PHOTOIMPOSTOR

Privacy Policy

Effective October 18, 2026

Who we are

Photo Impostor (the “App”) and photoimpostor.com are operated by Kramer Ventures GmbH (“we”, “us”). We are the data controller for the information described in this policy.

Kramer Ventures GmbH
Hagenholzstrasse 81
8050 Zürich
Switzerland
support@photoimpostor.com

This policy describes version 1.0.0 of the App. It explains what we collect when you use the App and the website, how we use it, who we share it with, how long we keep it, and the choices and rights you have. By using the App you agree to this policy and to our Terms of Service.

What we collect

Your account

The first time you open the App, it creates a guest account for you through Supabase Auth, our sign-in and database provider. The account is a random ID. The App keeps the account's sign-in token in your phone's secure storage (the iOS Keychain or Android's encrypted storage). We do not ask for an email address, phone number, password or your real name. Because there is no email or password, an account that is lost with its phone cannot be recovered. If you enter an access code in Settings, the server checks it and, for a code that grants Photo Impostor+, notes on your account that Plus was granted and until when.

Your profile

The display name you choose (up to 24 characters), the character you build, the reactions and stickers you equip, a random friend-link token, and when you were last active. This is stored in our database (Supabase) until you delete your account.

Your photo library

With your permission, the App reads your photo library on your phone: photos, and for video rounds, videos. You can give full or limited access; risky mode (below) needs full access. The App does not ask for, read or use the location stored in your photos.

To choose which photos to deal you, the App looks at them on your phone. On iPhone it uses Apple's on-device Vision framework and models built into the App to recognise things like faces, people, pets, text and the kind of scene, to compute a numeric summary of each photo (an image embedding: a list of numbers describing what the photo shows), to suggest words for the impostor's hint, and to check for nudity and sexual content so that such photos are held back from a table. All of this runs on your phone; photos are not sent anywhere for it. These on-device models are not available on Android, so on Android the App picks photos without them and the on-device safety check does not run. The App keeps some of these results, and a list of photos you recently played, on your phone so it does not deal the same photos again.

Photos and videos you play

Approving a batch. The App deals you a batch of photos from your library. You can swap any photo or deal a new batch, and nothing is uploaded until you approve the batch. When you approve it, every photo in the batch is uploaded for that game, not only the one that becomes the secret. With each photo, the App sends the hint words, labels, score and numeric summary your phone computed for it, where it could compute them.

Risky mode. Risky mode is optional. It is turned on for a private table by its host, with Photo Impostor+ or by watching one rewarded ad, and it applies to you only after you have read what it does and ticked a box to agree. In risky mode the App picks photos from your whole library and uploads them to the table without showing them to you or asking you to approve them, so anything in your library can come up, including screenshots, selfies and private photos. On iPhone, the on-device safety check still holds back photos it detects as sexually explicit; on Android there is no such check. Photos uploaded in risky mode are stored, shown and deleted like any other photo.

Planted photos. With Photo Impostor+ or creator access, you can pick (“plant”) one photo from your library by hand to be the secret photo of a game in a series; you will not be the impostor in that game. Because you chose it yourself, a planted photo skips the on-device safety check. Otherwise it is uploaded, shown, sent for the hint, stored and deleted like any other photo.

Video rounds. For video and mixed rounds (Photo Impostor+, or unlocked with rewarded ads), your phone cuts a five-second clip from a video, re-encodes it at a lower resolution and removes the sound before anything is uploaded, so audio never leaves your phone. The clip is uploaded together with a still frame, which is handled like a photo.

Storage. Our server re-encodes and resizes each photo, which removes its embedded metadata such as location, and stores it, with a smaller copy, in private storage at Cloudflare (R2). Photos and clips can be opened only through signed links that expire within 20 minutes, which our server gives only to players at your table while the game needs them.

Deletion. Each photo and clip is deleted from storage within 24 hours of upload, and sooner when the room closes, when the table goes back to the lobby for a new game, when you replace it, or when you delete your account. If a photo or clip is reported, a copy is kept separately for up to 30 days for moderation. The hint words, labels and score sent with a photo are saved with the room's record and deleted with it (see How long we keep it); the numeric summary is kept only in the server's memory while the game runs.

Game data

Rooms you create or join, room codes, who was at the table, your game settings, roles, the clues you give, votes, guesses, reactions, and results. In spoken games, clues are said out loud at the table and never recorded; in written games, the clues you type are sent to our server. If you take a screenshot during a game, the App tells your table (“Name took a screenshot.”). Each finished game adds a result to your profile (your role, whether you won, the kind of game, whether it was played in person, in writing or online, and how many players it had), which the App uses for your statistics, such as games played, wins, impostors caught and streaks.

Friends, invites, blocks and reports

You become friends with other players when you are dealt into a game together at a private table or join a private table by its invite link, and when you open another player's friend link. Online tables with strangers and computer players never create friendships. Your friends can see your name, character, when you were last active and whether you are playing, and, while you are in a lobby, its room code so they can join; they can invite you to a game. You can remove a friend or block a player from your friends list. Blocking removes the friendship and pending invites in both directions and stops the two of you from becoming friends again.

You can report a photo or a player from inside a game, choosing a reason (nudity or sexual content, hate or harassment, or something else). A report records who reported whom, the room, the reason and, for a photo or clip, a copy of it as evidence. The App hides a photo you report and mutes a player you report on your phone. At online tables (not yet available), serious reports can remove a photo or a player, and repeated reports can lead to a strike or a temporary pause from online play. We review reports to keep the game safe and keep a record of moderation actions.

Notifications

On iPhone, if you allow notifications, the App sends our server your device's push token from Apple's push notification service (APNs) and your platform. We use it to tell you when a friend invites you to a game, and to remind you when your table is called to vote while the App is closed on your phone. A notification can include the inviting friend's name and the room code. You can turn notifications off in your iPhone's Settings. The Android version of the App does not ask for notifications and does not register a push token.

Purchases

Photo Impostor+ is a subscription bought through the App Store or Google Play. Apple or Google handle the payment and keep the purchase record; we never see your card or payment details. The purchase screen is provided by Superwall, which processes your purchase and subscription status linked to your random account ID. Our server checks that status with Superwall to give you Plus, including when you tap Restore purchases. Superwall also sends us counts of subscription events (such as purchases, renewals and cancellations, with the price and our proceeds), which we store without any account ID. Deleting your account does not cancel a subscription; manage or cancel it in your Apple ID or Google Play settings.

Feedback

Messages you send us through Settings → Feedback, and any reason you give when you delete your account. With each message we also store your app version, platform, build and language, how many days you have had your account, and how many games you have played.

Technical information

When the App talks to our servers, your IP address and connection details are processed by our hosting, network and sign-in providers (Railway, Cloudflare and Supabase) to deliver the traffic. Our game server uses your IP address in memory to limit abuse and does not store it in our database. With every request the App sends your app version and language. Our server's logs record each request's route, result and timing, and, when you connect to a game, your account ID and room code. If Sentry (below) is not running in the App, the App sends error reports to our server instead, with personal details removed. We use this information to run the service, prevent abuse and fix problems.

Crash reports and diagnostics

When the App crashes, freezes or a step fails (for example, a purchase that cannot be confirmed or an ad that cannot load), it sends a report to Sentry. A report contains the error, your device model and operating system version, the app version, and short fixed labels such as the stage of the game, the connection state, the last kind of action you took, or the purchase or ad step that failed. The App also sends Sentry app-session health data (whether a session ended in a crash) and performance timings, such as how long launch or dealing photos took, labelled with fixed words and numbers. Reports are set up to exclude your account ID, name, photos, clues and room code, and IDs, email addresses and web addresses are scrubbed from error text. Sentry also sees the IP address a report is sent from. The App's reports are stored in Sentry's EU region (Germany).

Microsoft Clarity (switched off)

The App contains Microsoft Clarity, a tool that reconstructs how people move through a screen from interaction and layout data. In this version it is switched off: it never starts and sends nothing. It is built so that, if we ever turn it on, it could run only on the first two onboarding screens (the welcome screen and the “played before?” question) and would pause on every other screen, with no account ID or other identifier attached. We would update this policy, and ask for any consent the law requires, before turning it on.

Usage analytics

The App counts what happens in it so we can see where people get stuck. The counts are sent with a random identifier that the App creates each time it starts, keeps only in memory, and never links to your account. We collect:

• onboarding, tutorial and practice-round steps, visits to the rules, and peeks at your role card;
• how long you spend in an active round with the App open;
• joining a game and why a join failed, and connection problems;
• paywall, rewarded-ad and notification-permission outcomes, rewarded-ad attempts and rewards, and unlocked items or game credits;
• room-code copies and invitations or stats cards shared (never what was shared or with whom);
• for choosing photos: whether library access was given, how long choosing took, swaps, new batches, failures, and, for each photo offered to you, its broad kind as labelled on your phone (for example people, pet or food), a score range and whether you kept it, swapped it or dealt again (never the photo or anything that identifies it).

Each record also holds the day, your platform and app build. These records are deleted after 30 days; after that only daily totals by platform and build, without the random identifier, are kept for up to 400 days.

To see whether people come back and how games go, we also record the days on which your account uses the App (only your account ID and the date), and keep a summary of each game and table: its settings, how many players and computer players it had, how long each stage took, how it ended, and the app versions and language used. These summaries are stored under a coded key, without account IDs, names, clues, photos or room codes. We only look at this data in aggregate.

Improving photo picks

To learn which photos make good rounds, the App sends us a record for each photo offered to you on the batch screen. A record contains:

• the photo's numeric summary (the image embedding computed on your phone), never the photo itself;
• details your phone read from it, such as how many faces it has and where, whether it shows people or pets, how much text it contains, its brightness and contrast, an aesthetic score, whether it is a favourite, a screenshot, a panorama, a burst, a Live Photo, taken in portrait mode or edited, its size and its age in days;
• how the App scored it, and whether you kept it, swapped it or dealt again, and how long it was shown;
• the table's context, such as the number of players, the game settings, whether risky mode or planting was used, how many photos your library holds and whether the photo was stored only in iCloud;
• for photos that were played, how the game went, for example whether it finished, who won, how long the discussion lasted, how many reactions and chat messages were sent, whether someone walked out, whether the photo was reported and whether the table played again;
• the app version, build and platform.

Each record is stored with a random identifier for this installation of the App and a random identifier for each batch. It is not stored with your account ID, name or room code: your account is used only to check that the request comes from the App. We use these records only to improve which photos the App offers, based on your consent, and keep them for up to 2 years. Because they are not linked to your account, deleting your account does not remove records already sent; they are deleted on that schedule. Before your first photo is used, the App asks once whether you agree to AI hints and these records (one answer covers both); nothing is sent unless you agree. You can change your answer at any time in Settings → More → AI hints and photo picks, and turning it off stops future sending and drops records not yet sent. The App also keeps a log of recent records on your phone so that its picks can adjust to your taste; that log stays on your phone.

Test versions of the App released before version 1.0.0 (build 81) sent a similar numeric summary and two scores from the on-device model for photos offered on the batch screen, with whether you kept the batch, linked to your account ID. We keep that data only to improve photo picks, for up to 2 years. If you delete your account, the link to it is removed.

Rewarded advertising

Ads in the App are optional rewarded videos: an ad plays only when you choose to watch one, to keep a character part or sticker pack, or to play a game with videos, a mixed game or a risky game. There are daily limits, and there are no banner or other ads. Photo Impostor+ subscribers are not shown ads. The App does not ask for your age before an ad.

Ads are provided through AppLovin MAX, an ad mediation service. At launch, once Apple's tracking prompt is settled on iPhone and the server has confirmed that you do not have Plus, the App refreshes Google's consent information and shows any required consent form. It then starts MAX and may load a rewarded ad in advance while you have ads left to watch that day. The same privacy steps apply before an ad request if launch could not complete them. No ad is requested before consent is settled. Videos only play when you choose to watch one. MAX selects ads from AppLovin (including AppLovin Exchange), Google AdMob / Google bidding, Unity Ads, Mintegral and Liftoff Monetize (Vungle). These providers may receive device, App and network information, your IP address, advertising or vendor identifiers (on iPhone, the advertising identifier only if you allow tracking), your advertising choices, and how you interact with ads. They use this information to show, measure and personalise ads as your choices allow and to prevent fraud. They never receive your photos, display name, room code or clues.

Tracking permission (iPhone). Once, after the App's first screen appears, the App asks for Apple's App Tracking Transparency permission. Declining does not stop you from watching rewarded ads. You can change it at any time in iOS Settings → Privacy & Security → Tracking.

Consent (EEA, UK and Switzerland, and US states). Where the law requires it, including in the European Economic Area, the United Kingdom and Switzerland, the App uses Google's User Messaging Platform to ask for your advertising choices before the first ad is requested, and no ad is requested until you have answered. If you decline personalised ads, the networks can still show ads that your choices allow. You can review or change your choices at any time in Settings → More → Ad privacy, which opens the consent form, or, where US state law provides it, the choice to opt out of the sale or sharing of your personal information for targeted advertising. Opening Ad privacy does not start any ads. Changes apply from then on and cannot undo processing that already happened.

Privacy policies: AppLovin, Google (and how Google uses data from apps that use its services), Unity Ads, Mintegral and Liftoff Monetize (Vungle).

Rating the App

The App may invite you to rate it. It then opens Apple's or Google's own rating prompt, or the store's review page. Your rating and any review go to Apple or Google; we do not receive them through the App. The App only remembers, on your phone, that it has asked.

Creator tools

Creator tools, unlocked with a code, let you make a short animation from a photo you pick from your library. The animation is made on your phone and saved only to your own camera roll, which is why the App may ask for permission to add to your photos. It is not uploaded to us. The “green screen” option is a plain green background for video editing; the App never uses your camera.

Discord and Instagram

The Discord and Instagram buttons open those services outside the App, where their own privacy policies apply. Tapping one can unlock a community character (Gamer or Paparazzi) on your phone. We do not check whether you joined or followed, and we receive nothing from Discord or Instagram about you. The unlock is counted only in the anonymous usage analytics described above.

Online games (not yet available)

Online play with strangers is not available in this version of the App. The App already contains the parts it will use. When online play is available, public tables will include people you do not know and computer players; photos for public tables will also be checked for nudity by a model on our own server; players will be able to chat in writing; and voice chat, carried live by LiveKit, will use your microphone only after you allow it and turn your mic on. Voice will never be recorded or stored. We will update this policy when online play launches.

What we do not collect

• No email address, phone number, password or contacts.
• No precise location. The App does not ask for location, and location metadata is removed from every photo before it is stored.
• No camera. iOS shows a camera notice only because the voice chat library includes camera support; the App never uses it.
• No microphone recordings. The microphone is used only for voice chat in online games, which are not yet available.
• Ad software starts only after the applicable privacy steps are complete. For players without Photo Impostor+, it may start and preload a rewarded ad at launch. An ad plays only when you choose to watch one.

How we use it

• To run the game: create your account, deal photos, assign roles, show the right photos to the right players, collect clues and votes, and keep score.
• To write the impostor's hint: see the next section.
• To connect you with friends: friend links, invites and invite notifications.
• To keep the game safe: check photos for nudity, handle reports and blocks, enforce our rules, and prevent abuse.
• To provide purchases, ads and support: give you Photo Impostor+, deliver the rewarded ads you choose, and answer your messages.
• To improve the App: understand how games are played and fix crashes, using the analytics and diagnostics described above.
• To improve photo picks: learn which photos make good rounds, as described under Improving photo picks.

For players in the European Economic Area, the United Kingdom and similar jurisdictions, our legal bases are: performance of our contract with you (your account, running the game, uploading the photos you approve or the modes you choose, purchases), your consent (photo library access, the AI hint and photo-pick records, notifications, and tracking and personalised advertising where the law requires consent, which you can withdraw at any time), and our legitimate interests (safety, security, preventing abuse, analytics, crash reports and improving the App).

The impostor's hint and AI services

The impostor gets one word about the secret photo, such as “Cheesy”. If the photo's owner agreed to AI hints (the App asks once, before your first photo is used), our server sends a reduced-size copy of each game's secret photo (at most 768 pixels on its longest side, without its metadata) to xAI's Grok vision model once per game (and once more if the first try fails), with our instructions and the languages the impostors need. Nothing else about you is sent with it: no name, account ID, room code or clues. xAI returns a short list of words, which we save with the room. We can also set the server to send this request to OpenAI instead of xAI, in which case we ask OpenAI not to store it. If the owner said no, the photo is never sent and the hint comes from the words their phone suggested for it, as it does when the model is slow or fails. xAI and OpenAI process the photo under their own terms and may keep requests for a limited time, for example to monitor abuse. See the xAI and OpenAI privacy policies.

In online games (not yet available), computer players write their clues from the words phones suggested for a photo. Only when a photo has no such words, and its owner agreed to AI hints, can the server ask OpenAI for a clue, sending a smaller copy of the photo and the clue words already given at the table, without player names.

Who can see your content

Photo Impostor is a social game. Everyone at your table sees your display name, character, reactions, clues, votes and results, and whether you have Photo Impostor+. Any photo in the batch you approve, or that risky mode sends, can be shown to the table: as a candidate for the secret photo, as the secret photo itself, or as one of the decoys when a caught impostor gets a last guess. In Show Me and Whose Roll?, players' photos are shown to the whole table. During a game, everyone except the impostor sees the secret photo, and the impostor sees only a tiny blurred version; at the end, everyone sees it. Your friends see the information described under Friends. Anyone who can see a photo on their screen can take a screenshot of it, so approve only photos you would show at the table.

Who we share it with

We do not sell your personal information for money. When rewarded advertising starts as described above, AppLovin MAX and its ad partners receive the device and advertising information described above for their own advertising purposes, subject to your choices. Otherwise we share information only with service providers that run the App for us, under contracts that limit how they may use it:

• Supabase — your guest account, sign-in and our database.
• Railway — hosts our game server and its logs.
• Cloudflare — private photo and video storage (R2), the website, and network security.
• xAI — writes the impostor's hint from a reduced copy of the secret photo; OpenAI as a backup, and for computer players' clues in online games.
• Apple and Google — the App Store and Google Play, in-app purchases, ratings, push notifications through Apple, and Apple's tracking permission.
• Superwall — the purchase screen, purchase records and subscription status, linked to your random account ID.
• AppLovin MAX and its ad partners — rewarded advertising, preloading and measurement, subject to the choices described under Rewarded advertising, where their privacy policies are linked.
• Sentry — crash reports, error diagnostics and performance timings, without your account ID or content you enter.
• LiveKit — live voice chat in online games, once online play is available. Audio is relayed in real time and not recorded.
• Microsoft Clarity — included in the App but switched off; it receives nothing.

Our team uses an internal, password-protected admin dashboard to see aggregate statistics, read feedback and review reports, including reported photos and clips. Most of it shows coded IDs instead of account IDs; the moderation page shows player names and account IDs so that we can act on reports.

We may also disclose information if required by law, to enforce our terms, or to protect the rights and safety of players, the public or Kramer Ventures GmbH. If Kramer Ventures GmbH is ever part of a merger, acquisition or sale of assets, your information may transfer with it; this policy will continue to apply.

How long we keep it

• Photos and videos: deleted within 24 hours of upload, or earlier when the room closes, the table starts a new game from the lobby, you replace the photo or you delete your account. Copies of reported photos and clips: up to 30 days.
• Room records (who was seated, names, characters, settings, clues, votes, reactions, the hint and the words sent with photos): deleted about 7 days after the room's last activity. The numeric summaries sent with photos are kept only in memory while the game runs.
• Profile, friends, blocks and game results: until you delete your account. Invites are deleted with the room they are for.
• Push tokens: until Apple tells us the token no longer works, or you delete your account.
• Usage analytics: 30 days; daily totals without the random identifier for up to 400 days.
• Days you used the App: up to 400 days, or until you delete your account. Game and table summaries: up to 400 days.
• Photo pick records: up to 2 years, including records sent by test versions before build 81.
• Subscription event counts: up to 400 days, without account IDs.
• Feedback, reports and moderation records: kept without a fixed end date so we can handle them and keep the game safe. Feedback is no longer linked to your account once you delete it. Strikes and online-play pauses are kept after an account is deleted, to prevent abuse.
• Server logs and crash reports: kept by Railway and Sentry for a limited period for security and troubleshooting, then deleted.

Your choices

• Photo access: the App works only with the access you give it. You can switch between full and limited access, or turn access off, in your phone's settings at any time.
• Risky mode: off unless you agree to it at a table where the host turns it on. Normal mode always shows you every photo before anything is uploaded.
• AI hints and photo picks: turn off Settings → More → AI hints and photo picks to stop sending your photos to the hint model and records about the photos you are offered.
• Ads: an ad plays only when you choose to watch one. Settings → More → Ad privacy lets you review or change your advertising choices where they apply; on iPhone you can also change tracking in iOS Settings.
• Notifications: turn them off in your iPhone's Settings.
• Friends, blocking and reporting: remove a friend or block a player from your friends list, and report a photo or a player from inside a game.
• Delete your account: Settings → More → Delete account. It deletes your profile, friends, blocks, invites, game results and statistics, push tokens, the days you used the App and your uploaded photos and clips, and replaces your name, character, photos and clues in stored rooms. Any reason you give is kept as unlinked feedback. Copies of reported photos or clips may remain for up to 30 days, and reports and moderation records about you are kept. Data that is not linked to your account (usage analytics, game summaries and photo pick records) is deleted on its own schedule. The App then clears its sign-in and your saved profile from your phone; other data the App keeps on your phone is removed when you delete the App. Deleting your account does not cancel a subscription. See the account deletion instructions.

Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy of it, restrict or object to certain processing, and withdraw consent at any time. You can delete your account yourself in the App. For anything else, email support@photoimpostor.com. We will respond within the time required by law, and we may ask you to verify your request from the App. If you are in the EEA, the UK or Switzerland, you also have the right to complain to your local data protection authority.

California and other US states: the California Consumer Privacy Act and similar state laws give you the right to know what personal information we collect, use and disclose, to delete it, to correct it, to opt out of its sale or sharing for targeted advertising, and not to be discriminated against for exercising these rights. We do not sell personal information for money, but ad partners' use of device identifiers and ad interactions for personalised advertising may count as a “sale” or “sharing” under these laws. You can opt out in Settings → More → Ad privacy where it applies, and on iPhone by not allowing tracking. The categories we collect are described above: identifiers (account ID, push token, IP address, and advertising identifiers collected by ad partners), user content (photos, videos, clues, feedback), profile information, purchase information (subscription status), internet and app activity (usage analytics, logs, crash reports), and inferences our on-device models make about your photos to choose which to offer. You may designate an authorized agent to make a request on your behalf.

Children

Photo Impostor is not directed to children under 13, and we do not knowingly collect personal information from them. If you are under the age at which you can agree to this policy in your country, do not use the App. If you believe a child has created an account, contact us and we will delete it.

Security

All traffic between the App and our servers is encrypted. Photos and videos are stored in a private bucket and can only be fetched with a signed link that expires within 20 minutes. The App cannot read our database directly: only our server can, and database access is restricted with row-level security. No system is perfectly secure, so please approve only photos you are comfortable sharing with your table.

International transfers

We are based in Switzerland. Our service providers process data in the United States and in other countries where they operate; for example, the App's crash reports are stored in Sentry's EU region in Germany. Your information may be transferred to and processed in those countries. Where required, we and our providers rely on recognized safeguards such as standard contractual clauses.

Changes to this policy

We may update this policy as the App changes. The date at the top shows when it was last revised. For material changes we will let you know in the App or on this page before they take effect.

Contact

Questions, requests or concerns: support@photoimpostor.com, or write to Kramer Ventures GmbH, Hagenholzstrasse 81, 8050 Zürich, Switzerland.