Privacy Policy

Last updated: 2026-10-06.

AnyGuess stores as little about you as possible. No account is required to play, we set no tracking cookies, and we run no third-party analytics. This page lists everything the service stores, why, and for how long. The engineering source of truth behind it is a data inventory kept alongside the code.

What we store, and for how long

Anonymous player identity. Playing creates a random credential stored in your own browser. On our side it becomes a small document — a random key, the display name you chose, a friend code, when you were last seen, and your friends list. It contains no email, no IP address, and nothing that names you. Deleted after 180 days of inactivity.

Game rooms. Rooms live in server memory. A room is removed once it is more than 3 hours old and no players remain connected. During a deploy, live rooms are briefly written to disk so your match survives the restart — without the chat or the question log, which never outlive the room. A pending question is retained so its answer can resume. Private reveal permissions, participant history, scores and each player's board state are also retained for reconnection. A watcher receives a secret card only after its holder approves the request. Grants end with the round; restrictions on joining a game after seeing a card last until the next game.

Deck and portrait caches. We save completed decks and, separately, verified public subjects and their source evidence. This lets us reuse a theme or repair a missing picture without repeating the entire search. These records are eligible for reuse for 14 days, or 24 hours for time-sensitive themes. Each store is limited to 400 records, pruned when new records are written; expired records may remain until that pruning removes them. Public-subject portraits and retained generated sources are cached up to 180 days, with entry and storage limits that may remove them sooner. These shared caches are not linked to who requested them and do not contain private host additions.

Optional accounts and saved decks. When account features are enabled, Google sign-in or an emailed code creates a Supabase account with your verified email and links the browser identities you explicitly connect. Guests can still play. Saving, publishing and rating require an account. Saved decks are private by default. Your browser remembers a separate game credential for each account until you delete that account or clear browser storage. An active match keeps its credential until you leave the room, so changing accounts does not take over another player's identity. Publishing makes a deck discoverable after its checks; uploaded or unverified pictures require moderation. Unpublishing removes discovery and new public access. Matches already using a deck keep their temporary board until the room expires.

Shared card catalog. Verified public subjects, source facts, approved card versions and attributed pictures can persist beyond the 14-day deck cache. Sharing a deck does not contribute its pictures for reuse. Contribution requires a separate choice and moderation; personal photos remain outside the shared subject catalog. Approved public-subject contributions may continue in other decks after unpublishing or account deletion.

Card feedback. When accounts are enabled, we store one changeable rating per account and target version. Problem reports include a selected reason. Picture reports apply to that exact picture across decks; theme reports apply to the card’s membership in that deck. Targets are quarantined after at least five distinct eligible accounts have rated them and at least 60% are negative. Upvotes change ranking without rebuilding decks. Reports go to moderators; moderation audit records last up to 180 days. Ratings are removed when the account or target is deleted. Historical anonymous feedback retains its 90-day limit and exclusions; it does not become account votes.

Custom decks. If you build a deck of your own (a Creator plan feature), its title, names, details and the pictures you upload are stored against your browser's identity until you delete the deck. Uploaded pictures are resized, filed by their content, and served only to the rooms you deal the deck into. Delete a deck and its record goes at once; a picture nobody references any more is swept out of the picture store within 180 days.

Room additions. Hosts may add names, appearance descriptions and pictures to their room's deck. These remain labelled as host additions unless verified. They are kept with that room and its temporary snapshot, not added to shared deck caches. Room-owned pictures and retained illustration sources are removed when the room expires. Saved Creator decks follow the separate policy above.

Illustration processing. When generated artwork is enabled, Cloudflare receives the subject name and description to draw it. OpenRouter receives the generated picture and its subject or host-provided appearance description to check it. Retrieved-picture checking is controlled separately from illustration generation. With those checks enabled, retrieved Wikimedia pictures and their subject descriptions also go to OpenRouter for a visual match check. Uploaded room pictures are resized for display; the current service does not send those original uploads to an image model. Operational generation attempt records retain an asset key and time for 30 days. Daily paid-use counters enforce request limits.

Server logs. Operational logs record events and counts. They also record the text you submit for a theme and the theme you choose to build, so we can see what players request and improve the decks. Requests rejected by the contact-details or content screen are recorded without their text. These entries contain no player name or identity. Where an address must be correlated to stop abuse, they also record a hash of your IP salted with a value that changes daily, so hashes cannot be joined across days. Raw IP addresses are not logged. Logs are kept up to 14 days.

Crash reports. When crash reporting is enabled, error events go to Sentry with request data, user identifiers, and browsing breadcrumbs stripped before they leave our server. Sentry keeps them for 30 days.

What we do not do

Where data lives

Servers are hosted on Fly.io in the United States. The optional account and catalog service uses a dedicated Supabase project in US East, including a private image bucket. When email sign-in is enabled, Resend receives your email address to deliver a sign-in code. Google sign-in is optional. Portraits are fetched from Wikimedia servers when a deck is first built. Nightly encrypted backups of the data directory are kept for 30 days, so anything deleted from the live service leaves the backups within 30 days.

Your choices

Everything the service knows about an anonymous player expires on the schedules above. Clearing your browser's storage for this site removes your credential immediately. Nothing on our side can link a new one to the old. When signed in, your library offers an export of your account, saved decks, ratings and linked browser data, and an account-deletion control. Account access and owned database records are removed when deletion succeeds; linked local records and unreferenced personal pictures are cleared within 24 hours. Previously approved public contributions may remain as described above. Backups expire within 30 days after live deletion. If a save, vote or deletion fails, the app reports the failure so you can retry. Public-deck demand totals contain only a deck ID, date and count; they last 365 days and exclude operator warming and tests.

Contact

Privacy questions: privacy@anyguess.app.