Privacy Policy
Sumbo is built to need as little of your data as possible. No accounts, no profiles, no advertising trackers. This page sets out what is collected, why, how long it stays, and your rights. Last updated 27 May 2026.
Back to Sumbo →What we collect
A player name. You pick a display name when you join a match. It lives only in the memory of that match and disappears when the match ends. It is never linked to anything else about you.
Gameplay events. While a match is in progress, the server records the events needed to run the game (rooms created, players joined, answers locked in) so it can score the match and reveal results. These events are tied to the room code and the player name you chose, not to a personal identifier.
Server-side analytics. Sumbo uses PostHog (in EU region, cookieless mode) to record aggregate metrics — how many matches a day, which packs are popular, how players move through the funnel. No cookies are set on your device for this. PostHog assigns a short-lived identifier from a hash of request properties, used only to deduplicate visits.
Diagnostic logs. The server keeps short-term logs of HTTP requests, errors and SignalR events for debugging. These include IP addresses, user-agent strings, and request paths, and are retained for 90 days before deletion.
What we don't collect
No accounts, no email addresses, no phone numbers, no passwords. None of those are ever asked for.
No third-party advertising trackers, no Google Analytics, no Facebook Pixel, no cross-site tracking.
No precise location data — only the coarse country-level data inferable from an IP address, which we don't store separately from server logs.
No microphone, camera or geolocation access — Sumbo doesn't request any of these permissions.
Cookies
Sumbo doesn't set any cookies on your device. Local storage is used to remember a few preferences (e.g. the last room code you used) — this stays on your device and never leaves it. PostHog runs in cookieless mode and also does not set cookies.
Your rights
Under the UK GDPR and the EU GDPR you have the right to access, correct or delete personal data we hold about you. Because Sumbo doesn't hold personal data tied to identifiable individuals (no accounts), most of these requests have nothing to act on — but you can contact us at the email below and we'll respond within 30 days.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority in the EU.
Children
Sumbo is intended for adult players. It is not designed or marketed for children under 13, and we don't knowingly collect data from anyone in that age group. If you believe a child has used the service and you would like any associated data removed, contact us at the email below.
Updates to this policy
If we change what we collect or how we use it, we'll update this page and bump the "last updated" date at the top. Material changes will also be announced on the homepage. Contact: hello@sumbo.io.
Frequently asked questions
Are there ads on Sumbo?
Not today. If that ever changes, we'll update this policy first.
Where is data stored?
Game state runs on a server in the EU. PostHog analytics are also held in the EU region.
How do I request data deletion?
Email hello@sumbo.io. Because we don't hold personal data tied to you, the usual answer is "there is nothing to delete," but we'll confirm in writing.