Privacy Policy
1. Data controller
The data controller is Gustavo Guillermo Alonso, trading as Kirv Studio (the “Provider”), domiciled in the Argentine Republic.
For any question or request regarding personal data, users may write to gugueh.design@gmail.com. Requests are handled in Spanish, English or French.
2. Data processed
- Account data: the name and email address of the Google account the user signs up with, and an internal identifier. The App never receives or stores the Google password.
- Profile data: alias, avatar (a card image), title, bio, play style, play intent (casual or competitive), format, chosen city, neighbourhood or area if the user provides it, cosmetic accessories and friend code.
- Data about interactions with other users: people followed and blocked, reports sent, availability to play (city, end time, intent and format), challenges and the optional note attached to them, meetups (place, date, time, arrival confirmation, coin toss result and who goes first), results, community memberships, and tournament registrations and results.
- Notification data: notices sent to the user, the device notification identifier (token), an installation identifier, the App language and muted notice types.
- Technical crash data: when the App closes unexpectedly or logs an error, the device model, operating system and App versions and technical information about the failure are collected. This data does not include the user's game content.
- Acceptance of the legal documents: the version of this Policy and of the Terms and Conditions accepted, and the date of acceptance.
3. Data not processed
- The App does not access the device's GPS location; location is limited to the city the user selects manually.
- The App does not access contacts, photos, the microphone or the camera.
- The App shows no advertising, does not sell or share personal data for commercial purposes and does not use it for commercial profiling.
- The App is free and processes no payment data.
4. Data stored only on the device
Decks, side plans, card roles, practice statistics, the duel counter state and settings are stored on the user's device and are not sent to the Provider's server. If the user turns on the backup, a copy is saved in a private folder of their own Google Drive account that only the App can access; the Provider has no access to that folder.
5. Purposes and legal bases
- Creating and managing the account and profile. Basis: performance of the requested service and the user's consent.
- Allowing other users to find the user, challenge them and arrange meetups, communities and tournaments. Basis: performance of the requested service.
- Sending in-app notices and device notifications. Basis: consent, which can be withdrawn in Settings or in the device settings.
- Protecting safety and good conduct through blocking, reporting and moderation. Basis: legitimate interest of the Provider and of other users.
- Detecting and fixing App failures. Basis: legitimate interest in keeping the service stable and secure.
- Complying with legal obligations and requests from competent authorities. Basis: legal obligation.
The Provider does not make decisions based solely on automated processing that produce legal effects concerning the user.
6. Visibility of data within the App
- The profile (alias, avatar, title, bio, play style, city if the user chooses to show it and friend code) is visible to other users, except to those the user has blocked or who have blocked the user.
- When the user turns on availability, people browsing their city see them as available until the time set.
- Challenges, their notes, meetups and their results are visible only to the two people involved.
- In communities and tournaments, other participants see the user's alias, registered deck and results in that event.
- Reports are visible only to the Provider's moderation team; the reported person does not learn who reported them.
- Users can hide their city and neighbourhood in Settings.
7. Processors and third parties
The Provider uses service providers that process data on its behalf, following its instructions and under data processing agreements, and that may not use it for their own purposes:
- Supabase Inc.: database, authentication and server functions. Data is hosted in São Paulo, Brazil.
- Google LLC: Google sign-in; Firebase Cloud Messaging for device notifications (only the notice title and text are sent); Firebase Crashlytics for crash reporting; and Google Drive for the backup, if the user turns it on.
The App also connects to third-party services acting as independent controllers:
- YGOPRODeck: the App downloads card data and images from its servers, which therefore receive the device's IP address.
- yugiohmeta.com: only when the user imports a deck from that site.
The Provider does not disclose personal data to any other third party, except where required by law or by a competent authority.
8. International transfers
Some providers process data outside the user's country, in particular in Brazil and the United States. The Provider only uses providers offering appropriate safeguards, such as the standard contractual clauses approved by the European Commission or equivalent mechanisms. Where the applicable law requires it, the user consents to these transfers by accepting this Policy.
9. Retention periods
- Notices: 30 days.
- Expired, declined or cancelled challenges: 30 days.
- Expired availability: 7 days.
- Crash records: up to 90 days.
- All other data is kept while the account is active. When the account is deleted, the data is erased from the server immediately; the provider's backups may keep it for up to 7 more days, after which it is deleted automatically.
10. User rights
Users may at any time exercise their rights of access, rectification, updating and erasure, and withdraw their consent:
- Delete the account and all its data: in the App, Settings, Delete my account, or by writing to gugueh.design@gmail.com.
- Correct the profile: in the App, Profile, Edit.
- Any other request: by email to gugueh.design@gmail.com, from the address linked to the account, so that identity can be verified.
The right of access may be exercised free of charge at intervals of no less than six months, unless a legitimate interest is shown. Access requests are answered within 10 calendar days, and rectification or erasure requests within 5 business days.
The AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA (Argentine Agency for Access to Public Information), as the Supervisory Authority under Law No. 25,326, is empowered to handle complaints and claims filed by anyone whose rights are affected by non-compliance with the rules in force on personal data protection.
11. Security
Communications between the App and the server are encrypted with TLS. On the server, row-level security policies restrict each user's access to the information that belongs to them, and service credentials are stored encrypted. No system is completely infallible: if a security incident affecting the user's data is detected, the Provider will notify the affected people and the competent authorities where the law requires it.
12. Minors
The App is intended for people aged 13 or over. Users under 18, or under the age set by the law of their country to consent on their own to the processing of their data, need the permission of their parent or guardian. In the European Union and the United Kingdom that age ranges from 13 to 16 depending on the country (for example, 13 in Portugal and the United Kingdom, 14 in Spain and Italy, 15 in France and 16 in Germany and the Netherlands).
Minors are advised to attend meetups accompanied, or in public places and with the knowledge of a responsible adult. If the Provider learns that an account belongs to someone under 13, or to a minor without the required permission, it will delete it. Parents or guardians may request the deletion of a minor's account by writing to gugueh.design@gmail.com.
13. Users in the European Economic Area, the United Kingdom and Switzerland
If the user lives in the European Economic Area, the United Kingdom or Switzerland, Regulation (EU) 2016/679 (GDPR), the UK GDPR or the Swiss data protection law also applies, as the case may be:
- The legal basis of each processing activity is set out in section 5.
- The user has the right of access, rectification, erasure, restriction of processing, objection and portability, and may withdraw consent at any time without affecting the lawfulness of prior processing.
- Requests are answered within one month, which may be extended in the cases provided for by law.
- The user may lodge a complaint with the supervisory authority of their country of residence, for example the Spanish Data Protection Agency (AEPD) or the Commission Nationale de l'Informatique et des Libertés (CNIL).
- Transfers outside the European Economic Area rely on the safeguards described in section 8.
14. Users in Brazil
If the user lives in Brazil, or their data is processed in Brazilian territory, the Brazilian General Data Protection Law (Law No. 13,709/2018, LGPD) also applies. The user may exercise the rights granted by that law by writing to gugueh.design@gmail.com and may file complaints with the National Data Protection Authority (ANPD).
15. Changes
The Provider may update this Policy. The current version is published in the App and on the website with its date. Material changes will be announced in the App before they take effect and, where appropriate, consent will be requested again.
16. Language
This Policy is published in Spanish, English and French. In the event of any discrepancy between versions, the Spanish version prevails, unless the applicable law provides otherwise.