Privacy Policy
What SUS keeps (a random player number and your plays, with no account or email), for how long, the services involved, and your choices.
Last updated: 29 October 2026
This policy explains what playsus.app keeps when you play SUS, why, and for how long. The site is published by PVV Media Technologies, 102 N 2nd Avenue E, Newton, IA 50208, United States. Questions: contact@playsus.app.
In short
- There are no accounts and no sign-up. We never ask for your email, phone number or payment, and we never need your real name.
- Your browser makes a random player number and keeps it, with your scores, on your device.
- Our server keeps your plays under that random number, and deletes them after 60 days.
- No analytics, no advertising, no tracking pixels, and the site sets no cookies for visitors.
What your browser keeps on your device
Your browser keeps two things in its own storage on your device. This is not a cookie.
- A random player number, which your browser makes itself the first time you play.
- The scores of the cases you’ve finished, so the game can show your streak and your numbers.
That list of scores stays on your device. Your player number is sent to our server whenever the game talks to it, so the server can keep your play together (see the next section). Clearing this site’s data in your browser deletes both from your device, and you start over with a new number.
What our server keeps
Our server keeps the following under your random player number only. It doesn’t keep your email or IP address with them.
- Each case you play: your guesses, the true hints you used, the question you asked, your accusation, your score and the times.
- Each hint you pick as a writer, and in friends mode, the name you type for the case.
- Each friends case you start, so that only you can press “Start now”.
We use this to run the game (to remember where you are in a case and work out your score) and to show each case’s numbers, such as how many players solved it.
Plays and writer picks are deleted 60 days after they start. Friends cases are deleted 30 days after they’re made, with everything played and written in them. The totals in each case file (how many played, how many solved it, how many caught the imposter) keep no player numbers, and they stay.
The server also makes a copy of its database once a day and keeps the last 14, so something we’ve deleted can stay in a backup copy for up to 14 more days.
Stopping abuse
To stop abuse, the server counts requests by player number and by a scrambled form of your network address (IP address): moves in a case over a few minutes, new games over an hour, and hints written and friends cases started over a day. The scrambling uses a secret key and the day’s date, so the scrambled form changes every day, and it can’t be turned back into your address without the key. The counts are deleted within a day.
The sign-in page for the site’s editors also counts failed sign-ins from each network address for 15 minutes, to stop password guessing.
The server’s log
The server’s own log keeps only failed requests (errors), for at most 14 days, so we can fix problems. A record of a failed request can include the page that was asked for and the visitor’s IP address. The log keeps no record of visits.
No analytics, advertising or tracking
We don’t use analytics, advertising or tracking pixels, and the site sets no cookies for visitors. Cookies are set only for the site’s own editors, when they sign in to manage the site. The fonts and all of the site’s own scripts come from our own server.
Services we use
- Cloudflare sits in front of the site to deliver it and protect it from attacks. It processes your connection, including your IP address, under its own privacy policy. To tell people from bots, Cloudflare may sometimes add a check of its own, with a short script and a security cookie; it isn’t used for advertising or tracking. Cloudflare’s dashboard shows us samples of single requests (IP address, country, browser and the page asked for), which it keeps for about a month.
- DigitalOcean runs the server the site lives on, in the United States.
Sharing
The Share button uses your device’s own share menu, or copies the text so you can paste it yourself. In friends mode, the WhatsApp button opens WhatsApp with a message you can edit before you send it. WhatsApp’s own privacy policy applies there.
Children
SUS isn’t directed at children under 13, and the game asks for nothing personal. In friends mode, you don’t have to type your full real name if you’d rather not: a first name or a nickname works fine.
Your rights and choices
Wherever you live, you can:
- Delete your plays. Ask us to delete the plays and writer picks kept under your player number. Send us the number from the browser you play in: our contact page shows it and explains how.
- Start over. Clear this site’s data in your browser. That deletes your player number and scores from your device, and your next visit gets a new number. Plays the server already holds under the old number are deleted on the usual schedule.
- Know, correct and object. Ask us what we hold under your player number, ask us to correct it, or object to how we use it.
- Complain. If you’re in the European Union or the United Kingdom, you can also complain to your data protection authority.
Laws such as Europe’s GDPR and California’s CCPA give many people these rights, and we give them to everyone. We don’t sell your information, and we don’t share it for advertising. To use any of these rights, write to contact@playsus.app.
Changes to this policy
If we change how the site handles information, we’ll update this page and the date at the top. If we ever add accounts, analytics or advertising, this page will say so before they start.
Today's case is waiting. One secret word, four hints, and maybe a liar.