Privacy Policy

Last updated: 2026-07-18 This Privacy Policy explains how data is processed when using the mobile app "TryMe: Truth or Dare" ("App"). 1. Controller Moritz Heinemann Loewenmuehlstr. 1, 94034 Passau Email: hi@trymegame.app 2. General legal basis and principles We process personal data only as necessary to provide a functioning app and services. Depending on context, legal bases may include: - consent (Art. 6(1)(a) GDPR) - contract performance (Art. 6(1)(b) GDPR) - legal obligation (Art. 6(1)(c) GDPR) - vital interests (Art. 6(1)(d) GDPR) - legitimate interests (Art. 6(1)(f) GDPR) Data is deleted or restricted when the storage purpose no longer applies, unless statutory retention obligations require otherwise. 3. App access and log data When the app is accessed, technical data may be processed, such as: - device information - app version - installation ID - anonymized IP address - access time - crash/error logs Purpose: operation, security, and technical optimization. 4. Registration and account data Possible account data: - email address - authentication provider (Apple or Google) - provider-specific user identifier (Apple ID / Google ID) - username - optional profile picture - registration date - last login timestamp Purpose: account creation and app feature access. 5. Profile data Profile information (e.g. username/avatar) can be visible to members of shared groups. 6. Group data When joining/creating groups, we may process: - group identifiers and names - membership status/role information - participation metadata Purpose: group functionality and game organization. 7. Games and challenges When participating in games/challenges, we may process: - game/challenge IDs and participants - game content and responses - uploaded media - status and timestamps 8. Media uploads (photo/video) Uploads may include file data, metadata, and links to account/game records. Media storage may be provided through Supabase Storage. Uploaded images may be compressed for performance. 9. Group chat Chat functionality may process message text, optional media, sender/group IDs, and timestamps. 10. Push notifications For push notifications, we may process: - Expo push token - device platform data - account linkage You can revoke push permission in device settings. 11. Service providers (including Supabase) We use processors/providers (including Supabase, Expo, RevenueCat, and PostHog) for infrastructure, analytics, and purchase services. Privacy details: - Supabase: https://supabase.com/privacy - Expo: https://expo.dev/privacy - RevenueCat: https://www.revenuecat.com/privacy - PostHog: https://posthog.com/privacy Where data transfers occur outside the EEA, appropriate safeguards (e.g. SCCs) are used as required. For paid upgrades, we may also process purchase and billing-related data (e.g. product identifier, purchase timestamp, subscription/purchase status, and transaction-related identifiers) to: - assign personal upgrades to the specific user account (recurring monthly subscription) - assign group upgrades to the selected group (one-time purchase) Data is shared only where necessary for payment processing and delivery of purchased features. 12. Analytics and session recording (PostHog) 12.1 Provider PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Hosting is provided via PostHog Cloud EU with servers in Frankfurt, Germany. 12.2 Data processed - usage and event data (e.g. screens viewed, interactions, app lifecycle events) - device and session information - user ID and email address (to associate events with a user account) - session recordings (session replay): recording of on-screen interactions. Text inputs and images are automatically masked; network request/response bodies are not captured. 12.3 Legal basis Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with future effect. 12.4 Purpose Analysis of app usage, error diagnosis, and improving stability and user experience. 12.5 International transfers Processing takes place primarily in the EU (Frankfurt). Where data is transferred to PostHog Inc. in the USA, this is based on Standard Contractual Clauses (Art. 46(2)(c) GDPR) and a data processing agreement (Art. 28 GDPR). 12.6 Retention Until consent is withdrawn or the data is no longer required for the purpose. 12.7 More information https://posthog.com/privacy 12.8 Website analytics and cookies (trymegame.app, daredb.trymegame.app) We also use PostHog on our websites. No analytics cookies are set and no data is transmitted until you consent via the cookie banner. Cookies used after consent: - "__ph_opt_in_out_<project id>": stores your consent decision. Set for the domain .trymegame.app, lifetime 12 months. - "ph_<project id>_posthog": contains a randomly generated identifier (distinct ID), the session ID and the device ID. Set for the domain .trymegame.app, lifetime 12 months. Because both cookies are set for .trymegame.app, your decision and your identifier apply to trymegame.app and daredb.trymegame.app alike. Data processed: pages viewed, interactions with page elements (autocapture), referrer, approximate location derived from the IP address, browser and device type. We do not use session recording or heatmaps on the websites. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TTDSG (consent). You can withdraw your consent at any time with future effect via the "Cookie settings" link in the footer of either website; deleting the cookies in your browser has the same effect. If you decline, no analytics cookies are set and no data is sent to PostHog. 13. Your rights You may have rights under data-protection law, including: - access - rectification - erasure - restriction - portability - objection - withdrawal of consent - complaint to a supervisory authority 14. Deletion Account deletion generally triggers deletion of associated personal data, subject to legal retention requirements and technical constraints. 15. Security We apply technical and organizational safeguards (e.g. hashing, encrypted transport, access control, updates), but no system is absolutely secure. 16. Data sharing with third parties Data is shared only when legally permitted or required (e.g. consent, contract performance, legal obligations, legitimate interests, processors). 17. Minors The app is intended for users aged 18+. 18. Policy updates We may update this Privacy Policy to reflect legal or service changes. 19. Contact Moritz Heinemann Loewenmuehlstr. 1, 94034 Passau Email: hi@trymegame.app Phone: +49 (0) 15204181320