing): helps devices find each other and sees your IP address. We also run our own STUN/relay server (on the same US server), which keeps no logs.
Cloudflare: network delivery and security; processes your IP address and request details. Cloudflare Privacy Policy
Oracle Cloud: server hosting (Virginia, USA).
Gmail (Google): only used to email new-report alerts to the developer's mailbox.
Google Fonts, jsDelivr (web version only): load fonts and the video player library; they receive your IP address and browser details.
Video sites you watch: a video link the host enters is served straight from that site to your device, and that site sees your IP address.

7. Retention and deletion

Room content: deleted when the room closes.
Server access logs: 14 days.
Reports: 12 months.
Membership records: 90 days after the membership ends; a device's record is removed after 180 days unused.
On-device data: deleted when you uninstall or clear app data; the web version clears its device identifier when you close the tab.

Deleting your data from our server: in the app, open Settings → Privacy & data → Delete my data on the server. This immediately deletes this device's membership and device records and removes you as the reporter from any reports you filed. If your subscription is still active, membership is registered again the next time you open the app, so cancel in Google Play first if you want it gone for good. You can also email us; we respond within 30 days.

Reported content may be kept for up to 12 months while it's reviewed, to deal with abuse and protect other users.

8. Children

The Service is for a general audience and is not directed to children under 13 (or the higher minimum age set by your local law, such as 16 in some countries). We do not knowingly collect their personal information. Users under 18 need a parent's or guardian's permission. In India, you must be at least 18 to use the Service. There is no public room list; rooms can only be joined with a code or invite link from the host.

If you're a parent or guardian and believe your child used the Service without permission, contact us and we'll delete the relevant data promptly.

9. Your rights

Depending on where you live, you may have the right to:

Access, copy, correct, or delete your personal information. Most data is deleted automatically when a room closes; the rest can be deleted in the app or by emailing us.
Withdraw consent by stopping use of the Service and uninstalling the app. This doesn't affect processing that happened before.
Complain to your local data protection authority.

To exercise your rights, email [email protected]. We respond within 30 days (or sooner where your law requires). Because there are no accounts, we may ask for a room code and time to find your data, or point you to the in-app deletion option.

Information for specific regions

EU / EEA / UK (GDPR, UK GDPR): our legal bases are performance of our contract with you (running rooms, providing membership), legitimate interests (security, handling reports, access logs), and legal obligations. You also have the rights to restrict or object to processing and to data portability, and you may complain to your local data protection authority.
United States (e.g. California CCPA/CPRA and other state laws): you may know, delete, and correct the personal information we collect. We don't sell or share personal information for targeted advertising, and we won't treat you differently for exercising your rights.
Brazil (LGPD): you have the rights to confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about who we share data with, information about the consequences of refusing consent, and withdrawal of consent. You may petition the National Data Protection Authority (ANPD) or consumer protection bodies.
India (DPDP Act 2023): you may access a summary of your data, correct or erase it, nominate another person to exercise your rights, and raise a grievance with us at the email above; if it isn't resolved, you may complain to the Data Protection Board of India. We do not process data of children (under 18) in India — the Service is 18+ there.
Japan (APPI): you may request disclosure, correction, suspension of use, or deletion. See section 10 for the information about the United States we are required to give for transfers abroad.
Thailand (PDPA): you have the rights to access, portability, objection, deletion, restriction and correction, and to complain to the Personal Data Protection Committee (PDPC). See section 10 about the transfer to the United States.
Indonesia (PDP Law No. 27 of 2022): you have the rights to information, access, correction, deletion, to withdraw consent, and to object to automated decisions. We transfer data to the United States as described in section 10.
Canada, including Quebec (PIPEDA, Law 25): you may access and correct your information and withdraw consent. The person in charge of protecting personal information is the developer, reachable at the email above.
Mainland China (PIPL): you have the rights to be informed, to decide, to access and copy, to correct and supplement, to delete, to withdraw consent, and to have our processing rules explained.

10. Where data is stored and international transfers

Our servers are in Virginia, USA (Oracle Cloud), reached through Cloudflare's global network. Wherever you are, your data is transferred to and processed in the United States. The transfer is necessary to provide the Service to you, and for users in places that require it, we ask for your consent before your first use.

About personal data protection in the United States: the United States has no single comprehensive federal privacy law. Protection comes from sector-specific federal laws, the Federal Trade Commission's enforcement against unfair or deceptive practices, and state laws such as California's CCPA/CPRA. This level of protection may differ from, and in some respects be lower than, the protection in your country. To make up for this, we keep the data we transfer to a minimum (section 2), delete room content when rooms close, store passwords and purchase tokens only as hashes, encrypt all traffic, and apply the commitments in this policy to everyone regardless of where they live.

Users in mainland China: using the Service means your nickname, time zone, room content and device identifier are transferred abroad (to the USA). The overseas recipient is the developer named in section 1; purposes and methods are in sections 2 and 4; you can exercise your rights as described in section 9. The app asks for your separate consent to this transfer on first use; if you don't agree, please don't use the Service.

Users in the EU/UK: your data is transferred outside the European Economic Area (to the USA); the transfer is necessary to provide the Service to you.

11. Security

All traffic between the app, website and server uses HTTPS/WSS.
Your device identifier travels only between your device and our server and is never shown to other users.
Room passwords and purchase tokens are stored only as hashes.
Voice and screen sharing use WebRTC's standard DTLS-SRTP encryption.
Only the developer has access to the server.

No system is perfectly secure. If a security incident may affect your personal information, we will notify you and the authorities as applicable law requires.

12. Screen-sharing safety

Only share your screen with people you trust. Rooms are invite-only, but a leaked invite link lets strangers in. Hosts can lock rooms and remove members.
Don't open SMS codes, banking or payment apps, or password managers while sharing.
If someone asks you, for any reason, to turn on screen sharing and then open a banking or payment app, it's almost certainly a scam. Stop sharing and report them.

13. Changes

We may update this policy and change the "Last updated" date at the top. For significant changes, such as new types of data collected, we'll let you know in the app.

14. Languages

This policy is available in several languages. If the versions differ, the English version prevails, except where the law of your country requires the version in your language to apply.

15. Contact

Developer: CadeEmber (individual developer)

Email: [email protected]