Last updated: 10 October 2026 · Version 2026-10-10
This is the privacy notice and the terms of Prisma Photo Roulette, Prisma's photo guessing
game in the app library. On first sign-in you confirm, with a separate tick, that you have read
it and agree to play as described here.
In short: nothing leaves your gallery without your approval. Before a
game the app proposes a few random photos or short videos from the albums you have not hidden;
only you see them, and only what you approve is sent. What is sent is
end-to-end encrypted on your phone: the key exists only on the phones of the players
in the room. The server and its operators cannot open or see your photos and videos, during the game
or afterwards. The encrypted data lives in memory only and is deleted as soon as it is done with.
1. Controller
The controller is PRISM Creations Ltd. Reach us by messaging
@administration in Prisma.
2. Signing in
There is no separate sign-up: you use your Prisma username and password. The password goes
only to Prisma's Matrix server; the Photo Roulette server never sees it. The Prisma session
opened at sign-in is closed as soon as it has proved who you are. The game's own session token
is stored on the server only as an irreversible hash (SHA-256).
3. Gallery access
The app asks for Android's permission to read photos and videos (on Android 14 and later you can
allow selected ones only). Documents and other files are not read. You can stop your videos from
coming up in the settings.
Your album list, photo list and hidden albums are processed on your phone only
and never sent to the server.
Nothing from an album you hide is ever proposed.
Approval: before a game the app proposes a few random items from the albums you
have not hidden. The proposals and their previews are made on your phone and shown on your screen
only; at that point nothing has been sent. Swap or remove any you do not want, or send none at all.
Only what you approve with "Approve and send" is sent; nothing else is ever asked of your phone
during the game.
An approved photo is scaled to at most 1600 pixels and re-encoded on your phone, which drops its
EXIF data (GPS position, device model, date taken). An approved video is re-encoded to at most 15
seconds and 720p, and only its picture and sound tracks are copied into a new file; location, device,
title and all other metadata are dropped.
4. End-to-end encryption
In the lobby each phone makes a key pair (EC P-256) for that room alone and shares its public key.
When the game starts, the host's phone makes a random room key and encrypts it separately for each
player (ECDH + HKDF-SHA256 + AES-256-GCM). The server never sees the room key; it only carries the
copy encrypted for each player.
Every photo, video and preview is encrypted on your phone with the room key (AES-256-GCM) before it
is sent. The server knows only the encrypted data, its size and whether it is a photo or a video; it
cannot open it. So neither the server's operators, nor a backup, nor anyone breaking into the server
can see your photos and videos - during the game or afterwards.
Room security code: in the lobby and before the game everyone's screen shows a
12-digit code computed from all players' public keys. If it is the same for everyone, no other key
(the server's included) was slipped in. Compare it when you play side by side.
When opening data from the server, phones also check which room and what kind of item it belongs
to; anything altered or from another room does not open and is not shown.
Screenshots and screen recording are blocked in the app. Someone could still photograph the screen
with another device; we cannot technically prevent that.
5. What we process
Data
Why
Legal basis
Kept
Your Prisma ID and username
Recognising your account; showing your name to the players in a game
Performance of contract
Until you delete your account
Your 6-digit code
So that others can invite you
Performance of contract
Until you renew it or delete your account
Photos and videos you approve (encrypted only; the server cannot see their content)
Showing them to the players in the room, in the pool before the game and in the rounds
Explicit consent (the first sign-in tick, and your approval before sending in every game)
Memory only; deleted as soon as their round ends, they are excluded, you leave or the game
ends (4 hours at the very most). Never written to disk, backed up or logged.
Your public key for the room and the room key encrypted for you
End-to-end encryption
Performance of contract
Deleted when the game ends or you leave
Rooms, invitations, guesses and scores
Playing the game
Performance of contract
Deleted a day after the game ends
People you block
Stopping them from inviting you again
Legitimate interest
Until you delete your account
IP address
Rate limiting against abuse
Legitimate interest
In memory, a few minutes
6. Who sees what
Only the players in that room see the photos and videos you approve: in the pool before the game,
without owners; in a round, with the owner revealed after the guessing. Any player can exclude any
item from the pool; it is deleted from the server for everyone at once.
Nobody at Prisma, server operators included, can see the content (see section 4). Still, hide any
album with photos or videos you would not want to share.
Only players in the same room, and people you invite, see your username. There is no search
by username.
Your data is not shared with third parties or sent abroad; the server is Prisma's own.
7. Your rights
You can delete your account in Settings; your code, scores, blocks and game records are
erased at once and for good (your Prisma account is not affected). Deleting the account also
withdraws your consent. For anything else, message @administration.
8. Terms
Photo Roulette is free.
Keep on only albums with photos and videos that are yours or that you may share. Hiding albums with
explicit, violent or unlawful content, or content that intrudes on someone else's privacy, is
your responsibility.
Saving, sharing or otherwise using photos or videos you see in a game is not allowed.