The short version
- You can play without an account, and most people will. As a guest you are a display name you typed into a room, and nothing more.
- An account is optional and exists only to keep your stats, circles and packs across devices. It asks for an email address and a password — nothing else. No phone number, no payment details. See Accounts.
- We send email only when you ask us to — a password reset link, or an optional address confirmation. No mailing list, no marketing, no announcements. See Third parties for who delivers it.
- No advertising, and no tracking of you. We do keep a small set of anonymous counters — "a room was created", "a demo reached the finale" — with no identifier of any kind attached, so they can be added up and can never be traced back to a person. Nothing is shared with anyone else. The only cookie is the sign-in cookie, set when you sign in and never for guests. The site also stores a few things in your browser's local storage so you keep your seat when your phone drops off wi-fi; that is the extent of it.
- Games are recorded. Every room writes an ordered log of what happened — names, buzzes, answers, verdicts. That log is what makes replay, debugging and settling arguments possible, and it outlives the room.
- Some text goes to OpenAI to be turned into speech, judged, or written by an AI player. Details in Third parties.
- Anything shared by code — a room code, a circle code, a pack code — is readable by anyone who has that code. They are door keys, not passwords.
Who runs this service: Loqui Auris LLC, PO Box 271, Key West, FL 33041. Contact: [email protected].
Who you are here
Your identity in a game is a display name you type, per room. It is not verified, not unique, and not connected to anything else about you. If you type a real name, that real name is what gets stored, spoken aloud by the host, shown on the TV, written into the game's log, and — if the night is attached to a circle or a daily leaderboard — persisted beyond the room.
If you'd rather not have your real name in any of that, type a nickname. Nothing in the product depends on your name being real.
Account recovery: a password reset link is sent only to the address on the account, is single-use, and expires. Using one signs that account out everywhere.
Internally each seat also gets a randomly generated identifier and a random rejoin token. Neither is derived from your device, your name, or anything about you — they exist only so the server can tell one seat from another for the life of the room.
Stored on your device
These live in your browser's local storage. They are not cookies, they are not sent to any third party, and clearing your browser's site data removes all of them.
| Key | Contains | Why |
|---|---|---|
gptpg:<CODE>:<role> | Your seat id and rejoin token for one room. | Lets your phone reclaim the same seat — and the same score — after a disconnect. Also powers the "Rejoin" shortcuts on Game Home. |
gptpg:name | The display name you last used. | Pre-fills the name box so you don't retype it. |
gptpg:firstrun | A flag saying you've seen the first-run introduction. | So it stops appearing. |
gptpg:daily:name | Your daily-leaderboard name. | Pre-fills the daily challenge page. |
gptpg:daily:run:<game> | Today's in-progress daily room (date, room code, session id). | Lets you come back to an unfinished daily. Discarded at the next UTC midnight. |
gptpg-circle | The last circle code you opened. | Pre-fills the circle field when you set up a game. |
It proves "this browser is the one that took seat 3 in room ABCD" for as long as that room exists. It is not a password, it grants nothing outside that one room, and it dies with the room. Anyone who obtained it could take over that seat in that room — so a shared or public device is a shared seat.
Session logs — the replay record
This is the largest thing the service stores about a game, so it's worth being precise. Every room writes an append-only, ordered log of everything that happened in it. The log is the replay, the debugging tool and the dispute record; the design goal is that the log alone is enough to reconstruct the game exactly.
A log contains:
- Room setup — room code, which game, how many rounds, the random seed, the timing configuration, and the settings chosen at setup (content rating, teams, persona, AI players, and so on).
- Every action a player took, with the server time it was applied: joining (including the display name you typed), buzzing (including the time your own phone recorded the press, and its clock offset and round-trip time), and every answer or submission — meaning the literal text you typed or dictated, including lies written in Bluff City, one-liners in Hot Takes, questions asked in Interrogation, and words listed in Brainstorm.
- Every message the server sent out — turn grants, verdicts (with which rung of the correctness ladder decided it), reveals, running scores, standings, and the lines the host said out loud.
- A closing summary when the room is retired: the final state and the room's clock telemetry.
In production these are rows in a Heroku Postgres database, hosted in Heroku's United States region alongside the application itself. In local development they are files on the developer's own machine.
Logs are readable by anyone who has the room's session id — a random identifier that is not the four-character room code and is not displayed on the TV. It appears in the daily-challenge flow and can be read from the browser by someone who goes looking. Treat a session id as a link to that game's full record.
Retention: up to one year. A session log is kept for up to a year after the room closes, long enough to settle a dispute or revisit an old game, then deleted.
The one-year retention above is the stated policy, but no expiry job exists yet to actually delete logs once they age out, and there is still no self-service deletion before then. Until that job ships, a log in practice persists until someone removes it by hand — which also means logs older than a year already exist and need a one-time cleanup once the job is built.
Clock telemetry
Fair buzzing depends on knowing how far each phone's clock sits from the server's, so every connected device reports its measured clock offset and round-trip time roughly every ten seconds. The server keeps a rolling window of recent samples per seat (a few hundred at most, in memory) and folds a summary into the room's record when the room closes.
What this is: timing numbers — offset, drift, round-trip time, sample counts — tied to a seat and its display name. What it is not: location, device fingerprinting, or anything that identifies the device beyond "this seat's clock behaved like this tonight".
While a room is live, this data is publicly readable by anyone with the room code
at /api/sessions/<CODE>/telemetry. That is deliberate: it is the
evidence that buzzing was fair, and hiding it would defeat the point.
Feature data
Daily Challenges
Submitting a score stores the game, the UTC date, the leaderboard name you typed and your score — one row per name per game per day, keeping the best score. Names on the board are public. Because names are the only identity, there is nothing stopping two people using the same name; there is no verification and no ownership.
Circles & Campaigns
A circle stores its name and code, its member names, and one row per night played (which game, who won, and the final scores). It also stores memory notes — short typed facts derived after a game ends by reading that game's log. The kinds are a closed list: a win streak, a rivalry decided by a narrow margin, a category someone went cold on, and season championships.
Notes are written only about circle members — never about guests or AI players — and they are restricted by design to records of play (stats and titles), never to descriptions of people. They are shown in full on the circle page, so nothing is remembered about you that you cannot read.
The FORGET THIS control on each note is a hard delete: the row is removed from the database immediately and permanently, and the host has no other copy to fall back on. Notes that stop being reinforced are also pruned automatically after about two months; championship notes are exempt from that pruning and persist until deleted.
Anyone with the circle code can read all of this — standings, member names, and every note — and can delete any note. The code is the membership.
Pack Studio
Building a pack stores the brief you typed (truncated), the entries that were generated, the entries that were quarantined with the reason each was rejected, the pack name, its rating and its code. Packs are unlisted but not private: anyone with the six-character code can host with the pack and see its contents in play. There is currently no self-service deletion for a pack.
Road Trip Mode
No location data, no vehicle data, no CarPlay data. It is the same session engine with different pacing; what gets stored is what any other room stores.
Anonymous counters
We count how the product is used, so we can tell whether a change made things better or worse. It is worth being precise about what that does and does not mean here.
What is recorded. One row per event, and the row is only ever: a short event name from a fixed list we wrote (things like "a room was created", "a game finished", "someone tapped Play a round on the demo page"), the UTC date, the hour, and a handful of values from a fixed list — which game format, all-ages or adult mode, whether the room came from the demo or the daily or the setup screen, how many people were in the room as a plain number, how many rounds were played, and a coarse duration band such as "5–15 minutes".
What is deliberately not recorded — none of this, in any form. No IP address. No cookie or identifier of any kind. No visitor, session, seat or account id. No room code, circle code or pack code. No display name. No email address. No answer text, no question text, no chat. No browser or device information, no user agent, no screen size, no referring page. No precise timestamp — the date and hour are the finest resolution kept. None of it is hashed-and-kept either; it is simply never collected.
Why that matters. Because there is no identifier, these counters cannot be joined into a person's history and cannot be linked to your account, your seat or your games. They answer questions like "what fraction of people who start the demo reach the end of it"; they cannot answer any question about you. That is a deliberate design limit, and the code enforces it: the list of permitted event names and values is fixed in the software, and anything not on the list is discarded rather than stored.
Who sees it. Only us. The counters live in our own database on our own server. No third party receives any of it, no advertising or analytics company is involved, and — as stated in What we don't do — no third-party script of any kind is loaded on any page here to produce it. The summary dashboard is restricted to the site owner.
How long. Rows are deleted after about 400 days. Because there is nothing identifying in them, there is no individual record to look up, correct or remove — a deletion request cannot be applied to a row that was never about anyone.
Technical & network data
- IP addresses are used for rate limiting on Pack Studio (a few builds an hour) and circle creation (a few an hour). Those counters are held in memory with a one-hour window and are not written to the database or attached to any game record.
- The application code does not write a web access log.
- The service runs on Heroku with no separate CDN in front of it. Heroku's own router keeps a short rolling window of request logs (method, path, status, source IP) that is not drained anywhere else, so it ages out on Heroku's own schedule rather than being retained by us.
Third parties
These are the only external services the running application talks to.
OpenAI
Used for several distinct things. In every case, if the service is unavailable or slow the game degrades rather than stalls — so none of it is load-bearing.
| Feature | What is sent | Player identity attached? |
|---|---|---|
| Host voice (text-to-speech) | The line the host is about to say. Host lines routinely include player display names and, when reading back an answer, text a player typed. | Display names, yes — that's what the host says out loud. |
| Hot Takes judging | The written entries only, keyed anonymously, plus the judging rubric. | No. Entries are anonymised before they are sent; attribution happens after the ranking is locked in. |
| Interrogation | The question a player typed, the case file, and the running transcript of the interrogation. | No names — questions only. |
| AI players (Bluff City and similar) | The game prompt and the bot's own personality brief, so the bot can write its answer. | No. |
| Pack Studio | Your brief, then the generated entries again for fact-checking. | No. |
If no OpenAI key is configured on the server, none of this leaves the machine: the host falls back to your browser's own speech synthesis, judging falls back to a built-in ranking, AI players fall back to canned behaviour, and Pack Studio is unavailable.
Per OpenAI's published API terms: OpenAI does not use API data to train its models by default, and API inputs/outputs are retained for up to 30 days for abuse monitoring before being deleted. Zero Data Retention (no logging at all) is available only to eligible enterprise accounts on a qualifying use case — a standard pay-as-you-go account, which is what this product uses, is on the 30-day default rather than zero retention. unverified The owner should confirm the account is in fact a standard API account (not the separate ChatGPT product, which has different data rules) and state that here.
Atlas Cloud (image generation)
Used only offline, by us, to build picture packs before anyone plays — the generated images are downloaded, saved into the project and served from gptpg.ai. No player data is ever sent to Atlas Cloud, and no request is made to it during a live game. If that ever changes, this section changes with it.
Resend (email delivery)
Used only to deliver the two account emails described under Accounts: a password reset link and an optional address confirmation link. Nothing is sent unless you ask for it — there is no mailing list and no automated mail of any kind.
What Resend receives: your email address, the subject line, and the message body (which contains a one-time link and nothing else about you). What it does not receive: your password or its hash, your display name, your game history, room codes, circle codes, or anything a player typed in a room.
Per Resend's published security and privacy terms: email and log data is processed in the United States, retained for 30 days, and deleted within 90 days of account termination. Resend holds SOC 2 Type II certification and states GDPR compliance, with Standard Contractual Clauses plus the EU-U.S. Data Privacy Framework covering EU/UK transfers. Resend pre-signs a Data Processing Agreement for every account, available under Settings → Documents in the Resend dashboard.
unverified Whether that pre-signed DPA has actually been reviewed and accepted for this account needs confirming by the owner.
Cloudinary (avatar photo storage)
Used only if you choose to upload your own avatar photo on your account page instead of picking a built-in one. The image bytes are sent to Cloudinary and stored there — one image per account, overwritten each time you upload a new one. Nothing else about you or your games is sent to Cloudinary, and picking a built-in avatar never contacts it at all.
Deleting an account does not currently delete that account's uploaded avatar photo from Cloudinary — the code to remove a Cloudinary asset exists (intended for pack deletion) but isn't called anywhere yet, avatars included. Until that's wired up, an uploaded photo outlives the account it belonged to.
Hosting and database
The service runs on Heroku, in Heroku's United States region, with a managed Heroku Postgres database in the same region.
unverified Whether a formal data-processing agreement is in place with Heroku (Salesforce) and with Cloudinary needs confirming by the owner before this document is published.
Your browser's own speech recognition
Answering by voice uses the speech recognition built into your browser. On most browsers this sends audio to the browser vendor's service, not to us — that transfer is between you and your browser vendor and governed by their privacy policy. GPTPG receives only the resulting text, exactly as if you had typed it. Voice is off by default: you switch it on yourself in the player's Voice menu, and once on, the microphone opens only during your own turn to answer and closes when the turn ends. Some game screens also offer a 🎤 button that listens only while you use it.
What we don't do
- No advertising, no ad networks, no ad identifiers.
- No third-party analytics, no analytics or product-telemetry SDKs, no third-party scripts, no fonts loaded from anyone else's servers. The site's own art, sound and fonts are all served from gptpg.ai. The one exception is an uploaded avatar photo: if you choose to upload your own picture instead of a built-in one, that image is served from Cloudinary's servers wherever your avatar appears — see Third parties. The anonymous counters we do keep are our own code writing to our own database, carry no identifier, and are never sent anywhere.
- No third-party cookies, ever. The only cookie the service sets is its own sign-in cookie, and only if you choose to sign in — guests are never given one.
- No cross-site tracking, no device fingerprinting, no profiles built across rooms.
- Nothing is sold, rented or shared with data brokers.
- No background listening. The microphone is only ever opened by your own tap.
Retention & deletion
| Data | How long | How to remove it |
|---|---|---|
| Live room (roster, connections) | Until the room ends — at most four hours, and sooner once the game finishes and everyone leaves. | Automatic. |
| Session log | Up to one year by policy — but no expiry job exists yet to enforce it, so in practice indefinitely until that ships. | Ask (see Contact). No self-service option. |
| Clock telemetry | Recent samples in memory during the room; a summary lands in the room's closing record and follows the session log. | With the session log. |
| Circle memory notes | Auto-pruned after about two months without reinforcement. Championship notes are kept. | FORGET THIS on the circle page — immediate, permanent. |
| Circle standings, members, nights | Indefinitely. | Ask. No self-service option. |
| Daily leaderboard entry | Indefinitely, per game per day. | Ask. No self-service option. |
| Pack Studio pack and brief | Indefinitely. | Ask. No self-service option. |
| Anonymous counters | About 400 days. | Nothing to remove — the rows contain no identifier and are not about a person. |
| Rate-limit counters (IP) | About an hour, in memory only. | Automatic. |
| Password reset / confirmation link (hash of the token) | 45 minutes for a reset link, 24 hours for a confirmation link — and deleted the moment the link is used, superseded by a newer request, or the password is changed. | Automatic. |
| "Address confirmed" flag | Until you delete your account. | Deleting your account removes it. |
| Uploaded avatar photo (Cloudinary) | Indefinitely — including after account deletion. Uploading a new avatar or a built-in one overwrites it; deleting the account today does not. | Ask. No self-service option yet. |
| Delivered email at the mail provider | Governed by Resend's own retention — 30 days for email/log data, deleted within 90 days of account termination. | Ask Resend. |
| Everything in your browser | Until you clear it. | Clear site data for gptpg.ai in your browser. |
To ask for something to be deleted, write to [email protected] with as much detail as you can: the room code, the date, the display name used, the circle code, the pack code. Without at least one of those, a record cannot be located.
Set and publish a real retention period for session logs, and describe the process for handling deletion, access and correction requests — including the response deadlines required by whichever privacy laws apply. None of that exists yet.
Children
GPTPG is designed to be played by families and mixed-age rooms, and the all-ages content rating is the default. Children will therefore be among the people typing display names and answers into it, as guests in a room set up by someone 16 or older — see Who may use it. Adult mode exists, and creating an adult room now requires an explicit 18+ confirmation from whoever sets it up — but that is an unverified statement by a host, not age verification, and no birthdate is collected. See content ratings.
The minimum age to hold an account or host (16) is now set, but a full children's-privacy analysis has not been done. COPPA (US), the UK's Age Appropriate Design Code, GDPR provisions on children's data and equivalent rules elsewhere have not been individually reviewed against this product. Whether verifiable parental consent is required anywhere, and what the App Store age rating and disclosures must say, are still open questions.
Practical guidance for parents in the meantime: the display name is typed by the player and is spoken aloud and stored, so have children use a nickname; text written by other players in the room is shown unfiltered on the screen.
Accounts
An account is entirely optional. Every game can be hosted and played without one, and nothing about a room changes when a signed-in person is in it.
What is stored: the email address you sign up with, a display name, an avatar — either one of a fixed set of built-in pictures, or, if you upload your own (PNG, JPEG or WebP, under 500KB) from your account page, that photo — a password hash (scrypt — the password itself is never stored and cannot be recovered from the hash), and the times the account was created and last updated. If you use a reset or confirmation link we also store, for as long as the link lives, a hash of that link's token (never the token) with its expiry; and if you confirm your address, the fact that you did and when.
An uploaded avatar photo is stored on Cloudinary (see Third parties), one image per account, replaced each time you upload a new one. Choosing a built-in avatar instead never sends anything to Cloudinary.
Sign-in sessions: signing in sets one cookie holding a random token. The server stores only a SHA-256 hash of that token, so a copy of the database does not yield working sign-ins. The cookie is HttpOnly (unreadable by scripts), scoped to this site, and expires after 30 days. Signing out deletes the session on the server, not just in your browser.
Email is used for sign-in and account recovery only. There is no mailing list, no marketing and no announcements. The service sends exactly two kinds of message, both of them only because you asked for one: a password reset link, and an optional address confirmation link. Nothing else is ever sent to that address.
Password reset: asking for a link at /reset gets the same answer whether or not that address has an account — telling you would let anyone check who has signed up here. If it is an account, a link goes to that inbox. The link works once, expires in 45 minutes, and using it signs you out on every device — a reset is often how someone takes an account back, so leaving other sessions alive would defeat it. Only a SHA-256 hash of the link's token is ever stored, so a copy of the database does not yield working links.
Address confirmation is optional and gates nothing. No part of this product — not hosting, not joining, not the Daily, not circles, not packs — requires a confirmed address. It exists so a typo is caught while you still know your password, and so your dashboard can show a tick. If you never confirm, nothing changes.
What an account links to: rooms you started while signed in, packs you built while signed in, Daily Challenge scores recorded from sign-up onward, and circles you joined. Circles may also be matched by the display name you play under — a best-effort match, labelled as such on your dashboard, because a name is not proof of identity.
Adult-mode confirmation: if you confirm the 18+ statement while signed in, we store that you confirmed it and the time you did — a true/false and a timestamp, keyed to your account. No date of birth and no age is collected or stored, on purpose: an unverified birthdate is the same unverified statement with identifying personal data attached, and on an all-ages product that data would come overwhelmingly from households with children in them. You can withdraw the confirmation from your account at any time, which deletes the row, and deleting your account deletes it too.
Deleting your account removes the account, its sign-in sessions, and those links. It does not erase game records: a room's log, a published pack, a circle's standings and a public leaderboard entry belong to the rooms and people they were made with, and are described under Retention & deletion. It also does not currently remove an uploaded avatar photo from Cloudinary — see Third parties.
The reset and confirmation flows are built and tested, but no mail provider key is
configured on this deployment yet, so no email can actually be sent. Until
RESEND_API_KEY is set, /reset says so out loud rather
than pretending, and the only recovery path is changing the password while already
signed in.
The native apps
There are Apple TV, iPhone and Apple Watch apps in development. They connect to the same server over the same protocol as the website and hold the same data — a display name and a seat token — with the addition that the iPhone app passes those seat credentials to the Watch over Apple's own device-to-device link so the Watch can take over the seat.
Apple requires a privacy nutrition label, disclosure of every data type collected and whether it is linked to the user, an App Tracking Transparency stance, and a publicly reachable privacy policy URL. None of that has been prepared. The apps must not be submitted until it is.
Security posture — stated honestly
- Reset links are single-use, short-lived, and stored only as a hash. They are always built from this site's own configured address, never from the address a request claims to be for — a request that lies about which host it is talking to cannot redirect your reset link somewhere else.
- Codes are keys, not passwords. A room code, a circle code and a pack code all work on the same principle: possession of the code is the permission. There is no second factor and no ownership check. Share them accordingly.
- Rejoin tokens are seat claims, not authentication. They are randomly generated, compared carefully, scoped to one room, and expire with it. A wrong token cannot take a seat — it joins as a new player instead — but a token that has leaked can.
- One live connection per seat. A second connection presenting the same token takes the seat and the earlier one is disconnected. That is a deliberate anti-confusion rule; it is not an intrusion alert.
- Errors from external services are never passed through to players, so upstream responses cannot leak into the room.
- Heroku automatically issues and renews the TLS certificate for gptpg.ai (Automated Certificate Management), and Heroku Postgres encrypts data at rest as standard on every plan. Gap: the app does not currently force-redirect a plain HTTP request to HTTPS — worth closing even though Heroku's own edge already serves HTTPS for the domain.
- There is no formal breach-notification process today. That is a gap the owner needs to close.
Changes & contact
This document will change as the product does — accounts, retention rules and App Store requirements will all force revisions. There is no mailing list to announce changes to (see What we don't do), so a material change — anything that changes what is collected or how it is used — moves the Last revised date below and gets a short note on this page describing the change for a few weeks afterward. A routine wording fix does not.
Privacy contact: [email protected]. There is no ticketing system; this is a plain mail link, and no response time is promised.
Effective date: 26 August 2026
Last revised: 26 August 2026
See also: Terms of Service · Support Centre