In short
We keep what we need to run the game: the email, name and photo from your Google account, your nickname and language, your clues and scores, and your Plus status.
Your clues go to OpenAI so the game can reply and score your round. Your name and email never do.
We do not sell your data and we show no ads.
You can delete your account at any time in your profile, and you can email us for a copy of your data.
You must be 18 or older to use Taboo AI.
This summary is for convenience only. The full English text below is the version that applies. Read the full English text
PRIVACY POLICY
Effective date: 23 October 2026
Taboo AI ("we", "us", "our") is run by Li Yuxuan from Singapore. This policy explains what personal data we collect when you use taboo-ai.com (the "Service"), why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.
If you have a question or a request about your data, email support@taboo-ai.com. We answer within 30 days.
TABLE OF CONTENTS
3. DATA WE RECEIVE FROM OTHERS
4. HOW WE USE YOUR DATA AND WHY WE MAY
1. WHO THIS POLICY COVERS
This policy covers everyone who uses the Service: visitors, guests who play without signing in, signed-in players and Plus subscribers. You must be 18 or older to use the Service.
2. WHAT WE COLLECT
Account. When you sign in with Google we receive your email address, your name and your profile photo. We also store when you first signed in, when you last signed in and how many times you have signed in.
Profile. Your nickname, your preferred language, your learning goal and level if you set them, and whether you chose to hide your nickname from other players.
Game data. The topic you play, the clues you type, the AI's replies, the time you take, your scores and the coach review of each round.
Learning data. The words you have played, how well you know each one, your review schedule and your streak.
Topics you contribute. The topic name, target words and taboo words you submit, and the email address of your account, which we use to send you the review result.
Plus. Whether you are on a trial or a paid plan, your Stripe customer id, the plan you chose and the renewal date. Your card details go to Stripe. We never see them.
Multiplayer rooms. Your display name, your guesses, your room scores and the room code.
Messages you send us. When you use the feedback form we receive your nickname, your email address and your message.
Technical data. Our hosting provider records your IP address, your browser type and the pages you request, as every web server does. We read the country of your IP address once, to pick a default language for you. We do not store it. We do not collect precise location and we do not use GPS.
Guest accounts. If you play before signing in, we create a guest account with a random id. It holds only your game data. If you then sign in with Google, the guest account becomes your account. If you do not, we delete the guest account after 30 days without activity.
We do not collect sensitive data such as health, religion, politics or biometrics, and we do not ask for your postal address.
3. DATA WE RECEIVE FROM OTHERS
- Google, when you sign in: your email address, name and profile photo.
- Stripe, when you subscribe to Plus: your payment status, plan and renewal date. Stripe does not give us your card number.
We receive no other data about you from third parties.
4. HOW WE USE YOUR DATA AND WHY WE MAY
Each item lists a purpose, the data it uses and the legal basis we rely on under the GDPR, the UK GDPR and the Singapore PDPA.
- Run the game and the AI coach. Game data, learning data. Basis: contract.
- Sign you in and keep your account. Account, profile. Basis: contract.
- Bill and manage Plus. Plus data. Basis: contract.
- Email you about your account, your topic review or your Plus plan. Email address. Basis: contract.
- Send learning reminders and product news. Email address. Basis: consent; you can opt out at any time.
- Run multiplayer rooms. Room data. Basis: contract.
- Keep the Service secure, prevent abuse and fix bugs. Technical data, game data. Basis: legitimate interests.
- Measure how the Service is used. Technical data, in aggregate. Basis: legitimate interests.
- Answer your messages. Messages you send us. Basis: legitimate interests.
- Keep tax and accounting records. Plus data. Basis: legal obligation.
We send learning reminders and product news only if you ask for them. Every such email has an unsubscribe link. Emails about your account, your payments or changes to these documents are not marketing and you cannot opt out of them while you have an account.
5. AI AND AUTOMATED SCORING
When you play, we send the target word, the taboo words, the clues you type and the AI's replies to OpenAI. We do not send your name, email address, nickname or any account identifier. When you ask the AI for a topic, we send only the topic name you typed. OpenAI processes this data to generate replies, taboo words, topics and the coach review. OpenAI states that it does not use data sent through its API to train its models.
The coach score and review are produced by an AI model with no human involved. They exist only to help you learn. They have no legal or similar effect on you: they do not decide whether you can use the Service, what you pay or anything outside the game. If you think a score is wrong, email us and a person will look at it.
6. WHO WE SHARE DATA WITH
We do not sell personal data, and the Service shows no advertising.
Providers that process data for us.
- Supabase — database and sign-in.
- Vercel — hosting and Vercel Analytics. Vercel Analytics counts page views without cookies and without identifying you.
- OpenAI — AI replies, taboo words, topics and the coach review, as described in section 5.
- Stripe — Plus payments, invoices and the customer portal.
- Resend — sending our emails.
- dictionaryapi.dev — word definitions in Words and practice. It receives only the word you look up.
- Wiktionary (Wikimedia Foundation) — backup source for word definitions in Words and practice. It receives only the word you look up.
- Google — sign-in.
Each provider may only use your data to provide its service to us.
Other players. In a multiplayer room, the other players see your display name, your score and your wrong guesses. On topic pages, other players can see your nickname next to your scores unless you turn on "Stay anonymous" in your profile.
Third-party sites we link to. The Service links to Substack, Discord, GitHub and other sites. When the newsletter sign-up appears, Substack loads its own form in a frame and handles your subscription under Substack's privacy policy. We are not responsible for those sites.
Legal reasons. We disclose data when the law requires it, or when it is needed to protect the rights or safety of players or others.
If the Service changes hands. If the Service is sold or transferred, your data moves with it under this policy. We tell you before that happens.
7. INTERNATIONAL TRANSFERS
We are based in Singapore. Our providers process data in other countries, including the United States. When we transfer data of players in the European Economic Area, the United Kingdom or Switzerland, we rely on the provider's standard contractual clauses approved by the European Commission, with the UK addendum where needed, or on an adequacy decision. For players in Singapore, we make sure each overseas provider is bound to protect your data to a standard comparable to the PDPA.
8. HOW LONG WE KEEP DATA
- Account, profile, game and learning data: until you delete your account.
- Guest accounts: deleted after 30 days without activity.
- Multiplayer rooms, guesses and room scores: deleted 24 hours after the last game in the room.
- Payment records (invoices, Stripe customer id, plan history): 5 years after the payment, as tax and accounting law requires.
- Email delivery logs: 90 days.
- Messages you send us: until we have dealt with them, and at most 1 year.
- Technical logs at our hosting provider: a short period, then deleted.
When you delete your account we delete your account, profile, game and learning data. Topics you contributed that we published stay in the game without your name.
9. SECURITY AND DATA BREACHES
All traffic to the Service uses HTTPS. Data is stored with Supabase. Access to the database and to our providers is limited to the Service and its owner; other players see only what section 6 describes. No system is fully secure, so we cannot promise that a breach will never happen.
If a breach is likely to cause you significant harm, we notify the Personal Data Protection Commission of Singapore within 3 calendar days of confirming it, as the PDPA requires, and we tell affected players as soon as we can. For players in the EEA or the UK we also notify the relevant supervisory authority within 72 hours where the GDPR or UK GDPR requires it.
10. MINORS
The Service is for adults only. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we delete it. If you know of such an account, email us.
11. YOUR RIGHTS AND CHOICES
Wherever you live, you can:
- Delete your account. Open your profile and use "Delete my account" in the Danger zone. This removes your account and all your data, as listed in section 8. If you have Plus, deleting your account cancels it first. You will not be charged again.
- Get a copy of your data. Email us and we send you a copy within 30 days.
- Correct your data. Change your nickname, language and other profile settings in your profile. Email us for anything else.
- Stop reminder and product emails. Use the unsubscribe link in any such email, or email us.
- Withdraw consent. Where we rely on your consent, you can withdraw it at any time. This does not affect what we did before you withdrew it.
If you are in the EEA, the UK or Switzerland. You also have the right to restrict or object to our processing, the right to data portability, and the right to complain to your data protection authority. You can find the EU authorities at ec.europa.eu, the UK authority at ico.org.uk and the Swiss authority at edoeb.admin.ch. We would rather you contact us first so we can sort it out.
If you are in Singapore. Under the PDPA you can ask for access to your data, ask how we have used or disclosed it in the past year, and ask us to correct it. Send requests to support@taboo-ai.com. We answer within 30 days. If you withdraw consent for data we need to run the Service, we may have to close your account. You can complain to the Personal Data Protection Commission at pdpc.gov.sg.
If you are in California. We do not sell or share personal data for advertising. The rights above apply to you.
We do not track you across other websites, so browser "Do Not Track" signals change nothing about how the Service works.
12. CHANGES TO THIS POLICY
We may update this policy. If a change matters to you, for example a new purpose or a new provider that receives personal data, we email signed-in players at least 30 days before it takes effect and show a notice in the app. Previous versions stay available at the bottom of this page.
13. CONTACT
The person responsible for data protection is Li Yuxuan. Email support@taboo-ai.com or write to: