Privacy policy
Blot Twist is a party game you play with friends in the same room, each on your own phone. This policy explains what the Blot Twist app, our game server and this website do with information about you, why, and for how long.
“We” means Edvard Wikhall, who makes and runs Blot Twist and is the controller responsible for this data under the GDPR. You can reach us at hello@blottwist.app.
The short version
- No accounts, no ads, no analytics, no tracking. This website sets no cookies.
- To play, your phone sends our server your nickname, what you write and draw, and your votes. The other players in your room see them.
- Games live only in the server's memory. They are deleted when the room closes, at the latest about 30 minutes after it goes quiet.
- Our server logs keep some technical details, including IP addresses, the findings presented in games and any reports, for 30 days.
- We never sell your data or use it for advertising.
1. What we collect and why
On your phone
The app keeps a few small things in its own storage on your phone. They stay on the phone except where the next section says they are sent to us.
- A random device ID. The app makes it up the first time it starts. It is not your phone's hardware ID or advertising ID, and it is not linked to your identity. It lets you rejoin a room after a dropped connection, and keeps a player the host removed out of that room.
- Your last nickname, so you don't have to type it again.
- Your current room: the room code, your player ID in it and a secret session token, so you can get back in if the app closes or the connection drops. The app deletes it when you leave the room, are removed, or the room has ended.
- Findings you haven't sent yet, for example while you're offline. They are deleted as soon as they reach the server.
Deleting the app deletes all of this. On Android it is left out of backups; on iPhone it is part of your device backup like other app data.
Sent to our server while you play
Blot Twist runs on our game server, which is what lets iPhones and Android phones play together. While you play, your phone sends it:
- your device ID and, when you rejoin, your session token;
- your nickname and player colour;
- your findings: what you wrote (up to 80 characters) and where you pinned it on the board;
- when you present: where you pan and zoom, and your highlighter strokes;
- your game actions: board votes, “Me too” claims, Valid / Not valid votes, board ratings and best-find votes, and the room settings if you are the host;
- reports and blocks you make (see below).
We use this only to run your game. The legal basis is that it's needed to provide the game you asked to play (GDPR Art. 6(1)(b)).
Like any internet service, the server also sees your IP address. It uses it to limit how many rooms and join attempts come from one address, so nobody can guess room codes or flood the server. These counters are kept in memory for a few minutes; for a room you created, the count is kept until that room closes. The legal basis is our legitimate interest in keeping the game secure and available (Art. 6(1)(f)).
Connections between the app and the server are encrypted.
Reports, blocks and the family filter
- Report: you can report a player or one of their findings as offensive, spam or other. The report records the room, the round, your nickname and player ID, the reported player's nickname and ID, the reason and, for a finding, its original text. It is written to our server log so we can review it and deal with abuse. Nobody in the room is told who reported. Legal basis: our legitimate interest in keeping games safe (Art. 6(1)(f)).
- Block: hides a player's name and findings on your phone for as long as that room is open. Blocks are kept only in the room on the server and disappear when the room closes. The blocked player isn't told.
- Family filter: on by default. It masks rude words in findings for everyone and refuses rude nicknames. It runs on our server with a word list built into the game; nothing is sent to anyone else. The original text of a masked finding is still kept in the room, and in a report if one is made about it.
Server logs
The server writes a log of what happens, so we can keep it running, fix bugs and deal with abuse. It contains:
- game events, like rooms opening and closing, rounds, scores and errors, with room codes and random player IDs but no nicknames;
- the text of each finding presented in a game and whether it counted (masked by the family filter when it's on);
- reports, as described above;
- IP addresses in some connection events, like errors, rejected connections and too many rooms from one address. IPv4 addresses are logged in full; IPv6 addresses are cut down to their first half.
Device IDs and session tokens are never logged. Legal basis: our legitimate interest in running a reliable and safe service (Art. 6(1)(f)).
The camera
The app uses the camera only to scan a room's QR code, and only when you open the scanner. The camera picture is processed on your phone and is never saved or sent to us; only the room code read from the QR code is used.
On iPhone, scanning uses Apple's built-in frameworks on the phone. On Android, it uses Google's ML Kit barcode scanning, delivered through Google Play services. ML Kit also works on the phone and doesn't send the camera picture or the scanned code to Google. Google says ML Kit may send Google diagnostic and usage information, such as your device model, Android version, the app's name and version, a per-installation identifier, performance figures and errors, to maintain and improve ML Kit. See Google's ML Kit terms.
Sharing a game recap
At the end of a game you can share recap pictures of each round: the board with the findings that counted, the drawings, and the room code. The app makes the pictures on your phone. They go only where you send them with your phone's share sheet; we never receive them. The phone clears the temporary copies by itself.
This website
This website uses no cookies, no analytics and no content from other companies: even the fonts come from our own server. Like any website, the servers that deliver it see your IP address and the page you ask for. We don't use that to track you, and any access logs are deleted within 30 days.
The app stores
Apple's App Store and Google Play handle downloads and updates under their own privacy policies. They may show us statistics, such as download numbers and crash reports if you agreed to share them with developers.
2. How long we keep it
| What | How long |
|---|---|
| Your game: nickname, findings, drawings, votes, blocks and reports in the room | Only in the server's memory, never written to disk. Deleted when the room closes: as soon as the last player leaves, or after 30 minutes with no activity. A server restart deletes it too. |
| Rate-limit counters by IP address | In memory, for a few minutes, or until a room you created closes. |
| Server logs, including reports | 30 days, then deleted. |
| What's on your phone | Until you leave the room (room and session token), the findings are sent, or you delete the app. |
3. Who sees your data
- The players in your room. They see your nickname and colour, and your findings, highlighter drawings and claims once they're shown in the game. Findings stay private while everyone is still writing.
- The company that hosts our server stores and processes the data above on our behalf, only on our instructions.
- Google receives the ML Kit diagnostics described above on Android phones.
- Authorities, only if the law requires us to share something.
Nobody else. We don't sell data, and we don't share it for advertising. If data ever leaves the EU/EEA, we protect it with the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.
4. Children
Blot Twist is not directed at children under 13, and we don't knowingly collect personal data from them. The game has no accounts and asks for no real names, contact details or photos. If you think a child under 13 has sent us personal data, for example in a report, write to hello@blottwist.app and we will delete it.
5. Your rights
Under the GDPR you can ask us for a copy of your personal data, and ask us to correct or delete it. You can also ask us to restrict how we use it, or object to how we use it. Where the law gives you the right, you can ask for your data in a portable format.
There are no accounts, so we can only find you in our logs if you tell us enough to recognise your game: for example the room code, roughly when you played and your nickname. Game data is gone once the room has closed, and logs after 30 days.
Write to hello@blottwist.app. We'll answer within one month.
If you're unhappy with how we handle your data, you can complain to your local data protection authority. In Sweden, that is the Swedish Authority for Privacy Protection, IMY.
6. Changes to this policy
If we change how Blot Twist handles data, we'll update this page and the date at the top. Big changes will also be announced in the app or on this website before they take effect.