Privacy Policy

What's That Game ("we", "us", "our") is an independent project run by its founding team. We are not yet incorporated as a legal entity — the project is currently operated privately by its founders. If and when we incorporate, this policy will be updated with the company details.

For any privacy question or request, contact us at hello@whatsthatgame.info.

The project founders act as joint data controllers for the purposes of the UK GDPR / EU GDPR.

3.1 Account data (you give us this when you register)

We also automatically record an account role, an active/inactive flag, and account created/last updated timestamps.

3.2 Google sign-in data (if you choose "Sign in with Google")

If you sign in with Google, we receive from Google — under the openid email profile scopes — your email address (and whether it is verified), Google account ID (sub), first name and last name (given_name, family_name), and profile picture URL.

We store these to create and identify your account. We do not receive your Google password.

3.3 Content you create

• Games you contribute: name, description, objective, setup, rules, type, player counts, duration, difficulty, age rating, equipment, setting, up to 10 photos, and public/private visibility.
• Comments you post on games, and comments you like.
• Alias suggestions you submit for a game's alternative names, and their review status.
• Games you favourite or upvote.
• Achievements you earn.
• Reports you submit about other games (reason text and which game).
• Feedback you submit to us (type and message).

Anything you mark public is visible to other users. Anything you mark private is visible only to you.

3.4 Photos and images

When you upload a photo (for a game or your avatar), it is first placed in a private quarantine storage area and screened by our AI moderation provider (see §3.5) before it becomes publicly visible. Approved images are copied to public storage and served via a public URL; rejected images are discarded. We store the image file itself, its storage location, and, for game photos, its display position.

3.5 Content moderation

Text you submit (e.g. comments, game descriptions) and images you upload are automatically checked with an AI moderation model before being made public, to detect content such as hate speech or graphic/sexual imagery. This is an automated screening step, not a decision that produces legal effects on you — see §4.

3.6 Analytics data (Amplitude)

Our app uses Amplitude to understand how the app is used (e.g. which screens are viewed, key in-app actions). Amplitude may process a device identifier, app/usage events, and technical data such as device type and OS version.

Amplitude derives your approximate location (country/region/city level) from your IP address at the time of your request; we do not collect or store your IP address or precise/GPS location, and Amplitude does not retain the raw IP after deriving location. This coarse location data is used solely for internal product analytics (e.g. understanding usage by region) and is not used for tracking across other companies' apps or websites, not shared with data brokers, and not used for advertising purposes.

See Amplitude's privacy policy: amplitude.com/privacy.

3.7 Push notification data

If you enable notifications, we store a device push token and platform (iOS/Android) so we can deliver notifications (e.g. achievement unlocks, announcements) via Expo's push service. We keep a record of notifications sent to you and their delivery status.

3.8 QR / short-link data

Some marketing/social links route through short codes we host (e.g. qr.whatsthatgame.co.uk/<code>). We record an aggregate scan count per link — we do not tie individual scans to your account.

3.9 Technical data

When the app calls our backend, our hosting provider processes standard request metadata (IP address, timestamps, user-agent) for security and reliability. Authentication uses a JWT token stored in a secure, HTTP-only cookie and/or sent as a bearer token from the app.

When you create or edit a game, the game's text is sent to OpenAI to:

• Generate a semantic-search embedding (text-embedding-3-small), stored so your game can be found by meaning-based search.
• Optionally improve a field's wording when you use the AI optimiser (gpt-4.1-nano) or the "brain dump" free-text-to-fields feature.
• Screen text and uploaded images for policy violations using an AI moderation model, before the content is made public.

Only the content you submit (game text, comments, images) is sent — not your account credentials. OpenAI processes this as our service provider. See OpenAI's privacy policy: openai.com/policies/privacy-policy. We recommend not putting personal or sensitive information into game text, comments, or photos.

We share data only with providers that help us run the service:

Our backend and database are hosted on Railway, and our processors (Google, OpenAI, Amplitude, Cloudflare, Resend, Expo) may process data in Europe or the United States. Where data leaves the UK/EEA, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

• Active accounts: account data and content are kept while your account is active.
• Account deletion — Stage 1 (Day 0): when you request deletion, your account is deactivated immediately and login is blocked. Your data is not yet deleted.
• Recovery window (Days 1–30): you can reactivate your account and restore full access within 30 days of requesting deletion.
• Account deletion — Stage 2 (Day 30): after the 30-day window expires, we permanently erase your personal data (name, email, date of birth, country, avatar, authentication credentials). Private games and their associated content (including photos) are deleted. Public games you contributed are retained anonymously (attributed to "Deleted user") so the platform catalogue remains useful. Comments you posted are retained anonymously. User reports, favourites, alias suggestions, achievements, feedback, and push tokens are deleted.
• Rejected/quarantined images that never pass moderation are discarded and not made public.
• Analytics data is retained according to Amplitude's retention settings.
• Backups and logs are kept for a limited period for security and recovery, then deleted.

Depending on your location, you have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability.

To exercise any right, email hello@whatsthatgame.info. You also have the right to complain to your data protection authority (in the UK, the ICO: ico.org.uk).

What's That Game is not directed at children under 13. You must be at least 13 to create an account. We do not knowingly collect data from children under that age. If you believe a child has given us data, contact us and we will delete it. Some games are gated as adult content and require an appropriate age.

Passwords are stored only as bcrypt hashes. Authentication uses signed JWT tokens over HTTPS in HTTP-only cookies. Uploaded images pass through a private quarantine area and automated moderation before becoming public. Access to production data is restricted. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

We may update this policy. We will post the new version with an updated "Last updated" date and, for material changes, notify you in the app.

What's That Game (founding team)