Privacy Policy
Standing needs little about you: an account identifier, the Sign in with Apple identifier you join with, a nickname, a country code, your points and records of your purchases. Payments are handled by Apple; we never see your payment details. Advertising is provided by Google AdMob, which processes device data only according to the choices you make in the consent screens. We do not sell your data. This website uses no cookies and no analytics.
Contents
01Who is responsible
The controller of your personal data is Nazar Ashyrov, a sole trader registered in Poland, trading as ANApps. Our postal address, phone number, NIP and REGON are available on request at anapps.team@gmail.com.
Contact for all privacy matters: anapps.team@gmail.com. We have not appointed a data protection officer because we are not required to.
02What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account identifier, league name or the nickname you choose, profile country code, points, balance, place, tier, marks, season results, daily snapshots of your place, history of point entries | Providing the app, the tables, the change in your place since the previous day and the items you get; choosing which offers the app shows you (section 10) | Performance of the contract, Art. 6(1)(b) |
| Sign in with Apple identifier, received when you join the league. We do not request your email or name. | Joining the league, and opening your account on any iPhone with the same Apple Account | Performance of the contract, Art. 6(1)(b) |
| Purchase records from Apple: transaction and product identifiers, App Store country, price, the amount we receive, Membership status and renewals, refunds | Adding the points you bought and Membership shares, handling refunds, preventing refund abuse, tax and accounting records | Performance of the contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f): preventing fraud |
| Purchase data shared with RevenueCat: the purchase records above with their currency, a random purchase token for your account, a random RevenueCat customer identifier (not your account identifier), device model, iOS and app versions, language and region settings, IP address | Revenue reporting and accounting | Legitimate interests, Art. 6(1)(f): keeping accurate revenue accounts |
| Records of rewarded video sessions: time, advertising unit, confirmation from the advertising network, estimated advertising revenue | Adding points, reconciling with the advertising network, tax and accounting records | Performance of the contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Nicknames and Instagram usernames you submit, with the result of each check | Publishing them, moderation, keeping a history of names | Performance of the contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f): keeping the league free of abusive content |
| Players you follow and block; reports you send, with an optional comment, name and email; notices of decisions and your requests for review | Following and blocking, handling reports and appeals | Performance of the contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) (EU Digital Services Act) |
| Invitation code, who invited whom, and the device integrity key of the invited player when the code was entered | Showing how many players joined with your code, preventing abuse | Performance of the contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Which players’ panels you open, and when | Counting how often players are viewed (a player is never told who viewed them), preventing abuse | Legitimate interests, Art. 6(1)(f): improving the app and keeping counts honest |
| Record of accepting the Terms of Use: document version, time, language, country and app version | Proving what you agreed to | Legitimate interests, Art. 6(1)(f): establishing and defending legal claims |
| IP address, country and network derived from it, App Store storefront country, device integrity key (Apple App Attest), app version, technical logs | Security, preventing fraud and unfair play, choosing the regional point value, setting the starting country code of your profile, fixing errors | Legitimate interests, Art. 6(1)(f): keeping the competition fair and the service secure |
| App usage events: steps of joining, app opens with your time zone and preferred language, together with an installation identifier, the app and iOS versions, and your App Store country and the country of your IP address | Understanding how the app is used and showing texts in your language | Legitimate interests, Art. 6(1)(f): improving the app |
| Advertising identifier (IDFA), IP address, device information, interaction with advertisements | Showing advertisements, measuring them and, if you agree, personalising them | Your consent, Art. 6(1)(a), given in the consent screen and in Apple’s tracking prompt |
| Messages you send to support | Answering you, handling complaints and legal claims | Legitimate interests, Art. 6(1)(f); legal obligation, Art. 6(1)(c) |
The country code shown in your profile is decorative. It starts as the country of your App Store storefront, you can change it, and we do not treat it as your location or nationality. We do not collect your name, email address, phone number, contacts, photos or precise location.
Your nickname and Instagram username are public. Do not use your real name or other personal details in them.
The country and network of an IP address are looked up on our own server in an offline database, so your address is not sent to any geolocation service. IP Geolocation by DB-IP.
If you ask Apple for a refund, Apple may ask us about the purchase. As described in the Terms of Use, we then tell Apple only whether the purchase was delivered, how much of it had been delivered or used, whether a free sample was provided, and whether we would prefer Apple to grant or decline the refund. Legal basis: legitimate interests, Art. 6(1)(f): preventing refund abuse.
Providing account data is necessary to use the app. Consent to advertising data is voluntary: refusing it changes neither what the app can do nor the points you earn.
03What is public
Every user of the app can see your nickname, country code, points, place, tier, marks, season results, the number of players who joined with your invitation code, the MEMBER label while you have Membership and, if you add one, your Instagram link. For two weeks after you change your nickname, your previous one is shown as “Formerly”. If you share your player card link, anyone with the link can see the same on this website, except the number of players who joined with your invitation code. Who you follow, who you block, what you report, and who invited you or whom you invited are never shown to others.
04Advertising and your choices
Advertisements are provided by Google AdMob (Google Ireland Limited). For the collection of data by Google’s advertising software in the app, we and Google are joint controllers: we decide that Google’s advertising software is built into the app, and Google decides what it collects. Under our arrangement you can exercise your rights with either of us, and Google provides the information about its own processing at https://policies.google.com/privacy. For everything Google does with the data afterwards, Google is an independent controller. How Google uses this data is explained at How Google uses information from sites or apps that use our services.
The advertising software starts only after you join the league, and advertisements are shown only when you choose to watch a rewarded video. If you are in the European Economic Area, the United Kingdom or Switzerland, the app shows Google’s consent screen before any advertisement is loaded. There you choose whether Google and its advertising partners may use your data for personalised advertising, and you can see the list of partners. Separately, iOS asks whether you allow the app to track you. If you decline, advertisements are still shown but are not personalised using tracking data.
You can change your choices at any time in the app under You → Privacy settings, and in iOS under Settings → Privacy & Security → Tracking. Withdrawing consent does not affect processing that took place before.
05Who receives data
- Google Ireland Limited and the advertising partners you see in the consent screen: advertising, as independent controllers.
- DigitalOcean, LLC: hosting of our servers and database in Amsterdam, the Netherlands, as our processor under a data processing agreement.
- Google Cloud (Vertex AI, European Union), as our processor: the automated check of nicknames and Instagram usernames. Only the submitted text and your profile country code are sent, without your account identifier, IP address or device data. The check is processed in the European Union; Google does not use it to train models.
- RevenueCat, Inc. (United States), as our processor under a data processing agreement: reporting on revenue from purchases. It receives the purchase data listed in section 02 and never decides which points you receive.
- Encrypted database backups are kept on our server and on equipment that we own and control. Copies of the whole server (snapshots) are stored by DigitalOcean in the European Union as our processor.
- Apple: In-App Purchase, Sign in with Apple, device integrity checks and distribution of the app, as an independent controller.
- Public authorities, where the law requires us to disclose data.
Everyone who receives data from us protects it at least as well as described in this policy: our processors under data processing agreements, and Apple and Google as independent controllers under their own privacy terms and applicable data protection law.
An Instagram link opens Instagram outside the app. We do not share data with Meta and receive nothing from Instagram.
We do not sell personal data and do not share it for anyone else’s marketing.
06Transfers outside the EEA
Our database is stored in the European Union. Some recipients are based in, or may access data from, the United States. Such transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguards.
07How long we keep data
| Data | Kept for |
|---|---|
| Account, profile, identifiers | Until you delete your account; fully erased within 30 days of deletion. The device integrity key of your device (Apple App Attest), including the copy recorded with an invitation you accepted, is kept after deletion without any link to you, so that per-device limits and invitation checks keep working. |
| History of point entries, purchases and rewarded video sessions | Anonymised when you delete your account, then kept for 5 years for reconciliation with Apple and the advertising network, and for accounting. RevenueCat keeps its copy of purchase records under random identifiers that cannot be linked to you once your account is deleted, for the same 5 years. |
| Nicknames and Instagram usernames that were refused | 90 days |
| Follows and blocks | Until you remove them or delete your account |
| Reports and notices of decisions | 12 months after the decision; the IP address of a report’s sender 90 days |
| Records of opened player panels | 90 days |
| Daily snapshots of places | 35 days |
| App usage events | 180 days |
| Records of accepting the Terms of Use | 5 years after you delete your account, in pseudonymised form, only to establish or defend legal claims |
| IP address and network signals attached to video sessions and to security records of account actions | 90 days |
| Technical logs | 30 days |
| Database backups | Up to 35 days |
| Support correspondence | 3 years after the matter is closed |
08Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time.
To use these rights, write to anapps.team@gmail.com and include the account ID shown in You, so that we can find your data. We answer within one month. Exercising your rights is free.
You may lodge a complaint with a supervisory authority. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. You may also contact the authority in the country where you live.
09Deleting your account
In the app, open You → Delete account. This works for guest accounts too. Deletion is immediate: your profile disappears from the tables, your sessions end and, if you linked Sign in with Apple, we revoke that link with Apple. Your points, balance and items are deleted with the account. Deleting the account does not cancel Membership: cancel it in your Apple Account settings. If you cannot use the app, write to support with your account ID.
10Automated decisions
We use automated signals to detect unfair play, and an account may be hidden from other players’ tables while a person reviews it. Nicknames and Instagram usernames are checked automatically before they are published, and a submission may be refused by that check. Which offers and purchase suggestions the app shows you depends on your all-time score, which comes from your purchases and rewarded videos: from a set score upward, they are not shown. Prices are the same for everyone and never depend on this. These measures affect only your place, your appearance in the league and which offers you see, and have no legal or similarly significant effect on you. You can always ask for a human review, as described in the Terms of Use.
11Age
Standing is for adults aged 18 or over. We do not knowingly process data of anyone younger. If you believe a minor is using the app, tell us and we will delete the account.
12Security
All traffic between the app and our server is encrypted. The database accepts connections only from the server itself, access is limited by role, backups are encrypted, and access tokens are never written to logs.
13Regional information
13.1United States
We do not sell personal information for money. Allowing personalised advertising may be considered “sharing” or “targeted advertising” under some state laws. You can opt out at any time by declining tracking in iOS (Settings → Privacy & Security → Tracking) and in You → Privacy settings. We do not discriminate against you for exercising your rights: the app and your points stay the same. Depending on your state, you may have the right to know, correct and delete your personal information and to appeal our decision; write to anapps.team@gmail.com.
13.2United Kingdom
The UK GDPR gives you the same rights as described in section 08. You may complain to the Information Commissioner’s Office, ico.org.uk.
13.3Brazil
Under the LGPD you have the rights listed in its Article 18, including confirmation of processing, access, correction, anonymisation, portability and deletion. Write to the contact address above. You may also contact the ANPD.
13.4Saudi Arabia
If you live in the Kingdom of Saudi Arabia, the Personal Data Protection Law (PDPL) and its implementing regulations apply to our processing of your personal data, together with this policy.
Where your data is stored. Your data is stored outside the Kingdom, on our servers and database in Amsterdam, the Netherlands, in the European Union, hosted by DigitalOcean, LLC as our processor. Encrypted database backups are kept on our server and on equipment that we own and control. Copies of the whole server (snapshots) are stored by DigitalOcean in the European Union as our processor.
Who receives it outside the Kingdom. Advertising in the app is provided by Google (Google Ireland Limited), which may process advertising data in the United States as an independent controller. The automated check of nicknames and Instagram usernames is run by Google Cloud in the European Union as our processor. RevenueCat, Inc. processes purchase records in the United States as our processor, for revenue reporting. Apple receives data for In-App Purchase, Sign in with Apple, device integrity checks and distribution of the app. The full list of recipients is in section 05.
Why and on what basis we transfer it. The app is operated from the European Union and cannot be provided without transferring your data outside the Kingdom. We transfer it because this is necessary to perform our agreement with you (the Terms of Use): to run your account and the tables, process your purchases, keep the service secure and fair, and moderate nicknames and links. For advertising, we rely on your choices in the consent screens. Our hosting provider and RevenueCat are bound by data processing agreements, and we transfer no more data than each purpose requires. You can ask us which safeguard applies to each recipient.
Your rights. You have the right to be informed about how your data is processed; to access your data and receive a copy in a clear and readable format; to have inaccurate or incomplete data corrected; to have data destroyed when it is no longer needed; and to withdraw your consent at any time where processing is based on consent. To use these rights, write to anapps.team@gmail.com with the account ID shown in You. We answer within 30 days; if the regulations allow a longer period and we need it, we tell you why within those 30 days. Exercising your rights is free.
Contact and complaints. For any question about your data, write to anapps.team@gmail.com. You may also lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), sdaia.gov.sa.
13.5Other countries
Wherever you live, you can use the rights in section 08 by writing to us, and we will honour any additional rights your local law gives you.
14Changes
When we change this policy, we update the date and version at the top. We announce material changes in the app before they take effect.