Privacy Policy for the "Zip your Lips!" App#

Last updated: 29 September 2026

This privacy policy covers the "Zip your Lips!" app for iPhone and iPad (App Store, bundle ID de.pakumedia.zipyourlips). Our website has its own privacy policy at https://pakumedia.de/datenschutz.

1. Controller#

Pamuk und Kuscu GbR (PAKU Media), brand "PAKU Studios"
represented by its partners Aykut-Rasih Pamuk and Bünyamin Kuşcu
Friedhofstraße 171
33659 Bielefeld
Germany

Email: hello@pakumedia.de
Phone: +49 521 98 99 40 99

2. Overview#

"Zip your Lips!" is a party game for groups. You can

• play on one device ("Pass & Play"),
• play online with friends in rooms joined via a room code, a QR code or an invite,
• optionally subscribe to the paid Party Pass.

We only process the data these features need. The app contains no advertising. Usage statistics and error reports (PostHog) run only if you explicitly agree (see 3.15). When an account is deleted, PostHog only receives its user identifier so that any data linked to it there are deleted, even without consent (see 6). Crashes of the app itself (native crashes) are not sent to PostHog. The app does not use the advertising identifier (IDFA) and does not track you within the meaning of Apple's App Tracking Transparency. The app sends no push notifications. We do not sell personal data.

3. What data we process and why#

3.1 Data stored only on your device#

The app's storage on your device holds:

• settings (language, sound, vibration) and whether you have seen the onboarding,
• a Pass & Play game in progress, so you can resume it after an interruption,
• a counter for the rating prompt (see 3.13),
• your answer to the question about usage statistics and error reports (see 3.15), for a yes together with the user identifier of the account it belongs to. While your consent stands, also the data of the PostHog library: random identifiers for the device and the session and, while you are signed in, your user identifier, the properties sent along (app language, guest account, level, Party Pass status, version of the question's text), technical details of the app and the device (app version and build number, the app's identifier, operating system and its version, device type), the project settings loaded from PostHog, and statistics and error reports not yet sent (including the report on an error that closed the app, until the next start). When the app stops sending (because you withdraw, because another account signs in or because you delete your account, see 3.15), it deletes the data not yet sent and resets PostHog on your device: the identifiers, including the random device identifier, and the properties sent along are deleted. Until the app next starts, only data that are not sent and not attributed to any person at PostHog remain stored: PostHog's note that nothing may be sent, the loaded project settings, the technical details of the app and the device that the library creates again after the reset and, if the app comes back to the foreground before then, a new random session identifier. When the app starts without your consent, it deletes all files of the PostHog library. If after a withdrawal the app could not yet send a request to delete data already sent (see 3.15), it stores the request until it has been sent, at most until you uninstall the app, with the user identifier of the account the yes belonged to or with this device's random PostHog identifiers,
• your sign-in session (access and refresh token), so you stay signed in,
• caches for your account: custom decks, favorites, match summaries and experience points not yet uploaded, the last known Party Pass status, your acceptance of the Terms of Use and the location of the profile picture you last chose.

Account caches are removed from the device when you sign out and after you delete your account. The exception is the note of which version of the Terms of Use an account accepted on this device (with its user identifier); it stays until you uninstall the app. Your answer about usage statistics and error reports (for a yes, with the user identifier it belongs to) stays when you sign out, until you change it or uninstall the app; the app forgets a yes when another account signs in, and forgets your answer when you delete your account (see 3.15). Settings stay until you uninstall the app.

3.2 Account: guest, Apple or Google#

Online features, match history, the Party Pass and keeping your data across devices need a user account. The app creates it as follows:

• Guest account: When you tap "Play as guest", an anonymous account with a random identifier and a display name such as "Player-1234" is created. If you don't have an account yet, the app also creates a guest account automatically when you go online, finish a Pass & Play game, want to buy the Party Pass or restore purchases (if you are connected to the internet). We collect no email address and no name for it.
• Sign in with Apple: Apple sends us a user identifier and your email address, or an Apple private relay address if you choose "Hide My Email". The app also requests your name but does not store it.
• Sign in with Google: Google sends us a user identifier, your email address and the profile details Google includes (name, link to your Google profile picture). Our sign-in system stores these details with your account. The app does not show them to others and does not use them as your display name. Google sign-in runs in a browser window inside the app.

New Apple or Google accounts get a neutral display name such as "Player-1234". Only you can see your email address (Settings → Account).

Linking a guest account: If you sign in with Apple or Google while playing as a guest, the guest account is linked to that sign-in. Your identifier, progress, friends, match history and purchases carry over. If the Apple ID or Google account already belongs to another account, the app asks you first. If you switch to the existing account, the previous guest account and its data are deleted, including at PostHog (see 6). Exception: a guest account with an active Party Pass is kept so the purchase can be restored.

During sign-in our sign-in system also processes technical data such as access tokens, sign-in times and the IP address of the request.

Legal basis: Art. 6(1)(b) GDPR (providing the features you want to use).

3.3 Profile#

We store the following with your account:

• display name (2–24 characters, unique) and an optional profile picture,
• experience points (XP), level and the title you chose; to prevent abuse and to calculate your season progress we log XP credits with a timestamp and the bonuses applied (Party Pass, friends in the game, host, MVP, XP coupon, weekend),
• season pass: the rewards you received (item, season, tier, time received, for XP coupons the time redeemed), the items you have equipped (frame, up to three badges, board piece, confetti, buzzer, zip finisher, board, live-cam stage) and an armed XP coupon. The players in your room see your equipped items (see 3.5), and your friends also see your frame and badges (see 3.6),
• your day streak (current and best streak, last day played),
• game statistics (online games, wins, terms explained, how often you skipped while explaining in online games, buzzes) and the number of your Pass & Play games,
• for every finished online game a summary: win, host, MVP, team, team size, number of teams, players and devices, how many other people played at your device, number of friends in the game, rounds you explained, terms explained and skipped, fouls, buzzes, terms per game variant and game length. We use it to award XP and to credit achievements and tasks to you later, also retroactively. Only you can see this summary,
• your Party Pass status (active, expiry date),
• whether it is a guest account,
• the version of the Terms of Use you accepted and when,
• the code of the lobby you are currently in (so friends can join),
• creation and last-change time.

Word filter: Our server checks display names and custom decks against a list of clearly offensive, sexual and extremist terms. Matches are not saved.

Profile picture: You choose a photo using the system photo picker. The app only receives that one photo, scales it down to 512 pixels, saves it as a JPEG and uploads it to the "avatars" storage area. This storage area is publicly readable: anyone who knows the picture's address can open it. In the app, your picture is shown to your friends, to people with whom a friend request is pending, to people who blocked you (in their block list), and to the other players in an online room you are in (see 3.5). Don't upload a picture that shows other people without their consent.

Legal basis: Art. 6(1)(b) GDPR; for the word filter and the abuse log, Art. 6(1)(f) GDPR (protecting users and the game).

3.4 Pass & Play match history#

When you finish a Pass & Play game, we save a summary to your account: date, duration, board and game variants, team names, the player names you entered, the winner, the round log (who explained, drew or acted out the terms in each round, the terms with their result – guessed, skipped or foul – and how long each term was shown, in a duel also objections, plus the points), the card language, the chosen word packs, the number of custom decks mixed in and up to 12 drawings. Without a connection it is kept on the device first and uploaded later. Only you can see these entries. Your friends only see how many Pass & Play games you have played. Please use nicknames or first names for other players.

Legal basis: Art. 6(1)(b) GDPR. For the other players' names, Art. 6(1)(f) GDPR (our and your interest in showing the complete match history).

3.5 Online rooms and online games#

When you create or join a room, we process:

• Room data: room code, host, settings, selected decks, status.
• Participation data: your display name in the room, team, seat, ready status, connection status, the time of your last sign of life (the app sends it regularly while you are in a room, so dropped connections are detected) and which app features your device supports. If the host removes you from a lobby, we store that so you can't rejoin that room.
• Players at your device: If other people play on your device, we store the names you enter for them (up to three, 24 characters each at most) with your seat in the room. Everyone in the room sees these names in the lobby and in the game. They are deleted with the room (see 5) or, when you delete your account, with your participation. Please use nicknames or first names only.
• Game data: rounds, drawn terms with the time each was drawn and resolved, points and game events with timestamps (e.g. buzzer, fouls, skips, objections, who explains or controls).
• Live drawing: Your strokes are sent to the other players in real time during a drawing round through our host's real-time service (Supabase Realtime) and are not stored on the way. When the drawn term is guessed, we save the finished drawing with the term and you as its author. The players of that game can see it after the round. Players with a Party Pass can save your drawing as a favorite; a copy with your display name is then kept in their profile and visible to their friends (see 3.7).
• The host's custom decks: When a host starts a game with custom decks, we save a copy of the terms. Players see the terms in the game and the deck name in the lobby.

Players in the room see your display name, your profile picture, your equipped season items (frame, badges, board piece, confetti, buzzer, zip finisher, live-cam stage and, when you are the host, the board), the names of the players at your device, your team, your ready and connection status, your drawings, your live video (see 3.10) and your game actions. After the game, all participants see the game in their match history (teams, names, rounds, terms, drawings).

Legal basis: Art. 6(1)(b) GDPR. For the names of the players at your device, Art. 6(1)(f) GDPR (our and your interest in running the shared game).

3.6 Friends, invites and online status#

• Friend code: Your account gets a 6-character friend code, which you can also show as a QR code or pass on through your device's share menu. Anyone who has it can send you a friend request. Requests per hour are limited.
• Friendships and requests: We store who sent a request to whom and when, and whether it was accepted. While a request is pending, you both see each other's display name, profile picture and season frame.
• Online status: While the app is open, it sends a sign of life about once a minute. Confirmed friends see whether you are online and which open lobby you are in.
• What friends also see: your profile with level and XP progress, title, day streak, statistics, season frame and badges, your favorite drawings and whether you have an active Party Pass. For this, your friends' app receives your profile record, which also includes your equipped season items, an armed XP coupon, your Party Pass expiry date and your account's creation date; only the details listed are shown.
• Invites: We store inviter, invitee, room, status and time.

After a block, neither of you can see this information any more.

Legal basis: Art. 6(1)(b) GDPR.

3.7 Custom decks and favorites#

Custom decks (name, emoji, terms and no-go words) are stored on your device and in your account, so they are available on all your devices. Only you can see them, unless you use them as host in an online game (see 3.5). Drawings you mark as favorites are stored as a copy (strokes and term) in your account, in three albums: your own drawings from online games, other players' drawings from online games you took part in (Party Pass only; stored with the drawer's display name at the time of saving), and drawings from Pass & Play games. Each album holds up to 3, or up to 9 with the Party Pass. Your favorites are visible to you and your confirmed friends.

Legal basis: Art. 6(1)(b) GDPR.

3.8 Reporting, blocking, hiding video#

You can report profiles, drawings, live videos and a host's custom decks, block players and hide other players' live video.

• Reports contain: your account as the reporter, the type and identifier of the reported content, the reason you chose (offensive or hateful, sexual content, harassment or bullying, spam, something else; for reports from the player menu in the lobby, the note "lobby" instead, and for decks, where the report was made: lobby or game), the identifiers of the reported person, round, drawing or room, for decks the deck name, and the time and processing status. No copy of the reported content is made.
• Blocks contain who blocked whom and when. When you block someone, we delete existing friendships, pending requests and invites between you and separate you in shared lobbies.
• Hiding a video only takes effect on your device and is not stored.

The reported person is not told who reported them.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protecting users from illegal and objectionable content and enforcing our Terms of Use. Where we are legally required to handle notices (e.g. Art. 16 DSA), Art. 6(1)(c) GDPR.

3.9 Acceptance of the Terms of Use#

We store which version of the Terms of Use you accepted and when, on your device and in your profile.

Legal basis: Art. 6(1)(b) and (f) GDPR (proof that the contract was concluded).

3.10 Camera, microphone and live video (Pantomime)#

• QR code scanner: The camera only opens when you scan a friend's or room's QR code. The image is analysed only on your device and is neither stored nor transmitted.
• Live camera in Pantomime rounds: The live camera is available when you or the room's host has an active Party Pass. When it's your turn to act, the app asks for camera access before sending. During your Pantomime round your camera image is transmitted live to the other players in the same game. Only the person currently acting sends video; everyone else only receives. Transmission runs through LiveKit (see 4.3). For this, our server issues an access token containing your user identifier, your display name and an identifier for the round. It is valid for the round time plus two minutes.
• No audio: The app does not record or transmit sound. Our server only allows sending the camera image.
• No recording: We do not record or store live videos.

You can withdraw camera access at any time in your device settings (in the app: Settings → Permissions). The live camera and the QR scanner will then not work.

Legal basis: Art. 6(1)(b) GDPR. You allow camera access through the operating system's prompt (Sec. 25(1) TDDDG).

3.11 Sharing#

You can share drawings as an image, your friend code and the code of an online room through your device's share menu. The image is created on your device. We don't learn where you share anything. If you agreed to usage statistics (see 3.15), we only record that you opened the share menu, for which kind of content (drawing, friend code or room code, without the code itself) and, where the device reports it, whether you picked a target, but not which one.

3.12 Party Pass (in-app subscription)#

You buy the Party Pass through the App Store. Apple handles the purchase and the payment. We do not receive payment data (e.g. credit card).

We use RevenueCat to manage subscriptions (see 4.2). This involves:

• your user identifier from our system (the RevenueCat "App User ID"),
• App Store receipts and transaction data (product, purchase and expiry date, trial period, renewal, cancellation, refund),
• technical data the RevenueCat SDK needs to match purchases (e.g. app version, operating system, store country and currency).

RevenueCat reports purchases, renewals, cancellations and expirations to our server. Right after a purchase the app also requests this status itself. From this we only store which product is active and until when. Your friends see whether you have an active Party Pass. If you are the host, the players in your room can use the Party Pass features for that game.

Legal basis: Art. 6(1)(b) GDPR.

3.13 Rating prompt#

After every third finished game, at most once every three days, the app may show Apple's rating prompt. The app keeps the counter on your device only. We don't learn whether or how you rate the app. If you agreed to usage statistics (see 3.15), we record that the app requested the prompt.

3.14 Server logs and app configuration#

At start-up the app requests the minimum supported version and any maintenance notice. Every request to our servers creates technically necessary log data, including IP address, time, requested endpoint, status code and app identifier (user agent). It is used for secure operation and troubleshooting. Our host Supabase deletes these logs after 7 days.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation.

3.15 Usage statistics and error reports (only with your consent)#

In short: Only if you tap "Allow" does the app send usage statistics (which screens and features you use) and error reports to PostHog, linked to your player ID or a random identifier. The data are stored in the EU; PostHog is a US company (see 4.4). Without your consent the app sends nothing for this, and you can use every feature. You can turn it off at any time with one tap under Settings → Legal → Share stats & error reports. The app then stops sending and has what was already sent deleted (the data linked to your account as soon as you are signed in with it on this device). Otherwise we have the data deleted once nothing has come in for them for 12 months, and when you delete your account. The details follow.

The app asks you on the home screen whether you want to share usage statistics and error reports. By tapping "Allow" you agree and confirm that you are 16 or older or that your parent or guardian agrees (see 8). On this card, the note on age and the link to this privacy policy sit outside the scrolling text and are always visible. "No thanks" is a button of the same size right below "Allow". You can change your answer at any time under Settings → Legal → Share stats & error reports: if you turn the switch on, the app shows the same card as on the home screen; you have only agreed once you tap "Allow", and with "No thanks" the switch stays off. Turning it off, which withdraws your consent, takes one tap with no further question. Your consent is voluntary. Without it you can use every feature of the app. While there is no consent, the app sends nothing for this purpose and creates no identifier for it. The only exception: after the app has stopped sending, data of the PostHog library can remain on the device until the app next starts, and if the app comes back to the foreground in that time, the library creates a new random session identifier; none of this is sent (see 3.1). If you agreed to an earlier version of the question's text that covered usage statistics only, that yes no longer applies and the app asks again; a "No thanks" to that version stays.

Who your answer applies to: A yes belongs to the account you are signed in with when you give it. If you are not signed in when you give it, it belongs to the first account you sign in with on this device afterwards, including a guest account the app creates for you. If you link a guest account to Apple or Google, it stays the same account. If another account signs in on this device, your yes does not apply to it: the app stops sending, resets PostHog on the device (see 3.1), sends nothing for that account and asks again on the home screen. This is not a withdrawal, so the app has nothing deleted: what it sent for your account until then stays stored at PostHog. We have it deleted as described in 5: once no event has come in for it for 12 months, with your account (see 6), after a withdrawal on a device where your yes applies (see below), or on request. Answering "No thanks" when asked again is not such a withdrawal and deletes nothing. If you want the data deleted sooner, email hello@pakumedia.de with the account's friend code. We check the request before we delete anything; if we have reasonable doubts that it comes from you, we will ask for additional information first (Art. 12(6) GDPR). After you sign out, your yes stays stored on this device until another account signs in; but the app then records nothing until you sign in with your account again. If you delete your account, the app resets your answer, a "No thanks" too, and asks again afterwards. Otherwise a "No thanks" applies to the device, including every other account you sign in with on it. Your answer only applies on the device where you give it. If you use your account on several devices, the app asks on each device, and a withdrawal only stops sending on the device where you declare it. The deletion request after a withdrawal (see below), however, concerns all data about your account stored at PostHog, including data from your other devices; if you agreed there, the app keeps sending from those devices afterwards.

If you agree, the app sends the following through the PostHog service (see 4.4):

Usage statistics:

• which screens you open and which features you use, for example game started or finished, room created or joined, setting changed, share menu opened (see 3.11), Party Pass viewed, purchase started, cancelled or completed (with the plan chosen and the place in the app where you opened the Party Pass page), purchases restored, each with details such as game variants, board length or the number of teams and players,
• error codes when an action fails: when our server refuses it (for example "room full" or "update required"), there is no connection, or a purchase or restoring purchases fails,
• that you agreed and to which version of the question's text (as proof of your consent).

Error reports, when an unexpected error occurs in the app (uncaught JavaScript errors, unhandled promise rejections and errors while rendering the screen):

• the error type and the error message. Before sending, the app removes from the error message links (with any scheme such as "https://", or beginning with "www."), email addresses, random identifiers (UUIDs), tokens in JWT format (for example sign-in tokens), text in double quotes, straight (") or typographic (for example “…”), the values in database error messages of the form "(column)=(value)" and room or friend codes as far as the app recognises them (codes with at least one digit, and codes right after the word "code" or "room"), and cuts it to 500 characters,
• the stack trace: file, function, line and column in the app's program code, including the libraries it contains. The app does not send local variables or source lines; it replaces random identifiers (UUIDs) in file paths, such as that of the installation folder, with a placeholder.

If an error occurs while rendering the screen, also right at the start of the app, the app does not close but shows the message "Something went wrong" with a "Try again" button. With your consent it sends an error report on it as described above, but without the information which screen elements were being built (component stack). If an error closes the app, the report may be stored on your device and sent at the next start, but only if you still consent then. The app does not send crashes of the app itself (native crashes) to PostHog. We only receive such crash reports from Apple if you have allowed sharing with app developers in your iOS settings. So that error reports are readable, we upload the source maps of the app's program code to PostHog. They contain no personal data. PostHog groups similar error reports into issues. An issue's name and description are only the error type, not the error message. An issue has no link to any person and remains when your data is deleted.

With every event and every error report:

• app version and build number, the app's name and identifier, app language, device type (iPhone or iPad), operating system and its version, screen size, and the device's language setting and time zone,
• the screen currently open (only as a pattern such as "/game/[id]", without any room, game or user identifier) and a random session identifier,
• whether you use a guest account, your level, your Party Pass status and the version of the question's text you agreed to,
• PostHog's identifiers: a random identifier that PostHog stores on your device and, while you are signed in (a guest account too), your user identifier from our system (player ID). PostHog creates a profile for it, also without an account (see 5). When you sign in, PostHog links the random identifier to your user identifier. The data sent earlier under this identifier are then also linked to your account.

Not sent are console output, logs of your previous steps, screenshots and recordings of your session. We deliberately send no names, no text you type, no drawings, room codes or camera images and no location. The app cleans error messages before sending as described above; we cannot fully rule out that an error message still contains a fragment of such content, for example a name.

IP address: With every transmission PostHog receives your device's IP address; this cannot be avoided technically. PostHog does not store it with your events and error reports and does not derive a location from it. On the way to PostHog, the network provider named in 4.4 may also see it.

We use the data only to improve the app and the Party Pass and to find and fix errors, for example to see which features are used, where players stop, from where the Party Pass page is opened and which plan is chosen, how many purchases are started and completed, and which errors occur how often. We do not use them for advertising or for automated decisions about you, and we do not pass them on to third parties.

Legal basis: your consent (Art. 6(1)(a) GDPR; for storing and reading the identifiers and data not yet sent on your device, Sec. 25(1) TDDDG). You can withdraw it at any time with effect for the future. From then on the app sends no more usage data or error reports, deletes data not yet sent from your device and resets PostHog on your device (see 3.1). If, despite the cleaning, an error report exceptionally contains details about another person, such as another player's name, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is finding and fixing errors in the app. We do not analyse such details, they are deleted with the error report (see 5), and the person concerned can object (Art. 21 GDPR).

Whatever your answer, the app stores on your device what is needed to carry out and prove your decision: your answer (for a yes, with the user identifier it belongs to), after a withdrawal any deletion requests not yet sent (with the user identifier of the account the yes belonged to or with this device's random PostHog identifiers) and, until the app next starts, PostHog's note that nothing may be sent (Sec. 25(2) No. 2 TDDDG; Art. 6(1)(c) GDPR in conjunction with Art. 7(1) and Art. 17 GDPR, and for a stored "No thanks" Art. 6(1)(f) GDPR: our interest in respecting your decision without asking again). The other leftover data of the library until the next start (see 3.1) arise for technical reasons, because the library cannot be removed completely without restarting the app; the app does not send them, does not analyse them and deletes them as soon as it starts without your consent.

Deletion after a withdrawal: We then have data already sent deleted at PostHog without you having to contact us; for the data linked to your account, this applies as long as you are signed in with the account your yes belongs to or sign in with it on this device again.

• Data linked to your account: If you are signed in with the account your yes belongs to, our server immediately sends its user identifier to PostHog with the instruction to delete the matching person with all usage data and error reports, including those sent earlier under a linked random identifier. If you are not signed in with that account at the moment, the app keeps the request on your device and sends it as soon as that account is signed in on this device again. Until then the data stay stored at PostHog. If you no longer sign in with that account on this device, or you delete the app first, email hello@pakumedia.de with the account's friend code. We check the request and then delete the data by hand; if we have reasonable doubts that the request comes from you, we will ask for additional information first (Art. 12(6) GDPR).
• Data linked to this device: Our server also sends this device's random PostHog identifiers to PostHog with the same instruction, even if your yes belongs to no account. The app sends this request as soon as an account is signed in on this device, a guest account too (see 3.2); until then it stays stored on the device. Data under an earlier random identifier that was never linked to an account (for example if the app was deleted before any account had signed in on it) cannot be attributed to a person. We have them deleted once no event has come in for them for 12 months (see 5).

If the app could not send a request, for example without a connection, it stays stored on your device, and the app tries again at every start and every sign-in (the request for an account as soon as that account is signed in, the one for the random identifiers as soon as any account is signed in). Of the random identifiers not yet sent, the app keeps at most the 16 newest (this is only reached after many withdrawals without a connection); data under older ones we have deleted under the 12-month rule (see 5). As soon as a request reaches our server, it passes it on to PostHog immediately. If PostHog had data for it, our server repeats the request, usually in the next daily run and at least 15 minutes later, so that data still on their way at that moment are covered too. If the deletion at PostHog fails, we proceed as when an account is deleted (queue, see 5 and 6). After a deletion we free the identifier at PostHog, so that data arriving under it later (for example if you agree again) form a new person that can be deleted in the same way. PostHog removes the events and error reports of a deleted person with a delay, usually within a few days. The same applies when an account is deleted (see 6). The legal basis for sending the identifiers is Art. 6(1)(c) in conjunction with Art. 17 GDPR.

If you email hello@pakumedia.de, we also have data linked to your user identifier at PostHog deleted by hand without a withdrawal, without undue delay once we have checked the request. How long the data are kept if you do not withdraw is set out in 5.

3.16 Analysis of game data#

To improve word cards and game rules, we analyse data from online games (see 3.5) and from the Pass & Play match history (see 3.4) in aggregated form, for example how often a term was guessed, skipped or ended with a foul, and how long that took on average. For this we compute totals and averages without any link to individual people. We keep these aggregated figures even after the underlying game data has been deleted.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a game that plays well with understandable terms. You can object to this processing (Art. 21 GDPR).

4. Recipients and processors#

Supabase, RevenueCat, LiveKit and PostHog (4.1 to 4.4) process data on our behalf. We have concluded data processing agreements under Art. 28 GDPR with them. Apple and Google (4.5), other users (4.6) and authorities (4.7) are not processors.

4.1 Supabase (database, sign-in, file storage, server functions, real-time)#

Contracting party: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. The database, the sign-in system and the storage for profile pictures are located in the EU-Central region (Frankfurt am Main, Germany). Server functions and the real-time service may run in another Supabase data center closer to the request. Access by Supabase from outside the EU (e.g. for support) cannot be ruled out. It is covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4.2 RevenueCat (subscription management)#

RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. Processes the data listed in 3.12. The transfer to the USA is covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4.3 LiveKit (live video)#

LiveKit Incorporated, 369 Sutter St, San Francisco, CA, USA. The live camera runs on LiveKit Cloud. LiveKit relays the video through the nearest data center of its global network and does not store it. The video may pass through servers outside the EU on the way. LiveKit also receives your IP address, your user identifier and your display name. LiveKit is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). The EU Standard Contractual Clauses apply in addition.

4.4 PostHog (usage statistics and error reports, only with consent)#

PostHog, Inc., San Francisco, California, USA. Processes the usage data and error reports listed in 3.15, and only if you agreed. In doing so, PostHog also receives your device's IP address, which cannot be avoided technically, but does not store it with your events and error reports and does not derive a location from it (see 3.15). We also upload the source maps of the app's program code to PostHog (no personal data, see 3.15). Without your consent, PostHog only receives deletion requests about you from us: when an account is deleted (a guest account too, and even if you never agreed), our server sends its user identifier; after a withdrawal, the user identifier of the account the yes belonged to and the device's random PostHog identifiers; each with the instruction to delete the matching person with all usage data and error reports stored there (see 3.15 and 6, which also give the legal basis). For guest accounts we delete after 90 days, our server first checks with PostHog which of their user identifiers it holds data for and has only those deleted. We also have profiles deleted there that have received no event for 12 months (see 5). We use PostHog Cloud EU: the data is stored in the EU (Frankfurt am Main, Germany). PostHog is a US company and may also process the data in the USA and other countries, for example when PostHog staff access it for operations or support. On the way to PostHog, the data, your IP address included, may also pass through servers of a PostHog network provider outside the EU. PostHog, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). The EU Standard Contractual Clauses apply in addition (Art. 46(2)(c) GDPR).

4.5 Apple and Google#

• Sign-in: If you use "Sign in with Apple" or "Sign in with Google", Apple Distribution International Ltd. (Ireland) or Google Ireland Limited (Ireland) process your sign-in data as independent controllers under their own privacy policies.
• Purchases and distribution: Apple handles downloads, purchases, payments, trial periods, cancellations, refunds and ratings as an independent controller.

4.6 Other users#

As described in section 3, other players and friends see certain profile and game data. The only thing reachable outside the app is your profile picture, through its address.

4.7 Authorities#

We only pass data to authorities where we are legally required to.

5. Retention#

6. Deleting your account#

You can delete your account in the app at any time: Settings → Account → Delete account. We then permanently delete:

• your user account including the Apple or Google sign-in data,
• your profile and profile picture,
• your friend code, friendships, requests, invites and blocks (including blocks others placed on you),
• statistics, XP, season pass rewards, online status and Party Pass status,
• your Pass & Play match history, custom decks (including their copies from online games) and favorites,
• your participation in online rooms and games,
• your usage statistics and error reports at PostHog, if you had agreed. The app first deletes data not yet sent from your device, resets PostHog on your device (see 3.1) and resets your answer to the question; the app asks again afterwards (see 3.15). Then our server sends your user identifier to PostHog with the instruction to delete the matching person with all usage data and error reports, including those sent earlier under a linked random identifier. We do this even if you never agreed (then there is nothing to delete): your answer to the question is stored only on your device, so our server does not know who agreed. The legal basis is Art. 6(1)(c) in conjunction with Art. 17 GDPR; if you never agreed, Art. 6(1)(f) GDPR: our legitimate interest is to carry out deletions completely without having to store on the server who agreed. If PostHog had data about you, our server repeats the request, usually in the next daily run and at least 15 minutes later, so that data still on their way are covered too. PostHog removes the events and error reports with a delay, usually within a few days. If the deletion at PostHog fails, your user identifier stays in a queue for this purpose and we retry during the daily cleanup, up to 14 times (see 5). If it still fails, we delete your profile at PostHog with its events and error reports by hand; you don't need to ask us again for this.

The following remain without any link to you: drawings and game events from online games that appear in other participants' match history, and reports you filed. Reports about you remain while they are handled (see 5). Exception: if someone saved one of your drawings as a favorite, that copy stays in that person's profile with the display name saved at the time, until they remove the copy or delete their account.

Not deleted automatically is your customer record at RevenueCat (user identifier and purchase history). Email us at hello@pakumedia.de and we will have it deleted. Apple keeps purchase records according to its own rules.

Important: Deleting your account does not cancel a running subscription. The app reminds you of this before deleting. Cancel the Party Pass first in your Apple subscription settings (in the app: Settings → Party Pass → Manage subscription).

You can also request deletion by email to hello@pakumedia.de. We check the request before we delete anything; if we have reasonable doubts that it comes from you, we will ask for additional information first (Art. 12(6) GDPR).

7. Your rights#

You have the right to

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR), e.g. your consent to usage statistics and error reports in the app (Settings → Legal → Share stats & error reports) or camera access in your device settings.

Contact us at hello@pakumedia.de.

We do not make automated individual decisions, including profiling, within the meaning of Art. 22 GDPR.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.

8. Children and teenagers#

Pass & Play on one device can be played at any age. An account with Apple or Google, the online features (rooms, friends, live camera) and the Party Pass are intended for people aged 16 and over. If you are under 16, you may only use them with the consent of your parent or guardian. The same applies to consenting to usage statistics and error reports (see 3.15): by tapping "Allow", on the home screen or after turning on the switch in the settings, you confirm that you are 16 or older or that your parent or guardian agrees. The text of the question says so above the buttons. If neither is true, tap "No thanks".

If you believe a child has given us data without the required consent (including through usage statistics and error reports), email hello@pakumedia.de, ideally with the account's friend code (Friends tab). The friend code helps us find the account but proves nothing, because it can be passed on. So we only delete once we have checked that the notice comes from the child or their parent or guardian and that the account belongs to the child, and we ask for additional information for this (Art. 12(6) GDPR). If the notice is confirmed, we have the account's usage statistics and error reports deleted at PostHog and, if the parent or guardian asks for it, we delete the account with its data as described in 6 (this does not cancel a running subscription). It is quicker on the child's device: there a parent or guardian can withdraw the consent themselves (Settings → Legal → Share stats & error reports); the app then also has the usage data and error reports already sent deleted, as described in 3.15. They can also delete the account there themselves (Settings → Account → Delete account), including at PostHog. Data under an earlier random identifier that was never linked to an account cannot be attributed to a person; we have them deleted once no event has come in for them for 12 months (see 5).

9. Security#

Connections between the app, our servers, LiveKit and PostHog are encrypted (TLS). Access rules in the database (Row Level Security) restrict every record to the people entitled to it. Game-deciding and security-relevant writes run only through verified server functions.

10. Changes#

We update this privacy policy when the app or the law changes. The version linked in the app applies.