Privacy Policy

This policy explains what information DouzePoints collects when you use the website at douzepoints.app and the DouzePoints apps for iOS and Android (together, "DouzePoints" or "the Service"), how we use and share it, and the choices you have. DouzePoints is made and run by an independent developer based in Ukraine ("we", "us"). You can reach us at sasha.shysh23@gmail.com.

1. Information we collect

Data that stays on your device

The simulator works without an account. Your settings, the current simulation, voting presets, graphics drafts and similar data are kept in your browser's storage (on the website) or in the app's storage (in the apps). We don't receive this data unless you sign in and save something to your account, or share it.

Account information

An account is created when you sign in with Google, Apple or your email address. We receive and store:

• Google: your Google account ID, name, email address and profile picture.
• Apple: your Apple user ID, your email address (which may be a private relay address if you choose Hide My Email) and, on the first sign-in, your name if you choose to share it. We also keep a token from Apple whose only use is to revoke DouzePoints' access to your Apple ID when you delete your account.
• Email: your email address. Each time you sign in, we email you a one-time code and keep only a scrambled (hashed) copy of it until it is used or expires 10 minutes later.
• A username we generate for you, and the display name, country and profile picture you can change at any time.

Content you create

When you save or publish content, we store it with your account: contests (their setup, results, name, description and logo), custom themes (including the images, sounds and fonts you upload), graphics designs (including uploaded images), fonts in your font library, custom entries and their flags, folders, quick-select pins and the preferences you choose to sync to your account.

Activity

We store the users you follow, the items you like and save, which item a remix or added font came from, the reports you send (the reason and any note you add) and the users you block.

Technical data

• Sessions. To keep you signed in we store a session record with a hashed token, its expiry date, and the user agent and IP address of the device that signed in.
• Abuse protection. To stop sign-in codes being requested or guessed in bulk, we count requests per IP address and per hashed email address for up to a day.
• Server logs. Our servers and hosting providers process IP addresses and request data to deliver the Service and protect it from abuse.
• Error reports. When the app hits an error or a sign-in fails, it sends a report with the error, technical details about the device and browser (platform, user agent, language and screen size) and the state of the app at the time. When the iOS or Android app crashes, it sends a report the next time you open it, with what it was showing (such as the stage and theme), the last few things that changed on screen, and the device's memory size and number of processor cores. Error reports are not linked to your account.
• Website analytics. The website uses Umami Cloud, a privacy-focused analytics service that uses no cookies and collects no personal data, to count visits and measure page performance. The apps contain no analytics or tracking.

2. How we use information

• To provide the Service: your account, saving and syncing your content, publishing, following, leaderboards built from public contests, and sharing links.
• To show your profile and public content to other users.
• To keep the community safe: reviewing reports, removing content that breaks the Terms of Use, applying blocks and preventing abuse.
• To fix errors and improve the Service.
• To answer you when you contact us.

We don't use your information for advertising, we don't sell or rent it, and we don't make automated decisions about you that have legal or similarly significant effects.

If you are in the European Economic Area or the United Kingdom, we process your information to provide the Service you asked for (performance of a contract), for our legitimate interests in keeping the Service secure, working and free of abuse, and where the law requires it.

3. What other people can see

• Your profile (username, display name, country, profile picture, the date you joined and your follower count) is public.
• Content you make public (public contests, themes, designs and fonts, including the files you uploaded for them) can be seen, used and remixed by anyone, including people without an account, and shared with links. Completed public contests also count towards the global leaderboard.
• Uploaded files (images, sounds and fonts) are served from a public content delivery network, so anyone who has a file's link can open it, even if the item it belongs to is private.
• Your email address is never shown. Someone who already knows your exact email address can find your profile by searching for it.

4. Who we share information with

We share information only with service providers that process it on our behalf to run the Service:

• Cloudflare hosts the website, stores and delivers uploaded files and app content updates, and sends our sign-in emails.
• MongoDB Atlas hosts our database.
• Our cloud hosting provider runs the API server.
• Google and Apple provide sign-in with their accounts. They handle that sign-in under their own privacy policies.
• Umami provides anonymous website analytics.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a transfer of the Service to a new owner, who would remain bound by this policy.

These providers may process data in the United States, the European Union and other countries. Where the law requires it, transfers rely on safeguards such as the European Commission's standard contractual clauses.

5. How long we keep information

• Account data and content: for as long as your account exists.
• Session records: deleted automatically when they expire, 30 days after they were issued or last renewed.
• Sign-in codes: deleted when used, or automatically 10 minutes after they were sent. Request counts for abuse protection: deleted automatically within a day.
• Error reports: for as long as we need them to fix the problem.
• When you delete your account, we delete your profile, your content, your uploaded files (unless another user's copy still uses them), your likes, saves, follows, blocks and reports, and your sessions, and revoke our access to your Apple ID. Copies may remain in backups for a limited time before they are overwritten. Copies other users made of your public content (for example a remixed theme) belong to them and are not deleted.

6. Deleting your account

You can delete your DouzePoints account and its data at any time, in the iOS or Android app or on the website:

1. Sign in and open your profile from the main screen.
2. Choose Edit profile.
3. Under Account, choose Delete account and confirm.

Deletion is immediate and removes the data listed in section 5. If you can no longer sign in, email sasha.shysh23@gmail.com with your username and we will delete the account within 30 days once we have confirmed it is yours.

7. Your choices and rights

• Edit your profile, make your items private or delete them at any time.
• Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to complain to your data protection authority. Email us to use these rights; we answer within 30 days.

8. Cookies and storage

• Website: a secure, HTTP-only cookie on api.douzepoints.app keeps you signed in, and a short-lived cookie protects Sign in with Apple. There are no advertising or tracking cookies. Your browser's local storage and IndexedDB hold your settings, the current simulation and your drafts.
• Apps: your sign-in token is kept in the iOS Keychain or in storage protected by the Android Keystore; everything else is in the app's own storage. The apps download content updates from our servers, which see your IP address and the app version.

9. Security

Connections are encrypted with HTTPS, session tokens are stored hashed, and access to our systems is restricted. No system is perfectly secure, so please let us know if you find a problem.

10. Children

DouzePoints is not directed at children under 13, and they must not create an account (or the higher minimum age where you live). If we learn that a child has created an account, we delete it.

11. Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will also tell you in the app.

12. Contact

Questions or requests about your privacy: sasha.shysh23@gmail.com.