Point Taken Privacy Policy
Effective date: October 25, 2026
Last updated: October 25, 2026
This Privacy Policy explains how ExperCeption LLC, which operates Point Taken ("ExperCeption," "Point Taken," "we," "us," or "our"), collects, uses, discloses, retains, and deletes personal information through the Point Taken website, shared account service, online games, downloadable-material flows, and other Point Taken services that link to this Policy (collectively, the "Services"). It applies to pointtaken.social, auth.pointtaken.social, brain.pointtaken.social, and heart.pointtaken.social.
This Policy is organized by information practice and feature. A provision about chat, microphone transcription, AI processing, or another feature applies only when that feature is available. Feature availability may vary.
1. Information we collect
The information we collect depends on the Service and feature you use.
Account, profile, and age information
We may collect:
- your email address and information received from Google or another sign-in provider;
- authentication, account, and security records;
- a generated or selected display name and avatar;
- account settings and support communications; and
- if and when we ask, your self-reported age band, such as 13 through 17 or 18 or older, and records of the notice or choice presented with that question.
Point Taken does not currently ask every account holder for an age band. We do not ask for an exact date of birth as part of the shared account flow. A self-reported age band is not independent identity or age verification. If we add age-band collection, we may use it for eligibility, matching, safety settings, consent choices, corrections, and legal compliance. We do not use age information for advertising or game scoring.
Game, preference, and submitted-content information
We may collect:
- topic preferences, custom topics, proposed topics, matching preferences, and stances;
- game topics, arguments, deliberately submitted speech-to-text, actions, outcomes, AI or referee feedback, and game history;
- lobby presence, invitations, blocks, and related game status;
- leaderboard and progression information; and
- reports, report reasons, optional report details, and limited context needed to review a report.
Some topics, stances, game content, or communications may reveal or suggest political or philosophical views, religious beliefs, health information, sexual orientation, citizenship or immigration status, or other sensitive characteristics. We use this information for the purposes described in this Policy. We do not use it for targeted advertising or unrelated profiling, and we do not sell it to data brokers.
Existing Heart solo-practice records
Heart's solo-practice feature previously recorded submitted answers, correctness, revision snapshots, timestamps, application version, and the user's shared account identifier in an account-linked internal quality-assurance dataset. New optional collection into that dataset is paused. Existing records remain stored with account identifiers and are not anonymous. Optional further analysis is paused while we review collection notices, permissions, and deletion requirements; necessary service, security, privacy-request, and legal handling may continue.
These legacy records are different from the new pseudonymous improvement program described in Section 4. In particular, the legacy records can contain revision snapshots, while the new program will accept only content a user deliberately submits as final. Resuming optional collection requires the applicable notice and permissions; publication of this Policy does not reopen it.
Chat and player communications
Point Taken does not currently offer a general direct-message network or a deployed post-game chat feature. If chat becomes available, we may collect submitted messages, timestamps, room status, participant choices, block and report actions, and limited game context. We will provide any collection-time notice required for optional improvement use before that use begins.
Heart live rooms process text shared between the participants, including submitted turns and, while microphone transcription is active, live transcript text. The current live-room notice states that submitted live transcripts are retained for product debugging and are not donated to the solo-practice dataset. We will not retroactively reclassify those transcripts for a new improvement use.
Microphone and transcription information
When a feature offers voice transcription, the participant's browser sends microphone audio directly to Deepgram for real-time speech-to-text processing. ExperCeption's application servers do not receive or store that raw microphone audio. Point Taken receives transcript text, timing and room information, acknowledgement records, and limited technical information needed to operate and secure the feature.
Live or interim transcript text is stored in room state and may be displayed to the other participant before submission. Submitted transcript text is retained with the room as a game record and for debugging. Raw audio is not placed in Point Taken's internal datasets. Live-room transcript text is not part of the existing Heart solo-practice dataset.
Feedback, forms, support, safety, and technical information
We may collect feedback and form submissions, bug reports, page and game context, device and browser information, build information, IP address, timestamps, authentication and security logs, CAPTCHA or abuse-prevention signals, and similar diagnostic information. If you use a contact or download form, the form may be provided by Fillout.
Marketing-site analytics
The Point Taken marketing site uses Google Analytics 4 through Google Tag Manager. Subject to your analytics choices, these tools may use cookies or similar technologies to collect device, browser, IP-address, page-view, landing-page, referring-domain or referring-URL, normalized campaign-parameter, outbound-click, scroll, and file-download information. We use this information to understand how people find and use the site, maintain it, and evaluate communications and referring partnerships.
We do not intentionally send Point Taken account identifiers, age information, stances, game content, transcript text, or player communications to marketing-site analytics. Where applicable law requires consent before nonessential analytics, we do not enable the relevant tracking until the user consents.
2. How we collect information
We collect information:
- directly from you when you create or use an account, play, communicate, use microphone transcription, report content, submit feedback, download materials, or contact us;
- automatically from your browser, device, and use of the Services;
- from another player when that person plays or communicates with you, shares live transcript text with you, or reports shared activity; and
- from service providers, including sign-in, hosting, security, forms, email, analytics, speech-to-text, and AI providers.
We do not currently purchase demographic profiles about Point Taken users or connect email addresses or account identifiers to demographic information obtained from personal-information or enrichment providers.
3. How we use information
We use personal information to:
- create, authenticate, secure, and administer accounts;
- provide player profiles, invitations, games, transcription, history, progress, and requested AI features;
- show shared content to the appropriate players;
- operate, evaluate, debug, and improve the Services as described in this Policy and in collection-time notices;
- prevent abuse, investigate reports, enforce our Terms, and protect users and the Services;
- respond to support, privacy, correction, and deletion requests;
- communicate about the Services and material policy changes; and
- comply with law and establish, exercise, or defend legal claims.
We may create aggregated or genuinely de-identified information and use it for lawful purposes. When applicable law treats de-identified information specially, we maintain it in de-identified form, take reasonable measures to prevent re-identification, and do not attempt to re-identify it except as applicable law permits.
4. Internal Point Taken improvement
Existing account-linked records
Current operational records and the existing Heart solo-practice records described in Section 1 are linked to ordinary account identifiers. Calling an identifier a UUID or removing a display name does not make those records anonymous. Existing records remain governed by the notice presented when they were collected and the uses described in this Policy. New optional collection into the legacy solo-practice dataset and optional further analysis of its records are paused as described in Section 1.
In particular, live-room transcript text collected under a notice stating that it would not enter the solo-practice dataset will not be moved into that dataset or into the new improvement program without a new lawful basis and any required permission. We will not use this Policy to expand the use of previously collected content retroactively.
New pseudonymous improvement program
Point Taken plans to use deliberately submitted game content and, if chat is offered, submitted chat to evaluate and improve Point Taken. The new program is not active unless the collection-time notice and the controls described below are operating.
For an adult, content submitted after the program is enabled may include the final submitted version of an argument or speech-to-text, game actions, outcomes, AI or referee outputs, submitted chat, and derived product-performance measures. It may be reviewed by authorized personnel and used to evaluate and improve Point Taken's prompts, game mechanics, automated features, reliability, and safety.
The new program excludes revision snapshots, edit history, abandoned or unsubmitted drafts, interim captions, and raw microphone audio. This final-submission limit applies to the new program, not to the existing Heart solo-practice records described above.
Before any record enters the new improvement dataset, Point Taken will replace the ordinary account identifier with a random analysis identifier and separate the account-to-analysis linkage into restricted storage. The linkage may be used only for controlled administrative functions such as deletion, correction, safety review, and ban enforcement. We will not begin new-program ingestion until those controls are in place. Because a restricted ability to reconnect the data will remain, the data will be pseudonymized, not anonymous. Submitted text may also contain identifying information that a user chose to include.
If we know a user is 13 through 17, optional improvement use requires separate, informed consent before that processing begins. This requirement applies to both existing account-linked records and the new program. Processing strictly needed to provide the requested game, repair technical errors, protect safety or security, or meet legal obligations is treated separately. Refusing optional improvement use will not prevent access to otherwise available core game features. We do not currently offer the separate teen-consent flow, so we do not authorize optional improvement processing of known teens' records until that flow is available and consent is given. Consent can be withdrawn through the control provided with the request or by emailing us; we then stop the optional processing and delete the affected person-level improvement records unless a separate lawful retention ground applies.
We do not sell submitted game content or communications, license them as a standalone dataset or for another party's independent use, use them to train general-purpose or unrelated models, use production Point Taken data for academic or IRB research, or authorize service providers to train their own models on them. Providers may process content to supply Point Taken features and, if disclosed when the new program begins, related evaluation services on our instructions. A materially different external use would require a separate decision, updated notice, and any permission required by law.
5. Microphone transcription and people nearby
Before microphone transcription begins, Point Taken presents a transcription notice and requires the participating player to acknowledge it for that room or session. The feature provides controls to start and stop capture and an on-screen indication when transcription is active.
Players must tell anyone whose private conversation may be captured that transcription is active and obtain that person's agreement before intentionally capturing the conversation. Incidental public or background speech does not necessarily prevent use of the feature, but players must not intentionally capture it. If another person joins a private conversation, players must tell that person about the transcription and obtain agreement before that person participates substantively.
Microphone audio streams from the browser to Deepgram. Point Taken's application servers do not receive or store the raw audio. The production transcription request includes Deepgram's mip_opt_out=true parameter for initial and reconnected streams. That request setting is intended to prevent provider retention of audio and transcripts for model improvement, but it does not eliminate Deepgram's limited request metadata, usage records, or security records under its terms and the account configuration.
Point Taken uses the audio and vocal characteristics available in the stream only to obtain speech-to-text. Point Taken does not create voiceprints, identify people by voice, or infer emotion, health, demographics, or other personal characteristics from a person's voice.
6. What other users can see and who can connect
Depending on the available feature, another signed-in user may see your display name, avatar, lobby presence, a proposed topic or stance, shared game content, submitted transcript text, game outcome, and leaderboard statistics. In a Heart live room, the other participant may also see live transcript text before you submit it.
Point Taken does not currently offer an age-banded stranger-matching path for users aged 13 through 17. We do not collect an age band from every user and cannot currently restrict stranger matching by age band automatically. Under the Terms, users must be at least 18 to use stranger matching; if we learn a user is under 18, we will restrict that user's stranger features. Before teen stranger matching is offered, it will require an age-band flow and controls that keep stranger matching within the same band. A known friend or family member using a private invitation may be allowed to join across age bands if that feature is available. We do not publicly display a user's age band.
Point Taken does not currently offer open direct messages or a deployed post-game chat feature. If limited player chat becomes available, the participants in that conversation will see the messages submitted there, and the feature will include its own notice and available block or report controls.
7. AI processing
Some features send limited context to Anthropic. Depending on the feature, this may include the current topic, relevant arguments or board state, a player's submitted contribution, referee context, or other submitted content needed to provide the requested feature. The existing Heart solo and live referee paths use Anthropic. Brain features may also use Anthropic for game or coaching functions.
We do not ordinarily include your email address, block list, reports, or unrelated game history in an AI prompt. A specific support, safety, or legal task may require additional information when the disclosure is permitted by this Policy.
AI output may be incomplete, inaccurate, biased, or inappropriate. The Terms of Use describe additional limitations.
Anthropic processes API inputs and outputs under its commercial terms and our account configuration. Its published retention practices are available in Anthropic's commercial data-retention documentation. We do not authorize Anthropic to use Point Taken content to train its own models.
8. Service providers and other disclosures
We disclose information to service providers as needed to operate, secure, communicate about, and improve Point Taken. Current providers or provider categories include:
- Supabase for authentication, databases, and related infrastructure;
- Vercel for application and website hosting;
- Google for sign-in and, when enabled, Google Analytics 4 and Google Tag Manager;
- Resend for account and authentication email;
- Fillout for current website forms;
- Cloudflare for CAPTCHA and abuse prevention;
- Deepgram for real-time speech-to-text when microphone transcription is enabled;
- Anthropic for AI-dependent game, coaching, evaluation, or referee features; and
- logging, monitoring, support, and infrastructure providers enabled for the Services.
Providers may process information in the United States or other locations allowed by their terms and our account configuration. We do not give providers an independent right to sell Point Taken content or train their own models on it.
We may also disclose information:
- when you direct us to do so or disclosure is necessary to provide a shared feature;
- to comply with a court order, subpoena, law, or other valid legal process;
- when reasonably necessary to protect rights, safety, security, users, or the Services;
- to investigate fraud, abuse, or a violation of our Terms; or
- as part of a merger, financing, reorganization, sale, or transfer of all or part of the business, subject to appropriate protections.
We do not sell personal information. We do not use Point Taken account, age, game, stance, transcript, or communication information for targeted or cross-context behavioral advertising.
9. Age requirements and children
The interactive Point Taken Services are for people who are at least 13. Point Taken does not currently ask every user for an age band or independently verify age. When an age-band question is presented, the user must answer truthfully. A user under the age of legal majority must have permission from a parent or legal guardian, as the Terms require. Stranger features have the additional age restriction in Section 6. Our contact and download forms are not intended for children under 13.
We do not operate a parental-consent program for children under 13, and children under 13 may not create or use a Point Taken account or interactive Service. If we obtain actual knowledge that we collected personal information from a child under 13, we will stop the child's further use and delete or otherwise handle the information as applicable law permits or requires.
Until the necessary age-band and consent controls are available, Point Taken may withhold teen access to particular features rather than infer a user's age or treat silence as consent. Optional internal improvement use for a known user aged 13 through 17 is governed by Section 4 and is not a condition of core access.
Printable materials are separate from the interactive Services. Their availability does not allow a child under 13 to create an online account.
If you are a California resident under 18 and a registered user, you may request removal of content you submitted so that it is no longer visible to other users. Email info@experception.com and identify the content you want removed. Removal from view does not ensure complete or comprehensive removal from every system. Content submitted by another person, information another person copied or reposted, and information that must remain for a report, security measure, legal hold, or legal obligation may remain as described below.
10. Retention
We retain information for the time reasonably necessary for the purposes described in this Policy, including operating the Services, preserving shared game history, permitted internal quality assurance, securing accounts, investigating reports, resolving disputes, and complying with law. Current systems do not yet implement every shorter automated retention schedule Point Taken is evaluating. Retaining a record does not authorize a paused optional use. The following describes current practice:
- Raw microphone audio: Point Taken's application servers do not receive or store it. Deepgram may retain limited request metadata, usage, or security records under its practices and our account configuration.
- Heart live-room text: interim and submitted transcript text is stored in room state. Ordinary submission, advancement, or departure can clear a live draft field, but an abandoned room record may persist. A room credential or access window expiring does not itself delete the stored room record.
- Submitted game and shared history: Brain's current game event history and Heart's submitted live-room text may persist to preserve the game or room record. Current systems do not apply an automated two-year inactivity purge.
- Existing Heart solo-practice records: previously collected answers, correctness, revision snapshots, timestamps, application version, and account identifier persist in the account-linked quality-assurance dataset while new optional collection and further optional analysis are paused. There is not yet an automated inactivity purge for that dataset. We review these records for permitted retention, restriction, or deletion in light of their original notices and applicable rights.
- New pseudonymous improvement records: no new record will enter the new program described in Section 4 until its separate storage, linkage, and deletion controls exist. Once enabled, person-level records will be subject to the schedule and deletion rules disclosed with the program. Aggregate outputs retained after deletion will not reproduce submitted content and will not reasonably permit re-identification.
- Reports, support records, and security logs: retained for the period reasonably needed to handle the report or request, prevent abuse, maintain security, document the response, or comply with law. Provider-controlled logs and backups expire through the provider's operating cycle unless preserved for a legal or security reason.
- Marketing analytics: if enabled, retained for the period configured in the analytics account and subject to the choices in Section 13.
- Genuinely de-identified aggregate metrics: may be retained indefinitely.
Shared game contributions may remain after one participant deletes an account when needed to preserve another participant's player-facing history or the integrity of the shared record. Retaining a shared player-facing record does not authorize continued use of the departing user's contribution in the new improvement program.
Deletion from backups may not be immediate. Backup copies are removed or overwritten through our and our providers' normal backup lifecycles and are not restored to ordinary use after deletion except as needed for disaster recovery, security, or legal compliance.
11. Account deletion, content removal, blocking, and reports
Current account-deletion tools remove or replace ordinary profile labels and prevent ordinary continued account use. They can preserve account UUIDs, shared game history, Heart room text, and existing Heart solo-practice records. Those retained records are not anonymous merely because the display name or active sign-in is removed. A broader deletion request can include the email address and sign-in-provider information associated with the account; we handle those fields and any required exceptions as part of that request.
To request access, correction, content removal, or broader deletion, email info@experception.com. We will verify and process the request as required by applicable law, taking account of shared records, safety evidence, fraud prevention, legal holds, and legal obligations. Automated account closure may require additional manual deletion work; technical limitations do not reduce your applicable legal rights. Where law permits or requires retention instead of deletion, we restrict the retained record to that purpose and explain the applicable limit where required.
If and when the new improvement program is enabled, account deletion or a valid deletion request will remove the requesting user's person-level improvement records and the ordinary account-to-analysis linkage. We may keep aggregate measures that do not reproduce the submitted content and do not reasonably permit re-identification. A shared contribution that remains in another player's history will not continue in ordinary improvement use after the departing user's deletion request is processed.
Blocking stops new contact to the extent the feature permits, but does not destroy existing report evidence. We may preserve limited information needed for a safety report, ban, fraud prevention, dispute, legal obligation, or legal hold. That information is restricted to the relevant function and is not used for ordinary product improvement.
12. Security
We use administrative, technical, and physical safeguards designed to protect personal information. Current operational and legacy datasets may use account identifiers, and access is limited according to role and purpose. If the new improvement program is enabled, its direct identifiers will be separated as described in Section 4. No system, transmission, or storage method is completely secure.
You are responsible for protecting your account credentials and using care when sharing content with another player. Do not submit private contact information or intentionally capture another person's private conversation without informing the person and obtaining agreement.
13. Cookies and analytics choices
You can use browser settings to limit or delete cookies. Blocking required authentication or security cookies may prevent parts of the Services from working. Browser and provider controls may also limit Google Analytics tracking if analytics is enabled. Referring-site policies, applications, and privacy controls can cause a visit to appear without a referral source.
We do not currently respond to a browser's "Do Not Track" setting. Where applicable law requires consent before nonessential analytics, we request it before enabling the relevant storage or tracking. Where applicable law requires recognition of an opt-out preference signal, such as Global Privacy Control, we process the signal as required.
14. Your privacy choices and rights
Depending on where you live and applicable law, you may have rights to request access to, correction of, deletion of, or a portable copy of certain personal information, and to appeal a denied request. You may also have rights concerning certain sensitive-data processing, sales, targeted advertising, or profiling.
Point Taken does not sell personal information or use Point Taken account, game, transcript, or communication content for targeted advertising. To make a request, including an age correction, email info@experception.com. We may need to verify the request and may retain a limited record of the request and our response.
Available product controls may also allow you to sign out, block another player, report content, or delete an account. Product deletion and a broader privacy request are not necessarily identical, as explained in Section 11.
15. United States operations and international access
ExperCeption is based in Illinois, United States. The Services are designed and primarily marketed for use in the United States, and we do not actively target or specifically market the interactive Services outside the United States. Incidental access from another country may be technically available. If you access the Services from outside the United States, your information may be transferred to and processed in the United States and other locations where our providers operate. Privacy rights and consent requirements depend on applicable law and are not waived by a statement that the Services are primarily intended for the United States.
16. Changes to this Policy
We may update this Policy as the Services, our practices, or applicable law changes. The current version will identify its effective date. If a change materially affects registered users, we will provide notice through the Service or using available contact information and request consent where applicable law requires it. We will not use an updated policy to retroactively expand use of content when a new lawful basis or permission is required.
17. Contact us
Questions, requests, or concerns about this Policy or Point Taken's privacy practices may be sent to:
ExperCeption LLC
807 Davis Street, Unit 1606
Evanston, Illinois 60201
Email: info@experception.com