Privacy Policy for the "Zip your Lips!" App#

Last updated: September 17, 2026

This privacy policy covers the "Zip your Lips!" app for iPhone and iPad (App Store, bundle ID de.pakumedia.zipyourlips). Our website has its own privacy policy at https://pakumedia.de/datenschutz.

1. Controller#

Pamuk und Kuscu GbR (PAKU Media), trading as "PAKU Studios"
represented by its partners Aykut-Rasih Pamuk and Bünyamin Kuşcu
Friedhofstraße 171
33659 Bielefeld
Germany

Email: hello@pakumedia.de
Phone: +49 521 98 99 40 99

2. Overview#

"Zip your Lips!" is a party game for groups. You can

• play on one device ("Pass & Play"),
• play online with friends in rooms joined via a room code, a QR code or an invite,
• optionally subscribe to the paid Party Pass.

We only process the data these features need. The app contains no advertising, no analytics or tracking tool and no third-party crash reporting. It does not use the advertising identifier (IDFA) and does not track you within the meaning of Apple's App Tracking Transparency. The app sends no push notifications. We do not sell personal data.

3. What data we process and why#

3.1 Data stored only on your device#

The app's storage on your device holds:

• settings (language, sound, vibration) and whether you have seen the onboarding,
• a Pass & Play game in progress, so you can resume it after an interruption,
• a counter for the rating prompt (see 3.13),
• your sign-in session (access and refresh token), so you stay signed in,
• caches for your account: custom decks, favorites, match summaries and experience points not yet uploaded, the last known Party Pass status, your acceptance of the Terms of Use and the location of the profile picture you last chose.

Account caches are removed from the device when you sign out and after you delete your account. Settings stay until you uninstall the app.

3.2 Account: guest, Apple or Google#

Online features, match history, the Party Pass and keeping your data across devices need a user account. The app creates it as follows:

• Guest account: When you tap "Play as guest", an anonymous account with a random identifier and a display name such as "Gast-1234" is created. If you don't have an account yet, the app also creates a guest account automatically when you go online, finish a Pass & Play game or want to buy the Party Pass (if you are connected to the internet). We collect no email address and no name for it.
• Sign in with Apple: Apple sends us a user identifier and your email address, or an Apple private relay address if you choose "Hide My Email". The app also requests your name but does not store it.
• Sign in with Google: Google sends us a user identifier, your email address and the profile details Google includes (name, link to your Google profile picture). Our sign-in system stores these details with your account. The app does not show them to others and does not use them as your display name. Google sign-in runs in a browser window inside the app.

New Apple or Google accounts get a neutral display name such as "Spieler-1234". Only you can see your email address (Settings → Account).

Linking a guest account: If you sign in with Apple or Google while playing as a guest, the guest account is linked to that sign-in. Your identifier, progress, friends, match history and purchases carry over. If the Apple ID or Google account already belongs to another account, the app asks you first. If you switch to the existing account, the previous guest account and its data are deleted. Exception: a guest account with an active Party Pass is kept so the purchase can be restored.

During sign-in our sign-in system also processes technical data such as access tokens, sign-in times and the IP address of the request.

Legal basis: Art. 6(1)(b) GDPR (providing the features you want to use).

3.3 Profile#

We store the following with your account:

• display name (2–24 characters, unique) and an optional profile picture,
• experience points (XP) and level; to prevent abuse we log XP credits with a timestamp,
• game statistics (online games, wins, terms explained, buzzes) and the number of your Pass & Play games,
• your Party Pass status (active, expiry date),
• whether it is a guest account,
• the version of the Terms of Use you accepted and when,
• the code of the lobby you are currently in (so friends can join),
• creation and last-change time.

Word filter: Our server checks display names and custom decks against a list of clearly offensive, sexual and extremist terms. Matches are not saved.

Profile picture: You choose a photo using the system photo picker. The app only receives that one photo, scales it down to 512 pixels, saves it as a JPEG and uploads it to the "avatars" storage area. This storage area is publicly readable: anyone who knows the picture's address can open it. In the app, your picture is shown to your friends, to people with whom a friend request is pending, and to people who blocked you (in their block list). Other players in rooms only see your display name. Don't upload a picture that shows other people without their consent.

Legal basis: Art. 6(1)(b) GDPR; for the word filter and the abuse log, Art. 6(1)(f) GDPR (protecting users and the game).

3.4 Pass & Play match history#

When you finish a Pass & Play game, we save a summary to your account: date, duration, board and game variants, team names, the player names you entered, the winner, the round log (terms, points) and up to 12 drawings. Without a connection it is kept on the device first and uploaded later. Only you can see these entries. Your friends only see how many Pass & Play games you have played. Please use nicknames or first names for other players.

Legal basis: Art. 6(1)(b) GDPR. For the other players' names, Art. 6(1)(f) GDPR (our and your interest in showing the complete match history).

3.5 Online rooms and online games#

When you create or join a room, we process:

• Room data: room code, host, settings, selected decks, status.
• Participation data: your display name in the room, team, seat, ready status, connection status, the time of your last sign of life (the app sends it regularly while you are in a room, so dropped connections are detected) and which app features your device supports. If the host removes you from a lobby, we store that so you can't rejoin that room.
• Game data: rounds, drawn terms, points and game events with timestamps (e.g. buzzer, fouls, skips, objections, who explains or controls).
• Typed guesses: If the host has switched this option on, our server checks the term you type. We only store that you guessed and the result, not the text you typed.
• Live drawing: Your strokes are sent to the other players in real time during a drawing round through our host's real-time service (Supabase Realtime) and are not stored on the way. When the drawn term is guessed, we save the finished drawing with the term and you as its author. The players of that game can see it after the round.
• The host's custom decks: When a host starts a game with custom decks, we save a copy of the terms. Players see the terms in the game and the deck name in the lobby.

Players in the room see your display name, team, ready and connection status, your drawings, your live video (see 3.10) and your game actions. After the game, all participants see the game in their match history (teams, names, rounds, terms, drawings).

Legal basis: Art. 6(1)(b) GDPR.

3.6 Friends, invites and online status#

• Friend code: Your account gets a 6-character friend code, which you can also show as a QR code or pass on through your device's share menu. Anyone who has it can send you a friend request. Requests per hour are limited.
• Friendships and requests: We store who sent a request to whom and when, and whether it was accepted. While a request is pending, you both see each other's display name and profile picture.
• Online status: While the app is open, it sends a sign of life about once a minute. Confirmed friends see whether you are online and which open lobby you are in.
• What friends also see: your profile with level and statistics, your favorite drawings and whether you have an active Party Pass.
• Invites: We store inviter, invitee, room, status and time.

After a block, neither of you can see this information any more.

Legal basis: Art. 6(1)(b) GDPR.

3.7 Custom decks and favorites#

Custom decks (name, emoji, terms and taboo words) are stored on your device and in your account, so they are available on all your devices. Only you can see them, unless you use them as host in an online game (see 3.5). Drawings you mark as favorites (up to 200) are stored in your account and visible to you and your confirmed friends.

Legal basis: Art. 6(1)(b) GDPR.

3.8 Reporting, blocking, hiding video#

You can report profiles, drawings, live videos and a host's custom decks, block players and hide other players' live video.

• Reports contain: your account as the reporter, the type and identifier of the reported content, the reason you chose (offensive or hateful, sexual content, harassment or bullying, spam, something else, or for decks: lobby or game), the identifiers of the reported person, round, drawing or room, for decks the deck name, and the time and processing status. No copy of the reported content is made.
• Blocks contain who blocked whom and when. When you block someone, we delete existing friendships, pending requests and invites between you and separate you in shared lobbies.
• Hiding a video only takes effect on your device and is not stored.

The reported person is not told who reported them.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protecting users from illegal and objectionable content and enforcing our Terms of Use. Where we are legally required to handle notices (e.g. Art. 16 DSA), Art. 6(1)(c) GDPR.

3.9 Acceptance of the Terms of Use#

We store which version of the Terms of Use you accepted and when, on your device and in your profile.

Legal basis: Art. 6(1)(b) and (f) GDPR (proof of the contract).

3.10 Camera, microphone and live video (Pantomime)#

• QR code scanner: The camera only opens when you scan a friend's or room's QR code. The image is analysed only on your device and is neither stored nor transmitted.
• Live camera in Pantomime rounds: The live camera is available when you or the room's host has an active Party Pass. When it's your turn to act, the app asks for camera access before sending. During your Pantomime round your camera image is transmitted live to the other players in the same game. Only the person currently acting sends video; everyone else only receives. Transmission runs through LiveKit (see 4.3). For this, our server issues an access token containing your user identifier, your display name and an identifier for the round. It is valid for the round time plus two minutes.
• No audio: The app does not record or transmit sound. Our server only allows sending the camera image.
• No recording: We do not record or store live videos.

You can withdraw camera access at any time in your device settings (in the app: Settings → Permissions). The live camera and the QR scanner will then not work.

Legal basis: Art. 6(1)(b) GDPR. You allow camera access through the operating system's prompt (Sec. 25(1) TDDDG).

3.11 Sharing#

You can share drawings as an image and your friend code through your device's share menu. The image is created on your device. We don't learn where you share it.

3.12 Party Pass (in-app subscription)#

You buy the Party Pass through the App Store. Apple handles the purchase and the payment. We do not receive payment data (e.g. credit card).

We use RevenueCat to manage subscriptions (see 4.2). This involves:

• your user identifier from our system (the RevenueCat "App User ID"),
• App Store receipts and transaction data (product, purchase and expiry date, trial period, renewal, cancellation, refund),
• technical data the RevenueCat SDK needs to match purchases (e.g. app version, operating system, store country and currency).

RevenueCat reports purchases, renewals, cancellations and expirations to our server. Right after a purchase the app also requests this status itself. From this we only store which product is active and until when. Your friends see whether you have an active Party Pass. If you are the host, the players in your room can use the Party Pass features for that game.

Legal basis: Art. 6(1)(b) GDPR.

3.13 Rating prompt#

After every third finished game, at most once every three days, the app may show Apple's rating prompt. The app keeps the counter on your device only. We don't learn whether or how you rate the app.

3.14 Server logs and app configuration#

At start-up the app requests the minimum supported version and any maintenance notice. Every request to our servers creates technically necessary log data, including IP address, time, requested endpoint, status code and app identifier (user agent). It is used for secure operation and troubleshooting. Our host Supabase deletes these logs after 7 days.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation.

4. Recipients and processors#

We have concluded data processing agreements under Art. 28 GDPR with the following service providers.

4.1 Supabase (database, sign-in, file storage, server functions, real-time)#

Contracting party: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. The database, the sign-in system and the storage for profile pictures are located in the EU-Central region (Frankfurt am Main, Germany). Server functions and the real-time service may run in another Supabase data center closer to the request. Access by Supabase from outside the EU (e.g. for support) cannot be ruled out. It is covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4.2 RevenueCat (subscription management)#

RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. Processes the data listed in 3.12. The transfer to the USA is covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4.3 LiveKit (live video)#

LiveKit Incorporated, 369 Sutter St, San Francisco, CA, USA. The live camera runs on LiveKit Cloud. LiveKit relays the video through the nearest data center of its global network and does not store it. The video may pass through servers outside the EU on the way. LiveKit also receives your IP address, your user identifier and your display name. LiveKit is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). The EU Standard Contractual Clauses apply in addition.

4.4 Apple and Google#

• Sign-in: If you use "Sign in with Apple" or "Sign in with Google", Apple Distribution International Ltd. (Ireland) or Google Ireland Limited (Ireland) process your sign-in data as independent controllers under their own privacy policies.
• Purchases and distribution: Apple handles downloads, purchases, payments, trial periods, cancellations, refunds and ratings as an independent controller.

4.5 Other users#

As described in section 3, other players and friends see certain profile and game data. The only thing reachable outside the app is your profile picture, through its address.

4.6 Authorities#

We only pass data to authorities where we are legally required to.

5. Retention#

6. Deleting your account#

You can delete your account in the app at any time: Settings → Account → Delete account. We then permanently delete:

• your user account including the Apple or Google sign-in data,
• your profile and profile picture,
• your friend code, friendships, requests, invites and blocks (including blocks others placed on you),
• statistics, XP, online status and Party Pass status,
• your Pass & Play match history, custom decks (including their copies from online games) and favorites,
• your participation in online rooms and games.

The following remain without any link to you: drawings and game events from online games that appear in other participants' match history, and reports you filed. Reports about you remain while they are handled (see 5).

Not deleted automatically is your customer record at RevenueCat (user identifier and purchase history). Email us at hello@pakumedia.de and we will have it deleted. Apple keeps purchase records according to its own rules.

Important: Deleting your account does not cancel a running subscription. The app reminds you of this before deleting. Cancel the Party Pass first in your Apple subscription settings (in the app: Settings → Party Pass → Manage subscription).

You can also request deletion by email to hello@pakumedia.de.

7. Your rights#

You have the right to

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR), e.g. camera access in your device settings.

Contact us at hello@pakumedia.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.

8. Children and teenagers#

Pass & Play on one device can be played at any age. An account with Apple or Google, the online features (rooms, friends, live camera) and the Party Pass are intended for people aged 16 and over. If you are under 16, you may only use them with the consent of your parent or guardian.

If you believe a child has given us data without the required consent, email us at hello@pakumedia.de and we will delete it.

9. Security#

Connections between the app, our servers and LiveKit are encrypted (TLS). Access rules in the database (Row Level Security) restrict every record to the people entitled to it. Game-deciding and security-relevant writes run only through verified server functions.

10. Changes#

We update this privacy policy when the app or the law changes. The version linked in the app applies.