Privacy, and what the microphone actually does

Friendly Fire Department is a game about accusing your friends out loud, so it listens to you. This page is what that means in practice, written plainly, because "the game uses your microphone" is a sentence that deserves more detail than it usually gets.

The short version: when you hold the talk key, the other players hear your voice, and a transcript of it appears over your character's head. The audio goes to them and to nobody else — not to us, not to any server we run, and never to disk. There is no account, no recording, and nothing kept after the moment you stop speaking.

What happens when you hold the talk key#

The microphone is push-to-talk. It is not listening in the background, and it is not open between rounds — you hold a key, and it opens; you let go, and it closes.

Two things then happen to the same audio, and it really is the same audio — the game captures one stream and uses it twice.

The other players hear you. Your voice is cut into twentieth-of-a-second pieces, compressed, and sent to the room as you speak. Nothing is stored up and uploaded afterwards; when you let go of the key, the sending stops.

And it is turned into text, on your own machine. The game keeps the last six seconds of audio in a small fixed buffer in memory. It is a ring: once it is full, new audio overwrites the oldest, so nothing accumulates and nothing grows. When you let go, that buffer is handed to a speech recogniser running inside the game, on your own computer, which turns it into a line of text that appears over your character's head. The buffer is then reused for the next time you speak.

There is no server involved in the recognition, no API call, and no upload.

Nothing is written to disk. The audio exists only in memory, only while you are speaking, and only for as long as it takes to send it and transcribe it.

Where your voice actually goes#

To the other players, through the relay you or one of your friends is running. A room is hosted by somebody in the game — there is no service of ours in the middle. If you host the room yourself, the audio goes from the people playing with you, to your machine, and back out to them.

Who can hear you also depends on where you are standing. While a round is being played, your voice carries about as far as the speech bubble over your head does, and it does not carry through floors. During the vote at the end, everybody hears everybody — that argument is the point of the game.

The connection is encrypted — with two honest limits#

Everything between your game and the relay is encrypted, so somebody on the same cafe wi-fi, or anywhere else along the way, can see that you are playing and how much you are sending, and nothing else. Each connection gets its own keys, which are thrown away when it ends, so a recording of today's game cannot be decrypted later, even by somebody who takes the relay's computer.

Two limits, because you should know them:

• The relay itself decrypts messages to pass them on. It has to, to know who they are for. So whoever runs the relay could read them — which is why hosting it yourself, or playing on a friend's, is the most private way to play.
• Somebody already in the middle of your connection at the moment you join could pretend to be the relay. Encryption stops people listening in, but on its own it cannot prove who is on the other end. We are working on that.

Why we can say this rather than just promise it#

The recogniser is whisper.cpp, which runs locally, and the model it uses is a file that ships with the game. Both are listed on the credits page with their licences. The transcription genuinely happens on your machine: there is no network path in the speech code for the recogniser's input to take, and no API key to find, because there is no service to call.

You can watch the rest from outside. The game talks to exactly one address — the relay you or your friends are hosting — and nothing else. There is no analytics endpoint, no crash reporter and no second connection to us, because there is no "us" in the loop at all.

The browser version never opens the microphone#

If you play in a browser, the game never asks for microphone permission and never opens a capture device. You will hear everyone else; they will not hear you, and there is no speech-to-text either. Quick chat is the whole of what you can say.

That is a real limitation rather than a privacy feature we are dressing up as one. A browser tab is a listener. We would rather say so plainly than have you hold the talk key and wonder why nobody answered.

Silence stays silent#

Speech recognisers do not return an empty result for silence — they tend to invent something, and usually the same few things. A game where holding the talk key in a quiet room puts a polite "Thank you." over your head is a game with a bug in it.

So there are two checks. Audio that is too quiet is never submitted at all, and a result that looks like an annotation rather than a sentence is discarded. Holding the key in a quiet room produces nothing.

This costs something real and it is worth being honest about: if you genuinely say "thank you" and nothing else, you will sometimes get nothing. We would rather drop a real line occasionally than put words in your mouth.

The three settings, and what each one does#

The options screen has a parental mode with three positions. The wording below is the wording the game itself shows you, because the screen and this page should not be able to disagree.

PREBAKED never opens the microphone. That is the mode's promise, so it is enforced where the audio would be captured rather than being a label on a screen — the device is not opened, so there is nothing to capture. In that mode you communicate with the canned quick-chat phrases only, and other players' free-typed text is hidden from you as well.

There is also a plain microphone off switch, and a filter for strong language that applies to text from anyone.

Muting somebody#

Muting is a fact about your copy of the game and nothing else. It is not sent to the room, the other players are not told, and the person you muted cannot find out. It changes nothing about how the game plays for anybody else.

What we collect#

Nothing. The game has no analytics, no telemetry, no crash reporting and no account. It does not phone home, and there is no "us" in the connection at all when you are playing on a server you or a friend is running.

The only thing that crosses the network is what the game needs to keep everyone's fire burning in the same places: your inputs, the chat text you chose to send, and the name you gave yourself.

If something here is wrong#

This page describes the code as it is built. If you find a way in which it does not, that is a bug of the most serious kind and it will be treated as one.