Privacy Policy

• You can play as a guest. We collect only what the game needs to run and stay safe.
• We do not sell your personal information or use third-party analytics. Our pages show ads, and our guide and information pages also show Google ads that Google may personalize using cookies; you can turn that off (see “Ads”).
• Players under 13 can play only as guests, with preset chat, and we do not record analytics for them.
• You can ask us for a copy of your data, or to correct or delete it, at any time.

• Game data: your nickname, team, guesses, chat messages and scores in a room, which the other players in that room can see.
• A random session ID stored in your browser, to reconnect you to your game. It is also sent as a device ID, so we can stop one device joining a room twice, give you your seat back, limit how fast requests can be sent and honour room bans. It is random: it is not worked out from your browser or device, and clearing your browser storage replaces it.
• Your IP address, to keep the service secure: limiting how fast requests can be sent, blocking abuse, honouring room bans and counting unique visits.
• A country hint worked out by our game server from your IP address, using DB-IP’s free country database (IP Geolocation by DB-IP). It is used to apply local rules such as India’s and to show your country flag. We never ask for or store your precise location.
• Your settings (such as sound and theme) and your age answer, stored in your browser.

• Account: from Google, your email address, name and profile picture; from Discord, your Discord ID, username, avatar and email address. We also keep your Taboo Party username, country, friends, game history and statistics, coins, items, word packs you create, and settings.
• Age: your age group, how we learned it, the version of our age rules that applied and, if you are under 18, the month you turn 18. We do not keep the birth date you enter.
• Purchases and tips: what you bought, when, the amount, the payment method and the order ID, and for UPI the reference number you enter. Stripe handles card details; we never see them. We never collect bank details or UPI PINs.
• Supporter wall: when you tip, the name you choose (or “Anonymous”), the amount and the currency are shown publicly on the supporter wall.
• Advertisers: your name, email address, ad image and link, and booking and payment records.
• Messages to us: what you send us by email or Discord, reports you send with the in-game Report button (the reason, your details, the room code, your nickname, the reported player’s nickname and the reported message), and word or feature suggestions you make in the game (with your nickname and room code).

Voice guessing and the describer’s taboo check are optional and use your browser’s speech recognition, which needs your permission to use the microphone. Your browser turns speech into text; in some browsers, such as Chrome, the audio is processed by the browser maker’s speech service (for Chrome, Google). Taboo Party receives only the recognised words for the current turn and never records or stores audio.

We run our own first-party product analytics to understand how the game is used, find where players get stuck, and see whether our paid plans work. We do not use third-party analytics services.

We record events such as creating a room, starting or finishing a game, seeing an offer and completing an order. With each event we keep a random identifier, your account ID if you are signed in, the room code, the platform (web, Discord Activity or app) and a few non-identifying details such as the game mode. Outside the EU, EEA and UK the random identifier is stored in your browser; in the EU, EEA and UK it is kept only in memory for your visit and nothing is stored on your device.

We do not record these events on a device where the player has told us they are under 13. We keep analytics events for 13 months and then delete them. We do not sell or share this data, and we do not use it for advertising or to build advertising profiles.

• To provide the game and your account: rooms, scores, friends, purchases and receipts (necessary to provide the service you asked for).
• To keep Taboo Party safe: filtering chat, stopping cheating, spam and abuse, and securing accounts (our legitimate interest in a safe service, and our legal duties).
• To improve the game: product analytics in aggregate (our legitimate interest; you can object at any time).
• To show ads that pay for the servers: Google may personalize its ads using cookies (with your consent in the EU, EEA, UK and Switzerland; elsewhere our legitimate interest in keeping the game free, and you can opt out).
• To follow the law: tax and accounting records, age rules, and answering lawful requests.

Ads

Ads booked directly with us are contextual: every visitor on a page sees the same ad, and we send those advertisers no information about you.

Our guide and information pages (such as How to play, About and our comparisons, never the game itself) also show ads from Google AdSense. Google and its partners use cookies and similar technology to show ads based on your visits to this and other websites, which are called personalized ads. Google’s use of advertising cookies lets it and its partners serve ads to you based on your visits here and elsewhere on the internet. You can read how Google uses information from sites that use its services.

You can turn off personalized ads in Google’s Ads Settings, and opt out of other companies’ personalized ads at aboutads.info. In the EU, EEA, UK and Switzerland, Google asks for your consent before showing personalized ads, and you can change your choice at any time from the privacy settings link on our pages.

Google ads never appear in game rooms, in the Discord Activity, for TabooPlus members, or on a device where the player has told us they are under 13. TabooPlus members see no ads.

We do not sell your personal information. Google collects information directly through its ad code on our guide and information pages (see “Ads”); otherwise, service providers process data on our behalf:

• Hosting and storage: Vercel (website and ad images), Oracle Cloud (game server and country hint) and Supabase (database and sign-in).
• Sign-in and platforms: Google and Discord when you sign in with them; Discord, Apple and Google Play for purchases made through them.
• Payments: Stripe for cards. For UPI, the payment QR code image is generated by QR Server (it receives our UPI ID, the amount and the order ID, not your details), and we match payments using our own bank’s payment emails in our Gmail account.
• Content: GIPHY serves GIFs in chat (players under 13 cannot use GIFs); your browser loads profile pictures from Google or Discord and ad images from the advertiser’s chosen host, so those hosts see your IP address (except on a device where the player has told us they are under 13, see below).
• Advertising: Google AdSense, on our guide and information pages, receives your IP address, browser and device details and cookie identifiers from your browser to show, personalize and measure ads.
• Error reports: Sentry receives details of errors in the website and game server (the error, the page or server path, and browser and device type) so we can fix them. It does not store your IP address, and we remove cookies, links’ query details and messages before reports are sent.
• Email and alerts: Brevo sends emails to advertisers; we receive order and booking alerts and in-game reports in a private Discord channel. Tournament players who opt in get tournament emails (schedule, reminders, results) sent through Brevo, and can turn them off from the tournament page or the link in each email.

Under some US state laws, letting Google personalize ads can count as “sharing” personal information. You can opt out of that sharing by turning on Global Privacy Control in your browser, by answering the privacy message Google shows on our pages, or in Google’s Ads Settings.

We may disclose information if the law requires it, to protect players’ safety, or as part of a sale or transfer of Taboo Party (we would tell you first). Our providers store data in the United States and other countries; we rely on their data protection terms, including standard contractual clauses where required.

Other players in your room see your nickname, team, profile picture or avatar, equipped items, chat, guesses and scores. Signed-in players appear on leaderboards with their username, country flag and statistics unless they turn on anonymous mode. Your friends can see when you are online and which room you are in. Tippers appear on the supporter wall with the name they chose and the amount.

We only use cookies and browser storage that the game needs: a sign-in cookie that keeps you signed in, your session ID, settings, your age answer, cached shop data, and details of a payment in progress. Outside the EU, EEA and UK we also store the random analytics identifier described above.

On our guide and information pages, Google AdSense also sets advertising cookies, which Google can use to show you personalized ads across websites. See “Ads” above to turn personalization off.

We treat a Global Privacy Control signal as a request not to sell or share your information: when your browser sends it, Google shows you only non-personalized ads (Google may still use cookies to limit how often you see an ad, prevent fraud and count views). Do Not Track has no agreed meaning, so we use Global Privacy Control and Google’s settings instead.

Taboo Party is for a general audience. Anyone can play as a guest without telling us their age. Accounts are for players aged 13 and over: when someone creates an account we ask for their birth month and year, and if they are under 13 we do not create an account and do not ask Google or Discord for any of their information.

A player who tells us they are under 13 can keep playing as a guest with a generated nickname, preset chat phrases and no GIFs. For these players we collect only the session ID, IP address, country hint and game data described above, and we use them only for these internal operations: running and reconnecting the game, keeping it secure, preventing cheating and abuse, and meeting legal duties. We prevent other uses: no account, no analytics events, no ads, no contact from us, and no sharing beyond the hosting providers that run the game.

On a device where the player has told us they are under 13, the game does not load GIFs, other players’ profile pictures from Google or Discord, or ads, so GIPHY, Google, Discord and advertisers’ image hosts do not receive the child’s IP address from the game. A neutral “[GIF]” label or the player’s initial or chosen avatar shows instead.

This information is deleted on the schedule in “How long we keep data” below: game data when the room closes (or within 12 hours), and server logs after about 10 days. Parents or guardians can ask us to review or delete their child’s information, or to correct an age entered by mistake, by emailing anshlaw505@gmail.com.

Your age answer is used only to apply our age rules. We keep a signed marker of your age group in your browser so we do not ask again on that device, and the same details on your account if you have one. Accounts created inside the Discord Activity are recorded with an unknown age group, because Discord does not share ages with apps, and use the same safety settings as guests.

From 13 May 2027, India’s Digital Personal Data Protection rules for children (anyone under 18) apply. From that date players in India will be asked their age before they play, and accounts for players in India under 18 will need verifiable consent from a parent or guardian. We use the country hint from your connection to decide whether those rules apply.

• Room data and chat: while the room is open. A recovery copy (including players’ IP addresses and session IDs) is deleted when the room closes, or at most 12 hours after its last update. If a team disputes a tournament match result, that match’s chat is kept as evidence for the organizers until the dispute is resolved, then deleted. A finished tournament’s public recap shows each player’s tournament stat totals next to their username.
• Server logs, which include IP addresses, are kept for about 10 days. IP addresses used for rate limiting are held only in memory.
• Age marker in your browser: 12 months after you last use it. A sign-up age record, when used, expires after 10 minutes and is deleted within a day.
• Analytics events: 13 months. The nickname and room code on word suggestions and feedback are removed after 12 months; feature ideas are deleted after 12 months.
• Your account, statistics, friends, items and word packs: until you delete your account or ask us to.
• Orders and tips: as long as tax and accounting law requires (up to 8 years). Unpaid or expired orders: 30 days. Supporter wall entries: until you ask us to remove them.
• Advertisers: unused ad images after 24 hours, rejected ad images straight away, booking and payment records as long as accounting law requires.

We protect data with encrypted connections, encrypted databases, access controls and limits on who can see what, and we review these safeguards every year. No system is perfectly secure. If a personal data breach affects you, we will tell you without delay, along with the authorities where the law requires it.

You can ask us to give you a copy of your data, correct it, delete it or your account, move it to another service, or stop or limit using it. Where we rely on your consent, you can withdraw your consent at any time as easily as you gave it. In India you can also nominate someone to exercise these rights for you.

If you are signed in, you can download a copy of your data and delete your account yourself from your profile (Customize Profile, then Your data). Deleting your account removes your profile, statistics, friends, items and word packs. We keep paid order records because tax and accounting law require it, but we remove their link to you, and your supporter wall entries show “Anonymous”.

Email anshlaw505@gmail.com from the email address on your account, or tell us your username or Discord ID, so we can confirm it is you. We reply within 30 days at the latest (Indian law allows up to 90 days). This applies to Discord Activity players too.

If you are unhappy with our answer, you can complain to the Data Protection Board of India, the data protection authority in your EU or EEA country, or the UK Information Commissioner’s Office.

We will post any change here with a new date, and tell you in the game before an important change takes effect.