Privacy

Account and gameplay data

Creating a player stores the username you choose and a 4-digit PIN. The PIN is stored only as a hash — never in plain text, and never alongside gameplay data.

Playing stores your matches and recorded runs — the questions served, your answers, timing, results, and ratings — plus challenge links, live rooms, packs you create, and reports you submit. A report keeps the reported content revision, your reason and optional details, and the outcome; a pack’s creator never sees who reported it.

The server also records a small set of named product events — onboarding completed, match started and completed, live invite created and joined, challenge created and claimed, and question reported. These events never contain passwords, tokens, PINs, email addresses, or answer keys.

Anonymous analytics

Vercel Web Analytics and Speed Insights measure anonymous traffic and performance — pages, referrers, approximate country, device type, and loading responsiveness. Before a URL is sent, Touché strips query strings and replaces challenge tokens, room codes, and match IDs with route templates such as /c/[token]. Web Analytics sets no cookies. See Vercel’s Web Analytics and Speed Insights privacy documentation.

Storage, sessions, and deletion

Game and account data are hosted with Supabase in the EU (Ireland); the application runs on Vercel. After Create or Log in, a necessary session keeps you signed in on that device. Encrypted database backups are retained for 30 days.

Data is retained while early access runs. There is no self-serve deletion screen yet — to delete your player and its data, email rishi@touche.live naming the player; requests are honoured manually.