Privacy Policy

For Last Wit Standing (lastwit.com) · a FNDRY39 game · Last updated October 20, 2026

  1. October 20, 2026

    • A new room is now private — listed only to the people in it — until its host lists it on the home screen, so a host’s name is no longer shown to everyone unless they choose.
    • Results are now kept for 30 days instead of 400.
    • The Privacy Policy now says how we look after what the game keeps (section 7), that something deleted stays in our database’s restore history for up to a day, which decisions the game makes by itself and how to have a person look at one, that you can ask for a copy of what we hold in a machine-readable format, and how to complain to us first.
    • Applied on publication: nothing is taken away from players — the game keeps less, for less time, and shows less to fewer people, and the rest describes what was already true (Terms §13).

  2. October 20, 2026

    • First publication.

Last Wit Standing is a live trivia game you play with a name and a room code. There are no accounts, no email addresses, no ads and no analytics. This page says exactly what the game keeps when you play, why, for how long, and who sees it.

It is run by Ryan Murrell, a sole proprietor in Alberta, Canada, carrying on business under the registered trade name FNDRY39 WEB DESIGN (Alberta trade name registration TN27072784) (“FNDRY39”, “we”). Questions about this policy: privacy@fndry39.com, or by post to Ryan Murrell, FNDRY39 WEB DESIGN, PO Box 117, Sunnybrook, Alberta T0C 2M0.

1. What the game keeps

  • A random player id, in a cookie. On your first visit the server gives your browser a random id (128 random bits) in a cookie called lw_id. It lasts a year, and the page’s own scripts cannot read it (it is HttpOnly). It is how the game tells your browser from everyone else’s and keeps your seat when your connection drops. We never store the id itself: rooms and results are filed under a one-way hash of it, which cannot be turned back into the cookie.
  • The name you give. You type a name at the door: 2 to 16 letters, numbers or spaces, starting with a letter. Four digits in a row are refused, so a phone number cannot be a name, and so are names on our blocked lists. It is kept in a second cookie, lw_name (HttpOnly, a year from when you last gave it), so you do not type it every time. Use a nickname if you would rather not use your real name.
  • What you do in a room. The answers you give (the option you picked, or the words you typed), your secret moves between questions, the proposals you make to your team, your votes, and when your browser was last heard from. A typed answer is one line of at most 60 characters and never holds three digits in a row; the game refuses it otherwise.
  • Results. When a game that two or more people played finishes, one row for each player: the name, the mode, the place, the score and points, how many questions were answered and how many right, the lives left, how the game ended for them (still standing, out, left or voted out) and when it finished — filed under the hash, never the cookie.
  • Question reports. When you report a question (the answer is wrong, the question is unclear, it is out of date, or it is inappropriate), we keep the question, the reason and the time — nothing about who reported it.
  • Your switches, in your browser only. SOUND, MOTION and DARK are saved in your browser’s local storage, under lastwit:settings, and never sent to us.

That is all. The game asks for no account, password, email address, phone number, address, location, contacts, photos or payment details. We do not record your IP address, and our server’s logs never carry a name, a typed answer or what a browser sent — only the kind of request and what went wrong. There is no analytics, no advertising and no tracking, and the page loads nothing from any other website: its fonts and its QR codes are its own.

2. Who sees it

  • Everyone in a room, playing or watching, sees the names of the people in it, and after each question everyone’s answers — what they picked or typed — as the reveal shows them. Your secret moves are secret until the game reveals what they did. Your team sees your proposals.
  • Everyone on the home screen sees the rooms their hosts have listed: the room’s name (from the game’s own list), its mode, how many are playing and watching, and the host’s name. A new room is private — listed only to the people in it — until its host switches PRIVATE off. Anyone with a room’s four-character code can join or watch it, listed or not.
  • Our providers run the game for us and see what it handles in doing so: Vercel hosts the site and runs its server, and Neon runs its database, both in the Washington, D.C. area of the United States. Your connection reaches Vercel’s network at its point nearest you and travels encrypted from there. To deliver each page, Vercel’s systems see the technical details of every request — your IP address, your browser and the address asked for — and keep their own logs of them; the logs we can see are kept for a day.

We do not sell anything we hold, or share it with anyone else, unless the law requires it.

3. Why we keep it

To run the game you asked to play: to know who is answering, decide right answers, lives and winners on the server, keep your seat, show the room who is in it, and stop one browser flooding the server (each player is limited to 400 calls a minute, counted under the hash in the server’s memory for that minute). The results are the game’s record of finished games: we use them to look into a problem someone reports and to count how the modes are played, never to profile a person. Reports are how a wrong question is found and fixed. You give this information by playing; you can stop at any time.

Decisions the game makes by itself. Right or wrong, a life lost, a place, a player out, a winner: the server decides each one automatically, from your answers and the game’s rules, and no person decides them. The reveal after each question shows what was counted and why. You can ask us what a decision was based on and ask a person to look at it: write to privacy@fndry39.com with the room code and your name. A room is deleted five minutes after it goes quiet, so after that we hold only the result (section 1).

For players in the European Union or the United Kingdom: we keep what the game needs to provide the service you ask for, and the results and reports in our legitimate interest in keeping the game fair and its questions right.

4. How long we keep it

  • A room, with everything in it — the names, the answers, the moves — is deleted once nobody in it has been heard from for five minutes. Leaving a room drops you from it straight away.
  • Results are deleted 30 days after the game finished.
  • Question reports are kept until the question has been looked at; they carry nothing about the person who reported it.
  • Our database’s restore history. The database keeps a history of its recent changes so it can be put back after a fault; something deleted stays in that history for up to a day, then it is gone.
  • The cookies last a year (section 1); clearing your browser’s cookies ends them sooner.
  • Your switches stay in your browser until you clear its site data.

5. Your rights

You can ask us what we hold about you, and for a copy of it in a common, machine-readable format; ask us to correct it or delete it; and ask what a decision the game made about you was based on (section 3). Since we do not know who you are, tell us the name you played under, and the room code and the day if you have them, and we will find the matching results. Email privacy@fndry39.com; we answer within 30 days.

If you are unhappy with how we have handled your information or a request, tell us first, at the same address (section 7 says how we deal with a complaint). You can also complain — in Canada to the Office of the Privacy Commissioner of Canada, in Alberta to the Office of the Information and Privacy Commissioner, in Quebec to the Commission d’accès à l’information, in the EU or the UK to your local supervisory authority.

You can also act for yourself: play under any name, change it at the door whenever you are not in a room, and clear your browser’s cookies to become a new player. Results filed under your old id stay unlinked to the new one until they are deleted (section 4).

6. Security

Every connection is encrypted (HTTPS, with HSTS). The cookies are HttpOnly, sent only over HTTPS, and held back from requests other websites make in the background (SameSite), and the server refuses a request your browser says another website made. A strict content security policy lets the page load nothing from anywhere else. Only the game’s server holds the database’s credentials. We keep the hash of your id, never the id. No system is perfectly secure: if a breach ever puts people at real risk of significant harm, we will report it to the regulators as the law requires and, since we have no way to write to players, say so on this site.

7. How we look after it

The rules we work by are written down, and the person in charge of the protection of personal information (section 8) approved them:

  • Keeping and destroying. Each kind of information has its period in section 4, and the game’s own code deletes it when the period ends; nobody has to remember to.
  • Who can reach it. Ryan Murrell alone runs the game and can reach what it keeps, through our providers’ own dashboards. Nobody else is given access to it.
  • Before anything new. Before the game keeps something new, keeps something longer, or sends it to a new provider or a new place, we assess the risk to your privacy first (a privacy impact assessment) and change this policy.
  • Incidents. If information is lost, or reaches someone it was not meant for, we contain it, weigh the risk of serious harm, tell the regulators — and you, on this site — when the law requires, and record every incident in a register we keep for five years.
  • Requests and complaints. Write to privacy@fndry39.com. Within 30 days we answer with what we found and what we did about it, and tell you where to go next if you are not satisfied (section 5).
  • Review. We read these rules again at least once a year, and whenever the game changes what it keeps.

8. Canada, Quebec and elsewhere

We follow Canada’s federal privacy law (PIPEDA), Alberta’s Personal Information Protection Act and, for players in Quebec, the Act respecting the protection of personal information in the private sector (Law 25). The person in charge of the protection of personal information is Ryan Murrell, the sole proprietor of FNDRY39, reachable at privacy@fndry39.com. Nothing in the game locates you or builds a profile of you. What it keeps is processed in the United States by the providers in section 2: we have assessed each one, and each is bound by a written data-processing agreement that holds it to our instructions, to confidentiality and security, and to telling us of a breach. You can ask us about them at the same address. For players in the United States: we do not sell or “share” personal information as state privacy laws use those words.

9. Children

Last Wit Standing is for people aged 14 and over (the Terms of Use say so too). It is not directed at children, and we do not knowingly keep anything from anyone younger. If you believe a child under 14 has played, email us with the name they used and we will delete their results.

10. Changes

We post every change here, with its date at the top of the page and a note of what changed. We have no way to write to you, so a change that would keep more, keep it longer or show it to anyone new applies only to what is kept after it is posted, and where the law needs your consent first, the game will ask before it applies.