Privacy, before play.

Website and waitlist information

When you visit, the hosting provider processes technical information needed to deliver and secure the site, such as your IP address, requested page, browser information, and request time. The site does not contain advertising scripts, analytics trackers, Instagram embeds, or an Instagram upload form. It does not set application cookies or store information in your browser.

If you join by email, we receive your email address, display name if supplied by your email service, message, and ordinary email metadata. We use this information to keep the Busted waitlist and send the availability updates you request. Clicking the email link alone does not register you: you must send the message. You can withdraw permission for updates at any time by replying “remove me”.

If you send a support, privacy, or security request, we use your contact details and the information you choose to send to respond, investigate, and resolve the issue. Please do not send passwords, tokens, full Instagram exports, or unnecessary personal information.

Who receives that information

Lahta LLC handles waitlist and correspondence information. Website hosting and email service providers process information as needed to deliver those services. We do not sell or rent personal information, share it for cross-context behavioral advertising, or use waitlist emails for unrelated advertising.

We may disclose information where required by law or where necessary to protect people, investigate abuse, or establish or defend legal claims. External links and your chosen email service are governed by those services’ own privacy practices.

Retention

• Waitlist: until you leave, the waitlist closes, or 12 months after your most recent request to remain on it, whichever comes first. We will ask you to opt in again if we continue the waitlist beyond that period.
• Ordinary support and waitlist correspondence: up to 12 months after the request is resolved. If you request deletion, we remove personal information earlier unless a legal or security reason requires limited retention.
• Security reports: for as long as necessary to investigate and address the issue, and to retain a proportionate record of the resolution. We minimize personal information in that record.
• Hosting logs and provider backups: retention depends on the hosting or email provider’s service settings. Contact us for the applicable provider details. This website does not maintain a separate visitor analytics database.

We aim to complete verified deletion requests within 30 days. Residual provider backups may persist until their normal expiry; limited information may be retained where necessary for legal obligations or active claims.

The local development prototype

The current prototype can process JSON files that a tester selects from their own Instagram export, containing liked and saved posts. These may include post links or identifiers, interaction dates, creator information supplied in the export, and a record of whether an item was liked or saved. The prototype uses these records to show and filter the tester’s activity.

Imported records are stored on the device. The prototype does not upload those records to a Busted server or retain a separate copy of the original JSON files. Its live connector is unconfigured and makes no authorization or transfer requests. A local session credential is stored in the device Keychain; imported records use iOS file protection and are excluded from device backups by the app.

Use Disconnect and delete imported data to remove the prototype’s stored records and session. Your original export files and source Instagram account remain unchanged. Local diagnostic information is available for development; if you choose to send a report to us, it is handled as correspondence.

If you choose to load a public Instagram embed or open an Instagram link from the prototype, your device contacts Meta. Meta may receive your IP address, device information, the requested post, and interactions, and may use cookies or similar technologies. Read the Meta Privacy Policy. This website itself does not load Instagram embeds.

What we plan to build

Busted’s planned multiplayer game lets friends guess who liked a Reel or post. We intend to support user-authorized imports of the player’s own Instagram activity, including review of liked and saved posts where supported. Using saved posts in gameplay would require a separate explanation and permission. Provider access and approvals remain prerequisites.

Before new features collect information, we will explain the transfer source and any intermediary, requested data categories, processing locations, providers, retention, and deletion controls. We will request permission for importing activity and separately explain and obtain permission for revealing it in gameplay. The planned game may need player identifiers, room codes, participating players, selected posts, guesses, scores, and results to coordinate a session.

Gameplay would reveal the activity used in a round to the people playing with you. A private Instagram account does not prevent that disclosure. Other players could remember, copy, or record what they see; later deletion cannot erase copies they make independently.

We do not ask for your Instagram password. The intended game does not require direct messages, contacts, or precise location. We do not plan to sell Instagram activity, use it to target advertising, or build profiles of sensitive characteristics. We will not treat this notice or waitlist membership as permission to import or share your Instagram activity.

Sharing with third parties

Current website and prototype. Vercel hosts this website and processes the technical request information needed to deliver and secure it. Our email provider processes waitlist messages, support correspondence and security reports. The local prototype does not upload imported Instagram activity to Lahta or a Busted hosting provider. Loading an Instagram embed or opening an Instagram link sends the request information described above to Meta; it does not send Meta the complete imported activity list.

Planned multiplayer service. With your permission, the participants in your game will see your player name, the post or Reel used in a round, its association with you when the answer is revealed, and relevant guesses and results. We will not make your imported activity list publicly searchable or share the entire list with other players. People in a room can independently copy or record information they see.

We plan to use service providers for app hosting, database storage, authentication and necessary technical operations. Where server processing is needed, these providers will process only the player, imported-activity and game information necessary for their role, under agreements requiring confidentiality, appropriate safeguards and processing on our instructions. Any transfer intermediary and the requested data categories will be identified before authorization. The providers and processing arrangements will be disclosed before live imports begin; no live import backend is operating today.

We do not sell or rent personal information or share it for cross-context behavioral advertising. We will not give imported Instagram activity to advertisers or data brokers. We may disclose limited information if required by law or necessary to protect people or establish or defend legal claims. If Busted changes ownership, personal information may transfer to the new operator subject to applicable protections and notice requirements.

Imported-data retention and deletion

Current local prototype. Imported records remain on your device until you use Disconnect and delete imported data, replace the dataset with a new import, or remove the app’s stored data. There is no automatic time-based expiry in the prototype. Selecting a new manual dataset replaces the previous one. The app reads the selected JSON files without retaining a separate original-file copy; the files you selected remain under your control. Lahta does not hold server copies of these imports.

Retention commitments for the planned live service. The following rules will apply before we enable server-based imports or multiplayer play. They are requirements for the service we are developing, not claims that a live backend already implements them:

• Imported activity library: retained while you choose to keep it available, until you remove it, withdraw permission for its use, or delete your account. There is no separate fixed expiry while you keep the library active. A deletion request or consent withdrawal stops its use in future games and triggers deletion from active systems within 30 days of verification.
• Original transfer files: temporary copies will be deleted after processing finishes or fails; the service will retain only the normalized records needed for the features you chose.
• Live game-session copies: room codes, individual guesses and votes, and copies of imported activity used in rounds will be deleted from active session storage within 24 hours after the game ends or the room becomes inactive.
• Saved results, if offered: scores and game history will remain until you delete them or your account. Saving results will not extend the 24-hour retention of individual guesses, votes or session copies of Instagram activity.
• Deleted imported data in server backups: will expire within 90 days after deletion from active systems. Backup access will be restricted, copies will not be used for ordinary operations, and deletions will be reapplied after a restoration.

Any exception for a legal obligation or active legal claim will be limited to information necessary for that purpose, kept separately from ordinary use and deleted when the requirement ends. The website and correspondence retention periods above apply separately; the planned 90-day backup limit concerns the future app’s server data.

You can request deletion or withdraw permission by emailing founders@lahta.co. Future account-based features will also provide in-app deletion controls. We may request proportionate information to verify ownership, but never your Instagram password. Revoking a provider connection alone does not erase previously imported records. Deleting information from Busted does not change your Instagram likes, delete your Instagram account or remove copies made independently by other players. See step-by-step deletion instructions.

How we protect information

Current website. The public website uses HTTPS/TLS to encrypt traffic between your browser and the host. It does not accept Instagram uploads, contain an account database, or load third-party analytics scripts. Its content security policy restricts loaded resources and prevents other sites from framing the pages; additional headers restrict camera, microphone and location access. These controls reduce exposure but do not make a site immune to vulnerabilities.

Current prototype. Imported records are stored in the app’s local storage using iOS file protection and marked as excluded from backups. The local session credential is kept in the iOS Keychain with a device-only accessibility setting. The original export is read only when you select it, and the app provides a control to delete its stored records and credential. Device security still depends on your device settings and operating system.

Before live imports or multiplayer launch, we will require HTTPS/TLS for transfers to our services; encryption at rest for server-held imported activity; access limited to authorized staff and providers with a specific operational need; multi-factor authentication for administrative accounts; and separation of secrets from public application code. We will restrict game access to its participants, exclude raw exports and complete activity lists from diagnostic logs, maintain security updates, and implement the deletion and backup rules above. These are launch commitments: a live backend and its controls have not yet been deployed or independently audited.

No system can guarantee absolute security. Please report concerns using our security reporting page. Do not include passwords, access tokens or full exports in an initial email report.

Your choices and rights

You can leave the waitlist, withdraw consent, or request access, correction, deletion, or a portable copy of your personal information by emailing founders@lahta.co. Depending on applicable law, you may also request restriction of processing or complain to your local data protection authority. You may object to processing based on legitimate interests where applicable law gives you that right.

Withdrawing consent does not change the lawfulness of earlier processing. We may request proportionate information to verify your request and will respond within the period required by applicable law. We do not penalize you for exercising applicable rights. See deletion instructions for the waitlist and local prototype.