Privacy policy

The short version

We collect what we need to run Oneshotgems: your account, what you play and like, the games you prompt, and (only if you choose) a short interest profile made from your AI chat history.
If you import AI chat history, we delete the uploaded file immediately after processing and keep only a short derived profile (interests, topics, humour, things to avoid). You review it before it's saved, and you can view or delete it any time in Settings → Privacy.
We use your activity to personalise your feed and to make personal gems for you. We don't sell your personal data and we don't show third-party ads.
You can export or delete your data whenever you like.
Oneshotgems is for people aged 13 and over.

Who we are

Oneshotgems is operated by Oneshotgems ("we", "us"). We are the controller of the personal data described in this policy. Questions or requests: [email protected].

What we collect

Information you give us

Account: username, display name, password (stored only as a salted hash), avatar colour, bio and, if you add one, your email address.
Onboarding answers: the vibe and topics you pick.
Content: prompts you write, games generated from them, comments, replies, likes, saves, follows and reports.
AI chat history import (optional): see below.
Support messages you send us.

Information collected when you use Oneshotgems

Gameplay activity: which games you view, play, skip, share, how long you play, and scores. This powers your feed, leaderboards, streaks and personal gems.
Taste profile and gem memory: a profile we derive from your activity (favourite tags, topics, vibe) and notes our game AI keeps about which of your gems landed, so the next one is better.
Device and technical data: IP address, browser or app version, device type, operating system, language and crash logs, used for security, abuse prevention and fixing bugs.
Push tokens if you turn on notifications, so we can tell you when a gem is ready or someone replies.

Payments

If you subscribe on the web, payments are handled by Stripe; in the apps, by Apple or Google. We receive your subscription status, plan, renewal dates and country, never your full card number.

AI chat history import

During onboarding you can choose to import an export of your ChatGPT, Claude or Gemini history, or paste a short description of yourself written by your assistant. This is entirely optional; Oneshotgems works fully without it.

What we read: only your own messages and conversation titles. Assistant replies are ignored.
How it is processed: a sample of that text (at most about 40,000 characters from an export, or up to 60,000 characters you paste) is sent to our AI model provider, which summarises it into an interest profile: a short summary, your interests and topics, humour style, what you're learning, a vibe hint and things you'd rather avoid. The provider processes it on our behalf only to produce that summary. If the AI summary isn't available we use a simple keyword count on our own servers instead.
What we keep: only that derived profile. The uploaded file is deleted as soon as it has been read, and the extracted text is never stored or shown to other people.
Your control: you see the profile straight after the import and can remove anything that's off, or start over. Afterwards you can view or delete it in Settings → Privacy → Imported interests, stop it (and your activity) being used for personalisation by turning off Personalised feed, or replace it by importing again. Deleting your account deletes it too.

Please don't import history containing other people's sensitive information. Our summariser is instructed never to include health, sexuality, religion, politics, finances, relationships, real names, employers or locations in the profile.

How we use it

Purpose	Data	Legal basis (UK/EU)
Run your account, feed, social features and leaderboards	Account, content, activity	Contract
Generate personal gems and prompted games	Prompts, taste profile, gem memory, interest profile	Contract; consent for the optional chat-history import
Personalise recommendations	Activity, taste and interest profile	Legitimate interests (a relevant feed), which you can limit by deleting your interest profile
Subscriptions and receipts	Account, email, billing status	Contract; legal obligation (tax records)
Emails and push notifications	Email, push token, preferences	Contract for service messages; consent or legitimate interests for others, with an unsubscribe in every email
Safety, moderation and abuse prevention	Content, reports, technical data	Legitimate interests; legal obligation
Improving games and the product	Aggregated, de-identified gameplay statistics	Legitimate interests

We use aggregated, de-identified statistics (for example "merge games with short sessions are replayed more") to improve game generation for everyone. These never identify you.

AI-generated games

Personal gems are made by an AI model from your taste profile, gem memory and (if you imported one) interest profile. Prompted games are made from the prompt you write. Generated games may be shown to other players:

Prompted games are public and credited to your username, including the prompt text.
Personal gems may appear in other people's feeds anonymously, credited to "oneshotgems AI". They are never linked to you publicly, and gems don't include your profile data.

We do not make decisions with legal or similarly significant effects about you using automated processing.

We don't sell or rent your personal data. We share it only with:

Other players: your public profile (username, display name, avatar, bio, follower counts), prompted games, comments and likes on public games.
Service providers who process data for us under contract: cloud hosting and storage; our AI model provider (game generation, interest-profile summaries, content safety checks); Stripe (web payments); Apple and Google (in-app purchases, push notifications); our email delivery provider; Expo (push notification delivery); and error monitoring.
Legal and safety: when required by law, or to protect the safety of our users or the public.
Business transfers: if Oneshotgems is involved in a merger or acquisition, under this policy's protections.

Some providers are in other countries, including the United States. Where data leaves the UK or EEA we use recognised safeguards such as the UK International Data Transfer Addendum and EU Standard Contractual Clauses.

How long we keep it

Account and content: while your account is open.
Uploaded chat-history files: deleted as soon as they have been read (within seconds).
Gameplay activity: while your account is open.
Technical and security logs: for a limited period, typically no more than 90 days.
Payment records: as long as tax law requires (typically 6 to 7 years).
After you delete your account: removed from our live systems immediately, and from backups as they rotate out (within about 30 days).

Your rights and choices

Depending on where you live, you have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time. You can do most of this yourself:

Edit your public profile from Profile → Edit profile.
View or delete your imported interests in Settings → Privacy → Imported interests.
Control personalisation and AI memory in Settings → Privacy. Turning off AI memory for gems also deletes what your gems remember about you.
Export your data from Settings → Your data → Download my data.
Delete your account from Settings → Your data → Delete account (how).
Notifications: change them in Settings → Notifications or your device settings; every marketing email has an unsubscribe link.

For anything else, email [email protected]. We reply within one month. If you're in the UK you can complain to the Information Commissioner's Office (ico.org.uk); in the EEA, to your local data protection authority.

California residents: you have the right to know, delete and correct personal information and to not be discriminated against for exercising these rights. We do not sell or "share" personal information for cross-context behavioural advertising.

Children

Oneshotgems is not for children under 13, and you must be at least 13 (or the minimum age of digital consent in your country, if higher) to create an account. We don't knowingly collect data from children under that age. If you believe a child has created an account, email [email protected] and we will delete it.

Security

Passwords are hashed, traffic is encrypted in transit, and access to personal data is limited to people who need it. Every game runs in a sandboxed frame on an isolated origin with no access to your account, cookies or device data. No system is perfectly secure; if we learn of a breach affecting you we will tell you and the regulator as the law requires.

Cookies and local storage

This website does not use advertising or cross-site tracking cookies. The web app stores your sign-in token and preferences (such as sound) in your browser's local storage, and games may store your best score on your device. Our service worker caches the app shell so it loads fast and works offline. You can clear all of this in your browser settings.

Changes to this policy

If we make material changes we will tell you in the app or by email before they take effect. The date at the top shows when this policy was last updated.

Contact

Oneshotgems, privacy team: [email protected].