Privacy Policy

How Protocol15 handles facilitator accounts, hosted sessions, participants, analytics, and product operations.

This Privacy Policy explains how Protocol15 collects, uses, shares, protects, and retains information when facilitators, hosts, participants, visitors, and account contacts use the website, hosted game sessions, account features, and related services.

Protocol 15 is built for hosted group activities. Hosts create sessions and players usually join by link or code without creating accounts. Please do not enter sensitive personal information into nicknames, team names, support messages, or session content.

Information we collect

Host account information, including email address, authentication provider details, profile fields, login metadata, and subscription or usage status.
Player participation information, including nickname, team assignment, join time, connection state, player session token, and session participation records.
Gameplay information, including scenario selection, team rankings, locks, scores, result views, certificates, and facilitator-owned session data.
Support, billing-interest, and contact information you choose to send, including email address and message content.
Device, usage, log, and analytics information, including pages viewed, browser type, approximate location derived from IP address, timestamps, referral data, diagnostics, and security events.
Payment and billing information if paid checkout is enabled. Card details are handled by the payment provider; Protocol 15 should not store full card numbers.

How we use information

Provide, secure, and operate hosted game sessions, player join flows, host dashboards, scoring, results, certificates, and account features.
Authenticate hosts, preserve intended redirects, enforce host plan limits, prevent abuse, and troubleshoot live-session reliability issues.
Respond to support requests, billing-interest forms, security reports, account questions, and legal requests.
Measure product usage, improve usability and performance, detect errors, and understand which public pages and workflows are working.
Maintain records needed for billing, tax, compliance, dispute handling, fraud prevention, and enforcement of the Terms of Service.

Legal bases for processing

Where privacy law requires a legal basis, Protocol 15 processes information to perform a contract with hosts, based on legitimate interests in operating and improving the service, with consent where required for optional analytics or communications, and to comply with legal obligations.

Cookies, local storage, and analytics

Protocol15 uses essential cookies, local storage, session storage, and similar technologies to operate the service, including authentication, security, redirect recovery, language preferences, player session continuity, and live-session functionality.

Protocol15 also uses limited product analytics to understand usage, improve onboarding and facilitator flows, identify drop-offs, and troubleshoot product friction. These analytics are intended for product improvement, not ad targeting, retargeting, or behavioral profiling.

The cookie notice can be dismissed with the Continue button or close button. Blocking essential browser storage can break host login, player join, or live game behavior.

Tools currently used or wired for use include:

Supabase, for authentication, session management, database, and realtime product functionality.
Google Analytics, if enabled and consented to, for usage analytics.

How information is shared

With service providers that help run the product, such as hosting, database, authentication, analytics, email, error monitoring, and payment providers.
Within a live session, where hosts and participants may see nicknames, team names, team progress, submitted rankings, scores, and published results.
With professional advisers, authorities, or other parties when needed for legal compliance, safety, fraud prevention, security, or enforcement.
In connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate protections for personal information.

No sale of personal information

Protocol 15 does not sell personal information. Protocol 15 also does not use player gameplay data to create formal psychological, employment, credit, health, or educational assessments.

Retention

Host account records are kept while the account is active and for a reasonable period afterward for security, billing, legal, and backup purposes.
Session, player, result, and certificate records may be kept so hosts can run, review, and support sessions, unless deleted under applicable policy or law.
Solution Trajectory data, when retained for paid host plans, is limited to sampled team score points and follows the plan-based retention period shown in the product. Free sessions may keep only browser-local trajectory data for the current browser session.
Analytics, security logs, backups, and payment-related records may be retained for different periods where needed for operations, compliance, or fraud prevention.

Children, students, and classroom use

Protocol 15 is not directed to children under 13 and should not be used by children under 13 without legally valid school, parent, or guardian authorization. Hosts using Protocol 15 with students or minors are responsible for obtaining required permissions, following school or organization policies, and avoiding unnecessary personal information. Players should use non-identifying nicknames where appropriate.

Your privacy choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or opt-out of certain processing. To make a privacy request, contact support@protocol15.com. For account access or authentication issues, contact auth@protocol15.com. Protocol 15 may need to verify the request and may keep information where allowed or required by law.

Security

Protocol 15 uses technical and organizational safeguards designed to protect information, including authentication, row-level access controls, scoped player tokens, and provider-managed infrastructure. No internet service is completely secure, so hosts and players should avoid entering sensitive or confidential information into the product.

International use

Protocol 15 may process and store information in countries other than where you live. Those countries may have data protection rules different from your local rules. Where required, Protocol 15 relies on appropriate transfer mechanisms or provider safeguards.

Changes to this policy

Protocol 15 may update this Privacy Policy as the product, providers, legal requirements, or business model change. The updated version will be posted on this page with a new effective date.

Contact

For privacy requests or questions, contact support@protocol15.com. For account access or authentication issues, contact auth@protocol15.com.