osu!
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- The documents do not say who can read your content.
osu! collects account, device, and score data, keeps some public forever, and you them under as-is terms.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, IP, hashed device ID, scores, optional profile info, and error logs.
Read the exact line
Privacy policy
“When registering an account, we store Your username Your email address Your password (bcrypt+salt) Your IP address and country”
Training
They use data to run the game, rankings, anti-cheat, and security, and say they do no ads.
Read the exact line
Privacy policy
“We do not perform any marketing, advertising nor send any unsolicited emails.”
Sharing
Profiles, posts, and scores are public; they say they do not share personal data except payment and ticket vendors.
Read the exact line
Privacy policy
“We do not share your personal data with any third parties. All analytics are hosted in-house.”
Kept
Error logs are usually under a month; ranked maps, scores, and a hashed ID can stay after you leave.
Read the exact line
Privacy policy
“Generally the period of retention for non- data is less than one month, with automatic purge rules.”
Controls
You can edit profile fields in settings; deleting an account means contacting them and waiting days.
Read the exact line
Privacy policy
“You have the option of deleting your account from our service. Please note that this is currently a manual process and may take several days to complete (contact us to file a request).”
Fine print
Service is as-is, they can shut it without notice, and you must cover their legal costs.
Read the exact line
Terms of service
“USER EXPRESSLY AGREES THAT USE OF THE SERVICE IS AT USER'S SOLE RISK.THE SERVICE IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Edit or remove public profile fields
Settings page
Request account deletion
Contact them (manual process; privacy@ppy.sh)
Export account data via the public API
osu! public API
Contact the
privacy@ppy.sh or Dean Herbert, 41 Gregory Street, Wembley, WA, 6014, Australia
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If someone sues them because of how you used the site or what you uploaded, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to and osu!, its parent corporation, officers, directors, employees and agents, from and against any and all claims”
For example, if a beatmap you uploaded leads to a copyright fight, they can ask you to cover their lawyer costs.
They can change or shut down the game without warning and you cannot claim damages for that.
Read the exact line
Terms of service
“osu! reserves the right to modify or discontinue the Service with or without notice to User.osu! to User or any third party should osu! exercise its right to modify or discontinue the Service.”
For example, they could take down a mode you paid a supporter tag for and owe you nothing.
Once you submit a score, the replay can stay public on leaderboards forever.
Read the exact line
Privacy policy
“The scoring portion of this submission includes game replay data and may be displayed publicly in the Global Leaderboards and on your User Profile and can not be deleted or modified.”
For example, a failed run you regret can stay on your profile with no delete button.
They keep a hashed device string after you delete so you cannot make a new account.
Read the exact line
Privacy policy
“after account deletion you may not be able to return to our service. To enforce this, we will also maintain the unique identifying string as mentioned in "Information we collect", even after account deletion.”
For example, if you delete and try to start over, they can still block you on the same PC.
If they change the rules, keeping playing counts as you agreeing, even without a special alert.
Read the exact line
Terms of service
“User's continued use of the Service constitutes: (1) an acknowledgment by User of the STS and its modifications; and (2) an agreement by User to abide and be bound by the TOS and its modifications.”
For example, new limits on chat could apply the next time you log in without a popup.
Forum posts, chat, and maps are treated as public, and ranked maps can lose the delete option.
Read the exact line
Privacy policy
“When posting on the forums, participating in chat or uploading content to our service such as a beatmap, you are expressly publicising all submitted content.”
For example, a ranked beatmap you uploaded can stay for everyone even if you want it gone.
They say they will not run ads or spam you; emails are only for things you asked for.
Read the exact line
Privacy policy
“We do not perform any marketing, advertising nor send any unsolicited emails.”
For example, you should only get mail if you buy something or turn on discussion alerts.
They claim personal data stays with them except named helpers for tickets and payments.
Read the exact line
Privacy policy
“We do not share your personal data with any third parties. All analytics are hosted in-house.”
For example, buying a supporter tag goes through Xsolla or PayPal, not sold to advertisers.
They say the game is not for under-13s and will try to delete data if they find a child.
Read the exact line
Privacy policy
“osu! services are not designed for children under the age of 13. If we discover that a person under the age of 13 has submitted personal information to us without parental permission, we will endeavour to delete the information from our systems.”
For example, if a 12-year-old signs up, they say they will try to remove that account.
They describe basic encryption and limited staff access, but not an independent audit.
Read the exact line
Privacy policy
“We employ HSTS to ensure all sites on our domain are encrypted via TLS and maintain high standards in data security for access to our servers, restricting access to your personal data when we do not need to access it.”
For example, the site is supposed to load only over HTTPS.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- de-identified
- Data with your name and obvious identifiers removed, though it can sometimes still be traced back to you. For example, your chats with names stripped out may still be kept and studied after you delete your account.
- as is
- You get the service in whatever state it is in, with no promise that it works or will keep working. For example, if the app deletes your photos by mistake, it is not promising to fix that or pay you back.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
How we got here · grade B · score 50/100 · 15 of 15 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
They collect account info plus IP, country, a hashed hardware/software ID, scores, and error logs. Optional public profile fields include location and social links.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They say they do no marketing or advertising and host analytics themselves.
Do they sell or share your data, and can you opt out?
They say they do not share personal data with third parties, except named vendors for tickets, merch, and payments.
What rights do they take over what you type and what the AI makes?
You must let them use uploads as the site needs; ranked maps and scores can stay public and undeletable.
How long do they keep your data after you delete it, and can you delete it in the app?
Account deletion is a manual contact request that may take days; some public content and a hashed ID remain.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Your public profile fields can be added or removed from settings; it is a game profile, not an AI memory.
Do they commit to basic security, and have they leaked data?
They describe TLS/HSTS, restricted access, and automatic purges, but not an independent audit.
Is there a real age gate, and are teens protected?
They say the service is not designed for under-13s and will try to delete that data if found; volunteer teams require 18.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated, but the terms say continued use means you accept changes.
Can they close your account without warning, and can you get your data out first?
They can discontinue the service without notice, and violating the terms ends your permission automatically.
If something goes wrong, who pays?
The service is as-is with broad liability limits, and you must indemnify them for claims from your use or uploads.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 1,520 words at a fairly hard level (Flesch reading ease 51.5); the terms are 2,021 words at a college graduate level.
