Privacy policy

Who is responsible

The controller and developer is Mateusz Data, operating HalfEvidence. Privacy contact: [email protected]. This policy covers the HalfEvidence website and native iOS and Android apps.

Data needed to play

We process a guest or registered user ID, email and sign-in provider identifiers where supplied, your chosen nickname, room membership, progress, answers, hints, XP and chat messages. Supabase Auth handles passwords and authentication. We do not automatically publish the name supplied by a social sign-in provider.

Purposes and legal bases

Account access, saved investigations and two-player communication are necessary to provide the service you request (performance of a contract). Security, abuse prevention, technical diagnostics and handling support requests serve our legitimate interests in operating a safe service. Optional website analytics and advertising rely on your separate consent. We may process records to meet a specific legal obligation when applicable.

Visibility and service providers

Your partner sees the conversation and shared decisions; private evidence is assigned by role. The public ranking displays eligible players’ nicknames, level, XP and rewarded story count. It does not display emails. Authorized support staff can review a reported message and the context supplied in the report.

Supabase provides authentication and the game database. Hetzner hosts the web/API service and Cloudflare provides network protection and delivery. Requests expose technical connection information, including IP addresses, to the infrastructure handling them. If you choose Apple or Google sign-in, that provider processes the authentication under its own privacy terms. Service providers may process data outside the EEA; applicable safeguards and the specific deployment settings must be considered for those transfers.

Retention and deletion

We keep your saved account and game data while the account exists so you can return to your investigations. You can permanently delete a registered or guest account using Delete account. Your own messages and personal game records are removed from the live database; the deletion page explains how shared investigations are affected. Reports are accessible only to authorized moderation staff and are removed with either associated account. Resolved reports are cleaned up after 30 days by the maintenance process.

Technical logs, support correspondence and any recovery backups have separate retention depending on the service configuration and the purpose of the record. Account deletion does not automatically erase records held independently by sign-in, email or advertising providers. Contact [email protected] for a request covering those records. We do not use deleted live accounts for marketing.

Your choices and rights

You can request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw optional consent without affecting earlier lawful processing. Contact [email protected]. We may verify ownership before disclosing or changing data. You may lodge a complaint with your local data protection authority, including the Polish UODO. No automated decision making with legal or similarly significant effects is used.

Website cookies and optional tracking

Essential session cookies keep you signed in; a language cookie stores your choice for one year. Separate analytics and marketing choices are remembered for 180 days. You can reopen Cookie settings from the footer. Refusing optional cookies does not prevent playing.

After analytics consent, Google Analytics 4 measures visits to public home, catalog, story and how-to-play pages. It receives page views, a random cookie identifier and technical browser/device information; the connection also exposes your IP address to Google. The _ga and _ga_MR3Y7XEQDM cookies last up to 180 days without automatic renewal. Google Signals and advertising personalization are disabled.

After separate marketing consent, Meta Pixel measures public page views for advertising on Facebook and Instagram. Meta receives page addresses, cookie IDs, IP and browser/device details and may associate them with your Meta account. Advanced matching and automatic events are disabled. Meta may set _fbp and cookies on its own domains. Withdrawing consent stops future tracking and removes relevant cookies on our domain; it does not erase data already received by Google or Meta.

Tracking is excluded from game rooms, accounts, invitations, authentication, help, safety and deletion pages. We do not send chat, email, nickname, private codes or answers to Google Analytics or Meta Pixel. Query strings and fragments are not forwarded. The native app contains neither GA4 nor Meta Pixel, and does not request advertising tracking permission. Optional tracking may apply if you separately visit the marketing website in a browser and consent there.