Słowidok privacy policy

1. Data controller

The controller is Dark Fox Kamil Kmetyk, address: Biała Góra 107, 97-505 Dobryszyce, Polska. General contact: kontakt@darkfox.pl. Privacy requests: kontakt@darkfox.pl.

2. Data we receive

Email accounts use an email address, player name, password hash and session data. An optional avatar contains the image you upload. We do not receive your Google or Apple password.

External sign-in provides a verified provider identifier and data shared by that provider, such as a name or email. Apple may provide a relay address; a gaming profile may provide no email.

Technical data necessary for connectivity and security can include IP addresses, request times, errors and session information. Once gameplay launches, round identifiers, answers and validated scores are also processed. A notification token is used for notifications if that feature is enabled.

The described game features do not require your home address, GPS location or access to contacts.

3. Purposes and legal bases

Accounts, authentication, gameplay and scores provide the service you request — GDPR Article 6(1)(b).

Account protection, spam and cheating prevention, support and the establishment or defence of claims serve the operator’s legitimate interests — Article 6(1)(f). Legal obligations rely on Article 6(1)(c).

Optional website analytics relies on consent — Article 6(1)(a). Accepting the terms and acknowledging this policy do not constitute consent to analytics or marketing.

4. Guests, rankings and suggestions

Personal guest history and accumulated points are stored on the phone. The server assigns a random installation identity and stores document acceptance records and technical round, answer and score records for validation and abuse prevention. These records are not a public profile or a backup for restoring local history after uninstalling the app.

Rankings show signed-in players only, using their name, avatar and relevant scores. Email addresses, session tokens and identity proofs are not public ranking information.

Only signed-in players may submit word suggestions. We associate a report with the account, photo and language for moderation, deduplication and spam prevention. Authors are not shown publicly. Moderation also stores an account ban reason and duration, revocation and the administrator or moderator responsible. The reason and end date are shown to the account owner, without disclosing them in public rankings. History does not publish lists of suggestions.

5. In-app ads and iOS permission

We are configuring Google Mobile Ads and Google UMP for fullscreen advertising and privacy choices. Production ads require services configured for Słowidok. UMP presents the appropriate form depending on region and settings. Required privacy options can be reopened in the app settings.

On iOS, App Tracking Transparency permission is separate from accepting the terms. Refusing does not block the game. Without permission, we do not use IDFA to personalize ads. At your request, the app settings can display and copy the available IDFA; this readout is not stored in the game database or its logs. It does not constitute consent to website analytics.

6. Website cookies and analytics

Essential session and CSRF mechanisms operate the website and secure the panel. Session duration depends on the browser and server settings.

Your analytics choice is kept in localStorage as slowidok.privacy.v1 for 180 days. Change it with “Cookie settings” in the footer. Clearing website data also clears this choice.

The website is configured for Google Analytics 4 (measurement ID G-5Q483ES3Z7). It runs only after you consent. We do not load its script without consent. Withdrawal disables further analytics and does not affect the lawfulness of processing before withdrawal.

If activated, analytics may receive browser identifiers, page views, device and interaction information. We do not send email addresses, passwords or game answers to GA. The analytics provider and retention settings must be specified before activation.

7. Providers and international transfers

Hosting and infrastructure: [to be completed by the operator]. Server, email and support providers may receive data needed to deliver their services. Authorities may receive data where required by law.

Google and Apple participate in the authentication or gaming services you select, under their own privacy policies. New analytics, advertising or other SDKs require updated provider and data disclosures before activation.

Before using a service that transfers data outside the EEA, the operator must identify the destination and applicable safeguard, such as an adequacy decision or standard contractual clauses. Details depend on the providers actually selected.

8. Retention

Account data is needed while the account is maintained. Following a deletion request, it is deleted or anonymised except where needed for a legal obligation, a dispute or a specific abuse investigation.

Planned durable historical scores do not justify indefinite public identification. Account deletion must separate identity data from scores required for auditing.

Technical log retention: [to be completed by the operator]. Backup schedules and other provider retention must be completed before public launch. Local guest data remains on the device until removed by the user or operating system.

9. Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests and withdraw consent.

Write to kontakt@darkfox.pl. We may request information necessary to confirm identity, never your password. We respond within GDPR deadlines. You may complain to the Polish data protection authority, UODO, or the competent authority in your country.

10. Choice, security and automated decisions

Accounts are optional. Data required by a selected login method is necessary to use that method. Rejecting analytics does not block the website or game.

App tokens are stored in the system Keychain or Keystore. Server-side access control and identity verification protect account functions. You should protect your device and credentials.

Word validation and points use the approved photo dictionary automatically. These game results are not decisions producing legal or similarly significant effects under GDPR Article 22.

11. Changes

We update this document when the operator, providers or processing change. Material changes requiring consent are not accepted merely by continuing to browse. The current version remains available here and through the app.