Privacy Policy

Who is responsible

The controller of your personal data is [[FILL: operator's legal name]], [[FILL: business address]], NIP [[FILL: NIP]] ("we"). You can reach us at [[FILL: contact email]] about anything in this policy. We have not appointed a data protection officer.

This policy covers the pairplay app for iPhone and Android and the website pair-play.com. It follows Articles 13 and 14 of the GDPR.

In short

• What your desires and rewards say, your chat messages and photos are encrypted end to end on your phones. We store and pass on ciphertext that we cannot read.
• Our server does see some things in plain form: your email address and name, who you're paired with, time limits, when things happen and how each challenge ends, and your subscription status. The details are below.
• We don't sell data, show ads or use advertising trackers. Usage statistics are off unless you turn them on.

What we process, why, and on what basis

Your account

• Data: your email address; the name you choose (your partner sees it, and it is the title of the notifications they get); a sign-in id from Auth0; when you created the account and when you last used the app (updated at most once an hour); when you confirmed you're 18 or older and when you accepted the Terms of Use, with their version; a random billing id; and, if it comes to that, whether we blocked the account or signed you out on all devices.
• Passwords are handled by Auth0 only. We never see or store them.
• Why: to create and run your account (Art. 6(1)(b) GDPR, performance of the contract). We keep the age and terms confirmations to show what you accepted and when (Art. 6(1)(f), our legitimate interest in being able to prove it).
• You must give an email address, a name and the 18+ confirmation to use pairplay; without them we can't create an account.

Invites and pairing

• Data: invite codes (the code, who created it, when, when it expires and who used it), and the pairing itself: the two accounts, your names, and when you paired and unpaired.
• Why: to pair you up and run the game for the two of you (Art. 6(1)(b)).

The game

• What stays encrypted: the text of your desires and rewards is sealed on your phone before it is sent. We store the sealed copy and can't open it. The keys travel only between your two phones, through the encrypted channel.
• What we see: each desire's time limit (from 6 hours to 2 weeks); when items are created and changed; when a challenge is drawn, revealed, done and due; how it ended (fulfilled, skipped or expired); for a skip, the kind of reason (no time, not possible, not into it, something else), which your partner never sees; when a reward was redeemed; and how many items you have.
• Why: the server draws challenges, keeps deadlines and keeps your shared history (Art. 6(1)(b)).

Chat and photos

• Messages are encrypted on your phone (with the MLS protocol) and only your partner's phone can decrypt them. Our server holds each encrypted message until your partner's phone confirms it arrived, for at most 30 days. Alongside it we see which phone sent it to which, its type, when and in what order.
• Photos are re-encoded on your phone, which drops their metadata such as location, then encrypted with a key of their own. The encrypted file waits in our storage (DigitalOcean Spaces in Frankfurt) until your partner's phone downloads it, for at most 30 days; we see its size, who uploaded it and when. The key goes to your partner only inside the encrypted chat.
• Why: to deliver your messages (Art. 6(1)(b)).

Your phone and notifications

• Data: for the phone you use pairplay on, a random device id, the public keys the encrypted chat needs, a fingerprint of a secret that only that phone holds, when it was registered or replaced, and, if you allow notifications, its notification token and language.
• Notifications go through Firebase Cloud Messaging (Google) and, on iPhone, Apple Push Notification service. They carry your partner's name (or "pairplay") and a fixed text such as "A new challenge is waiting", never anything you wrote.
• Why: the encrypted chat and notifications (Art. 6(1)(b)).

Restaurant suggestions

When a revealed desire is about a restaurant, you can ask pairplay for places nearby. Only when you tap the search button, your phone sends our server the city, the cuisine you picked, a budget level, whether either of you prefers vegetarian or vegan food, and the app's language. Our server sends these to Google (Places API) and passes the results back. The desire itself is never sent. Google gets the request from our server, not from your phone, and we don't store the results.

Your city and other food preferences, such as allergies, stay on your phone. If you open a place, it opens in Google Maps, where Google's own privacy policy applies.

• Why: to give you the suggestions you asked for (Art. 6(1)(b)).

Subscription and payments

• Free trial: we record that the two of you paired and when the 14 days end, and when we told you the trial was ending.
• App Store and Google Play: Apple and Google sell the subscription and handle the payment. We learn, through RevenueCat, which product you bought, in which store, its dates, whether it renews and whether there is a billing issue. We never see card details.
• Web (pair-play.com): payments go through Stripe. Stripe receives your email address, the name and billing address you enter at checkout (for tax) and your payment details. We keep the link between your account and your Stripe customer, the terms version you accepted at checkout and your request to start immediately.
• RevenueCat keeps the subscription status for all three stores. It knows you only by your random billing id, never by your email or name.
• Why: to sell and run the subscription (Art. 6(1)(b)); to keep accounting and tax records (Art. 6(1)(c), Polish accounting and tax law).

Crash reports and usage statistics

• Crash reports (Sentry, EU data region): on by default; you can turn them off in the app (Us › Send crash reports). A report holds the app version, the phone model and system version, the error and the app's steps before it. Before a report leaves the phone, we strip email addresses, invite codes, encrypted data and web addresses; reports carry no screenshots, and Sentry doesn't keep your IP address. Our servers report their own errors to Sentry too, without request contents or passwords. Why: to find and fix faults (Art. 6(1)(f), our legitimate interest in an app that works). You can object at any time by turning them off.
• Usage statistics (PostHog, EU data region): off unless you turn them on, at sign-up or later in the app (Us › Share anonymous usage stats). They record events such as "invite shared" or "paired", with yes/no or category values only: never content, item types, cuisines, cities or names. They create no profile, aren't linked to your email address, and PostHog doesn't keep your IP address. Why: your consent (Art. 6(1)(a)), which you can withdraw at any time in the same place.

Logs and security

• Our servers log failed and slow requests: the time, the address requested (invite codes are masked), the result and your IP address. To stop abuse, we count requests per IP address and per account; those counters live in memory only.
• Auth0 records sign-ins (time, IP address, browser or device) to protect accounts from password guessing.
• Our team uses an admin panel to help people and deal with abuse. It shows account details, never encrypted content or notification tokens, and every action in it is logged with who did what and when.
• Why: security and preventing abuse (Art. 6(1)(f)).

This website

pair-play.com sets no cookies, runs no analytics and loads nothing from other companies; its fonts come from our own server. The web server sees your IP address and browser in its logs. If you sign in to manage a subscription, the session stays in your browser's session storage and memory, and is gone when you close the tab.

When you write to us

We use your email address and what you write to answer you (Art. 6(1)(f); Art. 6(1)(c) where the law requires us to respond, for example to a complaint). Account emails such as password resets are sent by Auth0 through [[FILL: email delivery provider used by Auth0]].

What we don't process

• The content of your desires, rewards, messages and photos: we can't read it.
• Your preferences from the app's onboarding. They stay on your phone; the ones you choose to share go only to your partner, encrypted.
• Your location, contacts or photo library (apart from the photos you send, encrypted).
• Advertising ids. There are no ad networks in pairplay, we don't sell data and we don't profile you for ads.

Who receives data

These companies process data for us, under contracts that bind them to our instructions, unless noted otherwise:

Apple and Google, as sellers of in-app subscriptions, and Stripe, for its own duties as a payment provider, act as separate controllers under their own privacy policies. Your partner receives what you choose to share in pairplay. We give data to public authorities only when the law requires it.

Transfers outside the European Economic Area

Some providers above are based in the USA or may reach data from there (RevenueCat, and the US companies behind Auth0, DigitalOcean, Google, Apple, Sentry and PostHog). Such transfers rely on the EU–US Data Privacy Framework, where the company is certified, or on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards.

How long we keep data

Your rights

You have the right to access your data and get a copy, to correct it (you can change your name in the app), to have it deleted (you can delete your account yourself, see Deleting your account), to restrict its use, to receive the data you gave us in a machine-readable form, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time; that doesn't affect what happened before.

Write to [[FILL: contact email]]. We answer within one month. We may ask you to confirm that the account is yours, usually by replying from its email address.

You can also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or to the data protection authority where you live or work.

Automated decisions

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Drawing a desire at random is part of the game, not a decision about you.

Adults only

pairplay is for people aged 18 and over. We don't knowingly process data about anyone younger; if we learn that an account belongs to a minor, we delete it.

Security

Content is encrypted end to end and data on the phone is encrypted too. Connections use TLS. Only the people who run pairplay can reach our systems, and our logs leave out passwords, tokens and encrypted content.

Changes to this policy

When this policy changes, we publish the new version here with its date. We tell you in the app about important changes before they take effect.