Who operates this service
Who Invited the Killer? is a Louisiana-based project. Formation of Who Invited the Killer LLC is pending; paid sales are not open. Contact support@whoinvitedthekiller.com with privacy questions or requests.
Information we handle
Hosts provide a name, an email address, a cell phone number and a password to create an account. The password is stored only as a one-way hash. The cell phone number is used to confirm the account and to text sign-in and password-reset codes; it is not used for marketing. We use an account identifier to connect hosts to their purchases and games. Launch-list subscribers provide an email address, selected interest and consent; we record signup time, subscription status and email-delivery status.
During play, we store player display names, room membership, assigned fictional roles, game progress and player actions. Hosts can provide a story title, setting, tone, difficulty, player count and content boundaries. We store these inputs along with generated stories and generation status. Use fictional names and avoid putting sensitive personal information about yourself or anyone else into story prompts or boundaries.
Stripe handles checkout and payment details. Our application stores purchase references, plan and price identifiers, customer/subscription identifiers and billing-event records. It checks payment, refund and subscription status to decide which games are available. Cards you save to your account are kept by Stripe: we show their brand, last four digits and expiry as Stripe reports them, and store only which card is your default. Do not email us card information.
We also process connection information for security, including IP-derived rate-limit identifiers, timestamps and request counts. Hosting and service providers may maintain operational and security logs. Support messages include the information you choose to send us.
How we use and share information
We use information to sign hosts in, deliver games, remember progress, process and manage purchases, prevent abuse, handle support and send requested launch updates.
Supabase provides host authentication. Resend delivers sign-in and launch emails. Stripe processes payments and subscription management. OpenAI receives custom story inputs and generated material for writing, review and repair. The current background-generation workflow requests provider-side response storage; this is not a zero-retention workflow. OpenAI Sites and its hosting infrastructure process and store the website's operational data. Providers process data under their applicable terms and policies.
Players in the same room can see shared game information and player display names. Private roles are restricted by the game's access controls. Keep your password, sign-in codes, private recovery codes and role screens private; other participants can still share information they see themselves.
Cookies and browser storage
The site uses cookies for host sign-in and browser storage for game access/recovery keys and relevant device preferences. Clearing storage may require signing in or recovering a game again. Guests do not need a ChatGPT account to join a room.
Retention and choices
New game rooms allow up to 30 days after creation to start, then 48 hours after starting. Monthly game access also depends on a current paid membership. Existing rooms may retain an earlier deadline shown in the game. This is an access limit, not an automatic deletion schedule. Expired room content becomes eligible for active-database deletion 30 days after expiry. Cleanup runs in bounded batches on website visits; actual deletion can occur later during quiet periods. Completed generation records are stripped of prompts, story, review and recovery-key content. Minimal purchase/usage/content-removal records remain. A conservative cleanup fallback covers completed generation records whose rooms were explicitly deleted. Failed or abandoned server-side generation content becomes eligible for removal after 30 days without activity, provided no active request or corresponding room remains. Removal stops that preparation; an eligible retry requires a fresh draft. Minimal purchase, usage and spending safeguards remain.
We retain host accounts while they remain open and handle closure through a verified support request. Account closure is handled manually; resolve any active subscription before removing access to billing management.
We review billing and tax records for deletion seven years after the relevant tax year ends, retaining records longer where an applicable requirement, audit, dispute or legal hold calls for it. This is a review point, not a promise of automatic deletion.
We remove ordinary closed support conversations after 12 months, except information still needed for an unresolved issue or documented legal/accounting reason. These account, financial and support reviews are handled manually.
We retain launch subscription details while you request updates. After unsubscribe, unnecessary interest preferences and delivery timestamps are removed, while a minimal opt-out/consent record is kept to prevent accidental resubscription while the list operates.
Expired application rate-limit counters are removed during visit-driven cleanup; provider logs and purchase/spending safeguards are separate. This cleanup does not erase browser drafts, third-party records or backups.
Email support@whoinvitedthekiller.com to request access, correction or deletion of your information. We may need to verify ownership before acting. Some records may need to remain for billing, security, dispute handling or legal obligations. We will explain relevant limits when responding. Exact rights and deadlines depend on where you live; this notice does not reduce rights that apply to you.
You can stop launch updates by opening the unsubscribe link in a launch email and confirming. Unsubscribing changes mailing-list status; it does not delete your host account or purchase records. Signing out or clearing browser storage likewise does not erase server records.
Age eligibility and updates
The service is for adults aged 18 and over. This minimum applies to hosts and guests. If you believe someone under 18 has provided information through the service, contact support@whoinvitedthekiller.com so we can review and address it.
Effective September 14, 2026. We will update this notice when our practices change.