Privacy Policy

This policy describes what we do with personal data when you use PlayEmojis. The company responsible for that data — the controller — is identified under "Who operates PlayEmojis" at the foot of this page.

The short version: you can play the whole game without telling us who you are; as of the date above we run no advertising and no third-party analytics on PlayEmojis; and we do not sell personal data.

1. Playing without an account

When you first do something that needs an identity — a guess, joining a room, the daily puzzle — we set a signed cookie on your device containing a random player id. We create it lazily: simply loading a page does not create one.

Against that id we store what the game needs to work:

• a generated nickname and avatar emoji (you can change the nickname);
• your guesses, the puzzles you write, your scores, votes and streaks;
• which rooms you are a member of;
• a country code derived from your network connection, used for aggregate statistics and abuse prevention.

None of that is linked to your name, your email or your device identity. The cookie is the only link; it lasts about a year and is set HttpOnly and — in production — sent only over HTTPS. If it is cleared, that history becomes orphaned: we cannot recover it or connect it back to you, because nothing ties it to a person. For the same reason, we can only act on privacy requests about a guest player if you can give us the player id from your device.

2. If you create an account

An account adds your email address and a hashed password (we never store passwords in plain text). Email confirmation is required.

If you sign in with a third-party provider such as Google, we receive your name, email address, whether the provider verified that email, and a profile image reference. We use them to create and sign you into your account. The provider's access tokens are used during sign-in and are not retained.

When you sign in, we link your existing guest player to the account so your history follows you between devices.

Account security data. We keep records of your sessions and sign-in events — time, IP address, approximate location derived from the IP address (country, region, city and approximate coordinates), browser, operating system and device type — so you can see and revoke your sessions, and so we can detect suspicious sign-ins and warn you about them. These records are kept on a rolling basis and routinely deleted after about twelve months.

Signup records. When an account is created we record the IP address, approximate location and signup method, and the fact and version of your agreement to the Terms and this policy (with time, IP address and browser identifier). We keep those records as evidence of the agreement and for security and fraud prevention.

3. Content other players can see

Some of what you write is shown to other people by design: your nickname and avatar on scoreboards and in guess feeds, the puzzles you write inside a party room, and — at the reveal — aggregated round highlights such as the most-repeated wrong answer. In the public arena those surfaces are visible to anyone on the page, including people who are not signed in, and gameplay is routinely streamed and recorded by other players. Do not type anything into the game that you would not want a stranger to read.

4. Server logs and technical data

Our servers keep ordinary operational logs — IP address, requested page, browser type, timestamps — used to run the service, debug faults and defend against abuse. Passwords, tokens and payment details are filtered out of application logs. Our infrastructure provider and CDN also process connection data (such as your IP address) to route traffic and mitigate attacks.

5. Reports and moderation

When you report content, or when someone reports yours, we keep a record: what was reported, a snapshot of the content at that moment, the reporting and reported players, what we decided, and when. Reports filed through the public Report illegal content form also include the name and email the reporter gives us, so we can acknowledge the report and respond. Moderation records are kept after the content itself is gone, because appeals, repeat-infringer decisions and our legal defense depend on them. Summaries of new reports may be delivered to our staff through internal alerting tools.

6. Payments

If and when paid features are on sale, payments will be handled by Stripe. Card numbers go to Stripe, never to us; we receive and keep customer, transaction and entitlement identifiers, and what you bought. Billing records are retained as long as tax and accounting law requires.

7. Service providers and other recipients

We use a small number of providers, each doing one job. They process data under contracts that limit what they may do with it. As of the date above they include:

• Hetzner — hosting, in a European Union data center.
• Cloudflare — CDN, security in front of the site, file storage, and the Turnstile anti-bot check on signup and the report form.
• Amazon Web Services — transactional email delivery and image hosting.
• Backblaze — encrypted off-site database backups.
• Stripe — payments, when paid features launch.
• Google — sign-in, if you choose "Continue with Google".
• Anthropic — AI processing of puzzle text: generating candidate puzzles for our public library and, where enabled, an automated pre-screen of candidate content before a human reviews it. This runs on puzzle text, not on player accounts, under terms that restrict the provider from using the content for its own purposes, including model training.

We may add or replace providers; this policy describes the categories we use and the current load-bearing names. We do not use third-party advertising or third-party analytics services on PlayEmojis as of the date above.

Beyond providers, we disclose personal data only: to comply with law or valid legal process; to protect our rights, our players or others (including reporting to authorities where we believe the law requires or permits it); in connection with a merger, acquisition or sale of assets, in which case this policy continues to apply until changed; and in aggregated or anonymized form that does not identify you, which we may use and share without restriction.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

8. International transfers

Our servers are in the European Union and some of our providers are in the United States, so data moves between the two. Where data leaves a jurisdiction that restricts transfers, we rely on our providers' data processing agreements, which incorporate the European Commission's Standard Contractual Clauses and their UK and Swiss addenda where applicable, and on adequacy decisions where available.

9. Cookies

We use cookies only to run the game:

• the player cookie described in section 1;
• session and remember-me cookies that keep you signed in, if you have an account;
• a security cookie set by Cloudflare Turnstile on the forms it protects.

As of the date above there are no advertising cookies, no third-party analytics cookies and no tracking pixels on PlayEmojis — which is why there is no consent banner: everything we set is needed to provide what you asked for. If that ever changes, we will update this policy and ask for consent where the law requires it.

10. Why we process data (legal bases)

Where the law (such as the GDPR) requires a legal basis, ours are:

• Performance of a contract — running the game you are playing: player identity, game state, accounts, purchases, and operational communications.
• Legitimate interests — securing the service, preventing fraud and abuse, moderating content, defending legal claims, and measuring and improving the game with our own first-party data. We balance these interests against your rights.
• Legal obligation — tax and accounting records, responding to valid legal process, and handling illegal-content notices where the law requires it.
• Consent — only where we ask for it, and you can withdraw it at any time without affecting earlier processing.

11. How long we keep things

We keep personal data only as long as reasonably necessary for the purposes above, and then delete or anonymize it. As guidance:

• Guest player records — while the player id remains in use; old game rounds are pruned over time.
• Account data — while your account exists.
• Session and sign-in security records — rolling, routinely deleted after about twelve months.
• Moderation and report records — for as long as needed for appeals, repeat-infringer enforcement and legal defense.
• Billing records — as long as tax and accounting law requires.
• Terms-acceptance records — for as long as the agreement they evidence may be relevant.
• Backups — encrypted and rotated, so deletions work through within the backup cycle.

Deletion timelines may be extended where the law requires retention, or where records are reasonably needed for an ongoing investigation or the establishment, exercise or defense of legal claims.

12. Your rights and choices

• Change your nickname at any time from your stats page.
• Delete your account from your settings; that removes the account and its email address, subject to the retention rules above.
• Clear your cookies to detach your device from its guest history.
• Write to us at the privacy address at the foot of this page to request a copy of your data, a correction, deletion, restriction, a portable export, or to object to processing based on legitimate interests. We will need enough information to find and verify the right records — for a guest player that usually means the player id from your device — and we respond within the time the law allows.

Depending on where you live you may also have the right to complain to your data protection authority.

If you live in California: the categories of personal information we collect are identifiers (player id, email, IP address), internet activity (gameplay and log data), approximate geolocation, commercial information (purchases), and the content you write; we collect them from you and from your device, for the business purposes described above, and disclose them only to the service providers and recipients described in section 7. We do not sell personal information and do not share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. You have the rights to know, access, correct, delete, and to not be discriminated against for exercising them; you may use an authorized agent, and we will verify requests as the law requires.

13. Automated decision-making

Automated filters check nicknames and room names before they are saved, and Safe Mode screens puzzle text in the rooms that use it; a rejected name can simply be resubmitted differently. Automated tools may also flag content for human review, and candidate puzzles for our public library are screened before a human curates them. Decisions that significantly affect you — such as account restrictions — can be appealed as described in the Terms, and a human reviews appeals.

14. Security

We apply technical and organizational measures appropriate to the risk, including HTTPS everywhere, hashed passwords, encrypted off-site backups, access controls and log filtering. No service is perfectly secure, and we cannot guarantee absolute security. If we discover a breach affecting your personal data, we will notify you and the relevant authority where the law requires it.

15. Children

PlayEmojis is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to the privacy address at the foot of this page and we will delete it.

16. Changes

We will post changes here and update the date at the top. If a change materially affects what we do with your data, we will say so in the product or by email, and where the law requires consent we will ask for it.

Who operates PlayEmojis

PlayEmojis is operated by Latent Software LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA. That entity is the party you are contracting with, and the party responsible for the personal data described in our Privacy Policy.

Write to us at [email protected] for anything about the game, [email protected] for legal notices, and [email protected] for questions about your data.

These pages supplement the operator's general Terms of Service and Privacy Policy, which apply to all of its products and are incorporated here by reference. If they conflict with the PlayEmojis documents, the PlayEmojis documents control for PlayEmojis.