Privacy Policy

Last updated: 2026-10-28 This policy covers the app "TryMe: Truth or Dare" ("App") and the websites trymegame.app and daredb.trymegame.app. 1. Controller Moritz Heinemann Loewenmuehlstr. 1, 94034 Passau Email: hi@trymegame.app 2. Data we process - Account: email address, sign-in provider (Apple or Google) and its user ID, username, optional profile picture, sign-up and last-login time. - Groups and games: group names and memberships, truths, dares, challenges, answers, chat messages, uploaded photos and videos, timestamps. - Purchases: product, purchase time, subscription status and transaction IDs, to assign a personal upgrade to your account or a group upgrade to the chosen group. - Push notifications: Expo push token and device platform. You can turn push off in your device settings. - Technical data: device type, OS and app version, IP address, crash reports. Your username and profile picture are visible to members of your groups; game content, chat and uploads are visible only to members of the group they belong to. Dare photos and videos are private and only accessible to group members via short-lived signed links. Legal basis: Art. 6(1)(b) GDPR (providing the App), Art. 6(1)(f) GDPR (security and error diagnosis), Art. 6(1)(a) GDPR (consent: push notifications, analytics), Art. 6(1)(c) GDPR (legal retention duties). 3. Service providers - IONOS SE, Germany: hosting of our servers and database. - Cloudflare, Inc., USA: storage of photos, videos and profile pictures (Cloudflare R2). - Expo (650 Industries, Inc.), USA: delivery of push notifications. - RevenueCat, Inc., USA: in-app purchase management. Payment itself is handled by Apple or Google. - Sentry (Functional Software, Inc.), EU data region: crash reports, without screenshots and without email address. - PostHog Inc., PostHog Cloud EU (Frankfurt): analytics, see section 4. - GIPHY: when you search for a GIF in the chat, your search term is sent to GIPHY. - Apple and Google: sign-in. All processors are bound by data processing agreements (Art. 28 GDPR). Transfers outside the EEA rely on the EU-US Data Privacy Framework or Standard Contractual Clauses (Art. 46(2)(c) GDPR). 4. Analytics (PostHog) App: usage events (screens viewed, interactions, app lifecycle), linked to your user ID. No session recording. Legal basis: Art. 6(1)(a) GDPR; you can withdraw consent at any time with future effect. Websites: no analytics cookies are set and no data is sent until you consent via the cookie banner. After consent we set two cookies for .trymegame.app (so they apply to both websites), each for 12 months: - "__ph_opt_in_out_<project id>": stores your consent decision. - "ph_<project id>_posthog": a random identifier (distinct ID), session ID and device ID. We then process pages viewed, clicks on page elements, referrer, approximate location derived from the IP address, and browser and device type. No heatmaps on the websites. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Withdraw via "Cookie settings" in the footer or by deleting the cookies. 5. Retention and deletion We keep data while your account exists. Deleting your account in the App settings deletes your personal data and uploads, unless legal retention duties apply. Content you posted in groups may stay visible to members until the group is deleted. 6. Your rights Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority (Art. 15-21, 7(3), 77 GDPR). Contact hi@trymegame.app. 7. Security Encrypted transport (TLS), access controls and regular updates. No system is absolutely secure. 8. Minors The App is intended for users aged 18+. 9. Changes We may update this policy; the current version applies.