01Controller
Finn Strehl
Kaiser-Friedrich-Ring 142
40547 Düsseldorf
Germany
Email: strehldevs@gmail.com
Phone: +49 176 59058049
02Data Unprompted processes
When you use the app, we process the minimum data needed to create a room and run a game:
- an anonymous account identifier and authentication session;
- the display name you choose, room code, room membership, host and ready state;
- the card text, card type and source label you deliberately import, kept as a personal deck attached to your anonymous account;
- for each imported card, an optional short description of its subject and a topic label your AI supplies, used only to avoid generating the same card twice;
- a record of each import: when it happened, which room you were in at the time, how many cards it contained and how many were skipped as duplicates;
- a record of which cards you have already seen in games, so future games can prefer cards that are new to the people in the room;
- guesses, scores, round results, game settings and timing information;
- technical timestamps, connection presence and room activity signals needed for realtime play and cleanup.
The app stores the authentication session on your device. It also stores your active room code, room identifier and display name so you can return after closing the app. Game cards, guesses, scores and rosters are not cached in that local resume record. Separately, the app stores your analytics choice, whether the installation is marked as one of our own test devices, and the identifiers of up to 32 recently finished games, so that a finished game is not counted twice in analytics.
If you consent to analytics, PostHog processes a randomly generated installation identifier, an associated person profile, app version and build, operating system and version, device type, manufacturer and model, locale, time zone, emulator status, lifecycle and screen-view events, feature-flag evaluations, the product events described by your actions, and an approximate location derived from the network address. Product events contain categories, settings, durations and counts. We do not deliberately add your display name, room code, room, game, round or player identifiers, card text, prompts, guesses or recap content to analytics.
When you visit this website, including a room invitation link, the server needs your IP address to send you the page. Each request is logged with your IP address shortened before it is written (the last block of an IPv4 address set to zero, an IPv6 address cut to its first 48 bits), the date and time, the page requested, the response status and its size. Full IP addresses, query strings, referrers and browser details are not logged. The website sets no cookies and loads no fonts, scripts or other content from third parties.
Your deck is not shown back to you. Cards stay hidden until they appear in a game, which is how the game works. The app can tell you how many cards you have and when each import happened; there is no screen and no request that returns the text of a stored card.
Your deck is tied to the anonymous account on this installation. Reinstalling the app, clearing its data or moving to a new device creates a new anonymous account and does not carry your deck across.
03What Unprompted does not access
Unprompted does not connect to your ChatGPT, Claude, Gemini or other AI account. We do not receive your AI login details, complete chat history, prompts outside the card bundle, contacts, precise location, camera or microphone data.
The app contains no advertising SDK, payment SDK or social profile system. PostHog analytics is inactive until you consent. Session replay is not enabled. The public website does not set analytics or advertising cookies.
04Cards and other people
You ask an AI service directly to prepare cards, review the result, and choose whether to paste the encoded bundle into Unprompted. Only the imported cards cross into the game. Your use of the AI service is governed by that provider’s own terms and privacy policy.
The prompt you copy describes the deck you already have. So that your AI does not write the same cards again, the prompt Unprompted places on your clipboard includes the short subject descriptions and topic labels of cards already in your deck. It never includes the text of a stored card. When you paste that prompt into an AI service, you pass those descriptions to that provider. The app itself never contacts an AI provider; that step is yours.
Card text may contain information about you or other people. Only import content you are entitled to share with everyone in the room. Avoid sensitive information and get permission where appropriate.
05Purposes and legal bases
You are not required by law to provide gameplay data, but the app cannot run a multiplayer room without it.
06Service providers and recipients
Supabase provides anonymous authentication, database hosting and realtime room infrastructure on our behalf. People in your room receive the cards, names, guesses, scores and results required for the shared game.
PostHog Cloud EU provides optional product analytics, person profiles and feature-flag delivery on our behalf. The project is hosted in the European Union. PostHog receives analytics data only after your consent.
Oracle Cloud Infrastructure provides the server in Frankfurt, Germany, from which this website and room links are delivered, on our behalf. We operate the web server on it ourselves.
Google Play and Apple may process store, download and device information as independent platform providers under their own policies. If you choose to share a recap, your operating system passes the generated image to the app or person you select.
We do not sell personal data. Where a provider processes data outside the European Economic Area, we rely on the safeguards offered for the relevant service, such as an adequacy decision or standard contractual clauses.
07Retention
Rooms and games
- an unstarted lobby with no activity is deleted after 30 minutes;
- a room with no activity for more than 24 hours is closed;
- a closed room is deleted after 7 days, including its players, games, rounds and guesses.
Your deck
Imported cards are no longer deleted with the room they were played in. They are kept as your personal deck so you can play again without importing every time, and so future generations can avoid repeating cards you already have.
- cards, their topic labels and your import history are kept until you delete them or your account is deleted;
- the record of which cards you have seen is kept on the same basis;
- if the app is not used for 24 months, the deck and everything attached to it is deleted automatically;
- an anonymous authentication user with no remaining player record, no cards and no recent activity may be deleted after 30 days.
Deleting your deck yourself
The app offers two different actions, and they do different things:
- Remove this import deletes the cards from one import, together with their topic labels and the record of which of them have been seen. They no longer appear in games, count towards your deck size or stop your AI writing the same cards again, and importing them again adds them back. The entry recording that the import happened — when, its source and how many cards it had — stays in your import history until you delete all your card data. Where one of its cards is part of a game that is still being played, that row is removed as soon as the game ends.
- Delete all my card data deletes your cards, their topic labels, your import history and the record of which cards have been seen. Nothing is kept to prevent repeats afterwards, so the same cards may be written again by a future import. Where a card is part of a game that is still being played, the row is removed as soon as that game ends; it is excluded from all games, counts and future generation immediately.
Website
Access-log entries, with shortened IP addresses, are deleted after seven days.
Analytics
Your analytics choice is stored on the device. Analytics events and the associated person profile are retained for no longer than 24 months unless earlier deletion is required or requested. Withdrawing consent stops future collection; it does not automatically erase data already processed lawfully. You can request its deletion using the contact details below.
Cleanup runs automatically every 15 minutes, so deletion can occur shortly after a threshold. Support emails are retained only as long as needed to answer the request and meet legal obligations. Local app data remains on your device until you leave the room, clear app data, or uninstall the app, subject to operating-system behavior.
08Security
We use encrypted network connections, anonymous authenticated sessions, database access controls and restricted server functions. No internet service can guarantee absolute security, so please do not import secrets or highly sensitive personal information.
09Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, data portability, or object to processing based on legitimate interests. You may also lodge a complaint with a data protection authority.
Delete your cards in the app: open My deck from the home screen. Delete all my card data there removes your deck, your import history and your seen-card record immediately, without contacting us.
Change analytics consent: tap Privacy at the bottom of the home screen. Choosing Stop sharing stops future PostHog collection on that installation.
Request deletion: Email strehldevs@gmail.com and ask us to delete your data. If available, include your room code, display name, and approximate play time so we can locate the anonymous record.
Our competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.
10Children and changes
Unprompted is not directed to children under 13. Playing does not depend on consent: rooms and games are processed to provide the service you request. The optional analytics is different, because it rests on consent: if you are under the age of digital consent in your country — 16 in Germany — only agree to it with the permission of a parent or legal guardian. If you believe a child under 13 has provided personal data, contact us so we can investigate and delete it where required.
We may update this policy when the app, providers or legal requirements change. The date at the top identifies the current version.