Privacy Policy
otsyy is a real-time party game app (Mafia, Truth or Dare) that you play together in a room, on your phone's browser or in the app. This policy explains what data we collect, how we use it, who we share it with, and the choices you have. Contact: admin@otsyy.com.
1. Signing in
To play, you sign in with your Google account. Sign-in is handled by our authentication provider, Supabase, which receives from Google your Google account ID, your email address, your name and your profile picture link.
- What we keep in our own database: your Google account ID (so you can sign back in) and a display name, which starts as your first name from Google and which you can change. We don't store your email address or profile picture in our database, and we never see your Google password.
- What Supabase keeps: its own record of your sign-in, including your email address, name and profile picture link, so that Google sign-in works.
- We don't use your email address to contact you or for marketing.
- Your avatar is a cartoon generated from a random value, not your Google picture.
- On iPhone you can also link Sign in with Apple from your profile. We then keep your Apple account ID, the same way as for Google.
New players no longer get a guest account based on a device identifier. If you played before as a guest, signing in with Google keeps your existing account and its history.
2. Data we collect
| Data | Why |
|---|---|
| Account: a user ID we generate, a username (auto-assigned, editable), your display name, an avatar seed, and your Google account ID. | To sign you in and show your name and avatar to the other players in your room. |
| Gameplay: rooms you create or join, your moves in a game (for example Truth or Dare choices, Mafia votes and roles), emoji reactions, and a game history (game type, player count, duration). | To run the game in real time and show stats such as your most-used emojis. |
| Product analytics (see section 3): which screens you open and what you do in the app, your device type, operating system, app version, browser language, and how you found us (link, QR code, referring site, campaign tags). | To understand how the app is used, find problems, and improve it. |
| Push notifications (only if you allow them): a push token or web push subscription for your device. | To tell you when it's your turn or a vote has opened while the app is in the background. |
| Purchase records (if you buy an upgrade): order/transaction ID, amount, currency, tier and status. Card details are handled by the payment provider and never reach us. | To unlock paid features and keep records of transactions. |
| Camera (optional, app only): used on your device to scan room QR codes. Images are not stored or uploaded. | To join a room by scanning its code. |
| Technical data: IP address and request logs on our servers, and crash and error reports from our servers. | To keep the service secure, prevent abuse, and fix errors. |
We don't collect your precise location, contacts, photos, microphone audio, or advertising ID. Truth or Dare prompt text is never sent to our analytics.
3. Product analytics
We use PostHog to measure how the app is used, for example how many people join a room from a shared link, or where people give up. Events are linked to your user ID once you're signed in (before that, to a random ID stored on your device). They include the event name and details such as the game type, plus your device type, operating system, app version, language and, on the web, the page address.
- PostHog may work out an approximate location (such as country or city) from your IP address.
- The first time you open the app we record how you arrived: campaign tags in the link (such as
utm_source), the referring website, and whether you came through a join link. - We don't send your email address, the names you type, or any game prompt text to PostHog.
Advertising measurement (web app, only if you allow it)
We advertise otsyy on Instagram and Facebook. The first time you open the web app, it asks whether we may use Meta's ad cookies. Only if you tap Allow do we load the Meta Pixel and tell Meta when you view a page, create or join a room, start a game, or sign in. We send this from your browser and from our server (Meta's Conversions API), so that Meta can count which of our ads led to people playing and show our ads to people more likely to enjoy the game.
- What Meta receives: the event and the page address, the game type and whether you're the host, your IP address and browser details, Meta's own cookies (
_fbp, and_fbcif you arrived from one of our ads), and a one-way scrambled (hashed) version of your user ID. Not your email, the names you type or any game content. - Meta may combine this with what it already knows about you if you have a Meta account; that use is covered by Meta's privacy policy.
- If you tap No thanks, none of this happens. You can change your answer any time from the menu (☰ → Ad cookies); choosing No thanks then stops it and removes Meta's cookies from the app.
- The iOS and Android apps don't use the Meta Pixel.
4. How long we keep data
- Rooms and games in progress are kept in our real-time database (Redis) and expire automatically 6 hours after the room was last updated.
- Your account and game history are kept while your account exists.
- Analytics, server logs and crash reports are kept according to our providers' retention settings.
5. Deleting your account
You can delete your account in the app: Profile → Delete account. When you do:
- your Google sign-in link to the account is removed, so signing in again creates a new, empty account;
- your username, display name and avatar are replaced with anonymous values;
- your emoji stats and push notification subscriptions are deleted;
- your game history is kept only in anonymous form, no longer linked to you, for overall statistics;
- purchase records may be kept where tax and accounting law requires.
Deleting your account in the app doesn't yet remove the sign-in record kept by Supabase or past analytics events in PostHog. To have those removed too, email admin@otsyy.com and we'll delete them.
6. Who we share data with
- Other players in your room see your display name, avatar, and what you do in the game.
- Service providers that run parts of the service for us, and process data only on our behalf:
| Provider | What for |
|---|---|
| Supabase | Google sign-in, and our main database |
| Google (Google Cloud; Google sign-in) | Hosting our servers; signing you in |
| Upstash | Real-time game data (Redis) |
| Cloudflare | Hosting the web app and website, networking and security |
| PostHog | Product analytics |
| Meta Platforms (Instagram, Facebook) | Measuring our ads, only if you allow ad cookies in the web app (see section 3) |
| Sentry | Error and crash reports from our servers |
| Expo, Apple and Google push services; your browser's push service | Delivering push notifications |
| DiceBear | Drawing avatars (your device asks it for the picture for your avatar seed) |
| Razorpay (and Apple or Google for in-app purchases) | Payments, if you buy an upgrade |
| Google Fonts, QR Server (api.qrserver.com) | On this website only: fonts, and the sample QR code drawn when you type a room code |
We also share data with authorities when required by law or to protect rights and safety. We don't sell your personal data. Apart from the ad measurement you can allow in section 3, we don't share it for advertising.
7. Storage on your device
We use no tracking cookies unless you allow Meta's ad cookies (section 3). The web app stores a few things in your browser's local storage: your sign-in token, the room you're in (so a reload brings you back), your player name and game settings, whether you've been asked about notifications, a random analytics ID, and your answer about ad cookies. Its offline support (a service worker) caches the app's files. The phone apps keep the same kind of data in the device's secure storage. Clearing your browser data or signing out removes them.
8. Security
Data travels over HTTPS/TLS and access to our systems is restricted. No method of transmission or storage is perfectly secure, but we work to protect your data.
9. Children
otsyy is not directed at children under 13 (or the minimum age in your country). We don't knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your data, and to object to or restrict certain processing. Email admin@otsyy.com to exercise these rights.
11. International transfers
Our providers may process data in countries other than your own.
12. Changes
We may update this policy. We'll change the effective date above when we do and, for important changes, tell you in the app.
13. Contact
otsyy · admin@otsyy.com