Privacy Policy

Overview

Imposter Games, developed by Med Studios, is a party game platform available at impostergames.io and in the Imposter Games Android app. This policy covers both the website and Android app: what information we collect, why we use it, who helps us process it, and how you can contact us about your data.

You can play many games without an account. Accounts are used for identity, saved profile details, account-linked features, and creating or managing community content.

Information We Collect

• Account information, such as your email address, display name, account ID, account creation date, email verification status, and authentication metadata. If you continue with Google, the additional details are described in the Google Sign-In Data section below.
• Login and security information needed to create sessions, verify accounts, send password reset emails, detect abuse, and protect the service. We do not see or store your plain text password.
• Game information, such as nicknames, lobby codes, answers, drawings, votes, scores, chat messages, custom character skins, reconnect tokens, and other inputs created during a game session.
• Stats and progress information, including local browser stats and any account-linked stats supported by the service.
• Community content information, such as uploaded prompts, packs, images, descriptions, creator names, publication status, reports, and moderation history.
• Messages you send us, including support emails, suggestion box submissions, reports, and copyright or abuse complaints. Feedback may include the game, play mode and rating you submit. If delivery fails, submitted feedback can be saved on your device and retried when you return with a connection; unsent drafts are not stored by this feedback feature.
• Technical information, such as IP address, browser type, device information, pages visited, approximate location, referral pages, diagnostics, server logs, and analytics events.

Google Sign-In Data

If you choose Continue with Google, Google provides basic identity information through Supabase Auth so we can create or sign you in to an Imposter Games account. This information may include your Google account identifier, name, email address, email verification status, and profile image. We request only the openid, email, and profile scopes. We do not request access to Gmail, Google Drive, contacts, calendars, or other Google services.

We use this Google sign-in information only to authenticate you, create and maintain your account, protect the service from abuse, and initialize your Imposter Games profile. If your Google name meets our player-name rules and is available, it may become your initial public display name; you can change it from the Account page. Your email address, Google account identifier, and authentication credentials are not displayed publicly.

Supabase processes and stores this identity information as our authentication provider. We do not sell Google sign-in data, share it with advertisers or data brokers, use it for advertising or retargeting, or use it to train artificial intelligence or machine-learning models. Optional Google Analytics operates separately based on your analytics choice; we do not provide your Google sign-in profile information to it.

Google sign-in information is retained while your Imposter Games account exists and may remain for a limited period afterward where required for security, backups, fraud prevention, or legal compliance. You can delete your account from the Account page, which removes the active authentication account and associated profile and synced stats. As explained under Retention, previously published community content may remain without your account attached. You can also revoke Imposter Games access from your Google Account; revoking access does not by itself delete your Imposter Games account.

Browser Storage, Cookies, Website Analytics, and Advertising

We use browser storage for features such as theme choice, local stats, saved player name, reconnect data, and Supabase login sessions.

Website Google Analytics (GA4) is optional and off until you choose Allow analytics in our own privacy screen. This applies worldwide, on desktop and mobile browsers. Choosing Only necessary keeps optional analytics off; sign-in, reconnecting and other necessary functionality remain available. Declining or closing the prompt does not limit games or account features. Before you allow Google Analytics, its measurement tag is not loaded and no GA4 events or cookieless GA4 pings are sent.

If allowed, Google Analytics receives page visits, sanitized game-completion and signup events, browser/device information, approximate location derived from IP address, and cookie identifiers. This information is not necessarily anonymous. Our custom events exclude names, email addresses, login tokens, lobby codes, messages, answers and drawings. Google signals and advertising personalization are disabled for website analytics.

Use Privacy & cookies on the website to review or withdraw your choice. Your versioned choice is remembered in this browser's local storage for 180 days without renewing on every visit; if storage is unavailable, it lasts this page only. There is no external consent manager or separate consent-reporting beacon. GA cookies are configured for up to 180 days without automatic expiry renewal. Turning analytics off disables new measurement, removes this site's GA cookies and clears our first-play analytics marker. Requests already queued by Google's tag or in flight may finish after withdrawal. Login, reconnect, conduct acceptance and other essential preferences are not deleted. Data already sent to Google is not automatically erased; it follows the GA4 property's retention settings. Contact us with deletion questions.

We do not currently serve advertising. Allowing analytics does not authorize advertising. Google's analytics tag may use Google's conversion-measurement endpoints after analytics is allowed; advertising storage, advertising data use and advertising personalization remain denied. Before activating any advertising service, we will update the disclosures and provide the required controls for the selected providers.

Google's handling of this information is explained in Google's partner sites policy. Android app consent is separate from website consent, including when you open the website in an Android browser.

When your browser sends Global Privacy Control (GPC), optional website analytics remains disabled. Older "Do Not Track" signals do not automatically change our settings; you can decline analytics using Privacy & cookies.

Aggregate Service Activity

To understand usage and improve Imposter Games, we maintain daily server-side totals of website page requests, online game launches, completed rounds and peak lobby player counts, with fixed game-type breakdowns. These aggregate totals are separate from optional Google Analytics and are recorded regardless of that choice.

This report stores no visitor identifiers, IP addresses, authentication or reconnect tokens, lobby codes, query strings, messages, drawings or individual browsing histories. It adds no browser tracking cookie, fingerprint or analytics beacon. Aggregate daily totals are retained for up to 400 days, accessible through protected administration tools, and are not sent to GA4 or used for personalized advertising. Cached pages and browser-local or offline gameplay are not observed by these server counters. Existing operational, security and account data described elsewhere in this policy remains separate.

For Gibberish, we also keep aggregate performance totals per card and content version to improve the clues: showings, qualifying solves and solve-time distributions, accepted wrong-guess counts, interruptions and unfinished rounds. Players can optionally rate clues at the end of a match; we keep anonymous counts of positive ratings and selected issue reasons. Breakdowns distinguish the timer, game settings and repeat showings within a lobby. These card totals contain no player identities, lobby codes, submitted guess text or individual event histories, use no additional browser storage or tracking requests, and are not sent to Google Analytics. They remain in protected server storage while useful for maintaining the card bank; edited and removed card versions may retain their aggregate history.

Optional Android App Analytics

The Android app uses Google Analytics for Firebase (GA4) only after you choose to allow optional analytics. Declining does not limit games, accounts, Local Play, or community features. Online conduct-rule acceptance is a separate requirement and does not grant analytics consent.

When enabled, Google processes app usage events such as screen views, games played, round completions and sign-ups, together with app/device information, an app-instance identifier, session information and approximate geographic region derived from the connection. This helps us understand usage and improve Imposter Games. These measurements are not anonymous: an app-instance identifier can link activity from the same app installation.

Our custom analytics events do not include names, email addresses, account IDs, lobby codes, chat messages, answers, drawings, votes identifying another player, or authentication and reconnect credentials. Android analytics does not use the website's tracking tag. Advertising ID collection, advertising storage, advertising data use and advertising personalization are disabled in the app's analytics configuration. We do not collect precise GPS location for analytics.

Open Privacy settings from the Android start screen, game library, Local Play setup, Account page, or this page to change your choice without signing in. Turning analytics off stops future collection and resets locally stored analytics data and its app-instance identifier. Data already sent to Google is not automatically erased by turning analytics off or deleting your game account; it follows the analytics retention settings. Contact us about deletion questions. We do not attach your game account ID to analytics records.

Your choice is stored on the device until changed or app data is cleared. Android backup rules exclude app storage, including consent preferences, login sessions and reconnect credentials. Analytics consent is not restored from cloud backups or device-to-device app-data transfers.

Google's handling of analytics data is described in its Privacy Policy. Website and Android analytics have separate behavior and settings.

How We Use Information

• To provide games, lobbies, account login, account recovery, profiles, saved settings, stats, and community content features.
• To send transactional emails, including verification emails, password reset links, and account security messages.
• To display names, scores, public lobbies, leaderboards, and community content where the feature expects public or shared visibility.
• To moderate content, investigate reports, enforce our Terms of Service, prevent spam, and protect players and the service.
• To analyze performance, fix bugs, improve gameplay, measure traffic, and understand which features are useful.
• To comply with legal obligations and respond to valid legal requests.

Third-Party Services

We use service providers to run Imposter Games. They process information only as needed to provide their services to us, under their own terms and privacy commitments.

• Supabase provides authentication, user management, and account-related infrastructure.
• Resend helps deliver account emails such as verification and password reset messages.
• Google provides optional Google account sign-in and optional Google Analytics, including Firebase analytics in the Android app.
• Hosting, security, logging, and infrastructure providers help us operate the website and game servers.

We may also disclose information if required by law, to protect rights and safety, to investigate abuse, or as part of a business transfer such as a merger or sale of assets.

Public and Shared Information

Multiplayer games are social. Other players in a lobby may see your nickname, display name, answers, drawings, votes, chat messages, scores, and similar gameplay information.

When a Camoflee seeker paints a custom skin, the final skin used for the round is automatically sent to a private moderation queue, including when the player is using a guest account. Guest submissions are not attached to an account or display name. A skin becomes selectable by other players only if a moderator approves it.

Community content you publish may be visible to other players and may identify your account by display name. Public submissions are reviewed before they become available in the public catalog. Do not upload private information or content you do not have permission to share.

Retention

• Temporary lobby data is generally kept only while the game session is active, unless needed for safety, diagnostics, or abuse review.
• Local stats and saved names stay in your browser until you clear your browser storage or use future account controls.
• Successful self-service deletion removes active account information immediately. Verified email deletion requests are completed within 30 days. Residual copies may remain in restricted backups for up to 90 additional days before routine backup rotation removes them.
• Security, abuse-prevention, moderation, and legal records may be kept only while needed for an active investigation, dispute, safety issue, or legal obligation. If a legal obligation requires retention beyond the normal periods, only the required records are kept until that obligation ends.
• Approved or published community content and Camoflee maps may remain available or playable indefinitely after deletion, without an active account attached, so community games continue to work. You can separately request removal of specific content.
• Analytics, logs, and hosting records are retained according to our settings and our providers' retention practices.

Your Choices and Rights

• You can update your display name from the account page. Email/password accounts can also update their email address and password there; Google-only sign-in details are managed through your Google account.
• You can clear local browser stats, saved names, theme settings, and reconnect data through your browser storage controls.
• You can permanently delete your account online or request deletion by email through our Account and Data Deletion page.
• You can request access, correction, export, or restriction of account information by contacting us.
• You can ask us to remove or review community content linked to your account.

If you are in a region with specific privacy rights, such as California, the EEA, the UK, or Switzerland, you may have additional rights to know, access, correct, delete, restrict, object, port, or withdraw consent. To make a request, email us from the address linked to your account or include enough information for us to verify the request.

We do not sell your account information for money.

Children's Privacy

Imposter Games is not directed to children under 13, and children under 13 should not create accounts or submit personal information. If you believe a child under 13 has provided personal information to us, contact us and we will take appropriate steps to remove it.

International Transfers

We and our providers may process information in countries other than where you live. Those countries may have different data protection laws. Where required, we rely on appropriate safeguards provided by our service providers and applicable law.

Security

We use reasonable technical and organizational measures to protect account and service data, including HTTPS, Supabase authentication, access controls, and provider security features. No online service is perfectly secure, so you should use a strong password and keep your account credentials private.

Changes

We may update this Privacy Policy as the site, accounts, stats, advertising, and community content features change. The updated date at the top of this page shows when the latest version was posted.

Contact

Questions or privacy requests can be sent to [email protected].