Privacy Policy

The short version

• You can play without an account, and most people will. As a guest you are a display name you typed into a room, and nothing more.
• An account is optional and exists only to keep your stats, circles and packs across devices. It asks for an email address and a password — nothing else. No phone number, no payment details. See Accounts.
• We send email only when you ask us to — a password reset link, or an optional address confirmation. No mailing list, no marketing, no announcements. See Third parties for who delivers it.
• No advertising, and no tracking of you. We do keep a small set of anonymous counters — "a room was created", "a demo reached the finale" — with no identifier of any kind attached, so they can be added up and can never be traced back to a person. Nothing is shared with anyone else. The only cookie is the sign-in cookie, set when you sign in and never for guests. The site also stores a few things in your browser's local storage so you keep your seat when your phone drops off wi-fi; that is the extent of it.
• Games are recorded. Every room writes an ordered log of what happened — names, buzzes, answers, verdicts. That log is what makes replay, debugging and settling arguments possible, and it outlives the room.
• Some text goes to OpenAI to be turned into speech, judged, or written by an AI player. Details in Third parties.
• Anything shared by code — a room code, a circle code, a pack code — is readable by anyone who has that code. They are door keys, not passwords.

Who runs this service: legal entity name — owner to complete, registered address — owner to complete. Contact: privacy contact address — owner to complete.

Who you are here

Your identity in a game is a display name you type, per room. It is not verified, not unique, and not connected to anything else about you. If you type a real name, that real name is what gets stored, spoken aloud by the host, shown on the TV, written into the game's log, and — if the night is attached to a circle or a daily leaderboard — persisted beyond the room.

If you'd rather not have your real name in any of that, type a nickname. Nothing in the product depends on your name being real.

Account recovery: a password reset link is sent only to the address on the account, is single-use, and expires. Using one signs that account out everywhere.

Internally each seat also gets a randomly generated identifier and a random rejoin token. Neither is derived from your device, your name, or anything about you — they exist only so the server can tell one seat from another for the life of the room.

Stored on your device

These live in your browser's local storage. They are not cookies, they are not sent to any third party, and clearing your browser's site data removes all of them.

Session logs — the replay record

This is the largest thing the service stores about a game, so it's worth being precise. Every room writes an append-only, ordered log of everything that happened in it. The log is the replay, the debugging tool and the dispute record; the design goal is that the log alone is enough to reconstruct the game exactly.

A log contains:

• Room setup — room code, which game, how many rounds, the random seed, the timing configuration, and the settings chosen at setup (content rating, teams, persona, AI players, and so on).
• Every action a player took, with the server time it was applied: joining (including the display name you typed), buzzing (including the time your own phone recorded the press, and its clock offset and round-trip time), and every answer or submission — meaning the literal text you typed or dictated, including lies written in Bluff City, one-liners in Hot Takes, questions asked in Interrogation, and words listed in Brainstorm.
• Every message the server sent out — turn grants, verdicts (with which rung of the correctness ladder decided it), reveals, running scores, standings, and the lines the host said out loud.
• A closing summary when the room is retired: the final state and the room's clock telemetry.

In production these are rows in a PostgreSQL database (hosting provider and region — owner to confirm). In local development they are files on the developer's own machine.

Logs are readable by anyone who has the room's session id — a random identifier that is not the four-character room code and is not displayed on the TV. It appears in the daily-challenge flow and can be read from the browser by someone who goes looking. Treat a session id as a link to that game's full record.

Clock telemetry

Fair buzzing depends on knowing how far each phone's clock sits from the server's, so every connected device reports its measured clock offset and round-trip time roughly every ten seconds. The server keeps a rolling window of recent samples per seat (a few hundred at most, in memory) and folds a summary into the room's record when the room closes.

What this is: timing numbers — offset, drift, round-trip time, sample counts — tied to a seat and its display name. What it is not: location, device fingerprinting, or anything that identifies the device beyond "this seat's clock behaved like this tonight".

While a room is live, this data is publicly readable by anyone with the room code at /api/sessions/<CODE>/telemetry. That is deliberate: it is the evidence that buzzing was fair, and hiding it would defeat the point.

Feature data

Daily Challenges

Submitting a score stores the game, the UTC date, the leaderboard name you typed and your score — one row per name per game per day, keeping the best score. Names on the board are public. Because names are the only identity, there is nothing stopping two people using the same name; there is no verification and no ownership.

Circles & Campaigns

A circle stores its name and code, its member names, and one row per night played (which game, who won, and the final scores). It also stores memory notes — short typed facts derived after a game ends by reading that game's log. The kinds are a closed list: a win streak, a rivalry decided by a narrow margin, a category someone went cold on, and season championships.

Notes are written only about circle members — never about guests or AI players — and they are restricted by design to records of play (stats and titles), never to descriptions of people. They are shown in full on the circle page, so nothing is remembered about you that you cannot read.

The FORGET THIS control on each note is a hard delete: the row is removed from the database immediately and permanently, and the host has no other copy to fall back on. Notes that stop being reinforced are also pruned automatically after about two months; championship notes are exempt from that pruning and persist until deleted.

Anyone with the circle code can read all of this — standings, member names, and every note — and can delete any note. The code is the membership.

Pack Studio

Building a pack stores the brief you typed (truncated), the entries that were generated, the entries that were quarantined with the reason each was rejected, the pack name, its rating and its code. Packs are unlisted but not private: anyone with the six-character code can host with the pack and see its contents in play. There is currently no self-service deletion for a pack.

Road Trip Mode

No location data, no vehicle data, no CarPlay data. It is the same session engine with different pacing; what gets stored is what any other room stores.

Anonymous counters

We count how the product is used, so we can tell whether a change made things better or worse. It is worth being precise about what that does and does not mean here.

What is recorded. One row per event, and the row is only ever: a short event name from a fixed list we wrote (things like "a room was created", "a game finished", "someone tapped Play a round on the demo page"), the UTC date, the hour, and a handful of values from a fixed list — which game format, all-ages or adult mode, whether the room came from the demo or the daily or the setup screen, how many people were in the room as a plain number, how many rounds were played, and a coarse duration band such as "5–15 minutes".

What is deliberately not recorded — none of this, in any form. No IP address. No cookie or identifier of any kind. No visitor, session, seat or account id. No room code, circle code or pack code. No display name. No email address. No answer text, no question text, no chat. No browser or device information, no user agent, no screen size, no referring page. No precise timestamp — the date and hour are the finest resolution kept. None of it is hashed-and-kept either; it is simply never collected.

Why that matters. Because there is no identifier, these counters cannot be joined into a person's history and cannot be linked to your account, your seat or your games. They answer questions like "what fraction of people who start the demo reach the end of it"; they cannot answer any question about you. That is a deliberate design limit, and the code enforces it: the list of permitted event names and values is fixed in the software, and anything not on the list is discarded rather than stored.

Who sees it. Only us. The counters live in our own database on our own server. No third party receives any of it, no advertising or analytics company is involved, and — as stated in What we don't do — no third-party script of any kind is loaded on any page here to produce it. The summary dashboard is restricted to the site owner.

How long. Rows are deleted after about 400 days. Because there is nothing identifying in them, there is no individual record to look up, correct or remove — a deletion request cannot be applied to a row that was never about anyone.

Technical & network data

• IP addresses are used for rate limiting on Pack Studio (a few builds an hour) and circle creation (a few an hour). Those counters are held in memory with a one-hour window and are not written to the database or attached to any game record.
• The application code does not write a web access log.
• unverified The hosting platform and any CDN in front of it will keep their own request logs (typically including IP address, user agent and URL) under their own retention rules. The owner needs to confirm the provider and its retention period and state it here.

Third parties

These are the only external services the running application talks to.

OpenAI

Used for several distinct things. In every case, if the service is unavailable or slow the game degrades rather than stalls — so none of it is load-bearing.

If no OpenAI key is configured on the server, none of this leaves the machine: the host falls back to your browser's own speech synthesis, judging falls back to a built-in ranking, AI players fall back to canned behaviour, and Pack Studio is unavailable.

unverified OpenAI's own data-handling terms — including whether the account is on a zero-retention or non-training configuration — need to be confirmed by the owner and summarised here. That is an account setting, not something the code can assert.

Atlas Cloud (image generation)

Used only offline, by us, to build picture packs before anyone plays — the generated images are downloaded, saved into the project and served from gptpg.ai. No player data is ever sent to Atlas Cloud, and no request is made to it during a live game. If that ever changes, this section changes with it.

Resend (email delivery)

Used only to deliver the two account emails described under Accounts: a password reset link and an optional address confirmation link. Nothing is sent unless you ask for it — there is no mailing list and no automated mail of any kind.

What Resend receives: your email address, the subject line, and the message body (which contains a one-time link and nothing else about you). What it does not receive: your password or its hash, your display name, your game history, room codes, circle codes, or anything a player typed in a room.

unverified Resend's own data-handling terms, its retention period for delivered messages, and the region it processes in have not been reviewed against this product. The owner must confirm them, and put a data-processing agreement in place, before this document is published.

Hosting and database

unverified The service runs on a cloud platform with a managed PostgreSQL database. The owner must name the provider(s), the region the data sits in, and any data-processing agreement, before this document is published.

Your browser's own speech recognition

Answering by voice uses the speech recognition built into your browser. On most browsers this sends audio to the browser vendor's service, not to us — that transfer is between you and your browser vendor and governed by their privacy policy. GPTPG receives only the resulting text, exactly as if you had typed it. Voice is off by default: you switch it on yourself in the player's Voice menu, and once on, the microphone opens only during your own turn to answer and closes when the turn ends. Some game screens also offer a 🎤 button that listens only while you use it.

What we don't do

• No advertising, no ad networks, no ad identifiers.
• No third-party analytics, no analytics or product-telemetry SDKs, no third-party scripts, no fonts or assets loaded from anyone else's servers. The anonymous counters we do keep are our own code writing to our own database, carry no identifier, and are never sent anywhere.
• No third-party cookies, ever. The only cookie the service sets is its own sign-in cookie, and only if you choose to sign in — guests are never given one.
• No cross-site tracking, no device fingerprinting, no profiles built across rooms.
• Nothing is sold, rented or shared with data brokers.
• No background listening. The microphone is only ever opened by your own tap.

Retention & deletion

To ask for something to be deleted, write to privacy contact address — owner to complete with as much detail as you can: the room code, the date, the display name used, the circle code, the pack code. Without at least one of those, a record cannot be located.

Children

GPTPG is designed to be played by families and mixed-age rooms, and the all-ages content rating is the default. Children will therefore be among the people typing display names and answers into it. Adult mode exists, and creating an adult room now requires an explicit 18+ confirmation from whoever sets it up — but that is an unverified statement by a host, not age verification, and no birthdate is collected. See content ratings.

Accounts

An account is entirely optional. Every game can be hosted and played without one, and nothing about a room changes when a signed-in person is in it.

What is stored: the email address you sign up with, a display name, an avatar emoji you pick from a fixed list, a password hash (scrypt — the password itself is never stored and cannot be recovered from the hash), and the times the account was created and last updated. If you use a reset or confirmation link we also store, for as long as the link lives, a hash of that link's token (never the token) with its expiry; and if you confirm your address, the fact that you did and when.

Sign-in sessions: signing in sets one cookie holding a random token. The server stores only a SHA-256 hash of that token, so a copy of the database does not yield working sign-ins. The cookie is HttpOnly (unreadable by scripts), scoped to this site, and expires after 30 days. Signing out deletes the session on the server, not just in your browser.

Email is used for sign-in and account recovery only. There is no mailing list, no marketing and no announcements. The service sends exactly two kinds of message, both of them only because you asked for one: a password reset link, and an optional address confirmation link. Nothing else is ever sent to that address.

Password reset: asking for a link at /reset gets the same answer whether or not that address has an account — telling you would let anyone check who has signed up here. If it is an account, a link goes to that inbox. The link works once, expires in 45 minutes, and using it signs you out on every device — a reset is often how someone takes an account back, so leaving other sessions alive would defeat it. Only a SHA-256 hash of the link's token is ever stored, so a copy of the database does not yield working links.

Address confirmation is optional and gates nothing. No part of this product — not hosting, not joining, not the Daily, not circles, not packs — requires a confirmed address. It exists so a typo is caught while you still know your password, and so your dashboard can show a tick. If you never confirm, nothing changes.

What an account links to: rooms you started while signed in, packs you built while signed in, Daily Challenge scores recorded from sign-up onward, and circles you joined. Circles may also be matched by the display name you play under — a best-effort match, labelled as such on your dashboard, because a name is not proof of identity.

Adult-mode confirmation: if you confirm the 18+ statement while signed in, we store that you confirmed it and the time you did — a true/false and a timestamp, keyed to your account. No date of birth and no age is collected or stored, on purpose: an unverified birthdate is the same unverified statement with identifying personal data attached, and on an all-ages product that data would come overwhelmingly from households with children in them. You can withdraw the confirmation from your account at any time, which deletes the row, and deleting your account deletes it too.

Deleting your account removes the account, its sign-in sessions, and those links. It does not erase game records: a room's log, a published pack, a circle's standings and a public leaderboard entry belong to the rooms and people they were made with, and are described under Retention & deletion.

The native apps

There are Apple TV, iPhone and Apple Watch apps in development. They connect to the same server over the same protocol as the website and hold the same data — a display name and a seat token — with the addition that the iPhone app passes those seat credentials to the Watch over Apple's own device-to-device link so the Watch can take over the seat.

Security posture — stated honestly

• Reset links are single-use, short-lived, and stored only as a hash. They are always built from this site's own configured address, never from the address a request claims to be for — a request that lies about which host it is talking to cannot redirect your reset link somewhere else.
• Codes are keys, not passwords. A room code, a circle code and a pack code all work on the same principle: possession of the code is the permission. There is no second factor and no ownership check. Share them accordingly.
• Rejoin tokens are seat claims, not authentication. They are randomly generated, compared carefully, scoped to one room, and expire with it. A wrong token cannot take a seat — it joins as a new player instead — but a token that has leaked can.
• One live connection per seat. A second connection presenting the same token takes the seat and the earlier one is disconnected. That is a deliberate anti-confusion rule; it is not an intrusion alert.
• Errors from external services are never passed through to players, so upstream responses cannot leak into the room.
• unverified Traffic is expected to be served over HTTPS/WSS with encryption at rest provided by the managed database. The owner should confirm both for the production domain and state it here.
• There is no formal breach-notification process today. That is a gap the owner needs to close.

Changes & contact

This document will change as the product does — accounts, retention rules and App Store requirements will all force revisions. Material changes should be announced rather than quietly edited; the mechanism for doing that is owner to decide.

Privacy contact: support@gptpg.ai. There is no ticketing system; this is a plain mail link, and no response time is promised.

Effective date: not in force — draft pending legal review

Last revised: 2 August 2026

See also: Terms of Service · Support Centre