01Who is responsible
The data controller is Oskar Śledź, the creator of Pyk, based in Poland. For privacy questions and requests, contact hello@oskarsledz.pl. This notice covers the Pyk mobile app and these public pages. Optional features process data only when they are available and you use them.
02Data, purposes & retention
You provide profile and sign-in details, photos, feedback and game actions. We also receive game and usage records automatically, reports from other players and, if you choose them, sign-in or purchase information from service providers.
| Data | Purpose | Retention |
|---|---|---|
| Nickname, @handle, random account ID, chosen cosmetics and optional profile photo | Your profile, discovery, friends and rankings. Only the photo you choose is uploaded, not your gallery. | Until account deletion; a chosen photo can be removed earlier. |
| Optional email and password; Google account ID, email, name and photo if you sign in with Google | Sign-in, linking and account recovery. Passwords are hashed by Supabase Auth, not stored as plain text. | Until account deletion. |
| Rating, match counts, wins, coins, inventory, reward and referral records, Pyk+ status | Ranking, rewards, cosmetics and purchase entitlements. | Until account deletion. |
| Friends, invitations and latest online activity | Social play. Online status is visible to friends only. | Relationships until account deletion or removal; activity is refreshed about every 30 seconds and cleared when the app goes into the background. |
| Match participants, scores, results and confirmed duel outcomes | Fair ranking, disputes and a duel balance between current, unblocked friends. | Match records and duel outcomes: up to 12 months. Account deletion removes your participation and duel histories; a match record and another player's own participation may remain until ordinary expiry. |
| Random Bluetooth presence token linked to your account | Resolve a nearby token to a player profile. | The server mapping expires after 15 minutes unless refreshed. The app uses a new token when restarted; expiry of a mapping is not automatic token rotation. |
| Usage events, timestamps and account ID in Supabase | Measure use and improve the app. Event parameters exclude names, emails, invitation tokens and opponents' IDs. | 90 days or earlier account deletion. |
| Firebase Analytics events, installation identifier, device and app details, approximate country derived from IP | Usage, retention and device statistics. Pyk does not set the Pyk account ID in Firebase or collect advertising IDs. | Under the project's Google Analytics retention settings. Detailed event/user data defaults to 2 months; aggregate reports may last longer. Contact us for the currently configured period. |
| Push device token and notification delivery records | Friend requests and game invitations. Notifications can include the sender's nickname. | Token until sign-out, account deletion or token expiry; server notification outbox: 7 days. |
| Product, store transaction ID, purchase/refund dates and Pyk+ expiry | Grant coins and subscription benefits, restore purchases and handle refunds. RevenueCat receives the account ID; Pyk does not send it your nickname or email. | Pyk records until account deletion. Store records follow Google/Apple's own legal retention. See deletion details below. |
| Optional feedback: description, category, optional email, platform, build and language | Handle bugs and ideas; reply if you provide an email. Sent through Web3Forms to our inbox, without a copy in Supabase and without automatically attaching account ID, logs or Bluetooth scans. | For handling the request and any necessary follow-up; provider and mailbox retention also applies. Request deletion by email. |
| Blocks, reports, moderation decisions: reporting/reported account, selected reason, optional shared match and time | Protect players and investigate abuse. Reports have no free-text field and are restricted to authorised moderators. | Until the related account is deleted or the relevant record is removed. There is no separate automatic expiry for these records in the current implementation. |
| Daily challenge attempts, scores, timing and reward records, when enabled | Limit attempts, validate scores and show a leaderboard of current, unblocked friends. Pending results are also stored locally for retry. | Account-linked server records until account deletion; pending local records are cleared on sign-out/deletion. No separate automatic history expiry is currently implemented. |
| Online queue ticket, supported game versions and queue/match times, when enabled | Pair compatible players, including people you do not know, and check queue quality; no GPS or Bluetooth data in tickets. | A waiting ticket expires after at most 120 seconds; ticket records are cleaned up after 180 days during queue entry or removed with the account. |
| Account-linked records of completed games and friend requests used for activation/retention statistics | Measure actual play and returning players, including after ordinary match records expire. Administrator reports are aggregate. | Until account deletion. |
03What other players can see
Players who can view your profile can see your nickname, @handle, avatar or photo, rating, game statistics, cosmetics and Pyk+ badge. Nearby discovery and player search can expose this profile to people who are not your friends. Your email and sign-in details are not displayed to them.
Friend relationships are available to the two people involved. Online status and daily challenge standings are limited to current friends. Duel balance is available to the participants while they are current, unblocked friends. Your opponent receives the gameplay information needed for a match. Your block list and reports are not a public feed.
04Bluetooth & phone permissions
Bluetooth: a random 8-byte token is advertised, without your nickname, account ID or phone name. Nearby scans stay on your phone; the app asks the server to resolve Pyk tokens, rather than uploading a list of surrounding devices. The token is pseudonymous, not anonymous: the server can link an active token to your profile, and an observer can recognise the same token during a session.
Location: Pyk does not collect GPS coordinates. Android 11 and earlier may require location permission for Bluetooth scanning; we do not use it to determine your position. Network providers and Firebase can process IP addresses, including to infer an approximate country.
Camera: used to scan a friend's QR code; camera frames are processed on the phone and not uploaded. Photos: only a selected profile photo is uploaded. Notifications: managed through your phone settings. Denying a permission disables its related feature, rather than granting unrelated data access.
We do not access your contacts or phone number, show ads, sell personal data, or share it for cross-context behavioural advertising.
05Why processing is permitted
For users in the EEA/UK, our bases are: performance of the service contract (GDPR Article 6(1)(b)) for accounts, gameplay, friends, rewards and purchases; legitimate interests (Article 6(1)(f)) in security, fraud prevention, fair rankings, support and proportionate service statistics, subject to your rights; and legal obligations (Article 6(1)(c)) where records or disclosure are legally required. Where consent is required for non-essential device storage/access or analytics, that processing requires consent (Article 6(1)(a)); accepting this notice or an operating-system permission is not an analytics consent.
The current app sends usage events automatically when the online backend and Firebase are configured and does not offer a dedicated analytics consent switch. You may contact us to object or request deletion; an email request does not itself switch off collection on your device. This notice does not replace any consent controls required by local law.
Essential account and gameplay data are needed to provide online play. Email sign-in, profile photos, feedback and purchases are optional. We do not use automated decisions producing legal or similarly significant effects; game ratings, scores and queue pairing are calculated automatically to operate the games.
06Service providers
- Supabase: authentication, database, storage and real-time gameplay. The production project is in the EU West region, Ireland.
- Google / Firebase: app analytics and Firebase Cloud Messaging when configured; Google also handles optional Google sign-in and Google Play purchases.
- Apple: APNs push delivery and App Store purchases where available.
- RevenueCat: purchase/subscription validation and entitlements when purchases are enabled.
- Web3Forms and our email provider: feedback delivery and support correspondence.
- GitHub Pages: hosting this website, including connection/security data.
Authorised administrators and moderators can access data needed for support, operations and safety. We may disclose data where legally required. App stores and sign-in providers also process information under their own terms; their independent records are not controlled by Pyk.
07Players around the world
Pyk is distributed internationally. The main Supabase project is in Ireland, but this does not mean every provider stores or accesses all data only in the EU. Google, Apple, RevenueCat, Web3Forms, GitHub and their subprocessors may process data in other countries, including the United States. Their service-specific transfer terms and safeguards apply; contact us for information about the providers and safeguards relevant to your data.
Where applicable, international transfers must meet local legal requirements, including adequacy decisions or appropriate contractual safeguards. A privacy notice, or your use of Pyk, is not by itself a valid transfer mechanism and does not waive your local rights.
EEA, UK and Switzerland: you may exercise applicable access, correction, deletion, restriction, portability and objection rights, withdraw consent where processing relies on consent, and complain to your local supervisory authority. In Poland this is UODO.
United States: where state privacy laws apply to Pyk, you may request access, correction, deletion or a copy of data, and appeal a refusal by contacting us with “Privacy appeal”. We do not sell data or share it for cross-context behavioural advertising. You will not be discriminated against for exercising applicable privacy rights; deleting essential data may prevent the service from working.
Brazil: where the LGPD applies, you may request confirmation, access, correction, portability, information about recipients, and anonymisation, blocking or deletion of unnecessary or unlawfully processed data, or withdraw consent where applicable. You can also contact the ANPD. See the Portuguese summary below.
Other countries, including Canada, Australia and Japan: contact us for access, correction, deletion, consent questions or complaints under applicable local law. Mandatory local protections take precedence over any conflicting wording in this notice. Regional rights depend on the law's scope; availability in a country does not mean that every privacy statute applies to Pyk.
08Your choices & requests
Write to hello@oskarsledz.pl with your request and @handle. If your account is secured, use the linked email where possible. We may request proportionate proof that you control the account; never send us your password, one-time sign-in code or payment card details. An authorised representative may contact us where local law permits.
We respond within the time required by applicable law, normally within one month for GDPR requests; if a lawful extension is needed, we explain it. If we cannot fulfil a request, we explain why and the available complaint or appeal route. You can edit profile details in the app, remove a profile photo, manage permissions in phone settings, remove friends, block players and request account deletion.
09Deletion & remaining records
Use Profile → Delete account, or follow our account deletion instructions without the app. This removes your authentication account, profile and account-linked server data, including friends, rewards, analytics events, push tokens, attempts, blocks/reports and duel histories. Photos are removed from Pyk storage as part of the app's deletion flow.
A match record and another participant's own data may remain until the 12-month limit. Pyk attempts to delete the RevenueCat subscriber through its server; this third-party step can fail independently and may need follow-up. Firebase events use a separate installation ID and are not automatically erased by deleting your Pyk account. Contact us about provider-held data; deletion depends on the identifiers available and the provider's process.
Feedback emails and providers' security, backup or legally required records are not automatically removed by the app action. Their applicable retention and deletion processes still apply. Deleting Pyk does not cancel an App Store or Google Play subscription; cancel it in the relevant store. Removing the app alone does not delete the server account.
10Age & young players
Pyk is intended for people aged 16 or older, or the higher minimum required by local law. It is not directed to children under 16, and does not offer a parental-consent flow or collect a date of birth for age verification. A store age/content rating does not override this rule. If local law requires a parent or guardian's involvement for a minor, that requirement still applies.
If you believe a child below the permitted age has provided personal data, contact us so we can investigate and delete it as appropriate. We do not knowingly collect data from children below the permitted age.
11Website, storage & security
The public home, privacy and deletion pages do not embed analytics, advertising, external fonts or trackers, and do not set cookies or browser storage. GitHub Pages processes connection information such as IP addresses and request metadata under its own privacy statement. Following store or provider links takes you to their services.
The separate administrator panel uses Supabase authentication and browser storage for an administrator's session; it is not required to read these public pages. The mobile app stores account/session settings and pending daily results locally. We use encrypted network connections and server access controls; no system can guarantee absolute security.
This notice describes the features currently implemented. Server-controlled or optional features may be unavailable in a particular build. It does not imply that disabled social invitation links or private user-created challenges are active.
12Changes to this notice
The update date appears at the top of this page. We publish revisions here and communicate material changes through an appropriate available channel, such as an in-app announcement. Where a new purpose requires consent, an updated notice alone is not consent.