Privacy Policy

Operator

Red Carded is operated by Red Carded, a New York-based project. For privacy questions or data requests, contact us at contact@getredcarded.com. If Red Carded later forms or transfers operations to a legal entity, that entity will become the operator and this Privacy Policy will continue to apply unless updated.

What we collect

We collect the following data when you use Red Carded:

• An anonymous player ID — a random identifier generated and stored in your browser's localStorage. We don't know who you are unless you choose to tell us.
• Your game content — the takes you submit, the AI-generated verdicts you receive (including classifications such as team referenced, sentiment, category, and spice/boldness scores), game session results, and Prove It match outcomes.
• Your email address — only if you choose to provide it. Submitting your email requires checking the “I agree to the Privacy Policy & Terms” checkbox. Providing your email is entirely optional.
• Leaderboard display name — if you choose to claim a leaderboard spot and enter a display name, it is stored and shown publicly on the leaderboard.
• Coarse location — country, region (state/province), and city or metro area, derived from your IP address by our hosting provider's edge network. We use this for aggregate analytics (e.g. “most fans from Brazil”). We do not store your raw IP address in our database. Your IP is processed transiently in server memory for rate limiting and geo derivation, and may appear in short-lived hosting platform logs.
• Device type and browser family — coarse categories (e.g. “mobile” / “desktop”, “Chrome” / “Safari”) derived from your browser's user agent string. We do not collect a device fingerprint.
• Marketing attribution — UTM parameters (source, medium, campaign, content), the referring URL, and your landing page path, captured once on your first visit.
• Behavioral events — page views, game starts, game completions, topic clicks, share button clicks, email submissions, and feedback ratings (“Spicy but true” / “Needs a reboot”). These are logged with your anonymous player ID.
• Moderation data — blocked or flagged submissions, moderation reasons, and related player ID/session information, logged when content is blocked by our moderation system.

How we use your data

• To run the game — processing your takes, generating AI verdicts, displaying results, and powering share pages.
• To send you email updates if you provided your email and consented.
• For analytics and product improvement — understanding which types of takes are popular, how users interact with the game, and where our audience comes from. We may use aggregated, anonymized data for these purposes; such data never identifies individual players.
• We may create and share aggregated, de-identified, or anonymized insights about game activity, audience trends, take popularity, and fan sentiment. These insights do not identify you by name, email, player ID, or other directly identifying information.
• We may use data to build and maintain an audience or research panel for ongoing engagement, surveys, or audience insights. If you provided your email, you may be contacted for such purposes; you can opt out at any time by emailing us.

Consent

You can play Red Carded without providing your email or directly identifying information. If you choose to submit your email address, you must first check the “I agree to the Privacy Policy & Terms” checkbox. This single consent covers both this Privacy Policy and our Terms & Conditions.

The Terms/Privacy checkbox records your acceptance of the Terms and Privacy Policy. It does not mean you have opted into every possible marketing or research program. Where required, we will request additional opt-in consent for optional marketing, research panel participation, or paid research opportunities. You can opt out of non-essential email communications by following the unsubscribe instructions in the email or by contacting contact@getredcarded.com.

U.S. storage and international users

Red Carded is operated from the United States. Your data is stored and processed in the United States by us and our service providers. If you access Red Carded from outside the United States, you understand that your data may be transferred to and processed in the United States, where privacy laws may differ from those in your location.

Third-party service providers

We use the following third-party services to operate Red Carded. They process data on our behalf:

• Supabase (hosted on AWS) — persistent database storage for all application data.
• Anthropic — AI provider. Your submitted take text is sent to Anthropic's API to generate verdicts. Anthropic may also perform web searches on our behalf to verify facts referenced in your take (e.g. recent match results).
• Vercel — web hosting and serverless function execution. Vercel's edge network processes your requests and derives coarse geolocation from your IP address. Vercel's platform logs may retain request metadata for a limited period.

Analytics and measurement

We may use analytics, measurement, or attribution tools to understand how people find and use Red Carded, measure traffic and sharing, and improve the game. If we use third-party analytics or advertising tools, we will update this Privacy Policy to identify them. We do not currently use third-party advertising pixels or retargeting tools.

Data storage and retention

Your data is stored in Supabase (hosted on AWS in the United States). Your anonymous player ID also lives in your browser's localStorage — clearing your browser data removes it from your device.

We retain data for as long as reasonably necessary to operate Red Carded, provide the service, analyze usage, maintain security, comply with legal obligations, resolve disputes, and support the purposes described in this Privacy Policy. Some temporary cache records may be retained briefly to improve performance. Other data may be retained until deleted upon request or until we no longer need it.

Deleting your data

Want everything gone? Email us at contact@getredcarded.com with your player ID (open your browser console and type localStorage.getItem("ht_player_id")) and we'll delete all your data within 30 days. Clearing your browser data removes the player ID from your device, but server-side data associated with that ID will remain until you request deletion.

Business transfers

If Red Carded is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, your data, including emails, gameplay data, user-generated content, and related records, may be transferred to the acquiring or successor entity as part of that transaction. The successor may continue to use the data as described in this Privacy Policy unless you are notified of a different policy or required by law to receive additional choices.

Age requirement

Red Carded is not intended for children under 16. If you are under 16, please do not use the game or provide any personal information. If we learn we have collected data from a child under 16, we will delete it promptly.

Changes

If we change this policy, we'll update this page and the “Last updated” date above. Continued use of the game after changes constitutes acceptance.

California privacy notice

We do not currently sell personal information. We also do not currently share personal information for cross-context behavioral advertising as those terms are defined under California law. If our practices change, we will update this Privacy Policy and provide any legally required opt-out rights. Depending on where you live and whether applicable privacy laws apply to us, you may have rights to request access to, correction of, or deletion of personal information, or to opt out of certain uses. To make a request, contact contact@getredcarded.com.

Governing law

This Privacy Policy is governed by the laws of the State of New York, without regard to conflict of law principles.