Privacy Policy – Fiafia

Last updated: 13 November 2026

1. Who we are

The data controller is Marco D'Alessio – Fiafia, an individual based in Italy. For any privacy question, write to support@fiafia.games.

2. The short version

• We don't ask for your name, email or an account. You need no data at all to play the free decks.
• No ads, no analytics, no tracking inside the app.
• The game works offline. The network is only used for purchases and subscriptions.
• Purchases are handled by the store (Apple App Store or Google Play) and checked through RevenueCat, which receives a random purchase ID (a pseudonym, not an anonymous ID) and the purchase history linked to that ID. Like any online service, RevenueCat also sees the IP address the request comes from. This is personal data, even though it doesn't include your name.
• Our website (fiafia.games) uses no cookies and no statistics (section 6).

3. Data kept only on your phone

The app stores on your device, and sends to no one: your language, the cards already played, your confirmation that you are 18 or over (for the adult decks), your settings (such as "show adult decks") and the last known purchase status, so you can play offline. Delete it by uninstalling the app; "Reset played cards" in Settings only clears the list of cards already played.

4. Purchases and subscriptions (Apple, Google, RevenueCat)

• Payment is handled entirely by Apple or Google through your store account. We never see your card details, name or email address. Apple's and Google's own privacy policies apply to that data; they act as independent controllers.
• Purchase checks: the app uses RevenueCat, Inc. (USA) as a processor to know what you have unlocked and to restore it. RevenueCat processes:
• a randomly generated app user ID (a pseudonym: not linked to your name or email, but it recognises the same device over time);
• your purchase history (product, date, price and currency, subscription status, store receipt);
• technical data needed for the service (such as device language/region, app and OS version) and the IP address the request comes from.
• Why: to deliver what you bought, validate receipts against fraud, restore purchases and see aggregated sales figures.
• Legal basis (UK/EU GDPR): performance of the purchase contract (Art. 6(1)(b)) and our legitimate interest in preventing fraud and understanding sales (Art. 6(1)(f)).
• Is it required? Only to buy: without the identifier and history a purchase can't be unlocked or restored. You don't need it to play the free decks.
• International transfers: RevenueCat is based in the United States. Transfers rely on the Standard Contractual Clauses approved by the European Commission (for the UK, with the UK International Data Transfer Addendum), as provided in RevenueCat's Data Processing Addendum.
• Retention: for as long as we use RevenueCat for purchases; when the service ends, RevenueCat deletes the data under its Data Processing Addendum. You can ask us to delete it at any time (section 8).

5. If you contact us

If you email us (including through "Report this card", which opens your mail app with the card code and language), we receive your email address and your message. - Why: to reply and fix content. - Legal basis: our legitimate interest in answering requests and improving the cards (Art. 6(1)(f)); if your request is about a purchase, performance of the contract or steps you asked us to take (Art. 6(1)(b)). - Who sees it: us, our domain's email forwarding service (Namecheap, Inc., USA) and the provider of the mailbox where we receive messages, as processors. - Retention: as long as needed to handle the request, at most 24 months.

6. Our website (fiafia.games)

The website presents the game and hosts this policy, the Terms and the support page. - Hosting: Cloudflare Pages (Cloudflare, Inc., USA), as a processor. To show you the pages, Cloudflare necessarily processes your IP address and the technical data of the request. Cloudflare is certified under the EU-U.S. Data Privacy Framework (and its UK Extension) and its Data Processing Addendum includes the Standard Contractual Clauses. - Statistics: none. The website uses no analytics tools and counts neither visits nor button taps. If we ever turn statistics on, we will update this policy first. - The App Store button takes you to Apple: from there Apple's privacy policy applies. If we use a "campaign link", Apple only shows us aggregated numbers of visits, downloads and purchases per campaign, never who you are. - Legal basis: legitimate interest in running the website (Art. 6(1)(f)). - Cookies: the website uses no cookies or other tools that store information on your device, so it shows no banner.

7. What we don't do

We don't sell data, profile you, make automated decisions about you, use your device's advertising ID, show ads, or ask for access to your contacts, photos, location, microphone or camera.

8. Your rights

You can ask for access, correction, deletion, restriction, objection and portability by writing to support@fiafia.games. To delete purchase data held by RevenueCat, please send us the purchase ID shown in the app under Settings › Purchase ID (also at the bottom of Settings › Privacy) or your store receipt. You can complain to your data protection authority (in the UK, the ICO: ico.org.uk). US residents: we do not sell or share personal information for targeted advertising.

9. Children

The app contains adult decks and is rated 18+ on the stores. It is not meant for anyone under 18 and does not knowingly collect children's data.

10. Changes

If this policy changes we will update the date above and mention important changes in the release notes.