Privacy, in plain words.

Playing as a guest

When you create or join a room, your browser receives a guest cookie. It holds a random token that lets this device get back to its seat after a refresh or a lost connection; the server stores only a hash of it. It expires after 30 days.

We also keep your language choice in a cookie for one year, and a few display settings, such as the colour theme, in your browser's local storage. None of this is used for advertising or to follow you across other sites.

Your nickname is public in the room

The nickname you enter is shown to everyone in that room, on the shared screen, and in the results and game history of the people you played with.

If you are signed in, the nickname field starts with your default name: your Google name, unless you set a different default on your account page. Change it before you join if you would rather not show it.

Signing in with Google (optional)

Signing in keeps your game history across devices. When you sign in, Google shares with us a stable account identifier, your email address and whether Google has verified it, your name and the address of your profile picture. We store the identifier only as a hash.

We use these to sign you in, to suggest your default nickname, and to show you your own account page. Your email address, Google name and profile picture are shown only to you: never to other players, on the shared screen, in results or in statistics. We do not send you email and do not use the address to match or merge accounts.

Your profile picture is loaded from Google by your browser, and only on your account page. The sign-in session lasts 7 days.

Games and results

While a game runs, the server keeps its secret state, such as roles, words and individual votes, and sends each player only what they are allowed to see. That private state is deleted 7 days after the game ends. The public result (who played, the revealed roles and the winner) is kept for 90 days so players can look back at it.

Statistics

We record a small set of product events, such as a room being created or a game being completed, in our own database, without any third-party analytics service. Each event carries a pseudonym computed from your device identifier with a secret key. It never contains your nickname, room code, role, words, votes or account.

Who else is involved

The site runs on servers we operate. Cloudflare carries the traffic between your browser and those servers, and so handles your IP address and request details as our network provider. Google is involved only if you choose to sign in.

How long we keep things

• Guest cookie and device credential: 30 days.
• Sign-in session: 7 days. An unfinished sign-in attempt: 10 minutes.
• Private game state and vote verification data: 7 days after the game ends.
• Results, game history and the nicknames in them: 90 days after the game ends.
• Your Google profile and default nickname: until you delete your account.
• Backups: before each release we back up the database on the same server. Backups older than 7 days are removed when the next release goes out, so a backup can last longer if no release happens for a while.

Export and deletion

On your account page you can download your data (your profile and your game history) or delete your account. Both ask you to sign in again if your last sign-in was more than 5 minutes ago.

Deleting your account signs you out everywhere, ends any game you are in, replaces your name in other players' results with a placeholder, and erases your email address, Google name, profile picture and default nickname. Copies in backups remain until those backups are removed (see above). Restoring a backup does not re-apply deletions automatically: if we ever had to restore one, an account deleted after that backup was taken could come back and would need to be deleted again. Write to us if that happens to you. Guest data has no account to delete: it expires on the schedule above.