Privacy Policy

Effective Date: April 12, 2026

Last Updated: July 29, 2026

OK or NOK (“the App”) is operated by Made by ACG (“we”, “us”, “our”). This Privacy Policy explains how we collect, use, store, and protect your information when you use the App.

1. Information We Collect

1.1 Information You Provide

What other players can see. When you join a room, the other players in that room see your nickname (which defaults to your account name if you do not choose one), your avatar — your profile photo if you have set one, otherwise the emoji and colour you picked — and how you voted once a round has been revealed. They do not see your email address or your subscription status. If you would rather not show your face, leave the profile photo unset and your emoji avatar is used instead.

1.2 Information Collected Automatically

1.3 Information We Do NOT Collect

• Precise location or GPS data
• Contacts or address book
• Photos, camera, or microphone data (except optional avatar upload)
• Browsing history
• Advertising identifiers (no ad SDKs are used)
• Health, financial, or biometric data

2. How We Use Your Information

We use the information we collect to:

• Provide the service — Create and manage your account, host and join game rooms, display game results.
• Process purchases — Manage subscription entitlements via RevenueCat (see Section 4).
• Send notifications — Game invitations, turn alerts, and important service updates (only if you opt in).
• Improve stability — Identify and fix crashes and bugs via error tracking (see Section 4).
• Personalize experience — Remember your language, theme, and onboarding preferences.

We do not use your data for advertising or ad targeting, selling or renting to third parties, behavioral profiling or tracking across apps, or automated decision-making that produces legal effects.

3. How We Store and Protect Your Information

• Backend: Your data is stored on our self-hosted Appwrite instance, deployed in Europe via Dokploy. We maintain full control over the server infrastructure.
• Encryption in transit: All data is transmitted over HTTPS/TLS.
• Encryption at rest: Database encryption is handled at the infrastructure level by the hosting provider.
• Access control: All database documents use Appwrite's document-level permissions. You are the only person who can modify your own data, and your account record — email address, subscription status, notification token — is readable only by you. The small amount of information that has to be visible to the people you play with (nickname, avatar and profile photo, votes once a round is revealed) is stored on the record for that game room and is readable by signed-in users of the App.
• Sensitive tokens: Authentication tokens are stored in the device's secure enclave (iOS Keychain / Android Credential Manager) via expo-secure-store.

4. Third-Party Services

We use the following third-party services. Each processes data solely for the stated purpose:

4.1 RevenueCat (Subscription Management)

• Data shared: Your account identifier (the same id that identifies your account in our own database — it is not anonymous), purchase transactions, and subscription status.
• Purpose: Processing in-app purchases and managing subscription entitlements.
• Privacy policy: revenuecat.com/privacy

4.2 Sentry / GlitchTip (Error Tracking)

• Data shared: Error stack traces, device type, OS version, app version, and your account identifier (the same id used elsewhere in our systems). Email and IP addresses are stripped before transmission.
• Purpose: Crash reporting and diagnostics.
• Hosting: Self-hosted GlitchTip instance (same infrastructure as our backend).

4.3 Expo (Push Notifications)

• Data shared: Expo push token, project ID.
• Purpose: Delivering push notifications.
• Privacy policy: expo.dev/privacy

4.4 Apple Sign-In / Google Sign-In

• Data shared: OAuth token exchange only. We receive your name and email (Apple may provide a relay email). Google Sign-In provides your name and profile photo URL.
• Purpose: Account creation and authentication.
• Privacy policies: Apple · Google

We do not integrate any advertising networks, analytics platforms (such as Firebase Analytics, Amplitude, or Mixpanel), social media SDKs, or cross-app tracking tools.

5. Data Retention

5.1 Abuse reports

The App lets any player report another player in a room. Filing a report stores the room code, the reason chosen, the reported player's nickname, whether they were showing a profile photo, and the account identifiers of both the reporter and the reported player. We use this only to review abuse and act on it.

Abuse reports are kept for 12 months and are not deleted when an account is deleted, in either direction. This is deliberate: if deleting an account also erased the reports about it, anyone could harass a room and then destroy the record on their way out, and erasing the reports a departing user had filed would gut open cases about people who are still here. Once an account is gone, the identifiers in the report no longer resolve to anyone.

No one using the App can read these reports. The App can only file one; it cannot read back anyone else's, and reports cannot be edited or deleted from the App by anybody, including the person who filed one.

6. Your Rights

You have the right to:

• Access your personal data — View your profile information in the App.
• Correct your data — Edit your name, nickname, and avatar in the App.
• Delete your account and all associated data — Go to Settings > Delete Account in the App, or use our account deletion page if you can no longer sign in.
• Withdraw consent — Disable notifications at any time via Settings. Revoke OAuth access via your Apple or Google account settings.
• Data portability — Contact us at [email protected] to request an export of your data.

EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation. We process your data based on (a) your consent (notifications, optional profile data), (b) contractual necessity (account creation, gameplay), and (c) legitimate interest (error tracking, service improvement). You may object to processing based on legitimate interest by contacting us, and you may file a complaint with your local data protection authority.

California Residents (CCPA)

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising.
• You may request deletion of your data via the in-app account deletion feature or via our account deletion page.

7. Children's Privacy

OK or NOK contains content categories suitable for different audiences. Certain decks are marked as adult content (18+) and are gated behind an age verification prompt. We do not knowingly collect personal information from children under 13 (or under 16 in the EU). If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via in-app notification or by updating the “Last Updated” date above. Continued use of the App after changes constitutes acceptance of the updated policy.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data:

• Email: [email protected]
• Developer: Made by ACG
• Website: madebyacg.com

← Back to home