Privacy Policy

Last updated: 2026-08-26. Draft — pending owner approval before public launch.

AnyGuess is built to know as little about you as possible. No account is required to play, we set no tracking cookies, and we run no third-party analytics. This page lists everything the service stores, why, and for how long. The engineering source of truth behind it is a data inventory maintained with the code.

What we store, and for how long

Anonymous player identity. Playing creates a random credential stored in your own browser. On our side it becomes a small document — a random key, the display name you chose, a friend code, when you were last seen, and your friends list. It contains no email, no IP address, and nothing that names you. Deleted after 180 days of inactivity.

Game rooms. Rooms live in server memory and expire after 3 hours. During a deploy, live rooms are briefly written to disk so your match survives the restart — without the chat or the question log, which never outlive the room.

Deck and portrait caches. Themes players have built are cached (as a hash-keyed record of the deck) for 14 days so the next person gets the deck instantly; portraits are cached up to 180 days. Neither is linked to who requested them.

Card feedback. If you rate a card ("great picture", "wrong person", "unsafe"), we keep the verdict with the theme for 90 days to improve deck quality. No identity is attached.

Server logs. Operational logs record events, counts, and — where an address must be correlated to stop abuse — a hash of your IP salted with a value that changes daily, so hashes cannot be joined across days. Raw IP addresses are not logged. Logs are kept up to 14 days.

Crash reports. When crash reporting is enabled, error events go to Sentry with request data, user identifiers, and browsing breadcrumbs stripped before they leave our server. Retention is set to 30 days.

What we do not do

• No advertising or tracking cookies today. If ads for free players launch later, they will be introduced with a consent dialog where the law requires one, and this policy will be updated first.
• No sale or sharing of personal data with data brokers, ever.
• No profiling, no cross-site tracking, no fingerprinting.

Where data lives

Servers are hosted on Fly.io in the United States. Portraits are fetched from Wikimedia servers when a deck is first built. Nightly encrypted backups of the data directory are kept for 30 days — anything deleted from the live service therefore leaves backups within 30 days.

Your choices

Everything the service knows about an anonymous player expires on the schedules above. Clearing your browser's storage for this site removes your credential immediately — nothing on our side can link a new one to the old. When optional accounts launch, they will come with self-service export and deletion, and this policy will describe them before they do.

Contact

Privacy questions: privacy@anyguess.app.