Overdraft Privacy Policy
Last updated: 2 October 2026
Overdraft is made by Kitchen Labs. It's a party game where 3 to 6 friends bid on things from their own phones, build a team, and vote on who drafted best. This page says, in plain English, what happens to your information.
The short version
- There are no accounts. You play under a first name (or any name) you type in.
- A game lives in a "room" on our server. A room is deleted about a day after anyone last used it.
- When the vote closes, the teams, pitches and votes are sent to an AI service so a judge can rule on who won.
- A copy of each finished game is kept for 30 days, then deleted. Email us and we'll delete one sooner.
- No ads, no analytics, no tracking.
What we handle, and why
The room. Whoever hosts gets a 4-letter room code. Everyone who joins types a name (up to 12 characters) and picks a colour. While you play, our server (hosted by Supabase) stores the room: the names and colours, the pack being played, every bid, who bought what and for how much, the short pitches you type (up to 280 characters), the votes, and the judge's ruling. Each device also gets a random seat key so it can act for its own player; we store only a scrambled (hashed) copy of it. Game updates are sent to the phones in the room through Supabase's live connection.
When rooms are deleted. A room, with its seats, its move-by-move log and any votes from its share link, is deleted automatically once nobody has used it for 24 hours.
Finished games. When a game ends, we keep one copy of it: the room code, the pack, the names, the teams and prices, the pitches, the votes and the ruling. We use it to see how the game is played and to fix problems. It is deleted automatically 30 days after the game ended. To have a game deleted sooner, email us the room code and roughly when you played.
The AI judge. When the vote closes, our server sends the pack, each player's name, team and prices, the pitches and the votes to a third-party AI service, which writes the judge's ruling. Our AI provider processes this under its API terms: it does not use it to train its models, and it may keep it for up to 30 days for abuse monitoring. If the AI doesn't answer in time, the room's vote decides and nothing more is sent. Please don't put personal details in your name or your pitch.
Share links. The recap page (/recap/<code>) and the "Who won?" page (/vote/<code>) can be opened by anyone who has the link, until the room is deleted. A vote from the "Who won?" page is stored with a random key kept in that browser, so one browser gets one vote.
Server logs. Our host, Vercel, keeps standard request logs (such as the page or address requested, the time, and your IP address) for a short period. Our own error messages there include room codes, never names. Your IP address is also used, in memory only, to slow down anyone sending too many requests.
What stays on your device
Your browser keeps your seat key for each room you join (so a refresh puts you back in your seat), the last name you typed, and your share-link vote key. Clearing your browser's site data removes them.
What we don't do
No advertising, no analytics tools, no cookies for tracking, no selling or sharing of data. We don't ask for your email, phone number, location or contacts.
Children
Overdraft is not directed at children under 13 and does not knowingly collect personal information from them.
Changes and contact
If this policy changes, we'll update the date above. Questions, or to have a game deleted? Get in touch through our contact page.