Privacy Policy
Draft. Working copy for Tuvro — not legal advice. IČO and registered office will be printed here when they are public (G41). Redeploy Hosting before treating the live URL as final.
1. Who we are
Tuvro is an in-person party game played on one shared phone. This policy covers the iOS and Android apps and the backend we operate (Firebase and purchase processing).
The data controller is ZARFA s.r.o., registered in the Czech Republic. For the registered office and company identification number (IČO), email the contact above or look up ZARFA s.r.o. in the obchodní rejstřík. We have not appointed a data protection officer.
2. What we collect
- Account: email address and authentication identifiers (Firebase user id, Sign in with Apple, Google Sign-In). If you use email and password, Firebase Authentication stores a hashed credential. We do not keep your password in plaintext. We do not use Facebook or other social networks.
- Purchases: subscription and entitlement status via Apple, Google Play, and RevenueCat. We do not receive your full card number. When you are signed in we also send your account email to RevenueCat as a subscriber attribute so we can find the purchase for support, restore, and fraud checks — not for advertising.
- Crash diagnostics: crash and error reports (Firebase Crashlytics) so we can keep the app stable. Collection is on while you use the app. It is not part of the optional analytics choice. We may attach a non-email Firebase user id when you are signed in.
- Optional analytics and performance: only if you tap Allow on the first-launch Tracking screen (Firebase Analytics and Performance Monitoring). We use a non-email user id and an app instance id. This is usage measurement, not advertising tracking, and it is not session recording. Player names, gender, and interests are not sent in these events.
- Task votes: if you rate a prompt, we store your vote and optional reason on our servers, keyed to your Firebase user id. That is not a public profile.
- App integrity: Firebase App Check (Apple App Attest / DeviceCheck and Google Play Integrity) to verify the app binary — not advertising.
- On-device only: player names, gender tags, and interest preferences for the night stay on the phone. They are not uploaded as account or profile data. If you type someone else's name onto the table, that stays on the device; you are responsible for playing with people who agreed to be there.
- We do not use IDFA or App Tracking Transparency advertising tracking. We do not sell personal information. We do not record the screen or user sessions.
Account, purchases, and crash diagnostics are needed to run the app. Analytics and performance are optional. You can use Tuvro if you tap Don't allow on Tracking.
3. Why we use it (legal bases)
- Contract: create your account, fetch content catalogs, restore purchases, provide premium packs, save task votes.
- Consent: optional analytics and performance. You choose on first launch. To withdraw later, email the contact above (ask us to turn analytics off for this install). We will add an in-app control; until then email is the withdrawal path. Withdrawing does not affect the night you already played.
- Legitimate interests: keep the app stable (Crashlytics), security and fraud prevention (App Check, abuse of callables), and running a reliable service. You may object by emailing us.
- Legal obligation: tax, accounting, and store rules where they apply. Store purchase history stays with Apple or Google even if you delete the Tuvro account.
We do not use your data for direct marketing. Session recording, if we ever added it, would need a new, separate consent — the analytics choice does not cover it.
4. Who we share it with
We use processors to run the app. They act on our instructions. We do not sell personal information and we do not share player names or table preferences with advertisers.
- Google (Firebase) — Google Ireland Limited / Google LLC. Authentication; Cloud Functions (catalog, votes, account delete); Cloud Firestore (votes and related account records); Crashlytics; optional Analytics and Performance Monitoring; App Check; Hosting for this page and the Terms of Use. Firebase privacy.
- RevenueCat, Inc. — subscription status and account email for support, restore, and fraud — not advertising. RevenueCat privacy.
- Apple — Sign in with Apple and App Store billing. Apple privacy.
- Google — Google Sign-In and Google Play billing. Google privacy.
Firebase Authentication is used to sign you in. We do not use it for advertising, targeting, or profiling.
5. International transfers
Our processors may process data in the United States and other countries (for example Google and RevenueCat). For users in the EU, EEA, or UK, those transfers rely on the vendors' safeguards, including Standard Contractual Clauses where they apply, and their privacy terms.
6. How long we keep it
Account data is kept while the account exists. Task votes stay tied to that account until you delete it (aggregate counts may remain without your id). Analytics events, if enabled, follow Google's retention for that property. Crash reports follow Crashlytics retention. Purchase records may be kept as needed for billing and accounting.
Deleting your Tuvro account removes the Firebase user and related app account data we control. Store purchase history remains with Apple/Google. Deleting the account does not cancel an App Store or Google Play subscription. Apple or Google will keep charging until you cancel in Subscriptions.
Operations logs (for example Cloud Functions request metadata, which may include IP address) are kept only as needed to run and secure the service.
7. Your rights
Depending on where you live (including the EU/EEA, UK, and California), you may have rights to:
- Access, correct, or delete personal data we hold
- Withdraw analytics consent
- Object to or restrict certain processing (including legitimate-interest processing such as Crashlytics)
- Receive a copy of data you provided (portability), where the law provides it
- Lodge a complaint with a supervisory authority. In the Czech Republic that is the Úřad pro ochranu osobních údajů (ÚOOÚ)
- California: know / delete / opt out of “sale” or “sharing” — we do not sell or share personal information for cross-context advertising as those terms are commonly used for this app
In the app: Account → Delete account (this also asks us to erase the copies we control). Analytics: Don't allow on first launch, or email us to withdraw later. We will answer rights requests using the contact above, free of charge, as soon as we can and within one month where GDPR requires it.
We may need to keep or disclose data if the law requires it, including for legal claims or a public-authority request.
8. Children and age
Tuvro is a 17+ product. Spicy packs (Heat and Dark) require an in-app confirmation that everyone at the table is a legal-age adult (18+, or higher where the law requires it). We do not knowingly collect data from children under 13, and the app is not directed at children.
9. Changes
We may update this page. The “Last updated” date will change when we do. If we change how we use data that we process on the basis of consent (today: optional analytics), we will ask again where the law requires it. A later feature such as session recording would need its own consent and an update here — it is not covered by the current analytics choice.
10. Terms of Use
Rules for using Tuvro (age, play, subscriptions, liability) are in our Terms of Use.