Privacy Policy – Squadrivo
Effective from: 28 September 2026
This policy explains what personal data we process when you play Squadrivo – the iOS and Android app or the web version at hra.squadrivo.cz (together the "game") – or visit squadrivo.cz, why we do it, and what rights you have. There is a short summary for younger players in section 7.
1. Who processes your data
The data controller is:
Dominik Vachun, Jablonského 474, 379 01 Třeboň
Email: privacy@squadrivo.cz
We are not required to appoint a Data Protection Officer. Please send any questions to the email above.
2. What data we process and why
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Account: email, nickname, account ID, password (hashed only) or identifier from Google / Apple sign-in; in the web game an email + password account | Creating and managing your account, sign-in, account recovery | Performance of a contract (b) | While the account exists; deleted within 30 days after account deletion |
| Year and month of birth | Checking the minimum age of 13 and applying protections for younger players (section 7) | Legal obligation (c), legitimate interest in protecting minors (f) | While the account exists |
| Game data: progress, stats, inventory, match results, friends, teams, leaderboards | Running the game, matchmaking, leaderboards | Performance of a contract (b) | While the account exists |
| In-game communication: chat messages, nicknames, reports and blocks | Player chat, profanity filtering, moderation, player safety | Performance of a contract (b), legitimate interest in community safety (f) | Messages 90 days; reported messages and moderation records 1 year |
| Online league chat (web game): message text (max. 280 characters), time sent, author; other league members see your display name, club and weekly table title next to the message | Communication between members of one league, spam protection | Performance of a contract (b), legitimate interest in community safety (f) | 60 days, then deleted automatically; deleted immediately when the account or league is deleted |
| Purchases: what you bought, when, transaction ID; for web purchases (e.g. "No ads forever") also your email and payment status from Stripe | Delivering purchased content, handling complaints | Performance of a contract (b), legal obligation (c) | While the account exists; accounting records 10 years |
| Technical data: IP address, device type, operating system, game version, language | Operating servers, security, preventing cheating and abuse | Legitimate interest (f) | 90 days |
| Crash reports (Firebase Crashlytics) | Fixing crashes and bugs | Legitimate interest (f) | 90 days |
| Analytics (Google Analytics for Firebase): game launches, play time, progression | Improving the game | Consent (a) – players aged 16+ only | 14 months |
| Advertising identifier (Android Advertising ID / Apple IDFA), in the web game advertising cookies and similar storage, and ad impression data (including rewarded videos you choose to watch) | Showing ads; for personalised ads, tailoring them | Consent (a) for personalised ads – players aged 18+ only; legitimate interest (f) for non-personalised ads | According to Google AdMob terms |
| Support communication: email and message content | Answering your request | Legitimate interest (f) | 2 years after resolution |
We do not process payment card details – in the app, payments are handled by Apple (App Store) or Google (Google Play); in the web game by the payment provider Stripe. Stripe only tells us that a payment succeeded plus basic details (amount, time, payment ID, email).
Automated processing: Chat passes through an automated profanity and spam filter, and we use automated checks to detect cheating (e.g. impossible match results). Temporary or permanent account suspensions are always decided by a human, and you can appeal (see the Community Rules).
3. Consent to analytics and advertising
- Players aged 16+: On first launch we ask whether you agree to analytics, and players aged 18+ are also asked about personalised advertising. You can play without consenting – analytics will then stay off and you will see non-personalised ads.
- Players aged 13–15: We do not ask for consent at all. Analytics is switched off and only non-personalised ads are shown.
- You can change your choice at any time in Settings → Privacy.
- On iOS, the system "Tracking" setting (App Tracking Transparency) also applies. Players under 18 are never shown this prompt.
- Web game: Google ads (AdSense / H5 Games Ads) use cookies only according to your choice in the consent banner shown by Google's certified consent management platform (IAB TCF). Without consent, only non-personalised (limited) ads are shown. Change your choice via "Privacy settings" in the game footer. Players under 18 never get personalised ads.
- Rewarded videos in the web game are only shown when you choose to watch one for a reward.
4. Who we share data with
We share data only with the following processors that help us run the game, and only to the extent needed:
| Service | Provider | Purpose | Data location |
|---|---|---|---|
| Firebase Authentication | Google Ireland Ltd. | Sign-in and accounts | EU / USA |
| Cloud Firestore, Cloud Functions | Google Ireland Ltd. | Game data, chat, game logic | EU (europe-west region) |
| Netlify | Netlify, Inc. | squadrivo.cz website | USA / global CDN |
| Firebase Crashlytics | Google Ireland Ltd. | Crash reports | USA |
| Google Analytics for Firebase | Google Ireland Ltd. | Analytics (with consent only) | USA |
| Google AdMob, User Messaging Platform | Google Ireland Ltd. | Ads and consent management | USA |
| App Store / Google Play | Apple Distribution International Ltd. / Google Ireland Ltd. | Game distribution, payments, Apple / Google sign-in | Per store terms |
| Zoho Mail | Zoho Corporation B.V. | Email communication (kontakt@, privacy@, abuse@squadrivo.cz) | EU |
| Railway | Railway Corporation | Hosting and database of the web game (hra.squadrivo.cz) | EU / USA |
| Google AdSense, Google H5 Games Ads, Google consent management | Google Ireland Ltd. | Ads in the web game and consent management | USA |
| Stripe | Stripe Payments Europe Ltd. | Payments in the web game (not yet in use) | EU / USA |
Google Privacy Policy: https://policies.google.com/privacy · Google ads: https://policies.google.com/technologies/ads · Firebase: https://firebase.google.com/support/privacy
We may also disclose data to public authorities where required by law (e.g. suspected crime or a child at risk).
Online league chat messages are visible only to accepted members of that league. They are never shown publicly.
We do not sell your data.
5. Transfers outside the EU
Some processors may process data in the USA. Transfers are based on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on Standard Contractual Clauses approved by the Commission.
6. Age of players
- The game is intended for players aged 13 and over. We ask for your year and month of birth when you register. We do not create accounts for, or store data of, children under 13.
- If we learn that an account belongs to a child under 13, we will delete it.
- If you are a parent and believe your child has given us personal data, please contact privacy@squadrivo.cz.
7. Protection of younger players (13–17)
Summary for younger players: If you are under 16, we do not track how you play for statistics or advertising. You will only see regular ads that are not chosen based on you. Chat has a strict filter switched on. Whenever someone in the game bothers you, you can report or block them.
| 13–15 | 16–17 | 18+ | |
|---|---|---|---|
| Analytics | off | with consent only | with consent only |
| Ads | non-personalised only | non-personalised only | personalised with consent only |
| Chat filter | strict, cannot be turned off | strict, can be relaxed | can be relaxed |
| Private messages | friends only | friends only (can be changed) | per settings |
| Profile and nickname | visible | visible | visible |
8. Your rights
You have the right to:
- access your data and obtain a copy,
- rectify inaccurate data,
- erasure ("right to be forgotten"),
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time (without affecting processing before withdrawal),
- lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.gov.cz) or the supervisory authority in your country of residence.
To exercise your rights, email privacy@squadrivo.cz. We will reply within 1 month. We may ask you to verify that you own the account. Parents may exercise rights on behalf of a minor player.
9. Deleting your account
Delete your account in the app under Settings → Account → Delete account, in the web game under Profile, or at squadrivo.cz/delete-account. We delete your data within 30 days, except data we must keep by law (e.g. accounting records) or to resolve an open report. Purchased content is permanently lost when the account is deleted.
10. Security
We protect data with encrypted transport (HTTPS/TLS). Passwords are stored by Firebase in hashed form only, access to data is restricted by database security rules, and administrator accounts are protected by two-factor authentication.
11. Cookies on the website
- The squadrivo.cz website (information pages, this policy and the terms) uses only strictly necessary cookies and no analytics or advertising cookies.
- The web game at hra.squadrivo.cz uses strictly necessary cookies and storage (login, settings) and – only with your consent – Google advertising cookies (see section 3). You can change or withdraw consent at any time via "Privacy settings" in the game footer.
12. Changes to this policy
We may update this policy. We will notify you of significant changes in the game or by email. The current version is always at squadrivo.cz/privacy.