Privacy Policy

1. Who is responsible for your data?

Match Trap is operated by Reuben Gathaiya in Portugal, who is the data controller for personal data processed through the game. For privacy questions or requests, email info@matchtrap.app.

2. Data we process

When you play an online game, we process the display name you provide, room code, visibility and settings, selected topics, submitted answers, human-target answers, scores, remaining lives, player role, game status, and timestamps. Please use a nickname and do not enter sensitive personal information.

If a room is public, its room code, lobby or game status, player count, and target type may appear in the public room browser. Player nicknames are shown to participants inside the room, together with answers, scores, and game progress needed to play. Public games may also contain computer-controlled players marked with an AI badge.

We also process a random player identifier and a securely hashed room-session token. Your browser stores the room code, player identifier, and raw session token in local storage so that it can reconnect you to the room.

In-person mode keeps player names and scores in the host device’s temporary browser memory. They are not written to the Match Trap database and disappear when the page is refreshed or the game is reset.

Our hosting provider may automatically process technical information such as IP address, approximate city or country derived from it, browser and device information, request timestamps, diagnostics, and server logs. If you email us, we process your email address, message, and any information you choose to include.

3. Why we process data

We use gameplay data to create rooms, synchronize players, generate questions, judge answers, calculate results, prevent unauthorized room access, troubleshoot faults, and provide support. The legal bases are performance of the service you request, our legitimate interests in operating and securing Match Trap, responding to your requests, and compliance with legal obligations where applicable.

4. AI processing

Match Trap uses the OpenAI API to generate question decks and judge answers that cannot be resolved locally. Question generation sends selected topics and game settings. Answer judging may send the question, target answer, submitted answer, and a pseudonymous player identifier; it does not intentionally send player display names.

Match Trap requests that OpenAI does not store response application state. OpenAI may nevertheless retain API content and related metadata in abuse-monitoring logs for up to 30 days, unless longer retention is legally required or necessary to protect its services. OpenAI states that API data is not used to train its models unless the API customer explicitly opts in; Match Trap does not intentionally opt in.

5. Service providers and disclosures

We use Vercel for website hosting, server execution, website analytics, and performance measurement; Supabase for the multiplayer database; OpenAI for question generation and answer judging; Zoho Mail for support communications; and Google AdSense for site verification, consent management, and—once our site is approved—advertising and advertising measurement. These providers process data on our behalf or under their own applicable terms. We may also disclose information where required by law, to protect users or the service, or in connection with a lawful business transfer.

Google and its advertising partners may receive technical information such as your IP address, browser or device information, page viewed, advertising identifiers, consent choices, and information from cookies or similar technologies where permitted. You can learn more in Google’s Privacy Policy and its information about advertising technologies.

Some providers may process information outside Portugal or the European Economic Area. Where required, transfers are protected through applicable contractual safeguards or other legally recognized transfer mechanisms.

6. Retention

Active online game rooms, player records, and submitted answers are placed into rolling deletion once they are more than 30 days old. Provider logs, security records, and backups may remain for their applicable retention periods. OpenAI’s standard abuse-monitoring period may be up to 30 days.

The browser room session remains on your device until you leave or reset the game, clear site data, or the browser removes it. Support emails are normally retained for up to 12 months after the matter is resolved, unless they are needed longer for security, disputes, or legal obligations.

7. Analytics, cookies, consent, and advertising

Match Trap uses Vercel Web Analytics to understand page visits and anonymous gameplay milestones, and Vercel Speed Insights to measure site performance. Measurements may include the page or route viewed, referring site, approximate location derived from the IP address, browser and device type, timing and performance information, and fixed gameplay properties such as play style, target mode, question count, player-count range, and whether a room join succeeded.

We do not intentionally send player names, email addresses, answers, room codes, session tokens, or user-created category text in analytics events. We use these measurements for our legitimate interests in understanding whether players can start and complete games, diagnosing performance problems, and improving Match Trap. Match Trap does not use this analytics data to build advertising profiles.

Match Trap uses essential browser local storage to reconnect you to an online game room. These essential functions do not depend on advertising consent.

The site currently includes Google AdSense technology while the site is being reviewed for advertising. Once advertising is enabled, Google and participating advertising partners may use cookies, local storage, device identifiers, IP-derived location, and similar technologies to select, deliver, limit, and measure advertisements, detect fraud, and produce aggregated reporting.

Where required, Match Trap displays a Google-certified consent message before non-essential advertising storage or personalised advertising is used. You may accept, reject, or manage the available choices. Depending on your selection and location, advertisements may be personalised using activity and inferred interests or non-personalised using limited contextual information such as the page being viewed and approximate location. Withholding or withdrawing consent will not prevent access to the game, although permitted non-personalised or limited ads may still appear.

You can revisit your consent choices through the privacy controls made available on the site once advertising is active. You can also manage how Google uses information for advertising through My Ad Center.

8. Your rights

Depending on applicable law, you may request access to, correction of, deletion of, restriction of, or portability of your personal data, and you may object to processing based on legitimate interests. You may also complain to Portugal’s data-protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

Because Match Trap does not currently use player accounts, include your room code, player name, approximate play date, and player identifier if available when contacting us. We may need this information to locate the correct record without exposing another player’s data.

9. Security and children

We use access tokens, token hashing, restricted database access, and encrypted network connections designed to protect gameplay data. No online service can guarantee absolute security.

Match Trap is a general-audience party game and is not directed to children under 13. Children should use it only with the involvement of a parent, guardian, teacher, or other responsible adult, as required by local law.

10. Changes

We may update this policy when Match Trap’s features, providers, or legal obligations change. The date at the top identifies the latest version. Material changes will be communicated through the service where appropriate.

11. Community accounts and proposals

If you create a community account, we process your email address, chosen public creator name, membership status, sign-in records, category proposals, descriptions, example challenges, review status, and moderation feedback. Magic-link authentication is provided through Supabase.

Category proposal content is sent to OpenAI for a preliminary suitability and safety review; your email address and creator name are not intentionally included. AI review never publishes a category automatically. Account and proposal data is retained while your account or a published category remains active and as reasonably needed for moderation, security, disputes, and legal obligations. You may request deletion by email.