Privacy

The short version

• We do not store the text you paste. We store a one-way fingerprint of it.
• We do not store full URLs. We store the domain only.
• We do not sell anything you submit and we do not use it to train models.
• You can delete your history at any time, entry by entry or all at once.
• No advertising, ever. The only third-party scripts are cookieless, privacy-friendly page-view analytics, and Paddle’s checkout on the pricing page when you buy something.

What we collect

Anonymous identifier. Every visitor gets a random identifier in a signed, HTTP-only cookie. It exists so preferences and rate limits work without an account. It is not linked to any personal information.

Spoiler check records. For each check we store the game, whether the input was a link or text, the registrable domain if there was one, a SHA-256 fingerprint of the normalised input and the classification result. We do not store the submitted content, extracted page text or anything quoted from it.

Account information. If you create an account we store your email address and a scrypt hash of your password. We never store the password.

Progress and preferences. The progress you record and the protection level you choose.

Product analytics. Counts of named events such as “a spoiler check completed”, with a small set of allowed properties. The server drops any property that is not on the allowlist for that event, so submitted text, URLs and questions cannot reach analytics even if a client tried to send them.

Sending content to an AI provider

When assisted analysis is enabled, the content you submit is sent to the configured AI provider so it can be classified or answered. The operator of this deployment chooses that provider and the provider’s own terms apply to that transfer. API keys stay on the server and are never exposed to your browser. If no provider is configured, nothing leaves our servers and the offline classifier handles checks on its own.

Payments

If you buy a paid plan, payment is handled entirely by Paddle.com, acting as our reseller of record. Paddle collects what it needs to process the payment (email, billing details, card information) directly — that information goes to Paddle, never through our servers, and Paddle’s own privacy policy governs it. We only receive confirmation that a purchase happened, which plan it was for, and an identifier we use to link the purchase to your account.

Cookies

We set one cookie: a signed, HTTP-only anonymous identifier (described above) and, once you sign in, a session cookie. Both are strictly necessary for the service to function — neither is used for advertising or cross-site tracking, and we do not load any third-party analytics, advertising or tracking scripts. That is also why this site does not show a cookie-consent banner: everything it sets is exempt from consent requirements for exactly that reason, not because we skipped it.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict some processing. History deletion and account deletion are self-service, described above; for anything else, contact support@playunspoiled.com. If you are in the EU or UK and are not satisfied with our response, you can lodge a complaint with your local data protection authority.

Children’s privacy

This service is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

International transfers

Our hosting, database and (when configured) AI provider may process data in countries other than your own, including the United States. By using the service you understand your data may be processed there, under that provider’s own safeguards.

Retention

Check records are kept for a configurable period, 30 days by default and can be disabled entirely by the operator. Signing out ends your session immediately. Deleting your history removes those records; it cannot be undone.

Logs

Server logs record operational events. They do not include submitted content, full URLs, question text or AI provider response bodies — provider errors can echo submitted content, so we discard those bodies rather than log them.

Changes to this policy

If what we collect or how we handle it changes materially, this page will be updated and the date below will change.

Last updated: September 5, 2026.

Contact

Questions or a deletion request: support@playunspoiled.com.

This page describes how the software behaves. It is not legal advice and an operator running their own deployment is responsible for their own compliance obligations.