Privacy Policy

1. Who we are

Tuvro is an in-person party game played on one shared phone. This policy covers the iOS and Android apps and the backend we operate (Firebase and purchase processing).

The data controller is ZARFA s.r.o., registered in the Czech Republic, ID 04573021, registered office at Arnošta Valenty 639/5, 198 00 Praha, Czechia. Contact: lukas@tuvro.app. We have not appointed a data protection officer.

2. What we collect

• Guest id: you don't need an account to play. When you first open the app, Firebase Authentication creates an anonymous user id for that install. It carries no email address and no name. We use it to load the packs, keep your purchases and task votes together, and help you with support (it is the Support ID in Settings).
• Account (optional): in some cases you can create an account or sign in. Only then do we hold an email address and authentication identifiers (Firebase user id, Sign in with Apple, Google Sign-In). If you use email and password, Firebase Authentication stores a hashed credential. We do not keep your password in plaintext. We do not use Facebook or other social networks. We send account emails (email verification, password reset, account-deletion confirmation) through Resend. We may also use an email address you give us to tell you about Tuvro and our other apps, but only as described under Marketing email in section 3.
• Promo sign-ups (optional): if you claim a promo (a page at app.tuvro.app/promo/…, which tuvro.app/promo/… links to), we keep the promo code, a scrambled (keyed hash) form of your email address, never the address itself, and when your free Premium ends. When the same address is confirmed as your email in the app, we match the two and give that guest id the free Premium through RevenueCat. We also count sign-ups per connection for a day, again only as a scrambled form of the IP address, to stop abuse. The legal basis is giving you the promo you asked for. That page is protected by Firebase App Check with Google reCAPTCHA Enterprise, which looks at signals from your browser and device to tell people from bots; Google processes those under its own terms. There's no puzzle to solve.
• Purchases: subscription and entitlement status via Apple, Google Play, and RevenueCat, linked to your guest id or account. We do not receive your full card number. If you've signed in to an account we also send your account email, the display name from your sign-in provider, and a non-email Firebase analytics instance id (only while analytics is allowed) to RevenueCat as subscriber attributes so we can find the purchase for support, restore, and fraud checks — not for advertising. This is separate from the on-device player names below.
• Crash diagnostics: crash and error reports (Firebase Crashlytics) so we can keep the app stable. Collection is on while you use the app. It is not part of the optional analytics choice. We may attach your non-email Firebase user id (guest id or account).
• Optional analytics and performance: only if you tap Allow on the first-launch Tracking screen (Firebase Analytics and Performance Monitoring). We use a non-email user id and an app instance id. This is usage measurement, not advertising tracking, and it is not session recording. Player names, gender, and interests are not sent in these events.
• Task votes: if you rate a prompt, we store your vote and optional reason on our servers, keyed to your Firebase user id. That is not a public profile.
• App integrity: Firebase App Check (Apple App Attest / DeviceCheck and Google Play Integrity) to verify the app binary — not advertising.
• On-device only: player names, gender tags, and interest preferences for the night stay on the phone. They are not uploaded as account or profile data. If you type someone else's name onto the table, that stays on the device; you are responsible for playing with people who agreed to be there.
• Also on-device only: if you use the premium "don't show this card again" control, the list of prompts you've hidden is stored on the phone, not on our servers or tied to your account. It stays as long as the app stays installed, but it does not move with your account to a new phone and is not restored by restoring your purchase there.
• We do not show ads, request App Tracking Transparency authorization, or access your device's advertising identifier. We do not sell personal information. We do not record the screen or user sessions. (Firebase Analytics' iOS build includes an ad-conversion library as a transitive dependency that this app does not invoke — see the note in our processors list below.)

The guest id, purchases, and crash diagnostics are needed to run the app. An account is optional. Analytics and performance are optional. You can use Tuvro if you tap Don't allow on Tracking.

3. Why we use it (legal bases)

• Contract: create your guest id (and your account, if you make one), fetch content catalogs, restore purchases, provide premium packs, save task votes.
• Consent: optional analytics and performance. You choose on first launch. To withdraw later, turn off Anonymous analytics in Settings (or email the contact above). Withdrawing does not affect the night you already played.
• Legitimate interests: keep the app stable (Crashlytics), security and fraud prevention (App Check, abuse of callables), and running a reliable service. You may object by emailing us.
• Legal obligation: tax, accounting, and store rules where they apply. Store purchase history stays with Apple or Google even if you delete the Tuvro account.

Marketing email. We may email you about Tuvro (new packs, features, offers on our subscription) and about other apps, products or services from ZARFA s.r.o. We only have an email address if you give it to us — by creating an account or entering it in the app. We never give your address to anyone else for their marketing.

• Legal basis: consent, for everyone — whether or not you've bought a subscription. We only send marketing email if you gave us an email address, ticked the box to get it, and confirmed the address with the link we send. You can turn it off at any time in the app (Settings) or with the unsubscribe link in any email. We keep a record of when and how you agreed, so we can show it.

Every marketing email has an unsubscribe link, or you can email us to stop — we'll stop, no questions asked. Unsubscribing doesn't stop account emails (verification, password reset, account-deletion confirmation), which we send whatever you choose.

Session recording, if we ever added it, would need a new, separate consent — the analytics choice does not cover it.

4. Who we share it with

We use processors to run the app. They act on our instructions. We do not sell personal information and we do not share player names or table preferences with advertisers.

• Google (Firebase) — Google Ireland Limited / Google LLC. Authentication; Cloud Functions (catalog, votes, account delete), which run in the United States; Cloud Firestore (votes and related account records); Crashlytics; optional Analytics and Performance Monitoring; App Check; and other Firebase platform SDKs bundled with the app (for example Remote Config, Installations) used only for app functionality, not advertising. Firebase privacy.
• RevenueCat, Inc. — subscription status and your guest or account id; if you've signed in to an account, also its email and sign-in display name; and (while analytics is allowed) a non-email Firebase analytics instance id, for support, restore, and fraud — not advertising. RevenueCat privacy.
• Resend — sends account email on our behalf (email verification, password reset, account-deletion confirmation) and, where section 3 allows it, marketing email about Tuvro and our other apps, products or services. Only your email address and the message content. Resend privacy.
• Apple — App Store billing, and Sign in with Apple if you use it. Apple privacy.
• Google — Google Play billing, and Google Sign-In if you use it. Google privacy.

This website (including this page) is a static site with no cookies, no scripts, and no forms; its hosting provider only sees ordinary web-connection metadata needed to serve a page, not app account data, so we don't list it as a processor of your Tuvro data.

Firebase Authentication creates your guest id and, if you make an account, signs you in. We do not use it for advertising, targeting, or profiling. Firebase Analytics' iOS build links Google's GoogleAdsOnDeviceConversion library as a dependency of the standard Firebase Analytics SDK; we do not call it, request ad-tracking authorization, or enable ad personalization signals, so no advertising identifier is collected through it in this app.

If you visit our public roadmap board (linked from the app) at tuvro.canny.io, that is a separate third-party service (Canny) with its own account and privacy policy — anything you post there is not covered by this policy.

5. International transfers

Our Cloud Functions and related backend processing run in the United States. Google, RevenueCat, and Resend may also process data in the United States and other countries. For users in the EU, EEA, or UK, we rely on each vendor's current transfer safeguard — the EU-US Data Privacy Framework where the vendor participates in it, or Standard Contractual Clauses otherwise — plus the vendor's own privacy terms. Email the contact in section 1 for details of the safeguard used for a specific vendor, or a copy of the relevant clauses.

6. How long we keep it

Guest and account data is kept while the guest id or account exists. Task votes stay tied to that id until you delete it (aggregate counts may remain without your id). Analytics events, if enabled, follow Google's retention for that property. Crash reports follow Crashlytics retention. Purchase records may be kept as needed for billing and accounting.

An email address you give us in the app, and the record of your marketing choice (when you agreed or stopped, to which words, and how), are kept while the address is with us. Remove it in the app (Settings) or delete your data and both are deleted.

A promo sign-up is deleted automatically 30 days after its free Premium ends; the per-connection count, after two days. Deleting your data in the app also unlinks your guest id from any promo sign-up.

If you unsubscribe from marketing email, we keep your address on a do-not-email list for as long as we send marketing, only so we don't email you again.

Uninstalling the app removes the guest id from the phone, but not the data tied to it on our servers; to delete that, use Settings → Delete my data in the app (or email us your Support ID). Deleting your Tuvro account removes the Firebase user and related app account data we control. Store purchase history remains with Apple/Google. Deleting the account does not cancel an App Store or Google Play subscription. Apple or Google will keep charging until you cancel in Subscriptions.

Backups: we back up our database so we can put things back if something goes wrong: a daily backup kept for 14 days and a weekly one kept for 14 weeks. The backups are encrypted, stay in the same United States location as the database, and are used only to recover from errors. Each one is deleted automatically when it expires. So when you delete your account, its data leaves our live database straight away, and the last copies in our backups are gone within 14 weeks.

Operations logs (for example Cloud Functions request metadata, which may include IP address) are kept only as needed to run and secure the service.

7. Your rights

Depending on where you live (including the EU/EEA, UK, and California), you may have rights to:

• Access, correct, or delete personal data we hold
• Withdraw analytics consent
• Stop marketing email at any time — unsubscribe or email us
• Object to or restrict certain processing (including legitimate-interest processing such as Crashlytics)
• Receive a copy of data you provided (portability), where the law provides it
• Lodge a complaint with a supervisory authority. In the Czech Republic that is the Úřad pro ochranu osobních údajů (ÚOOÚ)
• California: know / delete / opt out of "sale" or "sharing" — we do not sell or share personal information for cross-context advertising as those terms are commonly used for this app

If you have an account: Settings → Delete account in the app (this also asks us to erase the copies we control). If you play as a guest: Settings → Delete my data (or email us the Support ID from Settings and we'll delete the data tied to it). Analytics: Don't allow on first launch, or turn it off later in Settings. We will answer rights requests using the contact above, free of charge, as soon as we can and within one month where GDPR requires it.

We may need to keep or disclose data if the law requires it, including for legal claims or a public-authority request.

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

8. Children and age

Tuvro is an 18+ product, not directed at children. Spicy packs (Heat and Dark) require an in-app confirmation that everyone at the table is a legal-age adult (18+, or higher where the law requires it). We do not knowingly collect personal data from anyone below the digital-consent age that applies where they live — 15 in the Czech Republic, 16 by default under GDPR unless their country sets a lower age (no lower than 13), and 13 in the United States under COPPA. If we learn we collected data from someone below the applicable age, we will delete it.

9. Changes

We may update this page. The "Last updated" date will change when we do. If we change how we use data that we process on the basis of consent (today: optional analytics and, if you opted in, marketing email), we will ask again where the law requires it. A later feature such as session recording would need its own consent and an update here — it is not covered by the current analytics choice.

10. Terms of Use

Rules for using Tuvro (age, play, subscriptions, liability) are in our Terms of Use.