Last updated: October 2026
We collect your email address when you sign in via magic link. If you host or join a game, we store your display name, game room participation, submitted quotes, votes, and scores associated with your session.
Your data is used exclusively to operate the Who Said That service: to run game rooms, track scores, maintain leaderboards, and manage your subscription. We do not sell your data to third parties. We do not use your content for advertising.
We use passwordless magic links via Resend. Your email is used only for authentication and transactional communication (sign-in links, billing receipts). We do not send marketing email without your explicit consent.
All payments are processed by Stripe. We never store your full card number or payment credentials. Stripe's privacy policy governs how they handle your payment data.
Quotes you submit during a game are visible to other players in that room for the duration of the game session. Game data (quotes, votes, scores) is retained to provide your game history and stats. We do not share your submitted quotes outside the game room.
We retain your account data for as long as your account is active. You may request deletion of your account and all associated data by emailing CEO@epicai.ai. We will process deletion requests within 14 business days.
We set one cookie: an httpOnly session cookie named session that keeps you signed in. It is strictly necessary and cannot be turned off. The cookie banner saves your choice in your browser (local storage), not in a cookie.
In the cookie banner, Accept All turns everything on, Essential Only keeps just the sign-in cookie, and the Analytics and Marketing switches let you pick each one (on a phone, tap Choose to show them).
Analytics is off until you allow it. If you do, we load Vercel Analytics, Vercel Speed Insights and a visit counter; none of them set cookies, and they count page views without collecting your name or email. Turning on the Marketing switch sets no cookie and loads no ad script. We do not use tracking or advertising cookies, and you can change your choice any time by clearing site data.
Session tokens are stored as hashed values. All traffic is served over HTTPS. We apply industry-standard security headers including CSP, HSTS, and X-Frame-Options. We do not store passwords.
For privacy questions or data deletion requests, email CEO@epicai.ai.