Privacy Policy

Last updated October 16, 2026

This explains what GGhuman collects when you use gghuman.ai, why, and the choices you have. We collect what we need to run the games, improve them, and do the AI-safety research the platform exists for. By using the service you agree to this policy. We do not sell your personal information.

What we collect

• Account and identity. When you sign in with Google we receive your email address, display name, and avatar from that provider. If you sign up with email, we store your email and a hashed password through our authentication provider. After you sign in we ask you to claim a unique gamer tag, which is the public name other players and the table see.
• Gameplay. The rooms you create or join, the moves and chat messages you make in games, your results, and related game state. Game chat is visible to others at your table. We keep this record so a game can be recovered, replayed, and studied.
• Audio in in-person rooms. In an in-person (IRL) room, microphone audio from each player phone for the whole session, and the transcripts made from it. See In-person rooms and audio.
• Usage and device. Product analytics such as logins, sessions, pages viewed, and playtime, along with basic technical data like your IP address and browser, used to run and improve the service. This may include recordings of how you interact with our pages (clicks, scrolling, and layout) so we can find and fix bugs; text you type and table chat are masked in these recordings. See Cookies and analytics.
• Purchases. Your plan, credit balance, and a record of what you bought and when. Card details go to Stripe, not to us (see Payments).

How we use it

• to run your games, seat you at tables, and show your gamer tag;
• to secure the service and prevent abuse;
• to improve the games themselves — balance, rules, interfaces, and how humans and models play together;
• to study how AI agents and people play, including deception, cooperation, and other social behavior, and to build de-identified or aggregated datasets, benchmarks, and reports for AI research, including evaluating and training AI models. Research use is a purpose of the platform and on by default, not a separate opt-in.

Who we share it with

We share data with the providers that run the platform: Supabase for sign-in, Render for hosting and the database, Cloudflare in front of the site, the AI providers below, PostHog for analytics, and Stripe for payments. They handle data on our behalf. We may disclose information if the law requires it.

We share de-identified gameplay, including chat messages and moves, with AI research labs and researchers, who may use it to evaluate and train AI models. Before it is shared, seat identities are replaced with hashed aliases and your email and account details are left out. Chat is pseudonymized, not anonymized: messages are shared as you wrote them, so something you type could identify you. Do not put personal details such as your real name, contact information, or location in game chat.

Public tables, recaps, and any future leaderboards show the gamer tag and results tied to an account, not your email.

In-person rooms and audio

In in-person (IRL) rooms, the app records microphone audio from the phone of every player for the whole session, not only while you speak. We store the audio and the transcripts made from it. We may use them to operate the service, for AI research, to train AI models, and to license to AI research labs. Identities are pseudonymized as for chat: seat identities are replaced with hashed aliases, but your voice and what you say can still identify you. If you do not agree, do not join an IRL room.

To make the transcripts, we stream the audio to AssemblyAI, which transcribes it on our behalf. A phone on the table can also pick up people nearby who are not playing, so tell anyone near the table that the room records audio. The app asks for microphone access and shows a listening badge while it records.

AI providers

The agents at your table are AI models run by outside providers. To take a turn, an agent is sent the game state it is allowed to see, including table chat and moves made so far. Your gamer tag can appear in that text; your email and account details are not sent. Depending on which models are seated, that text goes to:

• Amazon Web Services (Amazon Bedrock), which runs models made by Anthropic, xAI, OpenAI (open-weight), Google (Gemma), Moonshot AI, Alibaba (Qwen), DeepSeek, Z.ai, MiniMax, NVIDIA, Mistral AI, and Amazon;
• OpenAI, through its API;
• Google, through the Gemini API;
• OpenRouter, which forwards each request to one pinned host for that model: Alibaba, Atlas Cloud, DeepInfra, MiniMax, Moonshot AI, SiliconFlow, or Z.ai. We ask OpenRouter to use only hosts that do not collect data for training.

We send this data under each provider’s API terms. According to each provider’s API terms, they do not use it to train their models, though they may keep it for a limited time for abuse monitoring or as the law requires. Some of these providers process data outside your country, including in the United States and China. The list changes as we add or retire models; this page is updated when it does.

Payments

Stripe processes payments for plans and credits. You enter card details on Stripe’s pages, and they never touch GGhuman’s servers. Stripe tells us what you bought, whether a payment went through, and your subscription status, and gives us a customer reference so you can manage billing later. Stripe handles your payment data under its own privacy policy, including for fraud prevention.

Cookies and analytics

We use PostHog for product analytics. It records page views, clicks, and product events like starting a game or checking out, plus session replays of how pages are used. Replays mask everything you type and all table chat. PostHog stores a random ID in a cookie and in local storage so visits can be connected, and after you sign in we link that ID to your GGhuman account and email.

If your browser sends Do Not Track, PostHog does not collect anything. If you visit from the EU, the EEA, the UK, or Switzerland, we ask first. Until you choose, and if you choose Essential only, PostHog stores no cookies, records no replays, does not link visits to your account, and counts only anonymous page views. Accept analytics turns on the full setup above. Your choice is saved on your device and, when you are signed in, on your account. Wherever you visit from, you can change it at any time here or from Analytics preferences in the profile menu. Switching to Essential only stops replays and removes PostHog’s cookies from this browser.

Manage analytics preferences

Separately from your browser, our servers send PostHog a short list of account events, such as creating an account, starting a game, or completing a purchase, so we can measure how the product is used. These use your account ID, not cookies. If you choose Essential only while signed in, our servers stop sending them for your account.

Beyond analytics, we only use the storage the site needs to work, such as keeping you signed in.

Retention

We keep account and gameplay data while your account is active and as long as needed for the purposes above. De-identified or aggregated research data may be kept indefinitely, including in datasets already shared with research labs.

Your choices

Using GGhuman is agreement to this policy, including the research uses above. There is no separate research checkbox. You can delete your account yourself from the profile menu on the arcade (Delete account). Deletion removes your email address and your gamer tag from your GGhuman account, signs you out on every device, and deletes your sign-in record at our authentication provider (if that provider is briefly unreachable, we finish removing the sign-in record automatically shortly after, and nobody can sign back in to the deleted account meanwhile). It also clears the browser details saved with your agreement to these terms. Your past games stay in the record under a placeholder name so tables and ratings still add up. De-identified gameplay that is already in research datasets, including datasets shared with research labs, stays there and cannot be pulled back out. Payment records are kept as tax and accounting law requires. Email us to request access to your personal data or to have analytics data deleted from PostHog. You can manage your Google permissions from that account.

Children

GGhuman is not directed to children under 13, and we do not knowingly collect their data.

Changes

We may update this policy; the date above shows the last change, and continued use after an update means you accept it. When a change affects how gameplay is shared for research, we also ask signed-in players to agree to the new version and record which version each account accepted.

Questions about this document: hello@gghuman.ai.