Privacy Policy
Last updated 25 September 2026 · Effective 25 September 2026
The short version. Cup Toss is a party game. You do not need an account to play, and we have deliberately built it so that there is almost nothing about you to collect. We do not show ads, we do not use advertising identifiers, we do not use third-party analytics or tracking tools, and we do not sell or share your personal information.
Your phone's motion sensors are read on your device only. When you throw, the app sends a direction and a power value — not the sensor data itself.
About audio. Speaking a chat message never sends us audio — your own device turns it into text and only the text reaches us. Live voice chat is different and we want to be plain about it: while it is switched on, your microphone is carried live to the other households you are playing against. It is never recorded, never stored, and never listened to — it passes through and is gone.
Who we are
Cup Toss is operated by Embra LLC ("we", "us"). This policy covers the Cup Toss website, the TV client, the phone controller in your browser, and the Cup Toss mobile app. If you have a question about anything here, write to support@embrallc.com.
How the game works, because it explains the rest
A TV — usually a laptop plugged into a television — displays the table and the cups. Players join with their phones by scanning a QR code or typing a four-letter room code. The phone is a motion controller: you aim by pointing it and throw by swinging it. A room is the unit everything hangs off. A room holds up to four seats, and a seat belongs to a connected phone rather than to a person — phones get handed around at parties, and whoever is holding one plays.
What we collect
When you play
| What | Why | How long |
|---|---|---|
| A display name you type — up to 14 characters | So the TV can show whose turn it is. It can be anything; it is not verified and does not have to be your real name. | Held while you are connected to a room, and discarded when the room is torn down or goes idle. |
| Room and game state — the room code, which seats are taken, whose turn it is, which cups are standing, the score | It is the game. The server is authoritative so that results are the same on every screen and cannot be faked by a client. | Stored against the room code so a game survives a phone dropping out. Removed when the room is deleted or after a long period of inactivity. |
| A random reconnect identifier stored in your browser or app | So that if your phone locks, loses signal, or goes in your pocket, it gets its own seat back instead of being locked out of the game. It is a random string generated on your device. It is not an advertising identifier, it is not linked to you, and it is not shared with anyone. | Until you clear your browser storage or uninstall the app. |
| Throw and position data — a direction, a power value, and where you are standing relative to the table | To simulate the throw on the server and draw your marker on the TV. | Not stored. It is passed through to the screens in the game and discarded. |
| Technical connection data, including your IP address, browser or device type, and timestamps | Handled by our hosting provider to deliver the game, keep it up, and protect against abuse — the same way any website works. | Kept briefly by our hosting provider for security and reliability. |
Raw sensor data never leaves your device
This is worth stating separately because it is the part people ask about. The phone controller reads your device's motion and orientation sensors continuously while you are aiming. All of that is processed on your device. What reaches our servers is the result: a launch direction, a launch angle and a power value at the moment you release, plus where you are standing. We never receive the underlying accelerometer or gyroscope stream, and we never store it.
What we do not collect
- No account, email address or password is required to play as a guest.
- No advertising identifiers, and no advertising.
- No third-party analytics, tracking pixels, or social media trackers.
- No contacts, calendar, photos, files, or precise geolocation.
- No sale of personal information, and no sharing of it for cross-context behavioural advertising.
Device permissions, and what each one is actually for
We ask for permissions only at the moment they are needed, never all at once when you join.
| Permission | What it is used for |
|---|---|
| Motion & orientation | Required to play. It is how you aim and throw. Processed on your device, as described above. |
| Camera | Two uses, both local to your device. Scanning the QR code shown on the TV to join a room; and, on devices that support it, tracking where you are standing so the TV can show you moving around the table. No image or video from this is recorded, stored, or transmitted anywhere. It is processed on your device and discarded frame by frame. |
| Microphone | Two separate uses, and they ask at different moments on different devices. On your phone, the first time you hold the pad to speak a chat message — your device turns your speech into text and only the text is sent. On the computer driving the TV, the first time somebody switches live voice chat on for that screen. Neither is requested until you do that thing, and voice chat is off until somebody turns it on. |
You can refuse or later revoke any of these in your device settings. Refusing motion access means you cannot throw, which is the game; refusing the camera means you type the room code instead of scanning it, and your position marker is simply not shown.
Talking to the other household
There are two of these and they work completely differently. One sends us text and never audio; the other carries audio and never text. Both are optional and both are off until somebody turns them on.
Speak-to-chat and the chat column
Hold your phone screen, speak, and the words appear as text in a column on the TV. We never receive, record, or store audio for this. The speech-to-text conversion happens through your own browser or operating system, and only the resulting text reaches us.
One thing worth being precise about: depending on your device and browser, that speech-to-text may be performed by your browser or operating system vendor — for example Apple or Google — on their own systems, under their privacy policies rather than ours. That is between you and your device vendor; we are not party to it and the audio never passes through us.
Chat text is transient. It lives in the room you are playing in, the last dozen lines are kept so that a TV joining or reconnecting can show what was just said, and all of it is gone for good when the room ends. There is no chat history in this product, and nothing you say in the column is written to any database or associated with you.
Live voice chat
Optional, off by default, and switched on from the computer driving the TV rather than from a phone — one microphone per household, not one per player. While it is on, everyone in that room shares that one microphone, and it is carried live to the other households in the game so you can talk to each other.
- This is the one feature that carries audio off your device. We are saying so plainly rather than burying it: while voice chat is on, your microphone is forwarded, live, to the other households playing with you.
- It is live only. We do not record it, store it, transcribe it, listen to it, or retain it after the call. It is forwarded and gone.
- The forwarding is done by our infrastructure provider's real-time media service, which relays the audio between households and does not retain it.
- It exists only when there is a second screen in the game. Two people watching one TV are in the same room already, so no microphone is offered and none is requested.
- You can mute your own microphone at any time and still hear everyone else — from the TV, or from your own phone.
- Whose microphone is live, and whose is muted, is shown on every TV in the game, so anyone in the room can tell from across it.
- The person whose room it is can mute a whole household. That is enforced by our server, not by asking the muted device nicely.
Features that are planned but not yet available
We are disclosing these now rather than when they ship, so that this policy does not change under you. None of them collect anything today. When any of them becomes available, it will be optional and will ask for the relevant permission at the moment you first use it.
Video party mode Not yet available
Planned as an optional add-on for online play: one camera per household, showing the room, streamed live to the other household you are playing against, so it feels like you are in the same place. Deliberately not one camera per player.
- It will exist only in online play against a remote household. A game where everyone is in the same room has no one to stream to, so no stream is created.
- It will be live only. We will not record it, store it, or retain it after the call ends.
- Whether your camera and microphone are on will be visible and unambiguous on screen, so anyone in the room can tell from across it.
- The live stream will be carried by our infrastructure provider in order to reach the other household, and is not retained.
Buying online play Not yet available
Online play will be unlocked by a one-time purchase. There is still no account and no password, and guests invited into an online game still need nothing at all. If you buy:
- Stripe handles the payment. You type your email address and card details on Stripe's page, not ours, and your card details never reach us. Stripe keeps a customer record with your email address; that is how we confirm your purchase and how we can help you get your pass back.
- We keep no database of buyers. The only things we record about your purchase are written onto that Stripe customer record: a count of how many times your pass has been issued, and a note if the purchase is refunded or disputed.
- Your pass is kept on your phone — in a cookie our site sets in your browser, which scripts on web pages cannot read, or in your phone's secure storage if you use the app. It holds a reference to your Stripe customer record and a signature that proves we issued it; it does not hold your email address or anything else about you. When your phone joins an online game, the pass is sent to our server to be checked.
- If you lose your pass, you can ask for it by entering your email address. We look up your purchase at Stripe using that address and, if there is one, email a link to it. That message is sent by Resend, our email delivery provider. We send nothing else to that address — no newsletters, no marketing — and Stripe sends the receipt for the purchase itself.
Who else is involved
We keep this list as short as we can. We do not sell data to anyone, and none of these providers is permitted to use your information for their own purposes.
| Provider | What they do |
|---|---|
| Cloudflare | Hosts the game and runs the game rooms. Processes connection data, including IP addresses, to deliver the service and protect it from abuse. When live voice chat is switched on, their real-time media service also relays that audio between households — live, and not retained. |
| Google Fonts | Serves the typefaces the pages are set in. Loading a font involves a request to Google from your browser. |
| Expo | Delivers updates to the mobile app. Receives app and device version information in order to send the correct update. |
| Apple App Store / Google Play | Distribute the mobile app and handle any purchases made through them, under their own terms and privacy policies. |
| Resend Not yet available | Delivers the one kind of email we send: the link that puts your online pass on a phone, when you buy it or ask for it back. Receives your email address and that message only. |
| Stripe Not yet available | Will process the one-time purchase that unlocks online play. Holds your email address and payment details, and the customer record described above, under its own privacy policy. Card details go to Stripe and not to us. |
We may also disclose information if we are legally required to, or where it is necessary to protect the rights or safety of our users or of Cup Toss.
How long we keep things
Room and game state lives as long as the room does, so that a game survives someone's phone dropping out and can be rejoined. Rooms are removed when they are deliberately closed or after a long period of inactivity. Live gameplay data — your aim, your throw, your position — is passed through and not stored at all. The reconnect identifier lives on your own device and is yours to clear. If you buy online play, your purchase record is kept by Stripe for as long as your purchase is in use and as financial record-keeping law requires; your pass lives on your phone until you clear your browser's data for Cup Toss or uninstall the app.
Your choices and your rights
Because guests have no account, most of what you might want to do you can do yourself and immediately:
- Leave. Tapping "Leave Table", closing the controller, or closing the room ends your part in it.
- Clear the reconnect identifier by clearing your browser's site data for Cup Toss, or by uninstalling the app.
- Revoke permissions at any time in your device settings.
Depending on where you live — including in the European Economic Area, the United Kingdom, and several US states such as California — you may have rights to access, correct, delete, or obtain a copy of personal information we hold about you, to object to or restrict certain processing, and not to be discriminated against for exercising those rights. Write to support@embrallc.com and we will respond within the period the applicable law requires. We may need to ask you for enough information to locate what you are asking about — which, for a guest who never gave us an account, may be very little.
Where we rely on consent — for example, camera or microphone access — you can withdraw it at any time by revoking the permission. Otherwise we process the small amount of data described above because it is necessary to provide a game you asked to play, and for our legitimate interest in keeping it running and free of abuse.
Children
Cup Toss is a party game anyone can play. Guests need no account and we store nothing about them, but we do not knowingly collect personal information from children under 13, and accounts (when they exist) are not offered to them. If you believe a child has provided us with information, write to support@embrallc.com and we will delete it.
Security
Connections between your devices and our servers are encrypted in transit. Room codes are generated using a cryptographically secure random source, so they cannot be guessed or enumerated, and a room is limited to four seats regardless of how many people have the code. The strongest protection, though, is structural: there is very little to steal, because we have gone out of our way not to collect it. No system is perfectly secure, and we cannot guarantee absolute security.
Where data is processed
Our providers operate globally, and information may be processed in countries other than the one you live in, including the United States. Where required, we rely on appropriate safeguards for those transfers.
Changes to this policy
If we change this policy we will update the date at the top, and for anything significant we will make it clear in the app or on this site before the change takes effect. Features listed above as not yet available are already described here precisely so that turning them on is not a surprise.
Contact
Embra LLC — support@embrallc.com