Legal
Privacy policy
Last updated: 18 August 2026
The short version. There are no accounts, so there is nothing to sign up for and nothing to log in to. What you type during a game lives in one server process’ memory for as long as your room exists and is thrown away when the last player leaves. Nothing about a game is written to a database. The one place data leaves this site is the advertising that pays for the hosting, and that is covered in section 2.3.
1. Who we are
Potato Potahto is a browser party game at potatopotahto.app. It is run by Lucas Vedana, an individual based in Massachusetts, United States. It is not a company, and this policy describes a small project rather than a platform.
Questions about this policy, or about anything below, go to [email protected]. That is the fastest and only route.
2. What we collect
2.1 What you type in
To play, you pick a display name and, if you want, an avatar — an emoji and a colour. You are never asked for a real name, an email address, a phone number, a date of birth or a password. There is no account system to attach any of that to.
During a round you write answer cards. Those are shown to the other players in your room, which is the whole point of the game. If you are judging, the prompt you choose is shown to the room as well.
We do not see who you are. We see a name you made up and some sentences you wrote, for the length of one game.
2.2 What happens automatically
- Game state. Your display name, avatar, score and submitted cards are held in the memory of one running process for as long as the room exists. They are not written to a database, a file or a log. When the last player leaves, the room is deleted and everything in it goes with it.
- Local storage on your device. The game keeps a handful of values in your browser so that a dropped connection does not cost you the game and so your settings survive a reload. They stay on your device. Every one of them is listed by name in section 6.
- Server and network logs. The web server, and Cloudflare in front of it, keep standard access logs — IP address, the URL requested, the time, the browser’s user-agent string. Every website has these. They exist so that outages can be diagnosed and abusive traffic can be blocked, and they are not used to build a profile of anyone or joined to game data.
- Cloudflare’s security cookies. The site sits behind Cloudflare, which sets its own cookies to tell visitors apart from bots and to remember that you have passed a security check. These are strictly necessary — the site is not reachable without them — and they are listed in section 6.
2.3 What advertising partners collect
This site shows ads through Google AdSense. This is the part of the site where information does leave it, so it is worth reading properly.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or to other sites.
- Google’s use of advertising cookies lets it and its partners serve ads to you based on your visits to this site and other sites on the internet.
- What that can involve — an IP address, an approximate location, a browser and device type, browsing behaviour across sites carrying Google advertising — is set out in how Google uses information from sites that use its services.
- You can turn off personalised advertising at Google Ads Settings or aboutads.info/choices. Ads will still appear; they will just stop being tailored.
We do not control what Google and its partners do with that information beyond what those pages describe, and we have no access to it ourselves.
If you are in the European Economic Area, the United Kingdom or Switzerland, you are shown a consent message before any non-essential advertising cookie is set. It is Google’s own consent message, delivered through AdSense, and you can reopen it and change your answer at any time from the link in the site footer. See section 6.
3. How we use it
The information above is used to do three things and nothing else:
- Run the game — put players in the right room, deal prompts, keep score, work out who judges next.
- Keep the site up and safe — find out why something broke, block traffic that is trying to break it.
- Show advertising, which is what pays the hosting bill and is why the game is free.
We do not sell personal information. We do not build a profile of you. We have no analytics product, no tracking pixel of our own, no mailing list and nothing to add you to.
4. How long we keep it
- Game data — names, avatars, scores, cards — lasts exactly as long as the room does. There is no record of past games and no way to look one up, including for us.
- Local storage on your device stays until you clear your browser data or it is overwritten by a later session.
- Server logs are rotated on the host’s normal schedule, a matter of weeks, and then deleted.
- Advertising cookies are governed by Google’s retention policy, not ours. The link in section 2.3 is the authority on those.
5. Children’s privacy
Potato Potahto is a general-audience party game. It is not directed at children under 13, not marketed to them, and does not knowingly collect personal information from them. Nothing on the site asks for a date of birth, an email address or anything else that would let us knowingly identify a child — which also means we have no way to detect one.
If you believe a child has given us personal information, write to [email protected] and it will be dealt with.
6. Cookies, storage, and your choices
The game itself sets no cookies. What it uses is your browser’s local storage, which stays on your device and is never sent to us as a record. The cookies that do get set come from Cloudflare, which sits in front of the site, and from advertising. Here is every value, by the name you would find it under:
| Name | Kind | Set by | What it is for |
|---|---|---|---|
potato_player_id | Functional | This site | Puts you back in your seat, with your score, if your connection drops mid-game |
potato_player_name | Functional | This site | Saves retyping your display name every game |
potato_game_code | Functional | This site | The room you were last in, so a reload rejoins it |
pp-lang | Functional | This site | The language you chose, so it is not re-detected each visit |
pp-volume | Functional | This site | How loud the game is |
pp-reduce-motion | Functional | This site | Whether you asked for less animation |
__cf_bm | Necessary | Cloudflare | Telling human visitors apart from bots. Expires after about 30 minutes |
cf_clearance | Necessary | Cloudflare | Remembers that you passed a security check, so you are not asked again |
| Advertising cookies | Advertising | Serving ads, measuring them, and limiting how often you see the same one |
The functional values are not tracking. They contain no identity, they are not read by anyone else, and they are what makes it possible to walk into a tunnel mid-round and come back to your cards. Clearing them will not stop you playing, but a dropped connection will then cost you your seat.
Cloudflare’s two cookies are strictly necessary and cannot be turned off while still reaching the site — they are what stands between the game and the automated traffic that would otherwise knock it over. They carry no advertising purpose and are not used to profile you.
The advertising cookies are not needed to play. In the EEA, the UK and Switzerland they are set only after you consent through Google’s consent message, and you can change that answer whenever you like. Everywhere else, the opt-out links in section 2.3 are the control. Your browser’s own settings will block or delete all of it regardless, and blocking advertising cookies has no effect on the game.
7. Your rights
Depending on where you live, you may have the right to know what personal information is held about you, to get a copy of it, to have it corrected or deleted, to object to or restrict how it is processed, and to opt out of the sale or sharing of personal information for targeted advertising.
In practice, almost nothing is held server-side to request. Game data is gone the moment the room empties, and the values on your device are yours to delete in your own browser settings. The one meaningful lever is the advertising opt-out in section 2.3. For anything else, write to [email protected].
If you are in the EEA or the UK, you also have the right to complain to your local data protection authority. If you are a California resident, the CCPA/CPRA gives you the right to opt out of the sale or sharing of personal information; for this site that means the advertising cookies, and the opt-out links above are how you exercise it.
8. Third parties in the path
Four, and that is the whole list:
- Cloudflare — DNS, content delivery and security. Every request to this site passes through it, which is how it blocks attacks and absorbs traffic spikes. See Cloudflare’s privacy policy.
- Amazon Web Services — the server the game runs on. See the AWS privacy notice.
- Google AdSense — advertising. See Google’s privacy policy and how Google uses information from partner sites.
- The domain registrar, which holds the registration for potatopotahto.app in the ordinary way that domain names work.
Nothing the browser loads comes from anywhere else. The fonts, the icons, the sounds and even React itself are served from this site rather than from a public CDN, so a cold page load contacts no third party except the ad tag.
9. Changes to this policy
This policy will change if the site does — a new feature, a different advertising partner, a service added behind it. The date at the top is updated when that happens, and the change takes effect when it is posted. Continuing to use the site after that means you accept the updated policy.
10. Contact
Questions, requests, or something on this page that looks wrong: [email protected].