Draft. This policy has not been reviewed by a lawyer yet and may change before PlotTwin is released. This describes the version we plan to release. Items marked To be confirmed are still open. Questions: [email protected].
PlotTwin
Privacy Policy
Effective date: To be confirmed on release
PlotTwin is an app for Android and iPhone where fans rate movies, TV shows, anime and books by answering questions about them. It is published by SashApps ("we", "us"). To be confirmed: publisher's legal name, address and country.
Contact: [email protected]
The short version
- You can play without signing up. The app makes a guest account for you automatically. A guest account is still an account: your answers are stored on our servers under its ID, not only on your phone.
- Usage events and crash reports are on by default and linked to your account ID. You can turn them off in Profile, under Share usage data.
- Usage events never have a field holding the answer you picked. But they name the question and say whether your answer was rare, and together those can reveal your pick. So don't read this as "your answers are never sent".
- The image you pick in Flip Duel stays on your phone. So does anything you choose from My photos.
- We have no ads, and we don't sell your data.
- You can delete your account in the app, including a guest account. Deleting does not erase usage events and crash reports already sent. See "Deleting your account".
What we collect and why
| What | Where it comes from | Why |
|---|---|---|
| Account ID, a random ID made on first launch | Automatic | Keeps your answers and streak together |
| Email and password, if you make an email account (passwords are stored only as a hash) | You | Signs you in and sends codes |
| Apple or Google sign-in details, if you use them: email and, when provided, name | You, through Apple or Google | Signs you in, and gives you a name friends recognize |
| Display name | You, or Apple or Google | Shows a duo partner who you are |
| Takes: your answer to each question, how you played and when | You | Runs the game and shows how everyone split |
| Streak, including any missed day we forgave | Worked out from your daily answers | Shows your streak |
| Watch progress: titles, season and episode, finished or not | You | Hides spoilers |
| Favorites | You | Shows your favorites. Private: other players don't see them, and they aren't on share cards |
| Duo answers and your guesses at your partner's answers | You | Runs Read My Mind |
| Votes and "Bad question" reports | You | Improves questions |
| Share records: kind of card, format, what it was about, the app or action you chose | Automatic when you share | Counts sharing |
| Who invited you, if you joined through an invite soon after starting | Automatic | Counts invites |
| Requests for more questions about a title, with a salted hash of your IP address | You, and your connection | Sets limits and spots abuse |
| Flip Duel room: the code, the host, who is in it by seat number, the title, the timer, the status | Automatic | Runs the room. Rooms are deleted after they expire, normally about 6 hours |
| Push token, device type, reminder setting, time zone | Your device, if you allow notifications | Sends notifications at a sensible local time |
| Title search text | You | Finds titles. See "Title search" |
| App check: on iPhone, an App Attest key ID and public key linked to your account | Automatic, when you add a title | Stops fake apps abusing imports |
| IP address and connection details | Your device, whenever it connects | Runs and protects the service |
| Usage events and crash reports | Automatic, if Share usage data is on | See below |
PlotTwin does not ask for your location, contacts, camera or microphone. It doesn't ask your age or date of birth. It doesn't use an advertising ID.
Permissions it can ask for: notifications; on iPhone, adding images to Photos; on Android 9 and older, storage access, to save a share card. It reads the clipboard only when you tap Paste on an invite code.
Guest accounts
The first time you open PlotTwin it signs you in with a guest account, with no email or password. Your takes, streak, progress and favorites sync to our servers under the guest ID.
A guest account can't be recovered if you lose your phone, because nothing connects it to you. Uninstalling the app does not delete it. To remove it, use the delete option in Profile before you uninstall.
You can save your account by adding an email, Apple or Google. It keeps the same ID. You need an account to invite someone to a duo or to hold more than 2 phones in a Flip Duel room. The app may offer this after your first finished deck, when your streak first reaches 3, or when you reach the daily limit on new decks. You can say no.
Usage statistics (PostHog)
Share usage data is on by default. To be confirmed: this default for the EU and UK.
To see which features get used, the app sends PostHog events when you open the app, answer a question, play a deck, set progress, search, vote, play a duo or Flip Duel, share a card, respond to a notification prompt or move between screens, go through onboarding or the guide, tap a favorite, sign in, link or sign out, or delete your account. Some events report a sync error, with an error code only.
Events carry:
- your account ID, so this data is not anonymous
- IDs of the titles, questions, decks, duos and prompts involved
- whether your answer was rare, and for a Rare Take a banded share of people who agreed. With the question ID, this can reveal the answer you picked, for example on a this-or-that question
- the season and episode you set as your progress
- your streak and your scores in a revealed duo
- the account ID of whoever invited you, if someone did
- which sign-in method you used, and whether you are a guest
- your platform, app version and days since install
Events don't carry your name, email or anything you type, including the text of a search. Favorite events say a heart was tapped, not which title. Session recording, automatic screen capture and tap capture are off.
Turning the setting off stops new events at once. What was already recorded while it was on and not yet sent goes out one last time as it closes, then nothing more leaves. The choice is stored on your phone and survives signing out. If you reinstall, it goes back to on.
PostHog stores this data in the United States. To be confirmed: whether IP capture is off.
Crash reports (Firebase Crashlytics)
If the app crashes, it sends a report to Firebase Crashlytics, run by Google. A report holds the error, where it happened, device and system details, app version, the time, Crashlytics and Firebase installation IDs and your account ID. We don't put your answers, passwords or tokens in reports.
Share usage data controls this too. While it is off, crash reports are not sent, and reports held on the phone are deleted.
Flip Duel
Flip Duel is a phone game people film. Each player secretly picks an image and flips their phone on camera.
What other players' phones get. That you locked in, and game timing. Your pick, your search and your image are never sent to them or to us as data. They see your image when you show them your phone. If the game is filmed, your image and anything else on screen is in the video, and whoever filmed it decides what happens to it.
My photos. The app opens your phone's own photo picker, which needs no permission and gives the app only the photo you choose. It stays in memory on your phone for the game. We don't save it to a file or upload it.
Search Google. Test builds only. Not planned for the store version. This shows Google's image search inside the app. Your phone talks directly to Google, so Google receives your search, your IP address and device details, and can set cookies during the game, under Google's own privacy policy. Your search words are added to the title and its type. We clear Google's cookies and site data when the game ends on Android, and on iPhone the view keeps nothing after it closes. We don't receive or store your search text. We record only that a search happened.
Images from other websites. When you pick a web image, your phone downloads it directly from wherever it is hosted, which can be Google or another website. That host can see your IP address. The download sends no cookies from the search. We don't control those sites.
SafeSearch is turned on for these searches and the view stays on Google's search results, but filters aren't perfect. Results can show mature images or spoil a story.
Voice lines. The game can speak using your phone's speech engine. It doesn't use the microphone.
Read My Mind (duos)
| When | What your partner can see |
|---|---|
| Before joining, with your code or link | Your name and the title |
| While you both play | Your name, how many questions you've answered and whether you've finished. Notifications may name you and the title, never answers |
| After you've both finished | All your answers, all your guesses and your scores. These stay in the duo and on your partner's phone |
| If the duo expires first | Your answers are never shown. Duos expire after 7 days |
Our database rules, not only the app, stop a partner reading your answers before you've both finished. The questions depend on how far you've both watched, so a partner may guess roughly how far you got.
When a duo is revealed, your own answers are added as takes and counted in the crowd totals. Either player can share a result card showing both names and answers.
Takes and crowd totals
Other players can't read your takes. They see totals for each question. Your answer is counted without your name or ID. On small questions, or if few people answered, someone who knows how you think might guess. If you delete your account, your answers come out of the totals.
Share cards and links
Cards are made on your phone and we don't receive the image. If you share one, it goes where you send it. A link on a Rare Take card names the question, not you. Invite and Rare Take links open a small page on plottwin.com if the app isn't installed. It has no analytics or cookies. Cloudflare, which hosts it, sees the visitor's IP address and the link.
Notifications
PlotTwin asks before turning on notifications. If you allow them we keep a push token, your device type, your reminder setting and your time zone. We send through Firebase Cloud Messaging, which delivers to iPhones through Apple's push service. They get the token and the message. Messages can include a partner's name, a title and your streak, never answers.
The Firebase component in the app can register an installation ID with Google when the app starts. Share usage data does not control this.
Title search
Most searches are answered from our own database. If we don't have enough results, our servers send your search text to Wikidata, and for anime and books also to AniList and Open Library. For TV episode lists our servers ask TVmaze, using the show's IMDb ID, not your search. These services see the text or the ID and our server's address, not your account or IP address. We keep the text with the results for about 24 hours, without your account ID. Please search only for titles, not personal details.
Title art
PlotTwin draws its own art for each title on your phone, from colors and patterns we chose. It doesn't load posters or covers from catalog services. The only outside images are ones you pick yourself in Flip Duel.
AI-written questions
Anthropic's Claude writes some questions, on our servers, never from the app. We send the title's name, year, type, counts, character names and existing questions for that title. We send no account ID, answers, name, email, IP address or device details. A person's request can start this. We record that in our own database and don't pass it on. AI questions can be wrong, and players can report them.
Services that receive data
| Service | Why | What it receives |
|---|---|---|
| Supabase | Database, sign-in, server functions, live game traffic | Everything in your account, IP address and connection details. Region: East US |
| PostHog | Usage statistics | See above |
| Google Firebase: Crashlytics, Cloud Messaging | Crash reports, notifications | See above |
| Apple Push Notification service | Delivers to iPhones | Token and message |
| Google Sign-In, Sign in with Apple | Optional sign-in | What you approve on their screen |
| Supabase (built-in email) to be confirmed | Sign-in and reset codes | Your email and the message |
| Cloudflare | Hosts this website and invite links, and forwards email sent to [email protected] to our mailbox at to be confirmed: email host | Visitors' IP address and the page opened; emails you send us |
| Google Search | Search Google in Flip Duel, if you use it | Your search, IP address, device details. Direct from your phone, under Google's terms |
| Other image hosts | Web images you pick in Flip Duel | Your IP address and the image requested |
| Anthropic | Writes questions | Title facts only |
| Wikidata (Wikimedia Foundation), AniList, Open Library | Title search and data | Search text from our servers, no user data |
| TVmaze | TV episode lists | Show IDs from our servers, no user data |
Google Play Integrity and Apple App Attest may check that a title import comes from the real app. To be confirmed: on at launch.
Our database (Supabase, East US) and PostHog are in the United States, and most services listed here are US companies. If you live elsewhere, your data goes to the US. To be confirmed: international transfer wording.
On your phone
The app keeps a local database so it works offline: takes, unfinished answers, votes, streak, progress, favorites, duos with your partner's name and, after the reveal, their answers, plus catalog data. Your sign-in session is held in the phone's secure storage. Android backup and phone-to-phone transfer are turned off for app data. iPhone backups may include the local database.
Signing out or deleting wipes your account's data from the phone. Catalog data and a few phone settings stay until you uninstall.
How long we keep it
| Data | How long |
|---|---|
| Account, takes, streak, progress, favorites, votes, share records | Until you delete your account |
| Guest accounts no longer used | To be confirmed |
| Duos and duo answers | To be confirmed. Today they stay after they expire or finish, until a member deletes their account |
| Flip Duel rooms | Removed after they expire, normally about 6 hours, by an hourly job |
| Search text and results | About 24 hours |
| Rate counters | About 1 day |
| Requests for more questions, IP hashes, daily summaries | To be confirmed |
| App Attest keys | Until you delete your account |
| Push tokens | Until you sign out or delete, or the token stops working |
| Usage events in PostHog | To be confirmed |
| Crash reports | 90 days, then Google starts removing them |
| Firebase installation ID | Until we ask Google to delete it, then up to 180 days |
| Server and sign-in logs, backups | To be confirmed |
| Takedown requests | Kept as our record |
Deleting your account
In the app. Go to Profile and tap Delete account. A guest sees Delete my takes, which deletes the whole guest account.
Without the app. Email [email protected] from the address on your account. A guest has no email, so a guest needs to use the app.
What goes. Your account, name, email, sign-in links, takes, streak, progress, favorites, votes, share records, push tokens, requests and your Flip Duel seats. Your answers leave the crowd totals. If you signed in with Apple, we ask Apple to revoke access.
Duo partners. Deleting removes every duo you were in for your partner too, including their answers in that duo. Their own takes stay.
What deleting does not erase:
- Usage events in PostHog and crash reports in Crashlytics already sent. They stay, under your old account ID, until their retention ends.
- Records of requests for more questions stay without your account ID but with the IP hash. Daily summaries from before you deleted can still hold your account ID and IP hash.
- Copies in server logs and backups, until those expire.
- Cards anyone already shared or saved, and videos anyone filmed.
- Your phone's own backups.
Your choices and rights
You can see and change your name and progress in the app, turn off usage data and notifications, and delete your account. There is no export button. Write to us for a copy of your data, a correction or anything else, and we'll answer within a time still to be confirmed. We can't tell which guest account is yours, so a guest account can only be viewed or deleted in the app.
Depending on where you live, you may have the right to access, correct, delete or get a copy of your data, to object to or restrict its use, to withdraw consent, and to complain to your data protection authority.
EEA and UK. We process account and game data to provide the service, notifications with your permission, and security and abuse protection for our legitimate interest in keeping the app safe. Usage statistics and crash reports: to be confirmed. EU or UK representative: to be confirmed.
California and other US states. We don't sell your personal information or share it for cross-context behavioral advertising, and won't treat you differently for using your rights.
Selling or licensing data
We don't sell or license your personal data or our analytics, including to studios. PlotTwin has no ads, subscriptions or purchases today. If that changes, we'll update this policy first, and we won't apply a less protective rule to data we already hold without asking you.
Children
PlotTwin is for a general audience and isn't directed at children. You must be at least 13, or older where your country requires it (up to 16 in parts of the EU), to use it. We don't ask your age, so we can't tell who is under that age. If you think a child under the minimum age has used PlotTwin, contact us and we'll delete the account.
Security
Data travels over encrypted connections. Database rules limit what each account can read. Our service keys stay on our servers. No system is perfectly secure.
This website
plottwin.com uses no cookies, analytics or trackers, and its fonts are served from this site. Cloudflare, which hosts it, sees your IP address and the pages you open, as any web host does.
Changes
If we change this policy we'll update the date. For a significant change, we'll tell you in the app first.
Contact
SashApps. To be confirmed: address. [email protected]. Rights holders can use the same address for takedown requests.