What's That Game ("we", "us", "our") is an independent project run by its founding team. We are not yet incorporated as a legal entity — the project is currently operated privately by its founders. If and when we incorporate, this policy will be updated with the company details.
For any privacy question or request, contact us at whatsthatgameteam@gmail.com.
The project founders act as joint data controllers for the purposes of the UK GDPR / EU GDPR.
What's That Game lets you create, store, search and discover party/board games. To do that we store an account for you, the games you contribute (including photos), and your activity — favourites, comments, aliases suggestions, and achievements. We use a small number of third-party providers (Google, Apple, OpenAI, Amplitude, Railway, Cloudflare, Resend, Expo) to sign you in, power semantic search and AI text suggestions, moderate uploaded content, measure how the app is used, host the service, store photos, send account emails, and deliver push notifications. We do not sell your personal data.
| Data | Required? | Why |
|---|---|---|
| First name | Yes | Display, personalisation |
| Last name | Yes | Display, personalisation |
| Username | Yes | Public identity on the platform |
| Email address | Yes | Login, account recovery, service notices |
| Password | Only for email/password sign-up | Authentication — stored only as a bcrypt hash, never in plain text |
| Date of birth | Yes | Age-appropriate content (age ratings, adult-content gating) |
| Country of origin | Yes | Personalisation / regional context (stored as a 2-letter ISO code) |
| Avatar image | Optional | Profile picture (see §3.6 for how images are handled) |
We also automatically record an account role, an active/inactive flag, and account created/last updated timestamps.
You can create or access your account using a third-party identity provider. We do not receive your Google or Apple password.
Sign in with Google — under the openid email profile scopes, Google gives us your:
sub)given_name, family_name)Sign in with Apple — Apple gives us your:
sub) — a stable user ID we use to recognise you on return visitssomething@privaterelay.appleid.com. We accept and store relay addresses and treat them exactly the same as a real email address for all account purposes (login, recovery, service notices).We store these to create and identify your account.
Anything you mark public is visible to other users. Anything you mark private is visible only to you.
When you upload a photo (for a game or your avatar), it is first placed in a private quarantine storage area and screened by our AI moderation provider (see §3.5) before it becomes publicly visible. Approved images are copied to public storage and served via a public URL; rejected images are discarded. We store the image file itself, its storage location, and, for game photos, its display position.
Text you submit (e.g. comments, game descriptions) and images you upload are automatically checked with an AI moderation model before being made public, to detect content such as hate speech or graphic/sexual imagery. This is an automated screening step, not a decision that produces legal effects on you — see §4.
Our app uses Amplitude to understand how the app is used (for example: which screens are viewed and key in-app actions/moments). Amplitude may process a device identifier, app/usage events, and technical data such as device type, OS version and approximate location derived from IP. This helps us improve the product. See Amplitude's privacy policy.
If you enable notifications, we store a device push token and platform (iOS/Android) so we can deliver notifications (e.g. achievement unlocks, announcements) via Expo's push service. We keep a record of notifications sent to you and their delivery status.
Some marketing/social links route through short codes we host (e.g. qr.whatsthatgame.co.uk/<code>). We record an aggregate scan count per link. We do not tie individual scans to your account.
When the app calls our backend, our hosting provider processes standard request metadata (IP address, timestamps, user-agent) for security and reliability. Authentication uses a JWT token stored in a secure, HTTP-only cookie and/or sent as a bearer token from the app.
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, authenticate you | Performance of a contract |
| Store and display the games, photos, comments, aliases and favourites you create | Performance of a contract |
| Semantic search and AI text suggestions (see §5) | Performance of a contract / legitimate interest |
| Automated content moderation of text and images (see §3.5) | Legitimate interest / legal obligation |
| Age-appropriate content gating | Legitimate interest / legal obligation |
| Push notifications | Consent (notification permission) |
| Transactional emails (e.g. password reset) | Performance of a contract |
| Product analytics and improvement (Amplitude) | Consent, where required, otherwise legitimate interest |
| Security, fraud/abuse prevention, debugging | Legitimate interest |
| Service and security communications | Performance of a contract / legitimate interest |
We do not use your data for automated decisions that produce legal effects on you. Automated content moderation (§3.5) only screens content before publication; it does not affect your account status, and rejected content can be appealed by contacting us.
When you create or edit a game, the game's text is sent to OpenAI to:
text-embedding-3-small), stored so your game can be found by meaning-based search.gpt-4.1-nano) or the "brain dump" free-text-to-fields feature.Only the content you submit (game text, comments, images) is sent — not your account credentials. OpenAI processes this as our service provider. See OpenAI's privacy policy. We recommend not putting personal or sensitive information into game text, comments, or photos.
We share data only with providers that help us run the service:
| Provider | Role | What they receive |
|---|---|---|
| Sign-in (OAuth) | Authentication exchange; we receive your basic profile (§3.2) | |
| Apple | Sign in with Apple | Authentication exchange; we receive your Apple ID, email (or relay address) and name (§3.2) |
| OpenAI | Embeddings, AI text suggestions, content moderation | Game/comment text and images you submit (§5) |
| Amplitude | Product analytics | Usage events and device/technical data (§3.6) |
| Railway | Hosting + managed PostgreSQL database | All data needed to run the service, stored at rest |
| Cloudflare (R2) | Photo and avatar storage | Uploaded image files, in quarantine and public storage (§3.4) |
| Resend | Transactional email | Your email address, for account emails such as password resets |
| Expo | Push notification delivery | Your device push token and notification content (§3.7) |
We do not sell your personal data or share it with advertisers.
Our backend and database are hosted on Railway, and our processors (Google, Apple, OpenAI, Amplitude, Cloudflare, Resend, Expo) may process data in Europe or the United States. Where data leaves the UK/EEA, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.
sub)). Private games and their associated content (including photos) are deleted. Public games you contributed are retained anonymously (attributed to "Deleted user") so the platform catalogue remains useful. Comments you posted are retained anonymously. User reports, favourites, alias suggestions, achievements, feedback, and push tokens are deleted.Depending on your location, you have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability.
To exercise any right, email whatsthatgameteam@gmail.com. You also have the right to complain to your data protection authority (in the UK, the ICO).
What's That Game is not directed at children under 13. You must be at least 13 to create an account. We do not knowingly collect data from children under that age. If you believe a child has given us data, contact us and we will delete it. Some games are gated as adult content and require an appropriate age.
Passwords are stored only as bcrypt hashes. Authentication uses signed JWT tokens over HTTPS in HTTP-only cookies. Uploaded images pass through a private quarantine area and automated moderation before becoming public. Access to production data is restricted. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
We may update this policy. We will post the new version with an updated "Last updated" date and, for material changes, notify you in the app.
What's That Game (founding team)
Email: whatsthatgameteam@gmail.com