Privacy Policy

This Privacy Policy explains how Untatu, operated by TATULABS SAS (“Untatu”, “we”, “us”), collects and uses personal data. It is informational: it tells you what we do with your data. For questions or requests, contact us at support@untatu.com. TATULABS SAS is registered in Uruguay under RUT 219325170014. Our postal address is 26 de Marzo 1365, Montevideo, Uruguay.

1. Data we collect

• Account data: nickname, email address, avatar, sign-in credentials and terms acceptance records.
• Date of birth: for Accounts, the date you give us the first time you sign in, so we can apply our minimum age and keep optional analytics off for players under 18. We ask once, after the Account exists. Guests give a date of birth on the join screen, before entering a room; a Guest’s date stays on their own device and is not sent to us, is kept there for up to 12 hours (after that we treat it as not given, so it cannot vouch for the next person on a shared device), and is used only to apply the minimum age and to keep optional analytics off for players under 18.
• Account gameplay history: game type, host status, start and end times, duration and completion status. We also retain aggregate participant counts.
• Feedback: phrase ratings, phrase text, game type, room code and player identifier, including for Guests, to evaluate content and prevent duplicate ratings.
• Surveys: now and then we may ask an Account holder aged 18 or over a few short questions about Untatu — a star rating, a multiple-choice question or a short written answer. Answering is optional. If you answer, we store your answers, the language you answered in, your plan (free or premium) and what prompted the survey, for example that you had just signed up, or the type of game and number of players of a game you had just finished. We also record whether a survey was shown to you, answered or dismissed, so that we don’t ask you too often or ask you the same survey twice. Survey answers are not sent to PostHog or any other analytics provider.
• Payment metadata: plan, status and transaction identifiers from Lemon Squeezy. We never see or store your full card number.
• Technical data: IP address, browser/device information and server logs.
• Optional browser analytics: with your consent, and only for players aged 18 or over, PostHog receives page views, interactions and gameplay events, browser/device details and persistent identifiers. We associate these events with your player identifier and nickname, including when you play as a Guest. This is identified analytics, not anonymous statistics. We do not run this analytics for players under 18, and we do not run it before you have told us your age.
• Anonymous page counts: on the home, sign-in, sign-up and guest pages, PostHog receives anonymous counts of page visits and button taps, whether you use a phone or a computer, and the domain of the website you came from. Nothing is stored on your device, the temporary identifier lives only in the open tab’s memory, and no name, player identifier, room code, location or profile is attached. We never count players we know are under 18, and we do not count you if you refuse browser analytics or your browser sends a Global Privacy Control signal. PostHog may receive your IP address with the request.
• Error reports: PostHog receives limited browser and server error types and diagnostic details. We do not intentionally include player identifiers, nicknames, room codes, request paths or free-form error messages in these reports. PostHog may receive technical information such as an IP address when a report is sent.
• Live Guest data: nicknames and connection/game state are held for the live room. Guest names and identifiers are not saved in Account gameplay history. Browser identity, submitted phrase ratings, browser analytics and error reports have separate lifecycles described below.

2. How and why we use data (legal bases)

• To provide the Service, including live rooms, Account history, authentication and paid access (performance of a contract).
• To secure and maintain the Service and diagnose failures using minimized logs and error reports (where necessary to provide the Service, performance of a contract; where applicable law permits, our legitimate interests in a reliable, secure service). Error reporting is enabled independently of optional browser analytics consent.
• To evaluate game content using submitted phrase ratings (legitimate interests).
• To improve our games and the Service using survey answers (our legitimate interests in understanding what players think of the Service and fixing what doesn’t work for them). Surveys are optional and you can always dismiss them; you can also object by contacting us.
• To count visits to our public pages anonymously and see how people find the Service (our legitimate interests in understanding and improving how people discover us; we never count players we know are under 18). You can object at any time by refusing browser analytics in Cookie settings or by enabling Global Privacy Control.
• To understand usage and improve the product using optional PostHog browser analytics (consent). You can withdraw consent in Cookie settings at any time without losing access to games.
• To send account and transactional emails (contract / legitimate interests).
• To send marketing emails, where permitted and with an opt-out (consent where required).
• To apply our minimum age and set age-appropriate defaults using your date of birth (compliance with a legal obligation; our legitimate interests in protecting younger players).
• To comply with legal obligations, including tax, accounting and lawful requests.

3. Cookies and browser storage

We use cookies, local storage and session storage for sign-in, player identity, room reconnection, preferences and your analytics choice. With consent, PostHog also uses cookies and local storage for analytics identifiers that persist across visits. Its separate error-reporting client uses a temporary in-memory identifier; reports may still contain technical personal data such as an IP address.

A value stored on your device can also be sent to us or our providers when needed: for example, credentials authenticate requests and player identifiers connect you to rooms. See our Cookie Policy for storage purposes, lifetimes and controls. Withdrawing browser analytics consent stops future optional browser collection; it does not itself delete previously received records or stop separate error reporting.

4. Sharing and service providers

We use Fly.io for hosting, Neon (Databricks, Inc.) for our database, Resend for email delivery, PostHog for optional browser analytics and error reporting, Lemon Squeezy for checkout and billing, and Google when you choose Google sign-in. Each receives data needed for its role. Payment and sign-in providers also process information under their own privacy notices, including for their legal obligations. Other players receive your nickname, avatar and the content you share during games, such as text or drawings, as needed to participate in your room.

We never sell your personal data. We may disclose data when required by law or to protect rights and safety.

5. International transfers

Untatu operates from Uruguay. Fly.io hosts our application and Neon hosts our database, both in the United States, and each processes service records and technical data to run them. PostHog processes consented browser analytics, anonymous public-page counts and limited error reports in the United States. These transfers continue while the relevant service is used and for the applicable retention period described below. Transfers of personal data to Fly.io, Neon and PostHog rely on the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), agreed in our data processing agreements with Fly.io, Inc., Databricks, Inc. (Neon) and PostHog Inc. For personal data from the United Kingdom, Neon and PostHog additionally apply the International Data Transfer Addendum issued by the UK Information Commissioner. Fly.io and PostHog are also certified under the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework. Other providers may also process data outside your country. You can request a copy of the safeguards applicable to your data by emailing support@untatu.com.

6. Data retention and deletion

• Accounts and history: we retain Account records while needed to operate your Account. Deleting an Account removes its linked game participations. Session records may remain for aggregate analysis without a room code, nickname or Guest identifier; a registered host reference is cleared on deletion of that host’s Account.
• Live rooms: in-memory gameplay state lasts until the room is removed; the end of a round does not necessarily remove the room.
• Phrase ratings: these are stored separately for content evaluation and duplicate prevention. The player identifier and room code attached to a rating are automatically erased 30 days after it is given, leaving the rating itself with nothing that points back to you. Ratings linked to a registered Account’s player ID are removed when that Account is deleted. If you ask us before the 30 days are up, tell us the player identifier or room details so we can find them.
• Surveys: your answers are stored without your Account identifier, but a separate record of which surveys you were offered — which is how we space surveys out — links them to your Account. That link is erased automatically six months after the survey was offered, and at once if you delete your Account. Your answers are then kept with nothing that identifies you, for as long as they help us improve the Service. A written answer contains whatever you typed, so if you wrote something you want removed, contact us and we will delete it — within those six months your Account is enough for us to find it; after that, tell us which survey it was and roughly what you wrote.
• Browser storage: player identity and preferences can remain after a room ends, until cleared, replaced or expired as described in the Cookie Policy. Account deletion does not remotely clear every device.
• Browser analytics, error reports and logs: after you confirm Account deletion, we ask PostHog to erase the person identified by your Account ID, its linked events and recordings in our configured projects. PostHog processes event deletion asynchronously, and we email you after it reports completion. Error reports without an Account identifier, provider logs and records needed for an investigation or legal obligation may remain for their applicable retention periods. Changing your analytics choice does not erase earlier records.
• Billing, legal records and backups: retention depends on applicable accounting duties, disputes and backup replacement cycles. Data that must be retained for these purposes is handled separately from active Account use. After a deletion request is completed, we retain a one-way hash of the Account ID to prevent an old backup from restoring the Account into active use.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, port, restrict or object to processing, and to withdraw consent without affecting the lawfulness of earlier processing. You can edit available profile details in Settings and change optional analytics consent on the Cookie page. Signed-in players can confirm Account deletion in Settings. We disable access immediately, cancel future recurring charges, remove linked local records and request linked PostHog erasure automatically. This ends any remaining paid access; it does not automatically issue a refund, and mandatory refund rights still apply. You can also contact us to request Account deletion or exercise other rights, including objections to processing based on legitimate interests where applicable. For Guest records, tell us the relevant player identifier or room details if available so we can locate your data. We may need information to verify the request. Marketing messages include an opt-out. You may complain to your local data-protection authority, including Uruguay’s Unidad Reguladora y de Control de Datos Personales (URCDP).

8. Security

Connections to Untatu are encrypted in transit, passwords are hashed, and payment details are handled entirely by our payment processor — we never see or store your card number. No system is perfectly secure, but we work to protect your data.

9. Children’s privacy

The Service is intended for users aged 13 and older, subject to the higher age of digital consent that may apply in your country. The first time you sign in to an Account we ask for your date of birth, and you cannot play until you give one that meets the minimum age. Guests give a date of birth on the join screen before entering a room, on their own device, and cannot join below the minimum age. We do not knowingly collect data from children below the applicable minimum age and will promptly remove any such account we become aware of.

For players under 18, Guests included, optional browser analytics is switched off and is not offered: we do not ask for that consent and do not act on one previously given. It is also off for anyone who has not yet told us their age. Players we know are under 18 are also left out of anonymous page counts. We never show surveys to players under 18, to Guests, or to anyone who has not yet told us their age.

10. Changes to this Policy

We may update this Policy. The effective date shown reflects the latest version, and we will provide notice of material changes.