Privacy and your data

When you play

You choose a name and an emoji. Everyone in the room sees them. Room codes are not private access keys: anyone with the room code or room ID can retrieve player names, answers and scores.

The room stores your answers, including what you have typed so far while the timer runs, your votes and your scores.

Your browser gets a random guest ID so the game knows which seat is yours. It holds no name and no email address.

What the AI models receive

When a round is judged, the prompt and all answers go to the AI judges the host picked. A roast sends the prompt and the one answer being roasted.

The text travels through OpenRouter, which passes it to the company behind each model: Anthropic for Claude, Google for Gemini, OpenAI, and xAI for Grok. Answers are labelled with a letter. Player names are not sent.

Those companies handle the text under their own policies. We do not control whether or how long they keep it, so leave private details out of your answers.

AI-made prompts are requested with the room's language and tone only.

Answers we keep after the game

After each round that players voted on, we keep a copy of the prompt, the answer texts, the vote counts and the AI judges' rankings and explanations. We use it to check how well the judges match what players found funny.

The copy has no player names and no guest IDs. It does hold every answer exactly as typed, so an answer that names a person still names them.

We do not delete these copies on a schedule.

How long a room stays

When someone closes a room, the room and its players, answers, votes and results are deleted between 24 and 25 hours later.

A room waiting in the lobby, on a scoreboard or on the final screen is closed automatically once no player's phone and no controlling screen has had it open for 24 hours. This check runs every hour. The room is then deleted the same way. A shared screen that only displays the room does not count as use.

A room left in the middle of a round is not closed or deleted automatically at the moment.

Accounts and payments

Only the person who pays needs an account. Clerk runs the sign-in and stores your email address and login details.

Our database stores a wallet tied to your Clerk account ID. It holds your credit balance and every change to it. For each purchase it holds the pack, the amount, the currency, the time and Stripe's reference numbers.

We never receive your card number. Stripe takes the payment through its Link service as the seller, and holds your payment details, receipts and invoices.

Purchase and credit records stay when a room is deleted.

Usage counts

We count visits, rooms created, joins, matches started and finished, checkouts and purchases, to see whether the game works for people. These records hold no names, email addresses or answers.

Each record holds the language, a campaign tag if the link you followed had one, and a keyed hash of your guest ID or account ID. The hash is not the ID itself, but it is the same every time for the same browser or account. That makes these records pseudonymous, not anonymous.

We delete them after 180 days.

Two smaller records use the same kind of hash. One remembers which built-in prompts a host has already seen, so they do not repeat. The other remembers that a free trial match was claimed, and is kept so a trial cannot be claimed twice.

Cookies and browser storage

• The cookie quiplash_session holds your signed guest ID. It lasts 30 days and is renewed while you play. Without it you lose your seat.
• The cookie aiplash_lang holds your language. It lasts a year if you picked the language yourself and 12 hours if it came from a link or a room.
• Clerk sets its own cookies to keep you signed in.
• Your browser's storage holds your seat and recovery keys per room, your name and emoji, your sound settings, a campaign tag for up to 30 days, and a marker that stops a double payment.

The site loads no advertising and no third-party analytics scripts. Stripe's checkout page is on Stripe's own site and sets its own cookies.

Companies that handle data for the service

• Vercel serves the website.
• Convex runs the database and the game server.
• Clerk runs sign-in.
• Stripe, through Link, takes payments.
• OpenRouter and the AI companies named above receive prompts and answers.

Like any website, the companies that serve it see your IP address and browser details when you connect. Most of these companies are based in the United States, so your data can be processed there.

What you can do yourself

Clear this site's cookies and storage in your browser to drop your guest ID and saved seats from that device.

Close a room from the room menu to have it deleted about a day later.

Ask Link to delete the payment data it holds about you.

European privacy law gives you the right to see, correct and delete your personal data, and to complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.