Privacy policy

Last changed November 9, 2026.

bad taste (badtaste.app) is a game made by pop.in. This page says what bad taste keeps about you, what it does with it, and how to have it deleted. Questions go to alex@smiletime.com.

What bad taste keeps

• Your name tag: the name you type and the face you pick from ours.
• The movies you make: your table's pitch, your credit on the movie, its poster and trailer, and what you do on the site, like plays, calls, backings and shares.
• If you connect YouTube: your channel's id, name and handle; the sign-in Google gives bad taste, kept encrypted; and your videos on bad taste's movies (the ones it posts for you, and any you added by link): their id, link, when they went up and who can see them, and their views, likes and comment counts over time.
• Earlier connections: players could connect TikTok or Instagram before bad taste posted only to YouTube. Those connections keep the same kinds of data, and Disconnect on your record ends them and deletes their sign-in.
• Cookies and your browser's storage: to keep you signed in on this browser, to remember the password or the friend's link you came from (that one for a day), to hold a movie you made until it's credited to you, and to finish a YouTube connect. No ads and no tracking cookies.

YouTube

bad taste uses YouTube API Services. With your permission, it uploads a movie's trailer to your YouTube channel as a Short, and only when you tap Post to YouTube. The button names your channel and says who will see the video before you tap it, and you can change the title and who sees it first. bad taste reads your channel's name, and the views, likes and comment counts of your videos on its movies, so their views count toward the movie's box office.

Your posted videos' links and view counts show on the movie's page to anyone who can open it. Your channel's name shows only to you, on your record.

YouTube's own use of your data is covered by the Google Privacy Policy. bad taste's use and transfer of information it receives from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who else sees it

• Google, when you post to YouTube: the video, its title, description and who can see it go to your channel.
• The AI services that make the movie: what your table types goes to OpenRouter (which passes it to models from Google, Black Forest Labs and OpenAI), to Cloudflare's own AI models, and to Popcorn, which makes the trailer. Your YouTube data never goes to them.
• Cloudflare, which runs bad taste and pop.in's games and stores their data.
• Datadog, where pop.in's games can send their logs, which can include what a table typed.

bad taste doesn't sell your data, shows no ads, and lets no one else put content or ads on its pages.

How bad taste protects it

• In transit: every page bad taste serves, and every call it makes to Google, goes over HTTPS (TLS). A plain http address is sent on to https, and browsers are told to use only https for badtaste.app.
• Your Google sign-in: the access and refresh tokens Google gives bad taste are encrypted (AES-256-GCM) before they're stored, with a key derived from a secret kept in encrypted secret storage, never in bad taste's code or its database. They're never shown on a page, put in an address or written to a log, and they're used only for the uploads and reads this page describes.
• Where it's stored: your name tag, your Google sign-in and your YouTube data are kept in bad taste's own database on Cloudflare, which only the site and the people who run bad taste can reach. A movie's poster, trailer and the names its writers played under are files pop.in's game keeps for the movie's page, and anyone with a file's address can open it.
• Signing in to bad taste: the cookie that keeps you signed in is signed, so it can't be forged, and it's never readable by the page's scripts or sent over plain http. One-time links, like the one that credits a movie to you, are kept only as a hash.
• Only what's needed: bad taste asks Google only to upload videos and to read your YouTube account, keeps only the YouTube data listed above, and uses it only as this page says: never for ads, never sold, and never used to train AI models.
• Deleted when you're done: Disconnect deletes the sign-in at once and asks Google to end bad taste's access, and an email deletes the rest within 7 days (below).

Taking it back

• Disconnect YouTube on your record. bad taste deletes its sign-in at once and asks Google to end its access.
• Or remove bad taste on Google's security settings page. bad taste can't use your account after that.
• Delete everything: email alex@smiletime.com with your name tag's name. bad taste deletes your name tag and everything kept under it, your YouTube data included, within 7 days, and replies when it's done.
• Videos already on your channel stay there until you delete them in YouTube.

Changes

When this policy changes, this page says so with a new date.