Privacy Policy

This Privacy Policy explains what information NextPlay (“we”, “us”, or “our”) collects when you use the NextPlay website at nextplay.now and the NextPlay app for Android and iOS, how we use it, who we share it with, how long we keep it, and the choices and rights you have. It applies to everyone who plays, whether you sign in or play as a guest.

NextPlay is operated by POLLSPORT LIMITED, a company registered in New Zealand (company number 9386286). POLLSPORT LIMITED is the controller of your personal information, which means we decide how and why it is used.

You can contact us about anything in this policy at founders@pollsport.com.

We collect the following information:

• Nickname: the name you play under. Other players see it on leaderboards, in chat, and in clubs. Nicknames are unique, so no two players can use the same one.
• Account details (if you sign in): your email address. If you sign in with Google, we also receive your name, profile picture, and Google account ID from Google, and we store the sign-in tokens Google gives us.
• Game activity: the sessions you join, your answers and predictions, the points and streaks you earn, and when you answered.
• Chat messages: the messages you send in a session's chat, with your nickname and the time you sent them.
• Reports and blocks: when you report a chat message, we keep the message, the sender's nickname, your nickname, and when you reported it, so an admin can review it. The players you block are saved on your device, and also to your account if you are signed in.
• Clubs: the clubs you create or join, including club names, which other players can see, and your role in each club.
• Prize email (optional): an email address you choose to enter when a session offers a prize. The game works fully without it.
• Device identifier: a random ID (nextplay_device_id) that the website or app creates the first time you play. It is not an advertising ID and does not identify you outside NextPlay.
• Technical data: when you sign in, we record the IP address and browser or device type of that sign-in. Our servers also keep short-term logs of requests (such as the page or feature requested and when), which can include your nickname or device identifier.
• Usage data: how you use NextPlay, collected through PostHog (see “Cookies, Local Storage, and Analytics”). On the website, this includes the pages you visit and the game actions you take. On the website and in the app, our servers also record when you join a session and when you submit an answer.

The Android and iOS app collects the same information as the website, with these differences:

• Device identifier: the app creates a random ID (nextplay_device_id) when it is first opened and keeps it in the app's storage on your device. The app sends it with every request to our servers and every live game connection. We use it to reconnect you to a session you already joined and to show your “Rejoin” list.
• Sign-in session: if you sign in, the app keeps your sign-in session, and a copy of your account's name, email address, and profile picture, in your device's secure storage (the Android Keystore or the iOS Keychain).
• Settings on your device: your language, vibration setting, and current game (nickname, session, and score) are stored only on your device.
• No analytics tools in the app: the app itself contains no analytics, advertising, or crash-reporting tools. Our servers still record the game activity described under “Usage data” when you play in the app.
• No device permissions: the app does not access your location, contacts, camera, photos, or microphone, and does not send push notifications.

Uninstalling the app deletes everything it stored on your device. It does not delete your account; see “Deleting Your Account” for that.

We use your information to:

• Run live game sessions, score your answers, and show leaderboards
• Let you sign in and keep your record, stats, and clubs across devices
• Reconnect you to a session after a refresh or a lost connection
• Show your chat messages to the other players in a session, and moderate chat
• Contact you about a prize or event result, if you entered a prize email
• Send you a sign-in code, if you sign in with email
• Understand how the website is used, so we can fix problems and improve it
• Keep NextPlay secure, and detect and prevent cheating, abuse, and fraud
• Meet our legal obligations

We do not sell your information, and we do not use it for advertising.

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on these legal bases:

• Contract: to provide the game and your account, including sessions, scoring, leaderboards, chat, clubs, sign-in, and the device identifier that reconnects you.
• Legitimate interests: to keep NextPlay secure, prevent cheating and abuse, keep server logs, and understand how the website is used so we can improve it. We have balanced these interests against your rights, and you can object to them (see “Your Rights”).
• Consent: to collect a prize email, and to load YouTube when you choose to watch a stream. You can withdraw consent at any time; this does not affect what we did before you withdrew it.
• Legal obligation: where the law requires us to keep or disclose information.

We do not sell, trade, or rent your personal information. It is shared only as follows:

• Other players: your nickname, scores, and rank appear on leaderboards; your chat messages appear with your nickname in the session's chat; and your club membership and the names of clubs you create are visible to other players.
• Event organizers: the people running a session can see its players' nicknames, answers, scores, and chat, and any prize emails entered in it.
• Service providers: companies that run parts of NextPlay for us (see “Service Providers”).
• Legal requirements: when the law requires it, or to protect the rights and safety of NextPlay, our players, or others.

These companies process personal information on our behalf, only to provide their service to us:

• Supabase: hosts our database.
• Render: hosts our website and game servers.
• Cloudflare: runs session chat and stores our encrypted database backups.
• GitHub: runs the automated job that makes our encrypted database backups.
• PostHog: usage analytics for the website, game activity our servers record from the website and the app, and error reports from our servers.
• Resend: sends sign-in code emails.
• Google: provides “Sign in with Google”, profile pictures, and embedded YouTube streams.

We are based in New Zealand, and our service providers process information in other countries, including the United States. When we transfer personal information out of the European Economic Area, the UK, or New Zealand, we rely on an adequacy decision or on safeguards such as the European Commission's Standard Contractual Clauses, as provided in our service providers' data processing terms.

Some sessions show a live YouTube stream on the website and in the app. The stream loads only after you choose to watch it. Once it loads, YouTube (a Google service) receives your IP address and device information, may set cookies or similar identifiers, and handles that data under Google's Privacy Policy (policies.google.com/privacy). We do not control what YouTube collects. If you do not want to share this data with YouTube, do not start a stream.

We keep your information only as long as we need it:

• Account, nickname, chat, clubs, and usage data: until you delete your account. Guest information is kept until you ask us to delete it.
• Game activity: your answers and scores stay part of each session's results. When you delete your account, they are kept without your name, labeled “Deleted player”.
• Prize emails: until you delete your account or ask us to delete them.
• Sign-in codes and sessions: sign-in codes expire after 10 minutes, and you are signed out after 30 days without using NextPlay.
• Device identifier: on the website, the cookie that holds it expires after one year; in the app, it stays until you uninstall the app.
• Backups: encrypted database backups are deleted automatically, at the latest 14 months after they are made.
• Server logs: kept by our hosting providers for a limited period and then deleted.

The website sets only first-party cookies that it needs to work: one that holds your device identifier, one that remembers your language, and, if you sign in, the cookies that keep you signed in. We use no advertising cookies.

The website also uses your browser's local storage to keep your current game (nickname, session, and score) through a refresh, and to remember settings such as sound. You can clear this in your browser's settings; doing so signs you out and removes you from any active session.

We use PostHog to understand how NextPlay is used. On the website it runs in cookieless mode, so it stores nothing on your device. When you join a session, on the website or in the app, our servers send PostHog your nickname and player ID, and then record the sessions you join and the answers you submit. The app itself contains no PostHog code.

Embedded YouTube streams can set their own cookies once you start one (see “Embedded YouTube Streams”).

We protect your information with encrypted connections (HTTPS and secure WebSockets), access controls on our systems, secure storage for your sign-in session in the app, and encrypted backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

NextPlay is not directed at children under 13, and we do not knowingly collect personal information from them. If you are under the age at which you can agree to the use of your personal information in your country (16 in some EU countries), you need a parent or guardian's permission to use NextPlay. If you believe a child has given us personal information, contact us at founders@pollsport.com and we will delete it.

Depending on where you live, including under the GDPR and New Zealand's Privacy Act 2020, you have the right to:

• Access the personal information we hold about you and get a copy of it
• Correct information that is inaccurate
• Delete your information
• Object to, or ask us to restrict, how we use your information
• Receive your information in a portable format
• Withdraw consent you have given, at any time

To use any of these rights, email founders@pollsport.com. We reply within one month. You can change your nickname in your account at any time.

You can also complain to a data protection authority, such as the authority in your EU country, the UK Information Commissioner's Office, or the New Zealand Office of the Privacy Commissioner.

You can delete your account at any time from the Account page on the website or the Account tab in the app, or at nextplay.now/account/delete, which also explains exactly what is deleted and what is kept.

Deleting your account permanently deletes your account, email address, sign-in details, chat messages, usage analytics, prize emails, club memberships, and device records, and signs you out everywhere. Your past answers and scores stay on old leaderboards as “Deleted player”. Copies in encrypted backups are deleted when those backups expire.

If you played as a guest, email founders@pollsport.com with your nickname, and we will delete your information.

We may update this Privacy Policy. When we do, we post the new version on this page and change the “Last Updated” date. If a change is significant, we also tell you on the website or in the app before it takes effect.

For questions about this Privacy Policy or your information, email founders@pollsport.com, or write to POLLSPORT LIMITED, Auckland, New Zealand.