1. Scope
This policy covers the rivlet.app website, the Rivlet app for iOS and Android, and the servers that run them.
2. Controller
The data controller is Dawid Bytys, address: Przemiarki 24/13, 30-384 Kraków, Polska.
Rivlet is a project developed by individuals, not an incorporated company. For privacy matters, write to the address below. We have not appointed a data protection officer.
3. What data and why
Profile
Nickname with its number, avatar (including an uploaded photo, stripped of metadata), optional country, the device's time zone. The nickname, avatar, country and game statistics are public: other players and anyone with your profile link on rivlet.app see them. Basis: contract (Art. 6(1)(b) GDPR).
Account
E-mail address, or a Google or Apple sign-in identifier, to sign in and keep progress across devices. Basis: contract.
Gameplay
Results, experience points, streaks, achievements, daily puzzles and what you type in rooms. Other players see results and rankings. Basis: contract.
Friends and invitations
Friend requests, your friends (who see your latest completed game) and room invitations. Their notifications carry the sender's nickname. Basis: contract.
Safety and moderation
Reports, blocks, suspensions (the reason for a suspension is public on the profile), proof that the app runs on a real device, short-lived request limits by IP address, server logs, and reports when an app update fails to start. Basis: our legitimate interest in a secure service (Art. 6(1)(f)).
Product analytics
App and server events under a random profile identifier, without e-mail or nickname, to understand how the game is used. Basis: legitimate interest (Art. 6(1)(f)); you can object.
Push notifications
A device identifier at our push provider. Basis: your consent, given in the system settings and the app.
Contact form and waitlist
Name, e-mail, message, IP address and browser; the forms check that a person is filling them in. Basis: answering you (Art. 6(1)(f)); the waitlist: consent (Art. 6(1)(a)).
Website analytics
Google Analytics 4, only after you accept analytics in the cookie banner. Basis: consent (Art. 6(1)(a)).
4. Device storage and cookies
The app keeps sign-in data in the system's secure storage, plus settings and a queue of analytics events, on your device.
The website stores your cookie choice for 12 months. Google Analytics cookies (_ga) are set only after consent, which you can change at any time with Cookie settings in the footer. We use analytics only, never advertising or remarketing.
5. Recipients
Providers process data on our instructions: hosting in Germany and Poland; network, abuse protection and file storage in the EU; product analytics on EU servers; push notifications; delivery of sign-in e-mails; and the team's e-mail.
Sign-in with Google or Apple is handled by those companies as separate controllers. Google Analytics on the website is provided by Google Ireland Ltd.
We give the current list of providers on request. We do not sell data or share it with advertisers. We disclose data to public authorities only when the law requires it.
6. Transfers outside the EEA
Our servers and databases are in Germany and Poland. Some providers are US companies; transfers to them rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We give details on request.
7. How long we keep data
- Profile, account, progress, friends: until you delete the account.
- After deletion, match results stay as "Deleted player", and so does the moderation record, on our legitimate interest: they are other players' history too and evidence in abuse cases.
- Uploaded photo: gone within about 2 hours of changing the avatar or deleting the account. Room invitations expire with the room.
- Sign-in codes: up to 24 hours. Sessions: up to 90 days.
- Backups: encrypted, stored in the EU and deleted after 30 days. Data you delete disappears from them when they expire.
- Server logs and update failure reports: 30 days.
- Product analytics: up to 7 years; erased within about 8 days of deleting your account.
- Contact messages: as long as needed to handle the matter, at most 24 months after the last message. Waitlist: until you withdraw consent, or 12 months after the app launches.
- Google Analytics: 14 months. Cookie choice: 12 months.
8. Your rights
You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting earlier processing.
Delete your account in the app (Menu → Profile → ⋯ → Delete account) or as described on the account deletion page at rivlet.app/delete-account. For anything else, write to the address below; we reply within a month and may ask only for what we need to confirm it is you.
You can lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) or your local supervisory authority.
9. Children
Rivlet is for people aged 16 and over. If someone younger uses it, write to us and we will delete the profile.
10. Automated decisions
We make no solely automated decisions with legal or similarly significant effects. Scores, rankings and streaks are game mechanics.
11. Security
Connections are encrypted, one-time codes and tokens are stored only as hashes, sessions are short, backups are encrypted, and access to the admin panel is restricted and logged.
12. Changes
The current version is published here with its date. We announce material changes in the app or on the website.