Privacy Policy

Who is responsible

The data controller is Trust in food snc di Emanuele e Stefano Nozza, Corso Milano 51, 20813 Bovisio Masciago (MB), Italia, VAT 09574370962.

For anything concerning your data — questions, requests, complaints — write to privacy@comedyroaster.com. Our certified address is trustinfood@legalmail.it, which is the formal channel under Italian law.

We have not appointed a Data Protection Officer, because the law does not require one for an operation of this size. Your requests reach the people who actually run the service.

What we collect, and why

If you write a joke without an account, we store the joke, the theme, the language, the model's judgment of it, an anonymous session identifier held in a cookie, and a salted hash of your IP address. That is enough to show you your result, keep a daily limit, and stop one person from running up our model costs from a thousand fresh browser sessions.

If you claim a stage name, we also store your username, your email address, your language, and the numbers that make the game work: your streak, your reputation points, and your badges. To sign you in, we briefly store the sign-in link we send you and the session that link opens.

If you take part in duels, we store your votes. If you play Roast Night, we store the room code, your nickname for that night, the answers you wrote, the votes, and the last round and phase you reached. That last item tells us at which point a night loses people.

If you subscribe, Stripe handles the payment and we store only what identifies your subscription: Stripe's customer and subscription identifiers, your plan, its status, and its renewal date. We also store the record of the consent you gave at checkout: that you asked us to start immediately and that you acknowledged what happens if you withdraw, with date and time.

If you ask to cancel or withdraw, we store the email you give, the type of request, the date and time, and any message you add.

If you report content, we store where it is, the reason you give, your good-faith statement and, if you leave them, your name and email. If the reported content is yours, we also store the decision taken and the reasons for it.

We record a few usage facts, which we call events: joining a room and how you got there (QR code, link, or typed code), how long a call to the model took and how it went, server errors, and views of the admin pages. Each event is linked to a session identifier or to an account.

If you ask for a quote for a night at your venue or company, we store what you write in that form — who you are, your name, email, phone if you leave one, city, headcount, a rough date, and any message — together with a hash of your IP address. That is only to reply and put together the quote. The request also reaches us by email.

Your IP address never appears in readable form in our database. We never see your card details — those stay with Stripe. There are no passwords to steal, because the service does not use any.

Some things stay only on your device and never reach us: your Academy exercise drafts and your choice to mute the screen. The details are in the cookie policy.

Your jokes are read by an AI model

This is the part worth reading twice. The judge in Comedy Roaster is an artificial intelligence model: Claude, by Anthropic PBC, used through its API. It does not run on our own servers. The scores, comments and rewrites you see are generated by that model, and the site says so where they appear.

When you submit a joke to the daily challenge or in the practice room, the model receives the text, the theme and the language. It returns a score across six dimensions, a comment and, sometimes, a rewritten version.

In the same call, an automated check can block the joke. It blocks only these cases: hate against protected groups, attacks on identifiable private individuals, sexual content involving minors, threats, incitement, exposing other people's personal data, and encouraging a real person to harm themselves. If that happens, the joke is not published and the page tells you the decision was automated. You can ask for a person to review it, as explained in the terms of service.

During a Roast Night nobody and nothing filters or judges the answers: only the players' votes decide. After a round has closed, a scheduled job sends the model the text of each answer together with the text of the card, which may contain the nickname of the player being targeted. The model computes the scores you see in your profile and in the night's cards, and flags answers the automated check would have blocked. Those answers are removed from the public results page. The job can be switched off. The same applies to company events.

Anthropic is based in the United States. The transfer relies on the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses. Anthropic processes the text to return the judgment and, under its API terms, does not use it to train models.

The score is an automated opinion, not a professional assessment. It has no legal effect on you and no similarly significant effect, so it is not an automated decision under Article 22 GDPR. You are free to disagree and tell us.

Do not write anything into Comedy Roaster that you would not want processed this way: data about private individuals, confidential information, or anything you would not say on a stage.

Where your jokes end up

Jokes written for the daily challenge are public by design. They can appear in duels, on leaderboards, in the preview images generated when someone shares a result, and in the permanent archive of past challenges, which search engines index.

What you write in the practice room is visible only to you.

Roast Night answers are seen by the table and by anyone who opens that room's results page, which can only be reached with the link. That page is not indexed by search engines.

On what legal basis

Running the game — your account, your jokes, the judgments, the rooms, your subscription — and handling your cancellation and withdrawal requests is the performance of a contract with you, under Article 6(1)(b) GDPR. Replying to a quote request is a pre-contractual step, on the same basis.

These rest on our legitimate interest, under Article 6(1)(f): the salted hash of IP addresses, to cap abuse and model costs; cookieless usage measurement and events, to know which parts of the service work and where they break; and the after-the-fact judging of Roast Night answers, to improve the game and keep public pages clean.

Emails about duels and streaks also rest on legitimate interest. We send them only to people with an account, they concern the game you are already playing, and each one has a link to stop receiving them.

We use a hash rather than the IP address itself precisely to limit the intrusion. You can object to any processing based on legitimate interest: see below.

Keeping records of payments is a legal obligation under Italian tax law, Article 6(1)(c). On the same basis we handle content reports as the EU Digital Services Act (DSA) requires, and we answer your data requests.

The emails we send you

Service emails, which you get because you did something: the sign-in link; the subscription confirmation, with the withdrawal information and the record of your consent; the confirmation of a cancellation or withdrawal request; the confirmation of a report, and the reasons for a moderation decision that concerns you.

Game emails, only if you have an account: the result of your duels, and a reminder when your streak is about to break.

Every game email has a link at the bottom to stop receiving it in one click, and a header that lets your mail app unsubscribe you by itself. You can also write to privacy@comedyroaster.com.

We have no newsletters and no marketing lists, and we do not pass your address to anyone. Emails are sent through Resend.

Who else touches your data

We use a small number of providers. Each acts as a processor, on our instructions and only for the service it provides to us. The list below is complete.

Vercel Inc. (United States) hosts the site. Its functions run in the European Union, in Frankfurt. Vercel keeps technical request logs, which include the IP address.

Neon (Neon Inc., United States) provides the database. The data is stored in Frankfurt, on Amazon Web Services infrastructure.

Stripe Payments Europe Ltd. (Ireland) handles payments. Card details go straight to Stripe and never pass through us. For some purposes of its own, such as fraud prevention and financial obligations, Stripe acts as an independent controller under its own policy.

Resend (Plus Five Five Inc., United States) sends our emails.

PostHog, on its European infrastructure in Frankfurt, measures how the site is used without cookies, without collecting your IP address, and without identifying you. It records page views and a handful of events.

Anthropic PBC (United States) provides the model that judges jokes, as explained above.

Aruba S.p.A. (Italy) hosts the privacy@comedyroaster.com mailbox, which receives data requests, reports and quote requests.

Where a provider is based in the United States or can access the data from there, the transfer relies on the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses.

We do not sell your data, we do not share it for advertising, and there are no advertising or social media trackers on this site.

How long we keep it

The time limits below are applied by an automated job that runs every night, unless stated otherwise.

Account: kept for as long as it exists. Ask us to delete it and we delete it within one month, together with everything attached to it, except what the law obliges us to keep.

Sign-in links: deleted one day after they expire. Sign-in sessions, which last 90 days: deleted when they expire.

Hashed IP addresses: used only to count the current day's requests, and deleted after 7 days.

Events and reports: 13 months. The same applies to cancellation and withdrawal requests.

Quote requests: deleted after 24 months. If you want them deleted sooner, write to privacy@comedyroaster.com.

Public daily-challenge jokes: they stay public until you ask otherwise. On request we remove the link between the jokes and your name, or the joke itself.

Roast Night rooms, nicknames and answers: we keep them because they power the group's history, such as records and rematches. They are not indexed. We do not currently delete them automatically. If you want them deleted, write to us with the room code and your nickname.

Practice-room texts: they stay private, and we keep them for as long as your account or session exists.

Records connected to payments, including the record of the consent given at checkout: ten years, because Italian tax law requires it.

What you can ask us to do

You can ask for a copy of your data, correction of anything wrong, deletion, restriction of how we use it, and portability, which means receiving your data in a format another service can read.

You can object at any time to processing based on legitimate interest: for example emails about duels and streaks, usage events, or the after-the-fact judging of your Roast Night answers. For emails, the link at the bottom of each one is enough. These are your rights under Articles 15 to 22 GDPR.

Write to privacy@comedyroaster.com. We answer within a month, and we do not charge for it. To make sure the request comes from you, we may ask you to confirm it from the email address linked to your account.

If you think we have handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.

Age

Comedy Roaster is not for people under 16, and we do not knowingly collect data from anyone younger. If we find out that an account belongs to someone under 16, we delete it. If you think this is happening, write to privacy@comedyroaster.com.

Changes

When this policy changes in a way that matters, we update the date at the top and tell registered users by email. Changes that matter are never applied retroactively to data already collected.