Privacy Policy

Controller

Finn Strehl
Kaiser-Friedrich-Ring 142
40547 Düsseldorf
Germany

Email: strehldevs@gmail.com
Phone: +49 176 59058049

Data Unprompted processes

When you use the app, we process the minimum data needed to create a room and run a game:

• an anonymous account identifier and authentication session;
• the display name you choose, room code, room membership, host and ready state;
• the card text, card type and source label you deliberately import;
• guesses, scores, round results, game settings and timing information;
• technical timestamps, connection presence and room activity signals needed for realtime play and cleanup.

The app stores the authentication session on your device. It also stores your active room code, room identifier and display name so you can return after closing the app. Game cards, guesses, scores and rosters are not cached in that local resume record.

What Unprompted does not access

Unprompted does not connect to your ChatGPT, Claude, Gemini or other AI account. We do not receive your AI login details, complete chat history, prompts outside the card bundle, contacts, precise location, camera or microphone data.

The current app contains no advertising SDK, third-party analytics SDK, payment SDK or social profile system. The public website does not set analytics or advertising cookies.

Cards and other people

You ask an AI service directly to prepare cards, review the result, and choose whether to paste the encoded bundle into Unprompted. Only the imported cards cross into the game. Your use of the AI service is governed by that provider’s own terms and privacy policy.

Card text may contain information about you or other people. Only import content you are entitled to share with everyone in the room. Avoid sensitive information and get permission where appropriate.

Purposes and legal bases

You are not required by law to provide gameplay data, but the app cannot run a multiplayer room without it.

Service providers and recipients

Supabase provides anonymous authentication, database hosting and realtime room infrastructure on our behalf. People in your room receive the cards, names, guesses, scores and results required for the shared game.

Google Play and Apple may process store, download and device information as independent platform providers under their own policies. If you choose to share a recap, your operating system passes the generated image to the app or person you select.

We do not sell personal data. Where a provider processes data outside the European Economic Area, we rely on the safeguards offered for the relevant service, such as an adequacy decision or standard contractual clauses.

Retention

• an unstarted lobby with no activity is deleted after 30 minutes;
• a room with no activity for more than 24 hours is closed;
• a closed room is deleted after 7 days, including its players, cards, games, rounds and guesses;
• an anonymous authentication user with no remaining player record may be deleted after 30 days.

Cleanup runs automatically every 15 minutes, so deletion can occur shortly after a threshold. Support emails are retained only as long as needed to answer the request and meet legal obligations. Local app data remains on your device until you leave the room, clear app data, or uninstall the app, subject to operating-system behavior.

Security

We use encrypted network connections, anonymous authenticated sessions, database access controls and restricted server functions. No internet service can guarantee absolute security, so please do not import secrets or highly sensitive personal information.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, data portability, or object to processing based on legitimate interests. You may also lodge a complaint with a data protection authority.

Request deletion: Email strehldevs@gmail.com and ask us to delete your data. If available, include your room code, display name, and approximate play time so we can locate the anonymous record.

Our competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

Children and changes

Unprompted is not directed to children under 16. If you believe a child has provided personal data, contact us so we can investigate and delete it where required.

We may update this policy when the app, providers or legal requirements change. The date at the top identifies the current version.