Privacy Policy

Information we process

• Account information: Supabase user identifier, sign-in provider, and the email address supplied when you use Apple or Google sign-in. If Apple provides a private relay address, we receive that address instead of your personal address.
• Installation identity: a randomly generated device identifier used during onboarding, account linking, and session recovery. Version one requires a connected Apple or Google account before gameplay begins.
• Profile and customisation: player name and owned or equipped avatars, name colours, and frames.
• Gameplay and progression: answers, scores, placements, match results, progression, stars, reward eligibility, wagers, and transaction-ledger records needed to operate the game and prevent duplicate rewards.
• Custom games: questions and expected answers entered by a Custom-room host are transmitted to the game server and displayed to that room's players.
• Social features: friend requests and relationships, blocks, Blessings, challenges, and presence or last-seen information used by the Friends screen.
• Support and safety information: information you choose to include in a support, privacy, deletion, or safety request, such as your player name, message, device details, and screenshots.
• Technical information: IP address, connection events, request counters, and limited server or infrastructure logs needed to deliver and secure the service.
• Device-only preferences: sound, music, haptic, and accessibility settings are stored locally and are not intentionally sent to us.

Version one does not intentionally collect contacts, precise location, photos, health information, microphone recordings, or advertising identifiers. It does not include third-party advertising, advertising analytics, or real-money purchases.

Required and optional information

An account identifier, installation identifier, player name, gameplay data, and basic connection data are required to provide the corresponding online game features. If you do not provide them, those features cannot operate. A supported Apple or Google account must be connected before entering the game. Information in support messages and screenshots is voluntary; include only what is necessary for us to handle your request.

Purposes and legal bases

For users in the European Economic Area, United Kingdom, and other places where similar rules apply, we rely on the following legal bases:

We do not rely on consent for advertising or cross-app tracking in version one because those activities are not used. Where we introduce an optional feature that legally requires consent, we will request it separately and allow it to be withdrawn.

Information visible to other players

Your player name, avatar, frame, name colour, gameplay actions, scores, and relevant match results may be shown to other participants. Custom questions and answers are shown to players in that room. Friends may see relationship, Blessing, challenge, and availability information needed for those features. Your email address, sign-in provider identity, installation identifier, IP address, and support messages are not displayed to other players.

Leaderboards and player rankings

Confivia uses global, game-wide leaderboards to display player rankings and competitive performance. When you participate in Ranked or another leaderboard-enabled mode, we process information through our backend services such as your internal account identifier, player name, scores, match results, current rank or leaderboard position, and ranking progress.

Your player name, rank or leaderboard position, and relevant gameplay scores may be visible to other Confivia players. Your internal account identifier, email address, sign-in provider identity, installation identifier, and other private account information are not displayed on the leaderboard.

We use this information to calculate and maintain accurate standings, operate competitive features, award progression or rewards, and investigate cheating, manipulation, or technical errors. The legal bases, retention periods, account-deletion treatment, and privacy rights described elsewhere in this policy also apply to leaderboard and ranking information.

Service providers and other recipients

We use the following providers and recipients to provide Confivia:

• Supabase — authentication, database, and related backend services. The production database is configured in the Central EU (Frankfurt) region.
• Render — game-server hosting. The production game server is configured in Oregon, United States.
• Apple and Google — sign-in services when you choose the corresponding provider. They also process information independently under their own terms and privacy policies.

If you follow our Discord invitation, Discord processes your use of its service under its own terms and privacy policy. Do not post account, deletion, or privacy requests publicly in Discord.

We do not sell personal information. We do not permit our processors to use Confivia player data for their own advertising.

International transfers

Some information is processed outside Bulgaria or the European Economic Area, including on Render infrastructure in the United States. Where required, these transfers are protected through an applicable adequacy mechanism, the European Commission's Standard Contractual Clauses, and supplementary contractual or technical measures. Supabase and Render make data-processing terms available that include transfer safeguards. You may contact us for additional information about the safeguards relevant to your data.

Retention

We keep personal data only for as long as needed for the purposes above:

• registered profile, progression, stars, inventory, and account data are kept while the account remains active;
• temporary, unlinked installation records are removed after 30 days without activity, unless a record must be kept for match, currency, safety, or other integrity reasons;
• friendships, blocks, unclaimed Blessings, challenges, and presence data are kept while operationally needed or until the associated account is deleted;
• Custom-room questions and expected answers ordinarily remain only in active room memory and are not intentionally retained after the room ends;
• completed match results and Ranked progression audit records are stored to maintain progression, fair rankings, and reward integrity. They currently have no automatic expiry. On account deletion, player names in match results are replaced and limited integrity records may remain as described below;
• support and safety correspondence is ordinarily kept for up to 30 days after the request is closed, unless longer retention is needed for a dispute, enforcement action, or legal obligation;
• application runtime logs held by Render expire after 7 to 30 days depending on the hosting workspace plan; and
• transaction-ledger and promotional-redemption records may be kept while the account exists, and for a limited period afterward where necessary to protect currency integrity, prevent duplicate rewards, resolve disputes, or comply with law.

These periods must reflect the production database, backup, and hosting configuration. We may retain limited information longer where reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, or the establishment, exercise, or defence of legal claims.

When account deletion is confirmed, the account becomes inaccessible and its identifying profile information is hidden or de-identified immediately. A daily cleanup permanently removes the remaining deletion-pending account row and its player-linked match and Ranked result rows once 30 days have elapsed. Retained currency and wager audit records have their reference to that player cleared. Limited match or transaction records may remain only where there is a valid reason above and will be de-identified where identification is no longer necessary. De-identified data is not described as anonymous unless it can no longer reasonably be linked back to a person.

Your rights

Depending on applicable law, you may have the right to:

• access your personal data and receive a copy;
• correct inaccurate personal data;
• request deletion;
• restrict or object to certain processing;
• receive certain data in a portable format; and
• withdraw consent where a particular activity relies on consent, without affecting processing that occurred before withdrawal.

To exercise a right, email spiridonovdaniels@gmail.com. We may request reasonable information to verify that the request concerns your account. You also have the right to complain to the Bulgarian Commission for Personal Data Protection at https://cpdp.bg/en/ or to another competent supervisory authority in your place of residence.

Account deletion

Open Profile > Delete account in Confivia to request permanent deletion. If you cannot access the app, follow the instructions at https://daniel-portfolio-pied.vercel.app/projects/confivia/delete-account. Deleting the app from a device does not by itself delete a registered account. The separate deletion page explains how registered accounts are handled and what limited records may remain.

Children

Confivia is intended only for people aged 16 or older. We do not knowingly collect personal data from anyone under 16. If you believe that a person under 16 has provided personal data, contact us so that we can investigate and delete it where appropriate.

The store age rating describes game content and does not replace this minimum age requirement.

Security

We use HTTPS/WSS encryption in transit, authenticated access controls, restricted database permissions, rate limits, and token-safe logging practices. No storage or transmission method can be guaranteed to be completely secure.

Changes

We may update this policy when Confivia, its providers, or legal requirements change. We will update the date above and provide appropriate notice before a material change takes effect where required.

Contact

Daniel Spiridonov
Independent developer
108 Oborishte Street
8000 Burgas
Bulgaria
spiridonovdaniels@gmail.com