No accounts
You never sign up. You type a display name when you join a room. We keep that name, whether you are voting or watching, and the times you joined and were last seen in the room.
How: there is no sign-up, email field or login anywhere in the service.
What a room stores
- The room's settings: its deck, its timer length, its music choice and whether it has a passcode.
- For each person who joined: their display name, whether they vote or watch, whether they are a moderator, and when they joined and were last seen.
- For each revealed round: the story title, the time, and which card each named person played.
Votes in a round that has not been revealed are never written down. They exist only in the server's memory until the reveal.
How: a round is saved at the moment it is revealed, and not before. Passcodes, the secret that keeps you signed in to a room, and the moderator link's secret are stored only in scrambled form that cannot be read back. The room's own link code is stored as it is, because it is how the room is found.
How long it is kept
A room, with everything in it, is deleted 30 days after it was last used. "Used" means someone joined, a round was revealed, or its settings were changed.
A moderator can delete a single round or all history at any time, and the room's owner can delete the whole room. Deletion takes effect at once. A room keeps its newest 1,000 rounds; older ones are deleted as new ones are saved.
Deleted data can remain in database backups until those backups are replaced.
How: a job runs every hour and removes rooms past that age.
Who can see a room
Anyone who has the room's link, and its passcode if a moderator set one, can join and can read the room's history. Treat the link as you would the contents of the room.
Nobody, the moderator included, can see how someone voted before the reveal. Before then everyone sees only who has voted.
How: room links are long random codes that cannot be guessed, and the server does not send any vote to any browser until the reveal.
Removing your name
On a room's history page you can remove your name from the votes you cast there. The votes stay and show as "Anonymous".
This reaches the votes you cast since you last joined. If you were removed from a room, or signed out because a passcode was set or because you had not visited, you come back as a new participant and cannot reach your earlier votes; a moderator can delete those rounds for you.
Cookies and your browser
We set one cookie for each room you join. It keeps you in that room and does nothing else. It cannot be read by scripts and is sent only to this site. If you do not open the room for 30 days you are signed out of it. The room's owner can come back with the moderator link. Your past votes keep your name.
Your browser also remembers whether you chose the light or the dark theme, whether you turned sound on, and how loud. Those choices stay on your device and are never sent to us. Sound is off until you turn it on, and no music is downloaded before that. When it is on and a room plays music, your browser asks this site for the music file, as it does for any page.
How: there are no advertising, analytics or third-party cookies on this site.
What we do not collect
- We do not store your IP address. A scrambled form of it, which cannot be turned back into the address, is kept for up to an hour to stop abuse such as creating thousands of rooms, and is then forgotten.
- We do not use analytics, trackers, advertising or fingerprinting.
- To keep the service running we may count totals for the whole service, such as how many rooms are open or how many messages were sent. These totals do not identify any room or any person.
- We do not load anything from other companies' servers: no fonts, scripts, images or embeds.
- The application does not write room links, names, story titles or votes to its logs.
How: the site instructs your browser to refuse anything not served by this site, so even a mistake on our side could not load a tracker.
The schema markup builder
The builder at /schema runs in your browser. What you type into it is never sent to this site: there is no form, no upload and no account behind it.
Your draft is kept in your browser’s own storage, on your device, so that a reload does not lose it. It stays there until you press Clear or clear your browser’s data. Anyone who uses the same browser profile can see it.
The builder links to Google’s Rich Results Test and to the Schema.org validator. Nothing is sent to either unless you go there and paste your markup yourself.
How: the page makes no request that carries your text. The only thing it fetches after
it has loaded is the list of Schema.org types, a file served by this site. The draft is one
entry in your browser’s local storage, named ay-schema-draft.
The text tools
The generators and converters at /text run in your browser. What you type into them and what they make stay there: nothing is sent to this site and nothing is kept. There is no account, no draft and no saved setting. Close the tab and it is gone.
A value you copy is on your device’s clipboard, like anything else you copy, for as long as your device keeps it. Clipboard history, clipboard managers and syncing between devices can keep it longer or copy it elsewhere; that is your device’s doing, not this site’s. The address of the page says which tool is open and nothing more.
Passphrases are made from the EFF long word list, by the Electronic Frontier Foundation, under the Creative Commons Attribution 3.0 United States licence. The file is served by this site; nothing is fetched from anyone else.
How: the page makes no request that carries what you typed or made. After it has loaded it fetches two files from this site and nothing else: the word list, only when you open the passphrase tool, which it checks against a checksum built into the page before using a word; and the script that converts long text beside the page, so typing never waits, only when you first use a converter. Your text goes to that script inside your browser and comes back; it is never sent over the network. The tools are not drawn on the server at all, so the server never makes a password. Every random choice comes from your browser’s cryptographic random source.
Barcodes and QR codes
The code maker at /codes makes every code in your browser. What you type into it, the colours and options you choose and the codes it makes stay there: none of it reaches this site or anyone else, and nothing is kept. There is no account, no draft and no saved style. Close the tab and it is gone.
A logo you choose is read on your device and never leaves it. The page reads the image with your browser’s own image decoder, makes a smaller copy in the tab’s memory, and draws the code with that; the file itself is not kept. A code you copy is on your device’s clipboard, and a file you download is wherever your browser saves it, for as long as you keep them. The address of the page says which kind of code is open and nothing more.
Codes are encoded by bwip-js, by Mark Warren, and files are packed by fflate, by Arjun Barrett, both under the MIT licence. Both are part of this site’s own files; nothing is fetched from anyone else.
How: the page makes no request that carries what you typed, chose or added. After it has loaded it fetches one file from this site, and only when you make your first code: the script that makes codes beside the page, so typing never waits, with bwip-js inside it. Your text goes to that script inside your browser and comes back as a picture; it is never sent over the network. The maker is not drawn on the server at all, so the server never makes a code. Where the browser can use your device’s own barcode reader, the page reads the code back with it, on your device; nothing is sent. Surprise me draws its colours from your browser’s cryptographic random source.