The short version. Deja Who has no accounts, no ads, no tracking and no analytics code. To run the game, our server keeps what you put into your groups: the name you pick, your answers, guesses, fake answers and photos, under a random ID the app makes. Only the people in your group see them. Photos are deleted after 30 days, and live-game photos when the game ends. We never sell anything about you. You can delete everything, any time, in Devices & data › Delete my data.
Your random ID
We don't ask for your real name, email, phone number or Apple ID. Instead the app makes a random install ID. On the web, and in the Android app from Google Play (package com.lyravant.friends, which is the web version running in Chrome as a Trusted Web Activity), it's kept in the browser's storage. On iPhone it's worked out one way from a random Lyravant ID in your iCloud Keychain, so a new iPhone with the same keychain carries on as you. The server also gives you a 10-character rejoin code that moves your ID to another device; treat it like a password. Other players only ever see a separate member ID and the display name you choose, never your install ID.
The daily game
When you start or join a group, our server (run by Lyravant on Supabase) stores:
- The group: its name, time zone, invite code and settings (question time, reveal time, days, packs, photos on or off, early reveal).
- You in the group: the display name you choose, when you joined, and the last day you visited (to pick who the question is about).
- Each day's round: the question, who it's about, their answer (a choice, a ranking, a number on a scale, a short written answer up to 80 characters, or a photo), the other players' guesses and fake answers, and 😂 reactions.
- Questions your group writes and the votes on them.
- Reports: which answer or photo was reported and by which member.
- Activity counts: that an ID answered, guessed or wrote a fake in a group on a given day, with no content. We use these, added up, to see whether groups keep playing.
Everyone in the group sees the names, the question, and after the reveal the answers, guesses and fakes (a guess is shown before the reveal only to you). Anyone with the group's invite link can see the group's name and how many people are in it, and can join, so share it only with friends.
Your group's memory. The game shows your group its own history: who has known whom, streaks, rematches, written answers the group laughed at, and what you played a month or a year ago. It's worked out from your group's past reveals each time you open the game, only the group's members see it, it never shows answers that were reported and hidden, and anyone who leaves is dropped from it.
Reveal links
If someone shares a reveal link (lyravant.com/friends/g/…/r/…), anyone who opens it, and the link preview in a chat, shows the group's name, the day's question, the display name of the person it was about, and how many people knew. It never shows answers, fake answers, photos or who guessed what.
Photos
Some questions ask for a photo of a thing (never people). On iPhone the app shrinks the photo and removes its metadata before sending it; on every device our server then re-writes the JPEG without location (GPS), camera details or comments before storing it. Photos sit in private storage. Group members see them through links that expire after 10 minutes, and guessers see only the photos in their own pick list until the reveal.
A photo is deleted after 30 days, when two members report it, or at once when its owner leaves the group, is removed, or deletes their data, or when the group is deleted.
Live games
A live room (Photo Imposter, Party rounds, Hot Take Court) stores its 4-letter code, the name you use in it, your score, what you write or vote, your photos, and, in Party rounds, up to three short facts about yourself if you choose to share them with the AI host. A room lasts at most 3 hours. Its photos are deleted when the game ends, and the room itself, with everything in it, about an hour after it closes. Afterwards we keep only an anonymous count: the mode, how many players, how many rounds and what the AI host cost. If at least two members of one of your groups played, the game also counts as a party night for that group: the day, the mode, the number of rounds, how many members and how many other players took part, and which members won. Your group sees these in its month and yearbook. Players who aren't in the group are never named. A prompt someone reports is kept for 30 days so we can review it, without who played.
The AI host
In Party rounds the host can turn on an AI host that writes rounds for the room. Our server then asks Claude, made by Anthropic, through Lyravant's own AI gateway. Each request sends only the kind of round, the facts the round's star chose to share, and the room's earlier prompts with every name replaced by a placeholder. It never sends names, answers, photos or your install ID; the gateway receives a one-way hash of the host's ID to apply limits. The AI's text is checked by our filters before anyone sees it. The gateway keeps a usage record for each request (the hashed ID, token counts, cost and time), not the text. Anthropic processes requests under its commercial terms, which don't allow it to train models on them. With the AI host off, rounds come from our own reviewed deck and nothing is sent.
Notifications
If you allow notifications, the app sends our server Apple's push token for your phone, whether it's a development or App Store build, your time zone, the app version and whether notifications are on. We use them to send at most two notifications a day (the day's question and “the reveal is in”), plus at most one live-game invite a day when a friend in your group starts a live game and taps “Tell your group”. A log of which notifications went out (the day, the kind and the group) is kept for about 40 days so nobody gets more than that. Tokens Apple reports as invalid are deleted. Notifications pass through Apple's push service.
On the web and in the Android app, if you turn notifications on, your browser (in the Android app, Chrome on your phone) gives our server a push subscription: an address on your browser's push service (Google, Mozilla, Apple or Microsoft) and the keys to encrypt messages to it, plus your time zone. The same two-a-day limit applies across your phone and browsers. Turning notifications off, or Delete my data, removes the subscription.
Discord
A group admin can link a Discord channel by pasting its webhook link. We store the webhook's ID and its token, encrypted, and post the day's question and the reveal teaser with its card there; answers and guesses are never posted. “Stop posting” deletes the link.
iMessage
So the iMessage app knows which group belongs to which chat, it sends a one-way hash (SHA-256) of the identifier Messages gives the app for that chat, with the group's code. We can't read your messages or see who is in the chat. Bubbles you send contain a link to the question or reveal.
Security checks
The iPhone app uses Apple's App Attest so our server can check that requests come from the real app; we keep the key's ID and public key, which say nothing about you. To limit abuse, the server counts requests per install ID and per IP address. It keeps the IP address only as a salted hash, for two days. Our hosting providers may keep short request logs, including IP addresses, for a few days for security.
How long we keep it
- Group content stays while the group exists. When you leave or are removed, your membership, your answers, guesses, fakes, reactions and photos in that group, and the rounds about you, are deleted. A group with nobody left is deleted with everything in it.
- Photos: 30 days at most. Live rooms: about an hour after they close. Reported live prompts: 30 days.
- Notification log: about 40 days. Request counts: 2 days. Activity counts: until you delete your data or the group is deleted.
- Error reports: 30 days. When the app crashes or the web page hits an error, it sends the kind of error, where in our code it happened and the app version, with emails, links, numbers and quoted text removed and no ID attached. We only count them, to notice when something breaks.
Deleting your data
On iPhone: Settings › Devices & data › Delete my data. On the web and in the Android app: lyravant.com/friends/settings › Delete my data. This removes, right away, your memberships and everything in the list above that belongs to your ID (answers, guesses, fakes, photos, reports, activity counts, push tokens, the iMessage chat links, App Attest keys and the notification log), and groups left empty. Your phone then starts a new random ID. Deleting the app or clearing the browser's storage removes what's kept on the device. Questions or requests: support@lyravant.com.
Who processes it
- Supabase: our database, photo storage and server code.
- Railway: hosts lyravant.com.
- Apple: push notifications and App Attest (iPhone).
- Browser push services (Google, Mozilla, Apple, Microsoft): web and Android app notifications, only if you turn them on.
- Google Play: distributes the Android app. The app itself is the web version, with the same data practices as on this page and no extra tracking.
- Discord: the posts in a channel your group links.
- Anthropic: the AI host, only when it's on (see above).
We don't sell or share personal information for advertising, and there are no ads.
What we don't collect
No accounts, email addresses, phone numbers, contacts, precise location, advertising identifier or hardware identifiers, and no analytics or tracking code (error reports, above, are anonymous counts). The camera is used only when you take a photo for a question; the web version's Hot Take Court can use your browser's own speech-to-text if you tap the microphone, which your browser handles, not us. The home-screen widget reads a small summary the app saves on your phone.
Children
Deja Who is for people 13 and older and isn't directed to children under 13. If you think a child under 13 has given us information, write to us and we'll delete it.
Changes
If this policy changes, we'll update the date at the top and describe material changes in the app's release notes.
Contact
Lyravant LLC · support@lyravant.com