1Who we are
Sushiroll is an app for finding people near you to play tabletop games with. It is run by Matthew Stout, 51 Gosberton Road, Balham, London SW12 8LE, who is the data controller for the information described here. You can reach us any time at hello@sushiroll.games or by post at that address, and either is the place to send any request in this policy.
What this website collects
Only your email address, and only if you give it to us.
| Your email address | Given by you when you subscribe to our newsletter. It is how we tell you the app is live and send you the occasional update, and nothing else. Every email has an unsubscribe link. |
We do not ask for your name, your address, your date of birth or your payment details on this site.
3What the app collects
The app needs more than the website, because it introduces you to people and puts you in a room with them. Nothing here is sold, and nothing is used to advertise to you.
| Your first name and photo | Shown on your profile and on your card in Connect. Up to three pictures, chosen by you from your phone. |
| Your date of birth | Kept private. Other people only ever see your age, never the date. We use it to keep the app to over-18s. |
| Apple's age check | On an iPhone the app also asks Apple whether you are over 18, through Apple's own age sheet. We keep only Apple's answer, an age band and how Apple knew it, and the date we asked. Apple never gives us your date of birth, nobody else sees the answer, and it is used only to keep the app to over-18s. |
| Your neighbourhood | A pin you drop, or a place you search for. Other people see the area name only, never your address. The point itself is rounded to about a kilometre before it is saved, and is used only to work out what is near you. |
| Your games and how you play | What you pick from our list, plus a line about yourself if you write one. Shown on your profile. |
| Messages you send | Stored so the conversation is there when you come back, and readable by the people in that conversation. We do not read your messages, except where we have to look at something you or someone else has reported. |
| Events and groups | What you host, what you go to, and who else is going. Visible to the other people there. |
| Who you passed and who you liked in Connect | Kept so we do not show you the same person twice. Nobody is ever told that you passed on them, and you are only told someone liked you once you have liked them back. |
| Reviews and shout-outs | Your rating of an event after it has happened. Ratings are only ever shown as an average across a group, never attributed to you. |
| Reports and blocks | If you report something we keep your report and a copy of what you reported, taken at that moment, so we can act on it even if it is deleted afterwards. The person reported is never told who reported them. |
| A notification token | An anonymous code for your handset, so we can send you a notification. It identifies the phone, not you, and it is deleted when you sign out. |
| Crash reports | If the app crashes, a report goes to Sentry, our crash-reporting service, saying what the app was doing, the model of your phone and its operating system version. It is set not to include anything about you: no name, no email, no messages, no photos, no precise location. |
We do not track you across other apps or websites, we have no advertising, and we do not use your data to train anything.
4Why we use it, and our legal basis
- To email you about Sushiroll. Telling you when the app launches, and the occasional update on how it is coming along. Our lawful basis is your consent, given when you subscribed, and withdrawn with the unsubscribe link in any email.
What we will never do. We will not sell your data. We will not share it with other companies for their own marketing. We will not add you to unrelated mailing lists.
And in the app:
| To run the app for you | Your account, profile, messages, and the events and groups you join. Lawful basis: performance of a contract with you — we cannot show you a table to join without these. |
| To show you what is near you | Your neighbourhood pin and the area around it. Lawful basis: consent, given when you allow location or drop the pin yourself, and withdrawn by changing your neighbourhood or deleting your account. |
| To keep people safe | Reports, blocks, a word filter, and reading something that has been reported: only what was reported and a few messages either side, with anything more needing a written reason that we keep on record. Lawful basis: our legitimate interest in a service where people meet strangers in person, and in some cases a legal obligation. |
| To send you notifications | Reminders, changes to events you are going to, and messages. Lawful basis: consent, withdrawn whenever you turn them off in Settings. |
| To keep the app to over-18s | Your date of birth. Lawful basis: our legitimate interest in an adults-only service. |
| To find and fix crashes | Crash reports, with nothing about you in them. Lawful basis: our legitimate interest in an app that works. |
Nothing about you is decided by a machine. The order people appear in Connect comes from the games you have in common and how far away they are. It chooses what you see next and nothing else — no one is accepted, refused or ranked by it. A word filter stops a short list of slurs and explicit words from being posted, and passes swearing in public places, like a bio or a group's description, to a person to look at. It judges words, never you, and a person makes every decision about an account.
5Who else can see it
Other people using Sushiroll see your profile, your games, your neighbourhood's name, and anything you post in a group or an event you share with them. They never see your date of birth, your pin, your email address, or who you passed on.
Our suppliers are a small number of companies that run parts of the service. They only handle your data to provide that service to us, never for their own purposes:
| Supabase | The database, sign-in, and the storage your photos live in. Hosted in the EU. |
| Expo | Delivers notifications to your phone. Receives the notification text and the handset code, nothing else. |
| Apple and Google | Only if you choose to sign in with them, and only to confirm it is you. Google also draws the map. |
| Resend | Sends our emails, including telling us when something has been reported. It receives the kind of report and the reason given, never what was reported or who by. |
| Photon and postcodes.io | Open map data, used to turn a search into a place. They receive what you type into the search box, never who you are. |
| Sentry | Receives crash reports from the app, and only those. Hosted in the EU. |
We do not sell your data, and we do not share it with anyone for advertising. We would only ever hand it to anyone else if the law required it. We choose suppliers that store data in the UK or Europe wherever we can.
We are happy to tell you exactly who our suppliers are at any time. Just email hello@sushiroll.games and we will send you the current list.
Each is bound by contract to process your data only on our instructions and may not use it for their own purposes. If any transfer of data leaves the UK or EU it is covered by the safeguards UK data protection law requires. We will also disclose information if we are legally required to, which so far has never happened.
Where it is held. Your account, messages and photos sit in the European Union. Notifications pass through Expo in the United States, which receives the text of the notification and your handset's code and nothing else; that transfer is covered by the UK's approved safeguards for US providers.
Every supplier we use is required to protect your data to the same standard set out in this policy, and to use it only to provide their service to us.
We do not send your data to any AI service, and we do not use anything you write, say or upload to train one.
6How long we keep it
- Your email address, until you unsubscribe or ask us to delete it, or until two years after the app launches if you never open anything we send.
- Crash reports, for 90 days, then deleted by Sentry.
In the app: your profile, messages, events and groups stay for as long as your account does. Delete your account from Settings and the lot goes, along with your photos — within 30 days, and usually straight away. Messages you have already sent stay in the other person's conversation, the way a text message does.
One thing outlives the account on purpose: a report you made or that was made about you, kept for up to 12 months so a pattern of behaviour can be acted on. The copy of what was reported is deleted six months after the report is closed. Blocks you made, and blocks on you, go with the account.
7Your rights
Under UK data protection law you can ask us to show you what we hold, correct it, delete it, hand it over in a portable form, or stop using it. You can also withdraw consent for emails at any time, which does not affect anything we sent beforehand.
The quick way. Every email we send has an unsubscribe link, and using it stops all marketing from us immediately.
To delete your app account, open the app and go to Profile, then the cog, then Delete my account. It removes your profile, your photos, your events and your games. Messages you sent stay in the conversations they were sent to, with your name taken off.
To delete everything else, email hello@sushiroll.games asking us to delete your data. We will do it within 30 days and confirm when it is done.
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
8Cookies
We do not use advertising or tracking cookies, and there is no cookie banner because there is nothing to consent to.
The sign-up form is protected by Cloudflare Turnstile, which works out whether you are a person or a bot. It is there to stop the list filling up with automated entries, and it does not track you across websites or build a profile of you.
9Children
The app is for over-18s. The date of birth it asks for at sign-up will not accept anyone younger. If you believe a child has given us their details, email us and we will delete them.
10Changes to this policy
If we change how we use your information in a way that meaningfully affects you, we will email you before it takes effect rather than quietly updating this page. The date at the top always shows the current version.