Privacy Policy

Draft for product review before release.

Who Roasted Me? at whoroastedme.app. Operated as Roast My Pic. Effective September 15, 2026 · Version 1.0. Draft reviewed September 19, 2026.

For privacy questions, data requests, deletion assistance, support or safety concerns, contact support@whoroastedme.app.

Playing and operating the game

The game processes your room nickname, photos, chosen context, roasts and actions to run, moderate, protect, measure, debug and improve Who Roasted Me?. Moderation and safety checks are part of using the service, not optional tracking.

Sessions and providers

There is no conventional account. A private browser cookie lasts up to seven days and identifies your session; server-side hashes associate it with temporary room membership and protect access. Entry records retain your agreement revision and acceptance time. Security and rate limiting also use hashed session and network references. These are not advertising identities, but they are not anonymous data.

OpenAI processes submitted nicknames, photos and roast context for moderation and, where applicable, generation. In Friends vs AI, xAI also processes submitted photos and authorized roast context to generate roasts. Context includes public self Roast Ammo and authorized Secret Ammo. New names and uploaded photos are checked before being shown to other players; a rejected or unavailable check does not publish the new content. Automated checks can miss harmful content and do not verify a pictured person’s age, identity or consent.

Self Roast Ammo is saved without an AI moderation request. During play, authorized context may be sent to OpenAI and, in Friends vs AI, xAI. Player-written Secret Ammo and human roasts are not pre-screened by AI before save or display. Players are responsible for their content under the Terms. AI-generated roasts retain narrow hard-safety controls. This adult consensual roast game permits harsh, offensive jokes, profanity and adult innuendo; checks address narrow safety boundaries, not ordinary roast intensity. Reporting remains available.

Supabase provides database, private storage and room updates; Vercel hosts the website and server requests. PostHog processes the limited external analytics described below when enabled. Providers may process service, security and diagnostic data under their applicable terms and settings. Our deletion controls do not guarantee immediate deletion from every provider system or backup, and we do not promise zero provider retention.

Photos and room visibility

Room members can see gameplay photos. Photos are processed by OpenAI and, in Friends vs AI, xAI, and stored temporarily in private storage. Rooms expire after 24 hours. Photo cleanup runs daily; failed cleanup is retried by later runs, so expiry does not mean immediate photo deletion. Raw photo files, storage paths and permanent photo links are not retained in long-term product analytics. Approved textual observations generated from photos during gameplay may be retained under the one-year policy below.

Saved self Roast Ammo is visible to everyone in the room and can be included in an assigned human writer’s context. Human roast authors are not revealed by the game.

Secret Ammo

Secret Ammo is optional in Cook Me and Friends vs AI. Receiving it is off by default: the target must opt in before friends can contribute private roast context. Submitted notes may be used by the AI and, in Friends vs AI, the assigned secret human writer. The target does not receive the raw submitted facts or contributor identities. Writer context does not include contributor identities; raw notes are not otherwise shown to other players. Contributors can manage their own submissions under the lobby rules. Approved, authorized facts used as game context may also be retained for product analysis under the one-year policy and deletion controls below.

Safety reports

You can report a visible roast, player or photo from its actions menu. Reports are restricted operational records, separate from product analytics and first-game feedback. They contain your selected reason, the reported item, private room/player references and, where available, source or author information for operator review. Other players cannot read reports or use them to identify anonymous human writers or Secret Ammo contributors.

Report access expires no later than 30 days after the original report, or 7 days after final disposition if earlier. A report about a photo may preserve only that reported image version in restricted storage; access expires 7 days after the original report. Reading, retrying or updating a report does not extend these periods. Daily cleanup deletes expired records and photo evidence on the next healthy run; outages can delay physical deletion. Reports are not sent to PostHog. For report-related data requests or further safety help, contact support@whoroastedme.app.

Temporary player blocks

You can block a known player from their actions menu. We store a private pair of hashed session references and creation/expiry times for up to seven days from the original block. Retries do not extend it. Current games continue unchanged; the pair cannot rematch or join future rooms together while the block is active. Other players cannot see who blocked whom. These restrictions are separate from reports and analytics. Clearing cookies, reinstalling, session expiry or another device can reset this protection. Expired restrictions stop applying immediately and are removed by the next healthy daily cleanup.

First-party product analysis

In our controlled data store, we may retain generated roasts, moderated human-written roasts from earlier games, approved self Roast Ammo and authorized Secret Ammo actually used as game context, and approved AI-generated observations. We also retain information about how roasts were generated, reactions, votes, guesses, outcomes, moderation decisions and performance or reliability measurements. This helps us understand what produced a roast, how players responded and how to improve the game. Raw rejected unsafe submissions are not retained merely for product analysis. New human-written roasts are not retained as raw text in long-term product data; they remain in the temporary room.

Optional first-game feedback records structured ratings and reasons, mode and prompt version through our product-event path. The browser stores a session-only flag when the prompt is shown. It does not include a free-text response, nickname, photo or roast content. Feedback is not an abuse report. Gameplay records also include votes, guesses, reactions and outcomes.

One-year retention

Retained first-party product and comedy analytics have a retention period of up to one year from their original occurrence. Later feedback and outcome updates do not restart that period. Automatic daily cleanup removes expired records on the next healthy run, normally within 24 hours; outages may delay cleanup. Expired records are not recreated by delayed writes. This is not an exact-time physical deletion guarantee.

Identifiers

Gameplay uses identifiers scoped to rooms, games, players and rounds. Product analytics does not introduce a persistent identity for a person or device across rooms. Nicknames are not used as durable analytics identities. This does not mean that everything you share is anonymous: room members can see your nickname, photo and public self Roast Ammo.

External analytics

When enabled, PostHog receives only approved events, derived measurements and opaque identifiers. It does not receive AI or human roast text, self Roast Ammo, Secret Ammo, generated observations, joke drafts, nicknames, room codes, photos, photo URLs or storage paths, session credentials, deletion keys or Secret Ammo contributor identities. Automatic activity capture, session replay and person profiles are disabled. The content-rich product analysis described above stays in our controlled data store.

A minimal record of deletion remains to prevent delayed processing from restoring deleted data. Keep your private deletion keys. You do not need an account to play, and we cannot reliably locate your records from a nickname alone or promise to recover a lost key after the room expires.

When you request deletion, we delete eligible data from our active systems and prevent it from being re-added through delayed processing. Copies that exist in backups or separately managed exports may remain temporarily until those systems are rotated or processed through our deletion procedures.

Older improvement records

Older retained improvement records remain governed by the prior improvement-choice system and their original deletion and revocation rules. Their existing deletion keys still work through these controls. We do not relabel those records as new service analytics or backfill old generations without the required source information.

This draft describes the implementation and is not a legal-compliance certification. Operator identification and provider-processing details still need final review.