Last updated: 2026-07-17
Framed is a local-area game you play with people you already know, over a fixed session (a "game"). This page explains what the app collects while you play, why, and when it's deleted. It applies to everyone who joins a game, host or not.
| Data | Encrypted before it reaches us? | Kept until |
|---|---|---|
| Display name | Yes | Game ends, or 24h, whichever first |
| Reference selfie | Yes | Game ends, or 24h, whichever first |
| Frame photos (the pictures you take of your target) | Yes | Game ends, or 24h, whichever first |
| Dead-chat messages | Yes | Game ends, or 24h, whichever first |
| Live GPS location | No — only last-known position is stored, never a movement history | Game ends, or 24h, whichever first |
| Push notification token | No | Game ends, or 24h, whichever first |
"Encrypted before it reaches us" means client-side end-to-end encryption: the game key is generated on the host's phone and shared with other players only through the join QR code or link, never sent to our server. We physically cannot read your name, selfie, frame photos, or dead-chat messages — we only ever store and relay opaque ciphertext for those. Location is the one exception: our server reads it in plain text because the game itself depends on it (see "Why we need your location" below).
A lobby that never starts a game expires sooner than 24 hours: the whole lobby is deleted after an hour of nobody in it being active, and an individual player who's gone quiet is dropped from an otherwise-active lobby after 15 minutes.
The server uses your GPS position, in plain text, to:
Only your most recent position is ever stored. There is no location history, no movement trail — each new update overwrites the last.
Consent. This page, and the shorter notice on the screen where you join, tell you what's collected and for how long before you join. Nothing leaves your phone until you do: your name and selfie sit on your own device while you fill the screen in, and joining is the consent action. You can withdraw it at any time by leaving — see "Your rights" below for what that does and doesn't reach mid-game.
Leaving a lobby before the game starts deletes your data immediately. Leaving mid-game isn't possible the same way — going silent marks you MIA, and everything is wiped when the game ends (24 hours at the latest either way). That's the right to erasure, automated rather than requested.
Framed is meant for players aged 16 and over. If you're inviting a group that includes anyone younger, get a parent or guardian's permission before they join — the consent flow above (joining is the consent action) doesn't include an age check or a parental-consent step of its own.
Names, selfies, frame photos, and dead-chat are end-to-end encrypted, so we never hold anything about you in a form we can read, correct, or export on your behalf for those fields — the app on your own device is the only place that ciphertext becomes readable, and only for as long as the game key (shared solely via the join QR code) still exists on a device. For the two fields we do hold in plain text — your last-known location and your push notification token — you have the rights below:
To exercise any of these, use the contact point at the bottom of this page.
Framed runs on a self-hosted Supabase instance on DigitalOcean, in their Amsterdam datacenter. While it's on our server, your data doesn't leave the EU, and there's no third-party data processor involved beyond that hosting provider. Thanks to end-to-end encryption, even the hosting provider only ever holds unreadable ciphertext for the fields listed as encrypted above. The one exception to "doesn't leave the EU" is the push notification token, covered next.
Push notifications (via Apple's APNs or Google's FCM) carry no readable content — only a bare wake-up signal (which kind of game event happened, and which game). The app decrypts and renders the actual notification text on your device, using the game key it already has. Apple and Google never see your name, a photo, or any other content through their push services.
Delivering that wake-up signal does mean your device's push token reaches Apple's or Google's own servers, which — unlike our hosting — aren't confined to the EU. Both are certified under the EU-US Data Privacy Framework, the adequacy mechanism that permits this transfer without a separate agreement.
No accounts, no ads, no third-party analytics or crash reporting of any kind. We don't know who you are beyond the display name you pick for a single game, and we don't want to.
Frame photos might catch people who aren't playing. Photograph your target, not crowds. Frame photos are deleted within 24 hours at the latest, same as everything else.
One anonymous row per finished game, with nothing that can be traced back to a player, a name, or a location:
create table aggregate_stats (
finished_on date not null,
player_count integer not null,
duration_minutes integer not null,
autocleaned boolean not null
);That's it — when a game happened, how many people played, how long it lasted, and whether it was cleaned up automatically versus properly finished. No IDs, no names, no locations. Used only to see, in aggregate, whether the game gets played.
Framed is a hobby project, built and operated by Roboroads (KVK 86738852). For questions about this policy, your data, or to exercise any of the rights above, email framed@deschepers.nl, or open an issue on the GitHub repository if it doesn't involve personal details.