How we handle data

This is the plain-language companion to our Privacy Policy. If anything here seems to conflict with the policy, the policy is the authoritative version.

You can play without an account

TicTease works without signing in. When you play without an account, your choices stay in your browser's local storage on that device — nothing about your session is sent to us.

We never ask for your email

Accounts use a username and password only. There's no email field, no phone number, no real name. The trade-off is real: with no email, there's no password reset. If you forget your password, your synced data can't be recovered.

What "sync" actually stores

If you create an account to carry your progress between devices, here's exactly what happens:

1. The app turns a small slice of your state into data.
2. It encrypts that data on your device using AES-GCM with a key derived from your password (the key never leaves your device).
3. Only the resulting ciphertext is sent to and stored on our servers.

Because we never receive your password or your encryption key, we cannot read your synced data — to us it's an opaque blob.

Analytics, done carefully

If product analytics are enabled for a build, we use PostHog configured for privacy:

• Hosted in the EU.
• No automatic click/scroll capture and no session recording.
• On-screen text is masked, so dares, prompts and anything you type are never collected.
• We don't persist IP-based location.
• We never build advertising profiles or sell data.

We use this only to see, in aggregate, which features people use so we can make TicTease better.

What we don't touch

We don't access your contacts, photos, camera, microphone, or precise location. We don't track what specific dares you draw or how a night goes — that's yours.

Deleting your data

You can clear your synced data from inside the app, or email privacy@tictease.com to delete your account entirely.

Want the full legal detail? Read the Privacy Policy and Terms of Service.