Privacy

Updated November 1, 2026

The short version: the games run on your phone, you don’t have an account here, and we never see a card, an answer or a wish. Here’s the long version, with the parts that aren’t so short.

What stays on your phone

Each game runs in your browser. The cards are part of the page you’ve already loaded, and drawing one doesn’t send anything to us.

A few things get saved on your device, in local storage, so a game can pick up where it stopped: custom dice faces, which cards you’ve already seen, your coupon selection, your bucket list ticks, your place in a long distance game. They stay there until you reset the game or clear your browsing data. They’re readable by anyone using your browser, so if you share a device, keep that in mind. We don’t receive any of it.

Google Analytics

Visits get counted by Google Analytics 4. It receives page views and a couple of generic events: game_start, when somebody starts a game, and outbound_click, when somebody clicks a partner link. These events carry no card, no answer, no heat level and no destination address. We send the page address without the part after the # sign, so shared links stay out of it.

Google Analytics sets its own cookies to tell one visit from another, and Google receives your IP address and browser details along with each request, from which it works out rough location and device type. You’ll see no cookie banner here at the moment. If you’d rather not be counted, a content blocker or Google’s opt-out browser add-on will stop it, and every game will still work.

Partner links

Partner links go through an address starting with /go/ on our site. Each click there adds a line to a log: when it happened, which page you came from, where the link sat on the page, the category of the link (couples, roleplay or toys), the country Cloudflare reports for you, mobile or desktop, and a label combining the placement and the category. The log holds no IP address and no cookie. Known bots are left out of it.

Once you land on the partner’s site, you’re under its own privacy rules, and it can tell that you came from us, which is how we get paid. Our links ask your browser not to pass along the page you came from.

Hosting

Our server sits with OVH in France, with Cloudflare in front of it. As with most websites, both can process technical data such as your IP address and browser details to deliver pages and fend off abuse, and our web server keeps access logs of the requests it receives, for security and troubleshooting.

Shared links

Bucket list. The list is sealed on your phone with AES-GCM before the link exists. The key comes from a six-digit code, stretched through 600,000 rounds of PBKDF2. The sealed list sits behind the # sign of the address, and since browsers keep that part to themselves, it never reaches our server.

To be plain about the limits: a six-digit code protects your list from a casual reader, like somebody glimpsing your chat. Someone who got hold of the link and really wanted in could try all million codes with a computer, so the code won’t stop them. Keep the link private and pass the code along by another route. Whoever has both can read the list, and that includes the partner you sent it to, since decryption happens on their phone.

Long distance. This link isn’t encrypted because there’s nothing private in it. It holds a random seed, a deck check, the heat levels you chose and a card number, also after the # sign. It says nothing about what you’ve said or done.

Your rights

Data protection law gives you rights over your personal data, including access and deletion. We hold nothing that links a visit to you by name, so there’s little for us to look up, but write to contact@spicyfortwo.com with any question or request. For Google’s handling of analytics data, Google’s own privacy policy and controls apply.

If any of this changes, this page changes too, and so does its date.