How well do you know each other?
Last updated: 14 October 2026
Short version: Fess has no sign-in, no ads and no tracking across other apps or websites. While you play, our server holds your nickname, answers, guesses and chat messages, and deletes each game room 6 hours after its last change. Everyone in the game sees every answer and guess at the reveal, and every chat message as it’s sent. Chat messages are never sent to Anthropic. Anthropic’s Claude AI scores the cards you answer in your own words: it gets the question, the answer and the guesses, with no nicknames attached. To see how Fess is used, the app and the website send TelemetryDeck usage statistics, such as games started and players per game, under a random ID made for your install, never with your nickname, the room code, answers, guesses or chat. The website also counts visits with Cloudflare Web Analytics. On Android, the QR scanner (Google’s ML Kit) sends Google some device and diagnostic data. If you subscribe or buy a deck in the app, Apple or Google takes the payment, and RevenueCat, our purchase service, tells our server what you’ve paid for under a random ID for your install. Our server then keeps your deck picks and a copy of your purchases until you delete them, which you can do in the app.
Fess is made by Postmark Digital, which is responsible for your information under this policy (the “controller”, in UK and EU law). This policy covers the Fess app for iPhone and Android, and the web version at playfess.com, where friends join a game from its QR code.
To play, you pick a nickname (up to 16 characters). During a game you answer cards about yourself and guess how the others answered theirs, either by typing a short answer or by picking an option.
Anyone with the room code or QR code can join while the game is in the lobby, so share it only with the people you’re playing with. Anyone who has the code can also see, without joining, the host’s nickname, which deck is being played, how many players there are and whether the game can still be joined, until the room is deleted. Codes are only four letters, so someone could also come across a game by trying codes at random. The host can remove players from the lobby. If someone you don’t know joins, start a new game.
Some decks get personal. Please don’t type anything you wouldn’t want the room, or an AI judge, to read, such as health details, passwords or other people’s private information.
Reporting and hiding. Press and hold someone’s chat message to report it or hide them. Report opens your email app with the room code, the sender’s nickname, the time and the message, for you to send to us if you choose; we use it only to look into the report. Hide works on your device only: you stop seeing that player’s messages in that game, and nobody is told.
Each game is a “room” on our server, which runs on Cloudflare. The room holds each player’s nickname, a random player ID, a private seat token that lets a phone rejoin after a dropped connection, whether they’re playing in the app or on the web, whether they’re connected (and when they last dropped out), and their score and how their guesses are going this game. It also holds the current card’s answer, guesses, scores and reasons, and the running tallies behind the Final Reveal, which are stored under the random IDs rather than names. Only one card is kept at a time: each new card replaces the last.
How long: a room deletes everything it holds 6 hours after its last change. Every change, such as a player joining, an answer, a guess or the next card, starts the 6 hours again. A room isn’t deleted when a game ends, because “Play again” keeps the same room and its tallies. Leaving a game (in the lobby or once it’s over) removes your nickname and seat token from the room straight away. Your part of the tallies stays under your random ID, without your name, until the room is deleted.
Cloudflare keeps a 30-day recovery history of this storage. Its documentation doesn’t say whether data we’ve deleted can be restored from that history, and we don’t use it.
Security: the app, and the https:// links in our QR codes, use encrypted connections (HTTPS and secure WebSockets). If you type the web address yourself, check that it starts with https://. Nothing is end-to-end encrypted, because our server has to read answers and guesses to run and score the game. Cloudflare encrypts game storage on its disks, and Anthropic encrypts what it receives and stores. The server decides what each phone receives, so seat tokens are never sent to other players.
Cards you answer in your own words (“Free Fess” cards, where you type an answer, and “Finish It” cards, where you fill in a blank) are scored by Claude, an AI model made by Anthropic. Claude judges how close each guess is in meaning. For each of those cards, our server sends Anthropic a request containing:
Fess asks first. The first time you join a game, Fess asks whether your written answers and guesses may be scored by AI. If you choose basic scoring, nothing you type is sent to Anthropic: your answers and guesses are scored by simple word matching on our server instead. A card goes to Claude only if the player answering it allowed AI scoring, and only with the guesses of players who allowed it too. To change your answer, clear the app’s data (or this site’s data in your browser) and you’ll be asked again.
It doesn’t send nicknames, player IDs, seat tokens, the room code, your IP address or anything about your device. The request comes from our server, not from your phone. What you type is sent as you typed it, though (we only tidy spacing and invisible characters), so if an answer or guess mentions someone by name, Claude sees that name.
Claude sends back a score and a short reason for each guess. Everyone in the room sees them at the reveal, marked “Judged by Claude”. Number, scale, multiple-choice, “Who here…?” and ranking cards are scored by our own code and never go to Anthropic. If Claude can’t score a card, for example because it’s unavailable or a daily usage limit has been reached, the card is scored by simple word matching on our server instead. Scores are just for fun: nothing about you is decided by them.
Anthropic handles this data for us as a service provider under its Commercial Terms and Data Processing Addendum. Those terms don’t allow Anthropic to train its models on it. Anthropic says it deletes what we send and what Claude sends back within 30 days. If its safety systems flag something as breaking its Usage Policy, it can keep that for up to 2 years, and its safety ratings of it for up to 7 years. It also keeps data longer when the law requires. Details are on Anthropic’s page How long do you store my organization’s data?
Like any website or app, our server sees your network’s IP address when you connect. Fess uses it for one thing: abuse limits, which cap how many new games (10), and game connections and room look-ups (120 together), one address can start each minute. Our code doesn’t store IP addresses and never sends them to Anthropic. Cloudflare does the counting, and its documentation doesn’t say how long it keeps those counts. Your device also connects to TelemetryDeck to send usage statistics, so TelemetryDeck sees your IP address too (see “Accounts, analytics, ads and tracking”).
We have Cloudflare’s server logs switched on so we can find and fix problems. They record each request that reaches our game server (creating, joining or looking up a game, and this page, but not ordinary page loads), including the address requested, which for a game contains its room code. Cloudflare’s documentation doesn’t list every detail they keep, so we assume they include your IP address and rough location. Our own log messages are about errors, and a few include a room code. Our code is written not to log nicknames, answers or guesses, though an unexpected scoring error could include a fragment of Claude’s reply. Cloudflare deletes these logs after 7 days at most.
Fess remembers these things on your device:
On the web, these are kept in your browser’s local storage. Fess doesn’t set cookies. Cloudflare can add a security cookie if it needs to check for bots, but we haven’t seen one on playfess.com. A seat token is removed when you leave its game, or when the app finds that game no longer exists. Otherwise, these stay until you delete the app or clear playfess.com’s site data. On iPhone, they’re left out of backups. On Android, they may be included in your own Google device backup.
On the web, the page also checks which kind of phone you’re using, on your device only, to show the right app store link.
The app uses the camera only to scan a game’s QR code so you can join. Fess reads just the text in the code, takes the room code from it, and doesn’t save or send any pictures. It never uses the microphone, and the web version doesn’t offer scanning. You can always type the room code instead.
On iPhone, Apple’s built-in scanner reads the code on your device. On Android, the scanner is Google’s ML Kit. Google says ML Kit sends Google details about your device and the app, such as the phone model, system version, app version and an ID for this install. It also sends performance and error data. Google uses this to find problems and to see how ML Kit is used. Google says the data is encrypted on the way and isn’t passed to other companies, and its disclosure doesn’t list camera images among the data it collects. See Google’s ML Kit data disclosure.
Fess has no sign-in, and the app never asks for your name, email address, phone number, contacts or location. Apart from the TelemetryDeck usage statistics described next, the Google ML Kit diagnostics described under “The camera” (Android only) and RevenueCat’s purchase library described under “Subscriptions and decks”, the app contains no analytics, advertising, crash-reporting or tracking code. We don’t sell or share your information (as California law uses those words), and we don’t use it for ads.
Usage statistics. To see how Fess is used and what to improve, the app and the web version send TelemetryDeck a short message (a “signal”) when one of these things happens: Fess is opened, or returned to after 5 minutes or more away; Fess is used on a device for the first time; a game room is created; you join a game (not when you rejoin your own seat); a game starts or finishes; you answer the AI scoring question (the signal says whether you allowed it); you tap Invite; or you send a chat message (the signal only says that one was sent, never what it said). Each signal includes:
Signals never include your nickname, the room code, answers, guesses, chat messages or anything else you type. They go from your device straight to TelemetryDeck, so its servers see your IP address. TelemetryDeck says it never stores IP addresses, in its database, its logs or anywhere else, though for signals from the web version it may use the start of the address to work out your likely country. It also says it rounds the time of each signal to the hour, and it uses no cookies. TelemetryDeck treats these statistics as anonymous and has no fixed date for deleting them: it says it expects to delete them after 7 to 10 years, but doesn’t guarantee that. Because nothing stored with them identifies you, we can’t find or delete the statistics that came from your device. See TelemetryDeck’s privacy FAQ.
The website, playfess.com, uses Cloudflare Web Analytics to count visits. Cloudflare says it uses no cookies or local storage for this, and doesn’t fingerprint visitors for its analytics. It records things like the page address (which can include a room code), the site you came from, your country, and your device type, browser and operating system. Cloudflare keeps these statistics for about six months. Cloudflare also asks browsers to report failed connections to the site (such as the address, the page you came from, the kind of error and the status code) so network problems can be spotted. Cloudflare says it doesn’t keep the IP address a report comes from.
Fess doesn’t track you across other websites or apps, and we don’t let advertising or tracking companies collect information about you through Fess. Fess doesn’t respond to “Do Not Track” browser signals, because there’s no tracking for them to switch off: Fess works the same whether they’re on or off. Cloudflare, our host, sees traffic to many websites and uses connection data such as IP addresses to protect its network, as its privacy policy describes.
In the app you can subscribe to host games (with a free trial) and buy extra decks. Guests never pay, and the web version sells nothing.
Payments go through Apple’s App Store or Google Play, which handle your payment details, receipts and refunds under their own terms and privacy policies. We never see your card details, name, email address or Apple or Google account.
RevenueCat (RevenueCat, Inc., in the United States) runs the purchase library inside the app and checks purchases with Apple and Google for us. It receives a random ID that the library makes for your install of Fess (it has no link to your Apple or Google account, and a new install gets a new one), the purchases made from that install (which products, when, the price and currency, the store, the country, whether it’s a trial and whether it will renew), the app’s version and your system and its version. Like any server, it also sees your IP address. We don’t send RevenueCat your nickname, answers, guesses or anything else from your games, and we don’t ask it to collect advertising IDs. If you restore your purchases on another phone, RevenueCat links that install’s ID to the same purchases. RevenueCat handles this for us under its data processing agreement and keeps it while we use RevenueCat, unless we have it deleted sooner; see RevenueCat’s Privacy Policy.
Our server keeps one record for each person who has subscribed or bought a deck, so it can tell who may host and with which decks:
A room you host also notes which player in it is paying, by their random player ID, and is deleted with the room. RevenueCat tells our server when your purchases change (a renewal, a cancellation, a refund). We keep only the ID of each of those notices, for 30 days, so a repeat isn’t handled twice, and then ask RevenueCat for your current purchases.
How long: our record is kept until you delete it, so your picks are still there if you stop subscribing and come back later. Delete my Fess data, on the You tab in the app, deletes it straight away: your picks, our copy of your purchases and the IDs linking your installs. Your subscription and bought decks stay with your Apple or Google account, and Restore purchases brings them back (but not your picks). To also delete RevenueCat’s record of your purchases, email us and we’ll have it deleted. Apple and Google keep their own records of your purchases under their policies.
Each deck says who it’s for. Adults decks are for players 17 and older, and some are cheeky or personal. Family decks are made for kids 8 and up to play together with their grown-ups, and a grown-up should host the game. The app is rated for adults in the app stores, and subscribing or buying decks is for adults (or younger people with a parent’s or guardian’s permission).
We don’t ask anyone’s age, and Fess never asks for a real name, email address, phone number or location: each player picks a nickname for the game. On every deck, Family decks included, written answers and guesses go to AI scoring only if the players allowed it (see “AI scoring by Anthropic’s Claude”). As in every game, what’s typed in a game room (nicknames, answers, guesses and chat) is deleted 6 hours after the room’s last change. If you’re a parent or guardian and think your child shared personal information in a game, email us (with the room code if you have it) and we’ll delete whatever we can find straight away.
There’s no setting yet to switch AI scoring off, and every deck includes some cards you answer in your own words. There’s no setting to switch usage statistics off either.
Why we use it: only to run the game you chose to play, including scoring it, and to provide the subscription and decks you bought (UK and EU law call this “performance of a contract”), and to keep Fess working, secure and affordable and learn how it’s used so we can improve it: the abuse limits, server logs, visit counts, usage statistics and, on Android, the diagnostics Google’s ML Kit sends when you use the QR scanner (our “legitimate interests”). You can object to the second at any time by emailing us. You need a nickname to play, and the game needs your answers and guesses. What you write in them is up to you.
Your rights: depending on where you live (for example the UK, the EU or California), you can ask what we hold about you. You can also ask us to correct it, delete it, send you a copy, limit how we use it while a question about it is settled, or object to how we use it. Email us to ask. Fess has no sign-in and finds games only by their four-letter code, so for games we usually can’t tell which information is yours: game rooms delete themselves within hours of their last change, and the rest expires on the timelines above. If you’ve subscribed or bought a deck, Delete my Fess data in the app deletes that record straight away; for anything else about it, email us and we’ll help you find it. We’ll still tell you honestly what we can do, and we won’t treat you differently for asking.
If you’re unhappy with how we’ve handled your information, email us and we’ll acknowledge your complaint within 30 days. You can also complain to your data protection authority. In the UK, that’s the Information Commissioner’s Office.
We don’t sell or rent your information. Apart from the other players in your room, these are the only companies involved:
Apart from Cloudflare’s own use of connection data and Anthropic’s safety checks, both described above, Cloudflare, Anthropic and RevenueCat handle this information only on our behalf, under data processing agreements (Cloudflare’s, Anthropic’s, RevenueCat’s). These agreements require them to keep it confidential and secure and to use it only to provide their service to us, so it gets the same or equal protection this policy describes. TelemetryDeck works differently: because what it receives doesn’t identify anyone, its data processing agreement says it handles the statistics for the analysis of app usage on its own account, not on our behalf or on our instructions.
Anthropic stores scoring data in the United States and may run the scoring itself in data centres in the US, Europe, Asia or Australia. For safety reviews, support and incident response, it may also handle it in other countries where it or its affiliates operate. Cloudflare runs on a worldwide network and places each room in one of its data centres, usually near where the game was started. TelemetryDeck says its servers are in the Netherlands and Germany. RevenueCat stores purchase records in the United States. Cloudflare’s, Anthropic’s and RevenueCat’s agreements include standard safeguards for handling your information outside your country, such as the EU Standard Contractual Clauses and the UK Addendum (and, for Cloudflare, the EU-U.S. Data Privacy Framework). We’d only give information to anyone else if the law required it.
If this policy changes, the updated version will be posted on this page with a new date above. We plan to add accounts and turn notifications. Before either launches, this page will be updated to explain what changes.
Questions or requests about this policy or your information: hello@postmarkdigital.com. If you email us, we’ll use your address and message only to reply and to handle your request, and we won’t keep them longer than we need to.