Privacy policy

1. Who we are

OUCH! Hot Potato Party Games (“OUCH!”, the “app”) is published by Cherry Pub LLP, registered office 71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ, company number OC431055 (“we”, “us”). We are the controller of the personal data described here. Contact: app@greentomatomedia.com.

Greentomatomedia Limited, a member of Cherry Pub LLP, runs OUCH!’s servers and content service and answers support emails on our behalf, as our processor: it uses your data only on our instructions.

This policy covers the OUCH! app for Android and this website, ouch-hot-potato.web.app. Google Play has its own privacy policy.

2. What stays on your phone

OUCH! is played on one phone, and most of what makes your party yours never leaves it:

• Players’ nicknames. Quick Fire Dares uses them on the phone. They never reach us.
• Your custom packs: the cards you write and the AI cards you keep.
• Your settings: language, sound, vibrations, chaos level, who’s playing, and which cards your group has already seen.

If backup is on, Android can include these in your own Google backup, under your Google account’s settings; we can’t see that backup. Uninstalling OUCH! deletes them from the phone.

3. What we collect and why

3.1 Your Install ID

The first time OUCH! goes online, Firebase Authentication (Google) gives your install a random ID. There is no sign-in screen, and no name or email is involved. You can see the ID in Settings → Install ID. Our server uses it to know whether you have Premium, to count AI cards, and to find and delete your data when you ask. Google keeps its sign-in logs, which include your IP address, for a few weeks. Deleting your data, or installing the app again, gives you a new ID.

3.2 Cards, packs and the app’s texts

The app downloads its cards and packs from our content service (gtmcontent.com) and its texts from our server, so new packs and fixes arrive without an update. These requests carry your language, the app’s version and the type of phone (Android), and, like any connection, your IP address. They don’t carry your Install ID. When you play Categories or Quick Fire Dares, the app also tells our content service which category cards were shown or skipped and which Quick Fire Dares cards were done or failed, by card number and without any ID, so we can make the packs better.

3.3 Usage statistics, only if you say yes

The first time you open OUCH!, right after the two quick questions about your group, the app asks once whether you’d like to share usage statistics. Until you answer, the events wait on your phone, and “No, thanks” deletes them.

If you say yes, the app sends our server events about how OUCH! is played: the modes and packs you pick, how long rounds last, how many passes there were, which cards were skipped (by card number), the screens you open and the paywalls you see. The same events go to Google Analytics for Firebase, run for us by Google, which also uses a random app-instance ID and works out your approximate country from your IP address. Events never include your players’ names, your AI ideas or the text of your cards.

Google Analytics’ advertising features are off: ad storage, ad user data and ad personalisation are denied, and the app has no access to the advertising ID. You can change your answer at any time in Settings → Usage Statistics; turning it off stops new events at once.

3.4 Our own records

Whatever your statistics answer, our server records what it needs to run OUCH! and keep it fair and affordable, linked to your Install ID: when the install first reached us; Premium purchases, renewals, cancellations and refunds (from Google Play, through Adapty) and which paywall a purchase came from; each AI pack made (the mode, how many cards, whether it worked, whether it was your free pack and what it cost us); your daily AI card count; your answer to the AI packs question; and the reports you send (3.8).

3.5 Crash reports

If the app crashes, it sends a technical report to Firebase Crashlytics (Google): the phone model, the Android version, the app version, a random ID for this installation and what went wrong. Reports contain no names, ideas or cards.

3.6 Keeping the app genuine, and tuning the game

• App Check with Play Integrity. When OUCH! talks to our server, Google Play confirms that the request comes from the real OUCH! app on a genuine Android device, so our server can tell real requests from fake ones. Google looks at information about your device and the app to do this; we receive only a pass or fail token, not your device’s identifiers.
• Remote Config. The app fetches settings from Firebase Remote Config (Google), such as how long rounds last, so we can tune the game without an update. Remote Config uses a random Firebase installation ID. Sometimes we try two settings against each other (Firebase A/B Testing): your install may get either one, and the results are measured only from people who share usage statistics.

3.7 Custom AI packs

To make AI cards, you type a short idea, such as “Christmas team building”. Before your first AI pack, the app asks for your agreement, and nothing is sent until you say yes. You can withdraw it at any time in Settings → AI Packs. Then:

• the app sends your idea, the mode, the number of cards, your chaos level and your language to our server;
• our server refuses ideas that contain an email address, a phone number or a link, and sends the rest to OpenAI (OpenAI OpCo, LLC, United States), our AI provider, which checks it for safety and writes the cards;
• with each request, our server sends OpenAI a one-way code made from your Install ID (not the ID itself), so OpenAI can spot abuse;
• the cards come back to the app and are saved in your custom pack, on your phone.

OpenAI doesn’t use your ideas or cards to train its models, and our requests ask OpenAI not to store them. OpenAI may keep them for up to 30 days only to check for abuse, unless the law requires longer, and then deletes them. We don’t keep your idea or the cards on our server: we record only that a pack was made, how many cards it had and what it cost. Friends’ names are fine if they’re in on the joke; please leave out anything private, such as addresses or phone numbers.

3.8 Reported AI cards

Every AI card has a report flag. If you report a card, the app sends us the card’s text, the reason you chose, your note if you wrote one, the mode and your language, linked to your Install ID. It is the only time a card’s text leaves your phone, because you chose to send it. The people who make OUCH!’s cards review reports to remove harmful content and improve the AI packs. A report is kept for 180 days, then deleted automatically. If you’re offline, the report waits on your phone and goes when you’re back online.

3.9 Premium and payments

Premium is a subscription bought through Google Play. Google handles the payment: we never see your card or bank details. We use Adapty (Adapty Tech Inc., United States) to manage subscriptions. Adapty receives your Install ID, so Premium follows your install; your subscription status and history from Google Play; and basic device information, such as the phone model, Android version, app version, store country and language. Like any online service, it sees your IP address when the app connects. It doesn’t receive your advertising ID. Our server keeps a record of each purchase: the plan, the price, the dates and Google Play’s order number.

3.10 Emails to us

If you email us, we receive your message, your email address and anything you choose to send, such as your Install ID. We use them to answer you and, for a deletion request, to find and delete your data.

3.11 What we don’t do

OUCH! has no accounts and no sign-in. It doesn’t ask for your contacts, location, camera or microphone. It shows no ads and has no advertising SDK. We don’t sell or rent your data, share it for advertising, or track you across other companies’ apps and websites.

4. How long we keep it

5. Who receives your data

• Service providers that process data for us under contract: Greentomatomedia Limited (servers, content service and support); Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase Hosting, Crashlytics, Google Analytics for Firebase, Remote Config and App Check); OpenAI (Custom AI packs); and Adapty (subscriptions). They must keep your data confidential and secure.
• Google Play processes your purchases and the Play Integrity checks as an independent controller, under its own terms.
• Authorities when the law requires it, and a buyer of OUCH! if it is ever sold (you will be told).

We don’t sell or rent personal data, and we don’t share it for cross-context behavioural advertising.

6. Where your data is stored

Our database and server run in the European Union (Google, europe-west1, Belgium). Some providers work elsewhere: Firebase Authentication runs from Google’s data centres in the United States; Crashlytics, Google Analytics, Remote Config, App Check and Firebase Hosting run on Google’s infrastructure around the world; OpenAI and Adapty are in the United States; and our content service runs on servers in the United States. When data leaves the UK or the EEA, we rely on adequacy decisions (such as the EU-US Data Privacy Framework and its UK extension, where the provider is certified) or on Standard Contractual Clauses.

7. Legal bases (EU and UK)

• Contract: to give you the game, its cards and texts, Premium, the AI packs you ask for, restored purchases, answers to your emails and the deletion you request.
• Consent: usage statistics, which start only after your yes, and sending your AI idea to OpenAI. You can withdraw consent at any time in Settings; that doesn’t affect what happened before.
• Legitimate interests: the Install ID and our own records, crash reports, App Check, Remote Config and its tests, card statistics, server logs, reviewing reported cards, and keeping OUCH! secure and free of abuse. You can object (section 9).
• Legal obligation: tax and accounting records, and answering lawful requests.

8. Deleting your data

In the app: Settings → Delete My Data, then Yes (you need to be online). This immediately:

• deletes what our server keeps about your install: its record, AI card counts, subscription records and the reports you sent;
• deletes your profile at Adapty and your Install ID at Firebase Authentication;
• removes your Install ID from our events, which can then no longer be linked to you and expire on their normal schedule;
• gives the app a new Install ID. Your custom packs, players and settings stay on your phone.

By email: write to app@greentomatomedia.com with your Install ID (Settings → Install ID, tap to copy). We delete your data and confirm within 30 days. Step by step: Delete my data.

What deletion doesn’t do:

• It doesn’t cancel Premium. Your subscription belongs to your Google Play account: cancel it in Google Play, or use Restore in the app to bring Premium back on this install.
• Purchase records are kept for 6 years for tax and accounting. Crash reports expire after 90 days, and Google Analytics data, which isn’t linked to your Install ID, after at most 14 months.
• Uninstalling the app deletes what’s on your phone, but not what our server keeps, and it doesn’t cancel a subscription.

9. Your rights

Depending on where you live (for example the EU, the UK, or US states such as California), you can ask us to give you access to your data or a copy of it, correct it, delete it, restrict it, or stop processing it on the basis of legitimate interests, and you can withdraw consent at any time. We will not treat you differently for using your rights.

You can do most of this in the app: Settings → Usage Statistics, Settings → AI Packs and Settings → Delete My Data. For anything else, email app@greentomatomedia.com with your Install ID: since OUCH! has no accounts, the ID is how we find your data. We answer within one month (45 days under US state laws).

OUCH! makes no decisions about you with legal or similarly significant effects. The AI writes cards, our safety checks may refuse an idea, and the potato decides who gets roasted.

You can also complain to a data protection authority, for example the UK Information Commissioner’s Office (ico.org.uk) or the authority in your EU country.

10. Children

OUCH! is for people aged 13 and over and is not directed to children under 13. We don’t knowingly collect personal data from children under 13. If you think a child under 13 has sent us data, for example a report or an AI idea, email us and we will delete it. If you are under 16, or under the age your country sets for agreeing on your own, ask a parent or guardian before you turn on usage statistics or make AI packs.

11. Security

All data travels over encrypted connections (HTTPS), and Google stores it encrypted. The app can’t read our database directly: only our server can, and it checks every request with App Check. Access to our consoles is limited to the people who run OUCH!. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

12. If you live in the United States

• What we collect. In the last 12 months we collected identifiers (the Install ID, the random IDs Firebase uses, and IP addresses), commercial information (purchase records), app activity (usage statistics if you allowed them), approximate location (your country, from your IP address, if you allowed statistics) and what you chose to send us (AI ideas, reports, emails). They come from you, your phone and Google Play, and we use them for the purposes in this policy.
• No selling or sharing. We don’t sell your personal information or share it for cross-context behavioural advertising, and we haven’t in the last 12 months.
• Do Not Track and Global Privacy Control. OUCH! doesn’t track you across other companies’ apps or websites. We treat a Global Privacy Control signal as a request not to sell or share your data, which we don’t do anyway.
• Your rights. Section 9 explains them. You can use an authorised agent, and if we refuse a request, you can appeal by replying to our answer.

13. This website

ouch-hot-potato.web.app uses no cookies, no analytics and no trackers, and its font comes from this site, not from Google’s font servers. Firebase Hosting, which serves the site, sees your IP address to deliver the pages and keeps it in its logs for a short time to stop abuse. If you pause the animations, your browser remembers that choice on your device; nothing is sent to us. When you follow a link to Google Play, Google’s privacy policy applies.

14. Changes to this policy

We will update this page when what we do changes, and change the date at the top. For important changes, we will also tell you in the app before they take effect, and ask for your agreement again where we need it.

15. Contact

See also our terms of use.