Privacy Policy for Spellisimo

This Privacy Policy explains how Spellisimo ("the app", "we", "us") handles information when you use the mobile application developed and operated by Gabriel-Ionut Enache ("the developer"), based in Romania.

By downloading, installing, or using Spellisimo you agree to this Policy. If you do not agree, please do not use the app.

1. Who we are

Data controller: Gabriel-Ionut Enache
Contact: support@spellisimo.com
Jurisdiction: Romania, European Union

For questions, data requests, or complaints about this Policy, email the address above.

2. Information we collect

2.1 Information you provide

• Email address — required to create an account and sign in.
• Username / display name — visible to other players in duels, leaderboards, guilds, and chat.
• In-app messages and guild chat — any text you voluntarily post through the mail system, guild chat, or similar features.
• In-app purchases — the fact that you made a purchase, what you purchased, and the anonymised receipt identifier provided by Apple or Google. We do not receive or store your payment card details.

2.2 Information collected automatically

• Gameplay data — your progress, level, experience, currency balances, inventory, attribute points, duel results, dungeon and tower runs, guild membership, Wanderer's Path progress, quest completion, mail history, cosmetics, and related in-game state.
• Device information — device model, operating system version, app version, approximate time zone, language, and crash reports.
• Session information — login timestamps, in-game event timestamps, and anti-cheat/fair-play signals.
• Push notification token — a device-specific identifier issued by Apple (APNs) or Google (FCM) used to deliver quest reminders and guild war notifications. Stored only if you grant notification permission.

2.3 Advertising identifiers

When you choose to watch a rewarded advertisement (for example to claim the ad chest, double your duel victory rewards, reroll the daily shop, or claim your spin bonus), the Google AdMob SDK may access:

• Your Advertising ID (IDFA on iOS, AAID on Android). On iOS we only access the IDFA if you accept Apple's App Tracking Transparency prompt; if you decline, the ID is unavailable and you will see non-personalized ads.
• Coarse IP-based location, device model, and basic technical data used by Google to serve, measure, and report on ads.

We do not sell your data. Advertising processing is performed by Google in accordance with Google's own privacy policy, which is binding for all AdMob traffic.

3. How we use your information

We process the information above to:

• create and maintain your account and authenticate you on each session;
• save and synchronise your gameplay progress across sessions and devices;
• match you against other players in PvP, guilds, and guild wars;
• deliver in-app communications such as mail, broadcasts, guild messages, and quest/war reminders;
• process in-app purchases and confirm entitlements;
• display rewarded advertisements and allocate in-app rewards to you after you choose to watch one;
• detect and prevent fraud, cheating, abuse, and violations of our terms;
• debug crashes, fix bugs, and improve the game;
• comply with legal obligations (for example tax and consumer law).

Legal bases (GDPR)

Where GDPR applies, we rely on the following legal bases:

• Contract (Art. 6(1)(b)) — for account creation, game progression, matchmaking, and purchase processing.
• Legitimate interest (Art. 6(1)(f)) — for fraud prevention, security, basic analytics, and serving non-personalised ads.
• Consent (Art. 6(1)(a)) — for personalised advertising and for the use of your advertising identifier where required by law. You may withdraw consent at any time through your device settings or the in-app privacy controls described below.
• Legal obligation (Art. 6(1)(c)) — for retention of purchase records required by tax law.

4. Who we share information with

We share limited information with the following categories of service providers, who act as our processors or as independent controllers as indicated:

We do not sell your personal information. We do not share your email, username, or gameplay data with advertisers.

We may disclose information if required by law, court order, or to protect the rights, safety, or property of the developer, our users, or the public.

5. International data transfers

Our backend (Supabase) and advertising partner (Google) may process data outside the European Economic Area, including in the United States. Where this occurs, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

6. Data retention

• Account data: retained for as long as your account is active.
• Gameplay data: retained for as long as your account is active.
• Messages and guild chat: retained for up to 12 months to allow moderation and dispute resolution, then deleted.
• Purchase records: retained for the period required by tax and consumer-protection law (typically up to 10 years in Romania).
• Advertising identifiers and ad event data: handled by Google in accordance with Google's own retention rules.

If you request account deletion, we will delete your account data within 30 days, except for information we are required to retain by law (such as purchase receipts for tax purposes).

7. Your rights

Depending on your jurisdiction, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete your account and personal data.
• Restriction / objection — limit or object to certain processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — at any time, without affecting prior processing.
• Complain — lodge a complaint with a supervisory authority. In Romania this is the ANSPDCP (www.dataprotection.ro).

To exercise any of these rights, email support@spellisimo.com. We may need to verify your identity before acting on a request.

Advertising preferences

• iOS: Settings → Privacy & Security → Tracking — disable tracking for Spellisimo, or reset the IDFA in Settings → Privacy & Security → Apple Advertising.
• Android: Settings → Google → Ads — reset or delete the advertising ID, or opt out of ad personalisation.
• EU/UK/Swiss users: you may re-open the in-app consent form at any time from the app's settings screen to change your ad consent choice.

8. Children's privacy

Spellisimo is not directed at children under 13 (or under 16 in jurisdictions with a higher digital-consent age). We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

9. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS), access controls, and server-side row-level security on our database. No system is completely secure; if we become aware of a breach affecting your personal data we will notify you and the relevant authority as required by law.

10. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you inside the app. Continued use of Spellisimo after the update constitutes acceptance of the revised Policy.

11. Contact us

For any questions, requests, or complaints regarding this Policy or your personal data, contact:

Gabriel-Ionut Enache
Email: support@spellisimo.com
Country: Romania, European Union