Kurulfun Privacy Policy
Last updated: October 17, 2026
Effective: October 17, 2026
1. Who we are
Kurulfun ("Kurulfun", "we", "us") is a browser party game where one player draws and the others guess. It is run by Gizzat Tazabekov, an individual based in Odessa, Florida, United States. Contact: hello@kurulfun.com.
2. The short version
- Guests can play without an account. We don't ask guests for their name, email or phone.
- Hosts sign in with Google so they can create rooms.
- Your drawings and chat are sent live to the other players in your room so the game works, and they're gone when the room ends.
- We use analytics (PostHog) and error monitoring to see what's working and fix bugs.
- We don't sell your personal data, and we don't show ads.
3. What we collect and why
| Data | Whose | Why | Where it goes |
|---|---|---|---|
| Google account basics: name, email address, profile picture, Google account ID (basic profile + email scopes) | Hosts, and anyone who chooses to sign in | To sign you in, let you create rooms, and show your name to your room | Our sign-in system (Auth.js) and database (Neon Postgres, United States) |
| Nickname you type in | All players | To show who's drawing and guessing | Room server (Cloudflare) while the room is active; not saved in our database |
| Drawings (stroke points, color, width) and chat/guess messages (up to 500 characters) | All players | To play: they are relayed live to everyone in the room, including spectators | Room server memory only while the room is active; deleted when the room ends |
| Room details: room code, settings, scores | All players | To run the game | Room server memory while the room is active; we don't keep game history after the room ends |
| Random session ID created by your browser | All players | To tell players apart in a room | Room server memory while connected |
| Usage events: e.g. room created, invite shared or opened, guest joined, game started, round completed, play again, each with language, device type, environment and campaign (UTM) tags | All visitors | To understand and improve the game | PostHog (US Cloud) |
| Error reports: technical details when something breaks | All visitors | To find and fix bugs | Sentry (United States) |
| Technical logs: IP address, browser and device info, request times | All visitors | To run, secure and debug the service | Vercel (hosting), Cloudflare (room server) |
| Feedback you send us | Anyone who writes in | To answer you and improve Kurulfun | Our email inbox |
We never send your chat, drawings or nickname to analytics.
4. Information from Google
When you sign in with Google, we receive only your basic profile (name, profile picture), email address and Google account ID. We use it only to sign you in and show your name in rooms. We don't use it for ads, and we don't sell it or share it except with the service providers listed below. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
5. What other players can see
Anyone in your room, and spectators if the host turns spectators on, can see your nickname, your drawings, your chat and guesses, and your score. Room invite links can be forwarded, so only share them with people you'd like to play with. Link previews of invite links show fixed text only, never your name.
6. Cookies and similar technologies
If you sign in, we use a sign-in session cookie, which is strictly necessary to keep you signed in. Our analytics run in memory only: PostHog does not set cookies or save identifiers in your browser's storage, so no analytics cookies are used and we don't need a cookie banner for them. If we ever add analytics cookies, we'll ask visitors in the EU/UK (and anywhere else the law requires) for consent first. You can clear cookies and site storage in your browser settings at any time.
7. Service providers
We share data only with providers who help us run Kurulfun, under their own terms:
- Vercel Inc.: website hosting (United States)
- Cloudflare, Inc.: realtime room servers (global network)
- Google LLC: sign-in
- Neon: database (United States)
- PostHog: analytics (US Cloud)
- Functional Software, Inc. (Sentry): error reports (United States)
- Our email provider (Google LLC, Gmail): our contact inbox. Mail to hello@kurulfun.com is forwarded there.
- ImprovMX: email forwarding for hello@kurulfun.com
We may also disclose data if the law requires it, or to protect players and the service.
8. Where your data is stored
We store data in the United States through Vercel, Neon, PostHog (US Cloud) and Sentry. Live room traffic runs on Cloudflare's global network, so it may be handled in a data center near you while you play. If you use Kurulfun from outside the United States, including Kazakhstan, Russia, the EU or the UK, your data will be transferred to and processed in the United States.
9. How long we keep it
- Drawings, chat and live room state: only while the room is active. They're deleted when the room ends.
- Account data: until you delete your account or ask us to, plus up to 30 days in backups.
- Analytics events: 12 months.
- Error reports and server logs: 30 days.
- Feedback emails: 12 months after our last reply.
10. Your choices and rights
You can play as a guest without an account. Signed-in users can ask us to access, correct, export or delete their data by writing to hello@kurulfun.com. Depending on where you live (for example, in the EU/UK, Kazakhstan or Russia), you may have more rights, such as objecting to processing, withdrawing consent, or complaining to your data-protection authority. We'll respond within 30 days.
11. Children
Kurulfun is not intended for children under 13. In places where the law sets a higher age to agree to data processing (for example, 16 in some EU countries), you need a parent's or guardian's permission until you reach that age. To sign in and host a room, you must be at least 13, and if you're under that local age, you must have a parent's or guardian's permission. If you believe a child gave us personal data, contact us and we'll delete it. Chat is not filtered at launch, so younger players should play with people they know.
12. Security
We use HTTPS for all traffic and keep access to our systems limited. No online service is perfectly secure, but we work to protect your data.
13. Changes
If we update this policy, we'll change the "Last updated" date and, for important changes, let signed-in users know by email.
14. Languages
This policy is available in English, Russian and Kazakh. If a translated version (Russian, Kazakh) differs from the English version, the English version governs.
15. Contact
hello@kurulfun.com · Gizzat Tazabekov, Odessa, Florida, United States (full postal address available on request)