Scope of this notice
This notice covers Got You! and this information website, operated by Got You!. Got You! is an independently developed game and does not represent OpenAI. ChatGPT and other hosts process their own conversations under their respective privacy notices.
Information used to run the game
- Game identity and connection: random guest and player identifiers, a necessary browser cookie that recognizes the guest identity, authorizations you personally confirm, credential validation records, expiration times and pairing records needed for local testing. These identify your game connection and separate player permissions. No real email address or password registration is required.
- Rooms and gameplay: room, seat, preparation and turn state; your confirmed secret character, identity description, aliases and real/fictional status; questions, answers and guesses sent to the game; illustration preferences, card tasks and prepared cards. The server needs these records to synchronize progress.
- Voluntary reports: the category, message and expected result you enter, plus version, interface language, game stage, report ID, time and review status. Please leave sensitive information out of reports.
- Connection and security information: network connections necessarily involve IP addresses, request times and protocol data for transport, rate limits and security. Actual hosting-log settings are described below.
Remote authorization uses this game’s own guest identity. It does not identify or verify your OpenAI account or real-world identity. The authorization page asks you to confirm before using an existing browser identity. Clearing browser data may make the original identity unrecoverable.
The remote connection service is available, subject to the host and actual connection status.
Who can see which information
- The game receives content sent through its tools. It does not automatically read your full ChatGPT conversation. Avoid giving tools personal information the game does not need.
- During a round, a secret character is provided to its own player’s view and AI partner. The opponent receives questions, answers, state and reveals allowed by the rules. After the whole round ends, both players receive the opponent’s character card.
- The server processes both players’ secrets and gameplay records. The operator may access necessary records to maintain the service, handle reports or respond to deletion requests. The service does not claim end-to-end encryption.
- The server database stores hashed validation records for remote access and refresh credentials. The remote gateway separately stores the internal game-core session credential encrypted with AES-GCM, using an independent key in restricted server configuration. These measures are not end-to-end encryption.
- Remote access credentials are handled by the host and server, and are not passed to the embedded game view. Authorization covers game operations and does not allow access to your other ChatGPT conversations.
- Each AI is provided by its own host. The game service is hosted on Tencent Cloud in Hong Kong. Hosts and infrastructure providers process service and transport data under their own rules.
- Player skin tone is not inferred from names, accounts, IP addresses or photos. Relationship-card age, skin tone and figure options are illustration preferences, not judgments about real players or relatives.
Retention and cleanup
- Unmatched rooms are kept for up to 30 minutes, abandoned rooms up to one hour, and completed rooms up to 24 hours. Completed or abandoned history may be removed earlier to control capacity.
- An ongoing room is kept for up to six hours without a meaningful game action. Reading state alone does not extend this period. Room cleanup also removes corresponding old requests and card-preparation records.
- The guest-identity browser cookie is valid for 30 days by default. Personally confirming use of the same identity and authorizing again in that browser can renew it. Clearing browser data may prevent identity recovery; this is not an account with email or password recovery.
- A remote authorization and its refresh credentials are valid for up to seven days, and an access credential for up to 15 minutes. Internal sessions between the gateway and game core last seven days and can be renewed while valid. A pending authorization flow lasts five minutes by default, and a one-time authorization code one minute.
- Expired credentials, pairing and authorization records are removed through service cleanup. Used authorization-code and refresh-credential hashes may remain until their parent authorization is cleaned, to detect replay. Credential validity is not the deletion time for every validation record. Revocation or security action may end a connection earlier.
- Reports are currently organized and deleted manually by the operator, with no fixed automatic cleanup period. A replacement contact channel for privacy access, correction or deletion requests has not been announced. This page currently has no form for these requests; in-game feedback is for reporting game issues. Do not submit session tokens, passwords, identity documents or other sensitive information.
- Removing records from the running database does not remove chats or cards already sent to a host. Those are managed by the respective host and user.
This website and hosting logs
This static website contains no advertising, analytics tracking, forms or third-party font requests. The language choice is passed in the URL; it does not set a language-preference cookie or local storage. Network access still involves the connection information described above.
This service disables Nginx site access logs and site error logs that could contain request URLs. Application code does not intentionally log OAuth credentials, full request bodies or game content; service startup, shutdown and generic runtime errors may still appear in system service logs. Tencent Cloud infrastructure and OpenAI may process network or account information under their own policies.
Your choices and contact
You can stop using the game or disconnect it in your host. Reports are voluntary; full conversations are not automatically uploaded to collect anomalies. A replacement contact channel for privacy access, correction or deletion requests has not been announced. This page currently has no form for these requests; in-game feedback is for reporting game issues. Do not submit session tokens, passwords, identity documents or other sensitive information.
