(DRAFT – to be reviewed by a qualified professional)

Privacy Policy – Fiafia

Last updated: [DA MARCO: data di pubblicazione]

1. Who we are

The data controller is [DA MARCO: nome e cognome del titolare], an individual, [DA MARCO: recapito pubblico (indirizzo)]. For any privacy question, write to support@fiafia.games.

2. The short version

• We don't ask for your name, email or an account. You need no data at all to play the free decks.
• No ads, no analytics, no tracking inside the app.
• The game works offline. The network is only used for purchases and subscriptions.
• Purchases are handled by the store (Apple App Store or Google Play) and checked through RevenueCat, which receives a random identifier (a pseudonym) and your purchase history. Like any online service, RevenueCat also sees the IP address the request comes from. This is personal data, even though it doesn't include your name.
• Our website (fiafia.games) uses cookie-free statistics (section 6).

3. Data kept only on your phone

The app stores on your device, and sends to no one: your language, the cards already played, your confirmation that you are 18 or over (for the adult decks), your settings (such as "show adult decks") and the last known purchase status, so you can play offline. Delete it by uninstalling the app or with "Reset seen cards" in Settings. [TO CHECK with the professional: storage on the device strictly necessary for the service, ePrivacy rules.]

4. Purchases and subscriptions (Apple, Google, RevenueCat)

• Payment is handled entirely by Apple or Google through your store account. We never see your card details, name or email address. Apple's and Google's own privacy policies apply to that data; they act as independent controllers.
• Purchase checks: the app uses RevenueCat, Inc. (USA) as a processor to know what you have unlocked and to restore it. RevenueCat processes:
• a randomly generated app user ID (a pseudonym: not linked to your name or email, but it recognises the same device over time);
• your purchase history (product, date, price and currency, subscription status, store receipt);
• technical data needed for the service (such as device language/region, app and OS version) and the IP address the request comes from [TO CHECK in RevenueCat's DPA whether and for how long the IP is kept].
• Why: to deliver what you bought, validate receipts against fraud, restore purchases and see aggregated sales figures.
• Legal basis (UK/EU GDPR): performance of the purchase contract (Art. 6(1)(b)) and our legitimate interest in preventing fraud and understanding sales (Art. 6(1)(f)).
• Is it required? Only to buy: without the identifier and history a purchase can't be unlocked or restored. You don't need it to play the free decks.
• International transfers: RevenueCat is based in the United States. [TO CHECK: name the safeguard used – EU-US Data Privacy Framework / UK Extension and/or Standard Contractual Clauses – per RevenueCat's Data Processing Addendum.]
• Retention: for as long as needed for the service and as set out in RevenueCat's DPA [TO CHECK]; you can ask us to delete it (section 8).

5. If you contact us

If you email us (including through "Report this card", which opens your mail app with the card code and language), we receive your email address and your message. - Why: to reply and fix content. - Legal basis: our legitimate interest in answering requests and improving the cards (Art. 6(1)(f)); if your request is about a purchase, performance of the contract or steps you asked us to take (Art. 6(1)(b)). [TO CHECK with the professional.] - Who sees it: us and our email provider, [DA MARCO: fornitore della casella email], as a processor. - Retention: as long as needed to handle the request, at most 24 months [TO CHECK with the professional].

6. Our website (fiafia.games)

The website presents the game and hosts this policy, the Terms and the support page. - Hosting: Cloudflare Pages (Cloudflare, Inc., USA), as a processor. To show you the pages, Cloudflare necessarily processes your IP address and the technical data of the request [TO CHECK in Cloudflare's DPA: retention and safeguard for the transfer to the US]. - Statistics: Cloudflare Web Analytics, with no cookies and without identifying individual visitors. We count visits per page, the referring site, device and browser type, and country. - Where you came from: the page address shows the source (for example /tt-en = our English TikTok profile). We only use it to count visits per source. - Taps on the store button: we count how many times the App Store button (or "Android: coming soon") is tapped on each page; the counter records only the page and the number, not who you are. - The App Store button takes you to Apple through a "campaign link": from there Apple's privacy policy applies; Apple only shows us aggregated numbers (from 5 upwards) of visits, downloads and purchases per campaign. - Legal basis: legitimate interest in running the website and knowing, in aggregate, which channels bring visitors (Art. 6(1)(f)). - Cookies: the website uses no cookies or other tools that store information on your device, so it shows no banner [TO CHECK with the professional].

7. What we don't do

We don't sell data, profile you, make automated decisions about you, use your device's advertising ID, show ads, or ask for access to your contacts, photos, location, microphone or camera.

8. Your rights

You can ask for access, correction, deletion, restriction, objection and portability by writing to support@fiafia.games. To delete purchase data held by RevenueCat, please send us the purchase ID shown in Settings › Privacy in the app [TO ADD in the app before release: see revisione/per_lo_sviluppatore.md] or your store receipt. You can complain to your data protection authority (in the UK, the ICO: ico.org.uk). US residents: we do not sell or share personal information for targeted advertising.

9. Children

The app contains adult decks and is rated 18+ on the stores. It is not meant for anyone under 18 and does not knowingly collect children's data.

10. Changes

If this policy changes we will update the date above and mention important changes in the release notes.