Privacy policy

Bash (bash.games) runs party games built from real photos and recordings of real people. This policy says what we collect, what we do with it, which companies process it for us, how long we keep it, and how to get it deleted. Our media consent policy covers photos and recordings in plain language; this page is the complete picture.

Who we are

WorldWurks LLC, operating Bash at bash.games. Questions and requests: support@bash.games.

What we collect

• Organizer account. First and last name, email address, phone number if you give one, and a password held for us by Google Firebase Authentication. We record when you accepted these terms and whether you agreed to text messages.
• Purchases. Payment is handled by Stripe. We receive and keep the buyer's name, email and phone, the amount paid, any discount code used, and Stripe's checkout reference. Card numbers never reach us.
• Party setup. The party name, the couple's first and last names, the event date, and the questions the organizer chooses.
• Player profiles. First and last name, an optional email address, whether the player is a woman or a man (used to decide how the games portray them), and a photo, uploaded either by the player from their phone or by the organizer on their behalf.
• The groom's recordings. Video answers recorded through his private link, the written transcript we make of them, and the multiple-choice answers generated from that transcript.
• Media we generate. Transformed portraits, still images, short video clips, a group photo, and the phone videos delivered after a game. These are made from the photos above and are treated as the same person's data.
• Game play. Which games a party played, when, who took part, scores, and votes.
• Technical records. Server logs, timing and error records for each generation step, and the operations records our team uses to keep the service running.
• Website visits. On our public pages (not inside a bash), Google Analytics records pages viewed, how you arrived, and device and approximate location, using a first-party cookie. We use it only to understand our own traffic, with Google's advertising features turned off. When you create an account or buy a bash, we tell Google Analytics that it happened, linked to that cookie, without your name, email or payment details. You can block it with your browser's settings or Google's opt-out add-on.

How we use it

• To run the games on your TV and phones and to create the media the games are built from.
• To send the emails and, with separate consent, the text messages needed to set up and run your party: account confirmation, purchase receipts, the groom's recording invitation, reminders about your event.
• To take payment and keep the accounting records the law requires.
• To support you, fix problems, and protect the service from abuse.
• To understand how the product is used, in aggregate, so we can improve it.

Automated processing of photos, voices and video

The games depend on automated image, voice and video generation, often described as artificial intelligence. When a photo, name or recording is added, some or all of the following happen:

• Each uploaded photo is checked automatically for a single clear face and for content that is not allowed. This step detects the presence and position of a face to judge the photo; it does not build a facial template to identify anyone.
• A player's photo is transformed into a portrait of an imagined person of the other gender for the game's fiction, and that portrait is placed into scenes and short video clips. A man's own photo is used as is.
• First names are spoken by a synthetic voice.
• The groom's recordings are transcribed and the transcript is used to write answer choices.

Generated media is fictional by design and is never presented as a real likeness. It is shown only inside your party and delivered to the people in it.

Who processes data for us

These companies process data on our behalf, only for the purposes above, and only receive what their task needs. We do not sell your data to anyone.

• Google Cloud and Firebase: hosting, sign-in, database and file storage, and the automated photo check (Cloud Vision).
• OpenAI: portrait transformation, scene images, transcription of the groom's recordings, and short generated text.
• fal.ai: generation of short video clips from still images.
• ElevenLabs: synthetic speech for names and narration.
• Stripe: payments.
• GoHighLevel (LeadConnector): delivery of our emails and text messages and our customer records.
• Google Analytics: measuring visits to our public website, and counting sign-ups and purchases (no names, emails or payment details).
• Vercel: hosting of our internal operations console. No customer data is stored there.

Who can see party content

• The people in your party: on the TV during the games, and on the phones of players who joined. Each player also receives their own generated videos.
• Our team, through an access-controlled operations console, to run the service and help you.
• The processors above, as described.
• Nobody else. Party content is never public, never used in our marketing without separate written permission from each person shown, and never sold.

How long we keep it

• Party content, including generated media, is kept for the party's access window (6 months from purchase, plus any extension) and deleted within 30 days after the window ends.
• An organizer can delete a player, which removes that player's photos and generated media, or delete the whole party, at any time from Settings.
• Any participant can ask us to remove their photos and media at any time at support@bash.games, and we do so within 30 days.
• Account details are kept while the account exists. Purchase and accounting records are kept for 7 years as required by tax law.
• Technical and operations records are kept for up to 12 months.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct it, ask us to delete it, or object to a use of it, by emailing support@bash.games. We respond within 30 days and may ask you to confirm who you are. If you live in a state with its own privacy law, such as California, Colorado, Connecticut, Utah or Virginia, those laws give you these rights and more; we do not sell personal information or share it for cross-context behavioral advertising, and we honor opt-out requests. Illinois, Texas and Washington residents: see the note on facial data in our media consent policy.

Age

Bash is for adults. Organizers must be 18 or older, and the games are not intended for anyone under 18. We do not knowingly collect information from children; if you believe a child's data has reached us, email us and we will delete it.

Security

Data is encrypted in transit and at rest on Google Cloud. A party's files and records can be read only by the people who have joined that party and by our team through an audited console. Payment details are handled entirely by Stripe.

Changes

When this policy changes in a way that matters, we update the date above and email organizers with active parties before the change takes effect.

Draft for legal review before public launch. The facts above match how the service works as of the date shown.