Privacy Policy

Who is responsible

The data controller is Trust in food snc di Emanuele e Stefano Nozza, Corso Milano 51, 20813 Bovisio Masciago (MB), Italia, VAT 09574370962.

For anything concerning your data — questions, requests, complaints — write to privacy@comedyroaster.com. Our certified address is trustinfood@legalmail.it, which is the formal channel under Italian law.

We have not appointed a Data Protection Officer, because the law does not require one for an operation of this size. Your requests reach the people who actually run the service.

What we collect, and why

If you write a joke without an account, we store the joke, the engine's judgment of it, an anonymous session identifier held in a cookie, and a salted hash of your IP address. That is enough to show you your result, keep a daily limit, and stop one person from running up our model costs from a thousand fresh browser sessions.

If you claim a stage name, we also store your username, your email address, your language, and the numbers that make the game work: your streak, your reputation points, and your badges.

If you take part in duels or in Roast Night, we store your votes, your nickname for that night, and the answers you wrote.

If you subscribe, Stripe handles the payment and we store only what identifies your subscription: Stripe's customer and subscription identifiers, your plan, its status, and its renewal date.

We never store your IP address in readable form, and we never see your card details — those stay with Stripe. There are no passwords to steal, because the service does not use any.

Your jokes are read by a language model

This is the part worth reading twice. When you submit a joke, its text is sent to a large language model, which scores it across six dimensions and proposes a fix. That is the entire product.

Depending on how the service is configured at the time, that model runs either on our own infrastructure — in which case your text never leaves it — or through the API of Anthropic PBC, in which case your text is transmitted outside the European Union under the European Commission's standard contractual clauses. Anthropic processes it to return the judgment and does not use it to train models.

Do not write anything into Comedy Roaster that you would not want processed this way: real names of private individuals, confidential information, or anything you would not say on a stage.

Where your jokes end up

Jokes written for the daily challenge are public by design. They can appear in duels, on leaderboards, and in the permanent archive of past challenges, which search engines index.

Two things are not public: what you write in the practice room, which is visible only to you, and what you write during a Roast Night, which stays inside that private room and is never indexed.

On what legal basis

Running the game — your account, your jokes, the judgments, your subscription — is the performance of a contract with you, under Article 6(1)(b) GDPR.

Hashing IP addresses to cap abuse and control model costs rests on our legitimate interest in keeping the service alive, under Article 6(1)(f). We use a hash rather than the address itself precisely to limit the intrusion.

Keeping records of payments is a legal obligation under Italian tax law, Article 6(1)(c).

Aggregate, cookieless usage measurement rests on our legitimate interest in knowing which parts of the service work.

Who else touches your data

We use a small number of providers, each acting as a processor on our instructions: Vercel Inc. for hosting, Neon for the database, Stripe Payments Europe Ltd. for payments, Resend for the one transactional email we send, PostHog on its European infrastructure for usage measurement, and Anthropic PBC for judging, when that configuration is active.

We do not sell your data, we do not share it for advertising, and there are no advertising or social media trackers on this site.

How long we keep it

Your account and everything attached to it stay for as long as the account exists. Ask us to delete it and we will.

Jokes published to the daily challenge are part of a public archive that is meant to be permanent. If you ask for deletion we remove the link between those jokes and you; tell us if you want the text taken down as well, and we will remove it.

Records connected to payments are kept for ten years, because Italian tax law requires it.

Hashed IP addresses are stored alongside the submission they belong to. They are only ever read to count the current day.

We do not currently delete Roast Night rooms automatically. If you want a night's contents removed, ask.

What you can ask us to do

You can ask for a copy of your data, correction of anything wrong, deletion, restriction of how we use it, or portability, and you can object to processing based on legitimate interest. These are Articles 15 to 22 GDPR.

Write to privacy@comedyroaster.com. We answer within a month, and we do not charge for it.

If you think we have handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.

Age

Comedy Roaster is not for people under 16. We do not knowingly collect data from anyone younger. If you believe a child is using the service, write to privacy@comedyroaster.com and we will remove the account.

Changes

When this policy changes in a way that matters, we update the date at the top and tell registered users by email. Changes that matter are never applied retroactively to data already collected.