After You Privacy Policy

Effective 22 October 2026.

Playing and connecting

Solo progress and saved replays are stored on your device. If Android backup is turned on, Android also copies them to your Google account, but only when the copy is encrypted with your phone's screen lock. We cannot read that copy. Photos are not included; Photo transfer moves them. On iPhone, After You keeps solo progress and saved replays out of iCloud Backup and computer backups. Online play and purchases use a randomly generated player identity protected by a device credential and recovery code. In the game, we do not ask for your email address or phone number. A display name is optional, and so is signing in to Google Play Games or Game Center. Our game server stores hashes of the credentials. Keep your recovery information private; never email it.

Online rooms store membership, accepted game inputs, replay checkpoints, progress, timestamps and supported preset reactions. A replay is game-action data, not a camera or microphone recording. Room information is available to its two invited participants. It runs and verifies shared turns and helps prevent invalid or conflicting submissions.

When Pollen is on, our server keeps your Pollen balance and a short history of what you earned and spent, linked to your online identity. Deleting your online identity deletes them.

When leaderboards are on, a finished room's time can show on that chapter's Fastest pair board. Your name shows there only if you and your partner both turn names on. Otherwise the row says "A pair". We keep the replays of each board's top 10 so anyone can watch them, and delete the rest once they're checked. Players can report a row, and we keep the report to review it. Deleting your online identity removes you from every board.

A display name is optional. If you choose one, we store it with your online identity and show it in After You to your accepted friends and to the people you share a room with. A room keeps a copy of your name so your room partner can see it. A new name reaches a room the next time you take a turn there. Going back to anonymous removes your name from your rooms straight away, and leaving a finished room or deleting a room removes its copy.

Your invite link also shows your display name: anyone who opens it sees "<your name> wants to play After You with you." To show it, the link page sends your friend code to our server, which answers only the display name you chose. A changed or removed name can take up to five minutes to update there. Without a display name the page says "A friend".

If you pick "Use my Play Games name" or "Use my Game Center name", the game reads that name from your phone at that moment and stores it the same way as a name you type. It does not follow later changes to your Play Games or Game Center name.

You can change your name or go back to anonymous at any time in Friends. Deleting your online identity deletes your name. If a name breaks the community rules, we can remove it, and that identity then cannot choose a new name for a week.

If you sign in to Google Play Games on Android or Game Center on iPhone, After You keeps a one-way code made from your Play Games or Game Center player ID next to your online identity. When you sign in on a new phone, that code brings back your friend code. Your saved progress goes to your own Play Games or iCloud saved games, which Google or Apple store; the After You server never receives it. Unlinking in Settings, or deleting your online identity, removes the code.

When both players' phones have saved a finished attempt of a shared room, our server deletes its recordings and keeps only a SHA-256 fingerprint of them, which cannot be turned back into a recording. If a phone sends an attempt back, for example so a friend's new phone can watch it, the server checks it against that fingerprint and keeps it until both phones have saved it again. If neither phone still has an attempt, it cannot be recovered.

Online status lets your room partner see whether After You is open on your device. While sharing is enabled, the app sends a short-lived presence signal about every 30 seconds. Signals expire after 90 seconds without an update and are removed automatically. Status is available only to authenticated room partners who are not blocked; we do not keep a last-seen history. You can disable Share online status in Settings. Turning it off or leaving the app sends a best-effort offline signal; a lost connection may leave the previous signal visible until it expires.

Optional photos and Photo transfer

The camera opens only when you choose it. On iPhone, After You can't take photos yet. You can still see the photos your room partner shares. Keeping a photo on your device does not upload it. Share uploads a compressed photo for your room partner. We remove embedded camera metadata, including EXIF location fields, from the JPEG; the image itself can still reveal personal information.

A shared server photo is removed when its owner deletes it, its room/account is erased, or both intended players confirm a verified copy is saved on their devices. Older versions may not provide this confirmation. Version, ownership and delivery metadata remains with the room. Deletion cannot erase copies or screenshots already saved by someone else.

Photo transfer is voluntary temporary storage for your own identity. It may include private, unshared photos you choose to transfer; it does not share those photos with your partner. It keeps at most the newest 1,000 entries within a storage budget. Entries expire after 14 days, may be displaced by newer entries at the count limit, or are removed after confirmed durable restore. New transfers normally start once per 24 hours. Capacity can refuse additional uploads. It is not permanent backup and does not transfer solo progress or purchases.

If you redeem a tester code, we retain a permanent Full Journey grant associated with your anonymous player identity, separate from paid transactions. Account recovery restores this grant; account deletion removes it. The submitted code is not stored in plaintext.

Purchases, alerts and providers

The Play edition uses Google Play and RevenueCat for purchase validation, restoration and purchase reporting. RevenueCat receives your app player ID and purchase information. We do not receive payment-card numbers. Demo editions use RevenueCat Test Store instead of real payment. The iPhone edition has no in-app purchases yet.

Optional turn alerts use Google Firebase Cloud Messaging. App-installation identifiers, messaging tokens and account bindings deliver generic friend-turn alerts with room/turn routing identifiers, never photos or recovery credentials. Disable alerts in app or Android settings. On iPhone, turn them off in the app or in the iPhone Settings app. Delivery is best effort.

Cloudflare operates the game API and database, including photo storage. RevenueCat and Google Play support purchases; Google/Firebase delivers alerts. Firebase sends iPhone alerts through Apple's push notification service. These providers process the information needed for their services. Network infrastructure processes connection information such as IP addresses; the API uses a hashed IP key to limit unauthenticated abuse. The app does not contain ads, sell personal data, or collect contacts, microphone recordings, location or advertising identifiers for its features. App analytics/crash-reporting SDKs are not enabled; RevenueCat provides purchase reporting.

The iPhone waitlist

The iPhone waitlist on aamirazeez.com is closed. We sent its one email when After You came out on the App Store, then deleted the list of addresses. If you have a question about it, email afteryou-reply@aamirazeez.com.

Security and retention

Connections use HTTPS. This protects data in transit but is not end-to-end photo encryption. Online access is authenticated, and device credentials use Android protected storage. On iPhone, they stay in that phone's Keychain. They don't sync through iCloud Keychain and don't move to a new phone. No system can guarantee against all loss or unauthorized access.

Identities and shared game records have no routine expiry; invite expiry only limits joining. Photo retention follows the rules above. Notification registrations and queued alerts have bounded lifetimes and account recovery/deletion invalidates bindings. Device photos can survive normal restarts and updates; uninstalling, clearing storage or device failure can lose them.

Community-rule acceptance and your block list are retained until changed or your account deletion. Another player's block list may keep your former player ID until they remove the block or delete their account. Safety reports contain reason and room/photo-reference metadata, not an automatic copy of the image; they are kept up to 90 days for investigation. Reports made by others may retain references to a deleted identity during that period. Providers may retain transaction or security records required by law.

Your choices and deletion

Settings → Account & recovery → Delete online identity removes your server identity, linked rooms and their recordings/photos for both participants, temporary photo transfers and alert registrations. Provider customer deletion is requested separately and may be processed asynchronously. The app clears local photo data and credentials after server confirmation and offers a retry if device cleanup fails. Solo progress remains. Remote deletion cannot erase copies on another or offline device and does not refund a purchase or erase Google Play transaction records.

A small deletion-completion record containing your player ID, a hash of the old device credential and retry metadata remains until the deleting device confirms durable local cleanup. It lets a lost deletion reply be checked and cannot restore account access. If the device never confirms, this limited record remains; contact us for help.

You can also request deletion without reinstalling. Contact hackathon-shipaton@aamirazeez.com for privacy questions, access or correction requests, including concerns about a child's information. We verify ownership of anonymous identities before acting and explain any legitimate retention or limits.

After You · Aamir Azeez · hackathon-shipaton@aamirazeez.com