Privacy

Privacy Policy

Effective October 7, 2026

Show & Tell is a daily photo game you play with your AI assistant. It's run by Inception Agents, Inc., a Delaware corporation ("we", "us"). This policy covers the game's website at playshowandtell.com, its connector (the MCP server at https://playshowandtell.com/mcp), and its API.

The short version

• We never receive your photos. They go to your AI assistant, like any other photo you send it. We only get your AI's guesses.
• No account needed. You get a random player code like brave-otter-4821. If you want one streak across assistants, you can save it with a passkey or Google. Either way, we never ask for your name, email, phone number, or password.
• No ads, no selling, no AI training. We don't sell or rent your data, share it with advertisers, or use it to train AI models.
• Easy deletion. Email support@playshowandtell.com with your player code and we'll delete your game records.

What we collect

When you play through your assistant

Your assistant calls our game tools for you. It sends us only what those tools ask for:

• Your player code, which we generate at random the first time you play.
• Your timezone, so the word changes at your local midnight.
• The name you call your AI (for example "Boo") and which assistant it runs in (for example "Claude" or "ChatGPT"). The assistant is your team.
• Each guess, plus an optional one-sentence description your AI writes about what it saw in your photo. The photo itself is never sent.
• Fouls, the hints you chose to use, the time of each move, and your streak and score history.

We don't receive your chat history or anything else from your assistant. Your conversations are covered by your assistant provider's own privacy policy (for example Anthropic's, OpenAI's, Google's, Meta's or xAI's).

When you reveal your secret word

Your word appears on a private page, or behind the Hold to reveal button on the in-chat card. To show you afterward whether anyone else saw your word (the fair-play check), each reveal records:

• A random device ID kept in a cookie on the private page, or for the in-chat card a code derived from your browser's user agent.
• Your browser's user agent (its type and version).
• A one-way, salted hash of your IP address. We don't store the IP address itself.
• The time of the reveal.

If you save your streak (optional)

Every player code has a basic account record that holds your timezone and which player codes belong to it. "Save your streak" on your private word page adds a passkey or Google sign-in to it, so codes from different assistants can share one streak. Playing as a guest works the same without it. When you save, we store:

• Passkey: the passkey's credential ID and public key, a signature counter, the connection types your device supports, and when it was created and last used. Face ID, Touch ID and other biometrics stay on your device; we never receive biometric data.
• Google: we ask Google only for the openid scope and store Google's stable ID for you, not your name, email, or photo. Signing in with Google happens on Google's pages, under Google's privacy policy.

If your assistant connects with sign-in

Some assistants connect through our sign-in address (/mcp/auth). Tapping Play there creates a player code, on your saved account if you're signed in, and gives your assistant a token for that code. We don't store these tokens; your assistant keeps them.

When you visit the website

Our hosting provider, Cloudflare, processes standard request data (IP address, browser, the page requested) to serve the site and protect it from abuse. We keep these request logs for a few days to fix problems. We don't use analytics or advertising trackers.

When you share your score, the share page makes the video and image on your own device. Nothing is uploaded to us.

What we don't collect

Photos, names, email addresses (unless you email us), phone numbers, contacts, precise location, payment details, passwords, or biometric data.

How we use it

• To run the game: keep your word secret, score guesses, track streaks, and show your share grid.
• To run the fair-play check and stop cheating and abuse.
• To improve the game, for example finding words that are too hard or scoring that feels wrong.
• To publish aggregate stats that can't identify anyone, such as "Claude players solved today's word in 3.2 shots on average."

Who we share it with

• Service providers that run the game for us: Cloudflare, for hosting, the database and request logs. It processes data only to provide its service.
• The law: if we're required to by law, or to protect the safety of players or the public.
• A buyer: if Show & Tell or Inception Agents, Inc. is sold or merged, this policy continues to apply to your data.

We don't sell your personal information or share it for targeted advertising.

Cookies

All our cookies are our own (first-party) and can't be read by scripts on the page. None are used for tracking or advertising.

• st_dev: a random device ID on your private word page, for the fair-play check. Kept for a year.
• st_session: which account you're signed in to, signed so it can't be forged. Set only after you sign in, kept for a year, and cleared when you sign out.
• st_passkey: a one-time challenge that lasts five minutes, only while you sign in with a passkey.
• st_google: lasts ten minutes, only while you sign in with Google, to keep that sign-in secure.

How long we keep it

We keep game records while your player code is in use, so your streak and history keep working. A saved account, with its passkey or Google link, is kept until you ask us to delete it. Cloudflare's request logs are deleted after a few days. You can ask us to delete your records at any time.

Your choices and rights

• Stop playing any time by disconnecting Show & Tell from your assistant.
• See or delete your data: email support@playshowandtell.com with your player code. If you saved your streak, any one of your codes covers every code linked to your account. We'll reply within 30 days.
• Depending on where you live (for example in the EU, the UK, or California), you may have more rights, such as correcting your data or objecting to how we use it. Email us to use them, and you can also complain to your local data protection authority. We process game data because it's needed to provide the game you asked to play, and fair-play and log data for our legitimate interest in keeping the game fair and secure.

Children

Show & Tell is for people 13 and older. It isn't directed at children under 13, and we don't knowingly collect their personal information. If you think a child under 13 has played, email us and we'll delete their records.

Security and where data lives

Everything travels over HTTPS. IP addresses are stored only as salted hashes, and the word calendar is protected by a secret key. Cloudflare may process data in the United States and other countries where it operates.

Changes

If we change this policy, we'll update the date at the top. If a change materially affects how we use your data, we'll say so on the homepage before it takes effect.

Contact

Inception Agents, Inc. · support@playshowandtell.com