Privacy Policy
Draft for product review before release.
Operated as Roast My Pic. Effective September 15, 2026 · Version 1.0.
For privacy questions, data requests, deletion assistance, support or safety concerns, contact support@whoroastedme.app.
Playing and operating the game
The game processes your room nickname, photos, chosen context, roasts and actions to run, moderate, protect, measure, debug and improve Roast My Pic. Moderation and safety checks are part of using the service, not optional tracking.
Photos and room visibility
Room members can see gameplay photos. Photos are processed by our AI providers and stored temporarily in private storage. Rooms expire after 24 hours. Photo cleanup runs daily; failed cleanup is retried by later runs, so expiry does not mean immediate photo deletion. Raw photo files, storage paths and permanent photo links are not retained in long-term product analytics. Approved textual observations generated from photos during gameplay may be retained under the one-year policy below.
Saved self Roast Ammo is visible to everyone in the room and can be included in an assigned human writer’s context. Human roast authors are not revealed by the game.
Secret Ammo
Secret Ammo is optional in Cook Me and Friends vs AI. Receiving it is off by default: the target must opt in before friends can contribute private roast context. Facts are moderated. Approved notes may be used by the AI and, in Friends vs AI, the assigned secret human writer. The target does not receive the raw submitted facts or contributor identities. Writer context does not include contributor identities; raw notes are not otherwise shown to other players. Contributors can manage their own submissions under the lobby rules. Approved, authorized facts used as game context may also be retained for product analysis under the one-year policy and deletion controls below.
First-party product analysis
In our controlled data store, we may retain generated roasts, moderated human-written roasts, approved self Roast Ammo and authorized Secret Ammo actually used as game context, and approved AI-generated observations. We also retain information about how roasts were generated, reactions, votes, guesses, outcomes, moderation decisions and performance or reliability measurements. This helps us understand what produced a roast, how players responded and how to improve the game. Raw rejected unsafe submissions are not retained merely for product analysis.
One-year retention
Retained first-party product and comedy analytics have a retention period of up to one year from their original occurrence. Later feedback and outcome updates do not restart that period. Automatic daily cleanup removes expired records on the next healthy run, normally within 24 hours; outages may delay cleanup. Expired records are not recreated by delayed writes. This is not an exact-time physical deletion guarantee.
Identifiers
Gameplay uses identifiers scoped to rooms, games, players and rounds. Product analytics does not introduce a persistent identity for a person or device across rooms. Nicknames are not used as durable analytics identities. This does not mean that everything you share is anonymous: room members can see your nickname, photo and public self Roast Ammo.
External analytics
PostHog receives only approved events, derived measurements and opaque identifiers. It does not receive AI or human roast text, self Roast Ammo, Secret Ammo, generated observations, joke drafts, nicknames, room codes, photos, photo URLs or storage paths, session credentials, deletion keys or Secret Ammo contributor identities. Automatic activity capture, session replay and person profiles are disabled. The content-rich product analysis described above stays in our controlled data store.
Your retained game data
While your room is active, use the same browser you played with to get your private deletion keys. Keep them if you may want to delete retained data after the room expires. They do not identify you in another room.
A key deletes linked first-party records and prevents delayed writes from restoring them. Shared generated content may also be removed when it used your context. This does not remove the live room’s gameplay content. Historical records use their original deletion receipts.
A minimal record of deletion remains to prevent delayed processing from restoring deleted data. Keep your private deletion keys. You do not need an account to play, and we cannot reliably locate your records from a nickname alone or promise to recover a lost key after the room expires.
When you request deletion, we delete eligible data from our active systems and prevent it from being re-added through delayed processing. Copies that exist in backups or separately managed exports may remain temporarily until those systems are rotated or processed through our deletion procedures.
Older improvement records
Older retained improvement records remain governed by the prior improvement-choice system and their original deletion and revocation rules. Their existing deletion keys still work through these controls. We do not relabel those records as new service analytics or backfill old generations without the required source information.
This draft describes the implementation and is not a legal-compliance certification.