Privacy

Last updated: 27 October 2026

Hümor Unleashed (HÜ) is a party game you play in the browser. This page says what data we process, why, for how long and how you can exercise your rights (Arts. 13 and 14 GDPR). The short version: guests leave only a nickname that disappears within hours; we ask for an email only from people who want a host account or the waitlist. The Italian version is the reference text.

Who is responsible

• Controller: Matteo Giuditta.
• Privacy contact: info@humorunleashed.com. We answer within one month (Art. 12(3) GDPR).
• We have no data protection officer (DPO): we are not required to appoint one (Art. 37 GDPR).

Playing without an account

• What: the nickname and face you pick, tied to the room, and a random identifier your browser keeps so you can get back in after a reload. During the game we also process the cards you play and the scores.
• Why: to let you play (Art. 6(1)(b) GDPR).
• How long: while the room is active and at most 6 hours after the last activity, then everything is deleted. Rooms live only in memory on our servers in the EU, never in a database.
• Age: the game is for adults only. We don't ask for your date of birth: we ask you to confirm you are at least 18, and the browser remembers it.

Share cards

• What: when someone shares a round's winning combo, we store the winner's nickname and face, the text of the prompt and the answer, the round and the sharer's language.
• Why: to create the image and the page that open from the shared link. It is our legitimate interest in letting people discover the game (Art. 6(1)(f) GDPR): the nickname is picked for playing, is often not a real name, and the card never carries the room code.
• How long: 24 months from sharing.
• Objecting: if a share card shows your nickname and you don't want it online, send us the link and we take it down.
• Group deck cards never end up in a share card.

Host accounts

The account is optional and only for hosts: we offer it at the end of a game. Guests never need one.

• What: your email address; if you sign in with Google, also the name and profile picture Google passes to us. For each game you host: date, deck, number of players and rounds, and the winning combos (the text of prompt and answer, not who played them). For Captioned, which images you already got and when (the image code only), so we don't show them again too soon. To keep you signed in we use a technical session cookie and store the browser you sign in from (user agent), not your IP address.
• Why: to sign you in and show your game history (Art. 6(1)(b) GDPR).
• Emails: the sign-in link; 24 hours after your first saved game, the best combos; a week later, the deck of the week. Every email has a link to stop them, and you can unsubscribe at any time.
• How long: as long as you keep the account. Sessions expire after 7 days of inactivity. If you delete the account from the "Your account" page, we delete your email and sessions right away; your games stay only as numbers, with no link to you.

Waitlist

• What: your email address, the language of the page you signed up from and, if you came from a share card, that card's identifier.
• Why: to tell you about new decks, games and the launch, with your consent (Art. 6(1)(a) GDPR), which you give by signing up.
• How long: until you unsubscribe, and at most 12 months after the public launch. You can withdraw consent by replying to one of our emails or writing to info@humorunleashed.com.
• Anti-bot: the form uses Cloudflare Turnstile, which checks the browser to tell people from bots (Art. 6(1)(f) GDPR, protecting the service).

End-of-game feedback

• What: your rating, whether you'd play again, an optional note (please no names or personal data) and, if you are the host, your four answers about the Host Pass price. They are tied to a random game identifier, not to you.
• Why: to improve the game and work out whether and at what price to offer the Host Pass (Art. 6(1)(f) GDPR).
• How long: 24 months.

Statistics and errors

• Statistics: we count what happens in rooms (rooms created, rounds played, shares, feedback) with PostHog, servers in the EU. Events are sent from our server, tied to the room and not to the person, and contain no nicknames, emails, card text or notes. No analytics cookies, no profiling.
• Errors: when something breaks, Sentry (servers in the EU) receives the technical error. We stripped cookies, addresses, request bodies and variables: what remains is the browser type.
• Why: our legitimate interest in keeping the game working and improving it (Art. 6(1)(f) GDPR).
• How long: errors 90 days; statistics 24 months.

Cookies and browser storage

We use no profiling or third-party cookies, so there is no banner. We only use technical tools (Art. 122 of the Italian Privacy Code):

• hu_lang: the language you picked by hand, for one year;
• the host account's session cookie, if you sign in;
• in browser storage: your 18+ confirmation, the identifier to get back into rooms and, for the life of the tab, the share card you arrived from.

Who handles data for us

Providers processing data on our behalf, under an agreement as required by Art. 28 GDPR:

• Hetzner Online (Germany): the servers everything runs on, database included.
• Cloudflare: the network in front of the site (attack protection, certificates) and Turnstile on the waitlist form. It may process data in the United States, under the EU-US Data Privacy Framework and standard contractual clauses.
• Resend: sending emails. It may process data in the United States, with the same safeguards.
• PostHog (EU) for statistics and Sentry (EU) for errors, as described above.
• Google, only if you choose to sign in with Google: Google identifies you under its own privacy policy.

We never sell or hand over data to anyone. We don't use your data for advertising.

Backups

The database is copied every night, encrypted, to Hetzner storage in Germany. Copies delete themselves after about 5 weeks, so deleted data also leaves the backups within that time. Rooms are never backed up.

Your rights

You can ask us at any time to see your data, correct it, delete it, restrict its use, receive it in a readable format, or object to processing based on legitimate interest (Arts. 15-22 GDPR). If you gave consent, you can withdraw it whenever you want, without affecting what was done before.

Write to info@humorunleashed.com. For data not tied to an email (nicknames, share cards, feedback) we need something to find it, such as the share card link.

If you think we handle your data unlawfully, you can complain to the Italian data protection authority (garanteprivacy.it) or to the authority of the country you live in.

Changes

When we change this notice we update the date at the top. If a change concerns the emails we send you or who receives your data, we tell hosts with an account and people on the waitlist first.