Back to Outwatch

Outwatch privacy policy

Last updated: October 11, 2026

Outwatch is a free, unofficial fan game made by Sean Hathaway, an individual, not a company. This policy covers the Outwatch app and the website outwatch.tv, which the app shows. Questions: support@outwatch.tv.

The short version

  • You sign up by typing a name. We never ask for an email, a phone number or a password.

  • We keep what the game needs: players’ names, their calls, and a record of each signed-in device.

  • If you join a Tribe, the other players in it see your players’ names (kids as a first initial) and points. Section “Tribes” below says exactly what.

  • No ads. No tracking across other apps or websites. We don’t sell or share your data for advertising.

  • You can delete your account and everything in it from the app, at any time.

What we keep, and why

  • Names. The name each player types (up to 24 characters), including names an adult types for kids, and whether each player is an adult or a kid. A new adult’s name, typed on their own phone to join, is kept with their join code only until it’s used or runs out. Why: to show who’s playing and whose calls are whose, and to keep account settings to adults.

  • Your calls. Each Top 10 / Snuffed call, when you made or moved it, which episodes you’ve marked watched, and your points. Why: to run the game and score it.

  • Your account and devices. Random IDs for your account, each player and each signed-in device; a sign-in token for each device; the device’s name if one is given; when it joined and was last seen. For an adult’s own phone only, the IP address and the app or browser version (user agent) recorded when it signed in. We keep no IP address or user agent for a kid’s own phone, or for any phone where kids play. Why: to keep each device signed in and let an account manage its devices.

  • PINs and codes. An adult’s 4-digit PIN, and the one-time codes that add a device, stored only in scrambled (hashed) form; counts of wrong PIN tries. Why: to stop others playing as you or changing your account.

  • Tribes. Each Tribe’s name, flag colour and a name we generate for it; which account typed each name; who started it; which accounts (a phone and the kids who play on it) belong to it and the weeks each one played for it; its rivals. When an adult agrees to the Tribe rules, and to which version. Why: to run Tribes and their boards, keep past weeks fair when an account leaves, and enforce the Tribe rules.

  • Name reports. If you report a name: which name (and which player, if it’s a player’s name), which Tribe, when, which account and player reported it, the reason you chose (if you chose one), and what we decided. For an account whose name was taken down: how many names were taken down this season, and whether it was blocked from naming or from Tribes. Why: to act on reports and apply the Tribe rules.

  • Watch-along. If you use the watch-along, where each player is in the episode, and each tap-back they send (chosen from a fixed list of emoji). What people type goes in Tribe chat, below. Why: to run the watch-along for your players and Tribe.

  • Tribe chat. If you write in your Tribe’s chat: what you wrote, which player wrote it, which episode moment it belongs to, and when. Only your Tribe sees it, each person when they reach that moment. Every message goes through a filter first, and a reported message is hidden at once and reviewed. Why: to run the chat and the Tribe rules. It is deleted with the player or the account.

  • Reminder token. If an adult turns on reminders on their own phone, we keep that phone’s notification token so we can send game reminders. Turning reminders off, signing out, or deleting your account deletes it. We never keep one for a kid’s own phone, or for any phone where kids play. Why: to send game reminders and show updates.

  • Daily takes. When a phone opens a daily take, we keep a random ID for that phone (and a scrambled copy of its key), the kind of phone (iPhone or Android), its time zone, so a take arrives at noon your time, and any answers. If you say yes to notifications, we keep the phone’s notification token. When you set up, the record joins your account. Answers given before setup never count in Everyone’s split. We delete a phone’s record if it isn’t used for 60 days, or when its account is deleted. Why: to show and send the daily take. A phone gets at most one daily take or show update a day.

  • Web notifications. If you say yes to notifications in your browser, we keep that browser’s notification address and keys. Web notifications are delivered by your browser’s push service; on Android Chrome, that is Google’s Firebase Cloud Messaging. We never keep one for a kid’s own phone, or any phone where kids play. Why: to send game reminders, the daily take and show updates to that browser. Turning them off or deleting your account deletes it; signing out deletes the reminders one.

  • Website totals. Our website host, Framer, counts page views, where visitors came from, device type, browser, operating system and country. It uses no cookies and no lasting ID: it scrambles the IP address and user agent with a key that is thrown away every day. We see only totals. Why: to see how many people use Outwatch.

We don’t collect email addresses, phone numbers, real-world addresses, your precise location, contacts, photos, or payment details. Face ID, or fingerprint or face unlock on Android, happens on your phone: the phone’s own system checks you and tells the app only yes or no.

Who sees what

Players on the same account see each other’s names and calls. Adults can see the account’s devices.

Everyone else sees only anonymous totals, such as how many players put a castaway in their Top 10, except in a Tribe, as follows.

Our admin page. We look at totals to fix the game. Only we can see a list of accounts, each with its first adult’s name and how far it has got, to help people who get stuck. Kids appear only as a number.

Tribes. If you join a Tribe:

  • The other players in that Tribe see your players’ names, and each player’s points. Adults show by the name they typed. Kids always show as a first initial, such as “M.”. An adult’s name also shows as a first initial if it doesn’t pass our filter for names other players see, if a report is hiding it, or if the account has been blocked from naming. They see your Tribe’s name and flag too.

  • What your tribe sees. Other players in your tribe see each player’s first name (kids as a first initial), their points, which episode they’ve watched up to, whether they’ve made this week’s calls, and when they last used the app (now, today, or a day count). They also see their points each week, how many of their calls landed, and their best call and biggest miss in episodes you’ve watched. In episodes you’ve both watched, a tribe member can compare their picks and points with yours, question by question. Nothing else about your account is shared.

  • Rival Tribes. If your Tribe takes on a rival, which is each side’s admin choosing to by sharing a code, the rival sees your Tribe’s name and flag, your Tribe’s average for each week you’ve both played since the rivalry began, and the win-loss record. They never see who is in your Tribe. In the watch-along they see only your Tribe’s name, how many of its adults are watching or done, and how many reactions it has made. No names, and no kids.

  • Anyone with your Tribe’s invite code or link sees the Tribe’s name (only if it came from our name roller; a name an adult typed is never shown there), its flag and the size of the Tribe.

  • In the watch-along, the other players in your Tribe also see your adults’ first names and your reactions. A kid shows as a first initial.

  • Nobody else sees your Tribe: no tribe of people you don’t know, and no list of every Tribe.

Tribe names are typed by adults who have agreed to the Tribe rules, and checked by a filter. Any adult in a Tribe can report another account’s Tribe name, or an adult’s name. A reported name is usually hidden while we review it. A name that breaks the rules is taken down, and the account that typed it can lose Tribes for the season.

On your phone

The app keeps your sign-in in your phone’s secure storage (on iPhone, the Keychain) so you stay signed in. On iPhone, the Keychain can keep it even after you delete the app, so reinstalling signs you back in. On Android, your sign-in is kept in the phone’s secure, hardware-backed storage and is left out of Android backups, so after reinstalling you sign back in with a code from an adult’s phone. To remove it, delete your account.

Who else handles it

We use a few services to run Outwatch:

  • Cloudflare runs our server and database.

  • Framer hosts the website the app shows, and counts the website totals above.

  • Expo, Apple and Google (Firebase Cloud Messaging, on Android) deliver notifications if you turn them on.

  • Google Fonts serves some of the lettering, so your phone asks Google’s servers for font files.

We only use services that handle data on our behalf under their own privacy terms. We don’t sell your data, and we don’t give it to anyone else unless the law requires it.

Kids

Outwatch is a game for the whole family, not an app made for children. Kids don’t sign up: an adult adds them as players by typing a name, and they play on an adult’s phone (2 kids at most on one) or on a phone of their own. Please use a first name or nickname for kids. If you’re in a Tribe, the other players in it see a kid only as a first initial, with their points. Kids can’t start, name, join, leave or report in a Tribe on their own: only an adult can. We don’t ask kids for email, photos, contact details or anything else, and we keep no IP address or user agent for a kid’s own phone, or for any phone where kids play. An adult can remove a player, or delete the whole account, at any time from the app. If you think a child’s information reached us without a parent’s say-so, email support@outwatch.tv and we’ll delete it.

How long we keep it, and deleting it

  • We keep your account’s data while the account exists. A device’s sign-in expires after 30 days without use.

  • If every phone on an account signs out, nobody can sign back in, and the account is deleted 30 days after the last one signed out. We don’t delete an account just because nobody has opened the app.

  • Delete it yourself, in the app: tap your name at the top of Home, then Settings, then Delete my account. This deletes, right away, your account, every player in it, all their calls and “watched” marks, every device’s sign-in, PINs, codes and reminder tokens. It takes an adult playing on their own phone, and their PIN on a phone where kids play.

  • Remove one player: tap your name, then Players, then Edit next to them. Their calls and “watched” marks go with them.

  • Tribes: leaving a Tribe keeps a record of the weeks your account played for it, so the Tribe’s past weeks don’t change. Deleting your account deletes your account’s Tribe memberships, its players’ Tribe records and its agreement to the Tribe rules. The Tribe itself, and any Tribe name your account typed, stay with the Tribe.

  • Name reports: a report, and what we decided, is kept so we can apply the Tribe rules. If the account that sent it is deleted, the report stays but is no longer tied to that account. It is deleted if the reported player is deleted or the Tribe is.

  • Watch-along: reactions and where each player was in an episode are kept while the account exists, and deleted with it.

  • Some totals are frozen at set moments, such as the split when Episode 1 calls closed. After you delete your account, those totals still include your calls as numbers only, with nothing that points to you.

  • Our database provider keeps short-term backups for recovery. Deleted data can stay in those backups for up to 30 days before it’s gone for good.

  • Deleting the app from your phone doesn’t delete your account. Use the in-app delete, or email us.

Your choices

You can change players’ names in the app, remove players, and delete your account at any time. Depending on where you live, you may have legal rights to see, correct or delete your data. The in-app delete covers deletion; for anything else, email support@outwatch.tv.

Security

Everything travels over HTTPS. PINs and one-time codes are stored only as keyed hashes, and wrong PIN tries are limited. No system is perfectly secure, so we keep as little as the game needs.

Changes

If this policy changes, we’ll update this page and the date at the top. If a change affects what we collect, we’ll say so in the app first.

Contact

Sean Hathaway · support@outwatch.tv

Outwatch is an unofficial fan game, not affiliated with or endorsed by CBS or Survivor.