这份说明适用于什么

本说明适用于 Got You! 运营的 Got You! 服务及本资料网站。Got You! 是独立开发的游戏项目，不代表 OpenAI 官方。ChatGPT 及其他宿主自身如何处理会话，适用各自的隐私说明。

为运行游戏处理的信息

• 游戏身份与连接：随机游客与玩家标识、浏览器中用于认出游客身份的必要Cookie、你亲自确认的授权记录、凭据校验记录、失效时间，以及本地私测必要的连接配对记录。这些信息用于识别自己的游戏连接并隔离双方权限，无需提供真实邮箱或密码注册。
• 房间与对局：房间、座位、准备和回合状态；你确认的秘密人物、身份说明、别名、真实或虚构信息；发送到游戏的问题、答案与猜名；卡面外观偏好、制卡任务和已准备的卡片。服务器需要这些记录来同步双方进度。
• 主动反馈：你在报告中填写的类别、正文、预期结果，以及版本、界面语言、游戏阶段、报告编号、时间和处理状态。请不要在反馈中写入敏感资料。
• 连接与安全信息：服务接收网络连接时会处理IP地址、请求时间和必要的协议数据，用于传输、限流与安全。主机日志的实际设置见下方。

远程授权使用本游戏自己的游客身份，并不识别或验证你的 OpenAI 账户或真实身份。选择使用本浏览器已有身份前，授权页面会先让你确认；清除浏览器数据可能使原身份无法恢复。

远程连接服务已开放，具体可用性以宿主及实际连接状态为准。

谁能看到哪些内容

• 游戏通过工具调用接收你发送给游戏的内容，不会自动读取整段 ChatGPT 聊天。请避免将游戏不需要的个人信息交给工具。
• 对局期间，秘密人物只发给本人的游戏视图和AI搭档；对手收到按规则公开的问题、答案、状态和最终揭晓。整局结束后，双方收到对手的人物卡。
• 服务器需要处理双方的秘密与对局记录。运营者可能为维护服务、处理报告或删除请求访问必要记录；本服务没有宣称端到端加密。
• 对外授权的访问与刷新凭据在服务器数据库中保存哈希校验记录。远程网关另用AES-GCM加密保存连接游戏核心所需的内部会话凭据，独立密钥放在受限的服务器配置中。这些措施不等于端到端加密。
• 远程访问凭据由宿主与服务器处理，不下放到游戏内嵌界面。授权只涵盖游戏操作，不允许读取你的其他 ChatGPT 对话。
• 两位AI由各自宿主提供。游戏服务部署在腾讯云香港主机；相关宿主和基础设施按其各自规则处理传输与服务数据。
• 不会根据玩家姓名、账号、IP或照片推断肤色。关系卡的年龄、肤色与人物形象是插画偏好，不是对真实玩家或亲友的判断。

记录保留与清理

• 未匹配房间最多保留30分钟；已退出房间最多1小时；已结束房间最多24小时。为控制容量，结束或退出的历史房间可能更早清除。
• 进行中房间在没有有效游戏动作后最多保留6小时。单纯读取状态不会延长该期限。清理房间时会同时清理对应的旧请求及制卡记录。
• 浏览器游客身份Cookie的默认有效期为30天；在同一浏览器中再次亲自确认使用该身份并授权，可以续期。清除浏览器数据可能让你无法找回原身份；它不是有邮箱或密码恢复方式的账户。
• 远程授权及其刷新凭据最长有效7天，访问凭据最长有效15分钟；网关与游戏核心之间的内部会话有效期为7天，可在有效期间续接。临时授权流程默认5分钟，一次性授权码默认1分钟。
• 失效凭据、过期配对及授权记录按服务清理流程删除；为检测凭据重放，已用授权码和刷新凭据的哈希可能保留至所属授权清理。凭据有效期不等于每条校验记录的删除时间。主动撤销或安全处理也可能让连接提前失效。
• 反馈暂由运营者人工整理和删除，目前没有固定的自动清理期限。如需访问、更正或删除相关记录，请使用本页列出的联系方式。处理前可能需要核实你与相关记录的关系。请勿发送会话令牌、密码或证件。
• 删除运行数据库中的记录不等于清除已发送到双方宿主中的聊天或卡片；这些内容由各自宿主及用户自行管理。

本资料网站与主机日志

本静态网站不包含广告、分析追踪、表单或第三方字体请求。语言选择通过网址参数传递，不设置用于语言偏好的Cookie或本地存储。网络访问仍会涉及上述连接信息。

本服务的Nginx站点关闭HTTP访问日志，并关闭会包含请求地址的站点错误日志。应用代码不主动记录OAuth凭据、完整请求正文或对局内容；服务启动、停止和通用运行错误仍可能进入系统服务日志。腾讯云基础设施及OpenAI可能依据各自政策处理网络或账户信息。

你的选择与联系

可以停止使用或断开宿主中的插件连接。游戏反馈为自愿提交；不会为了收集异常而自动上传整段对话。如需访问、更正或删除相关记录，请使用本页列出的联系方式。处理前可能需要核实你与相关记录的关系。请勿发送会话令牌、密码或证件。

Scope of this notice

This notice covers Got You! and this information website, operated by Got You!. Got You! is an independently developed game and does not represent OpenAI. ChatGPT and other hosts process their own conversations under their respective privacy notices.

Information used to run the game

• Game identity and connection: random guest and player identifiers, a necessary browser cookie that recognizes the guest identity, authorizations you personally confirm, credential validation records, expiration times and pairing records needed for local testing. These identify your game connection and separate player permissions. No real email address or password registration is required.
• Rooms and gameplay: room, seat, preparation and turn state; your confirmed secret character, identity description, aliases and real/fictional status; questions, answers and guesses sent to the game; illustration preferences, card tasks and prepared cards. The server needs these records to synchronize progress.
• Voluntary reports: the category, message and expected result you enter, plus version, interface language, game stage, report ID, time and review status. Please leave sensitive information out of reports.
• Connection and security information: network connections necessarily involve IP addresses, request times and protocol data for transport, rate limits and security. Actual hosting-log settings are described below.

Remote authorization uses this game’s own guest identity. It does not identify or verify your OpenAI account or real-world identity. The authorization page asks you to confirm before using an existing browser identity. Clearing browser data may make the original identity unrecoverable.

The remote connection service is available, subject to the host and actual connection status.

Who can see which information

• The game receives content sent through its tools. It does not automatically read your full ChatGPT conversation. Avoid giving tools personal information the game does not need.
• During a round, a secret character is provided to its own player’s view and AI partner. The opponent receives questions, answers, state and reveals allowed by the rules. After the whole round ends, both players receive the opponent’s character card.
• The server processes both players’ secrets and gameplay records. The operator may access necessary records to maintain the service, handle reports or respond to deletion requests. The service does not claim end-to-end encryption.
• The server database stores hashed validation records for remote access and refresh credentials. The remote gateway separately stores the internal game-core session credential encrypted with AES-GCM, using an independent key in restricted server configuration. These measures are not end-to-end encryption.
• Remote access credentials are handled by the host and server, and are not passed to the embedded game view. Authorization covers game operations and does not allow access to your other ChatGPT conversations.
• Each AI is provided by its own host. The game service is hosted on Tencent Cloud in Hong Kong. Hosts and infrastructure providers process service and transport data under their own rules.
• Player skin tone is not inferred from names, accounts, IP addresses or photos. Relationship-card age, skin tone and figure options are illustration preferences, not judgments about real players or relatives.

Retention and cleanup

• Unmatched rooms are kept for up to 30 minutes, abandoned rooms up to one hour, and completed rooms up to 24 hours. Completed or abandoned history may be removed earlier to control capacity.
• An ongoing room is kept for up to six hours without a meaningful game action. Reading state alone does not extend this period. Room cleanup also removes corresponding old requests and card-preparation records.
• The guest-identity browser cookie is valid for 30 days by default. Personally confirming use of the same identity and authorizing again in that browser can renew it. Clearing browser data may prevent identity recovery; this is not an account with email or password recovery.
• A remote authorization and its refresh credentials are valid for up to seven days, and an access credential for up to 15 minutes. Internal sessions between the gateway and game core last seven days and can be renewed while valid. A pending authorization flow lasts five minutes by default, and a one-time authorization code one minute.
• Expired credentials, pairing and authorization records are removed through service cleanup. Used authorization-code and refresh-credential hashes may remain until their parent authorization is cleaned, to detect replay. Credential validity is not the deletion time for every validation record. Revocation or security action may end a connection earlier.
• Reports are currently organized and deleted manually by the operator, with no fixed automatic cleanup period. For access, correction or deletion requests, use the contact details listed on this page. Your relationship to the records may need to be verified. Do not send session tokens, passwords or identity documents.
• Removing records from the running database does not remove chats or cards already sent to a host. Those are managed by the respective host and user.

This website and hosting logs

This static website contains no advertising, analytics tracking, forms or third-party font requests. The language choice is passed in the URL; it does not set a language-preference cookie or local storage. Network access still involves the connection information described above.

This service disables Nginx site access logs and site error logs that could contain request URLs. Application code does not intentionally log OAuth credentials, full request bodies or game content; service startup, shutdown and generic runtime errors may still appear in system service logs. Tencent Cloud infrastructure and OpenAI may process network or account information under their own policies.

Your choices and contact

You can stop using the game or disconnect it in your host. Reports are voluntary; full conversations are not automatically uploaded to collect anomalies. For access, correction or deletion requests, use the contact details listed on this page. Your relationship to the records may need to be verified. Do not send session tokens, passwords or identity documents.