Skiddy Privacy Policy

Version of 29 October 2026

1. Who is responsible

Skiddy — the iOS app "Skiddy: Sniffer vs Tooters" and the website skiddy.app — is made by Volha Murachova, an individual, Koscielna 33a/277, 60-537 Poznań, Poland. She is the controller of your personal data under the EU General Data Protection Regulation (GDPR). In this policy "we" means her.

Email for any privacy question, request or complaint: [email protected]

2. In short

No account, no email, no phone number. The app signs you in anonymously.
No ads, no tracking, no advertising identifier (IDFA). We don't sell your data and don't share it for advertising.
Only the players in your room see your name and hear your recorded sound.
Game data is deleted automatically: a room 24 hours after its last activity, your sound soon after you leave.
Settings → Delete my data erases what we keep about you in one tap.

3. What we collect and why

Player name (up to 24 characters). Shown to the players in your room. Checked automatically against a list of banned words.
Anonymous ID. A random ID created by our sign-in service on first launch. It links your rooms, your sound, your purchase status and the usage events below. It doesn't tell us who you are.
My sound (only if you record it). 3 seconds from the microphone, recorded only while you hold the button. Uploaded so that the other players in your room hear it during the round. You can play with a ready-made sound instead.
Game data: the room and its code, your role, "ready" status, round start and end, scores, which sound played and when (for example "motion sound at 21:03:15"), whether you are still in the room, and failed attempts to join with a wrong code (to stop code guessing).
Purchase status: whether this ID bought or restored "Skiddy forever", and marks for the free evening and early creator status. Payment is handled by Apple. We never see your card or your Apple ID.
Usage events: room created, number of players at start, round finished, evening counted, room closed, purchase screen shown, button pressed on it, purchase completed, purchase restored. Linked to the anonymous ID, without names. We use them to see whether the game works and whether people pay for it.
Reports: when a player is reported — the anonymous ID of the reporter and of the reported player, the room and its code, the name at that moment, the reason (name, sound or other) and a reference to the reported sound.
Technical data: when your phone or browser connects to our servers, our providers see your IP address and device or browser type and keep them in their logs. The sign-in service also keeps session records (IP address, device type) for your anonymous ID. We don't use IP addresses to find your location.
Support emails: if you write to us, we get your email address and everything you send (for example a screenshot or a diagnostic file). We use it only to answer you.

4. What stays on your phone

Motion sensor: the phone itself notices that you moved. Only the fact "a motion sound played" and its time go to the server. Sensor readings never leave the phone.
Proximity sensor: turns the screen off in your pocket. Nothing is sent.
Camera: only reads the room's QR code. No pictures are saved or sent.
Microphone: works only while you hold the record button. Nothing is recorded during a round.
Diagnostic log: stays on the phone. It leaves only if you share it yourself (press and hold the Skiddy logo on the start screen for 3 seconds, then Share). It contains the app version, phone model, iOS version, your role, the room code and technical events.
Notifications and the Live Activity on the lock screen are created on the phone. We don't use push tokens.
The phone also keeps your name, your sound, your list of muted players, the room to return to, and in the iOS Keychain the free-game counter and a purchase hint.

5. Why we are allowed to (legal bases, GDPR Art. 6)

Running the game you asked for — name, anonymous ID, sound, game data, purchase status, technical data: performance of a contract, Art. 6(1)(b).
Safety and moderation — reports, name filter, blocks, limits on code guessing and on reusing the free evening: our legitimate interest in a safe game without abuse, Art. 6(1)(f).
Usage events: our legitimate interest in knowing that the game works and in improving it, Art. 6(1)(f). The data is minimal and kept 180 days. You can object (section 10).
Legal duties — answering lawful requests of authorities, handling notices about illegal content: Art. 6(1)(c).
Support emails: Art. 6(1)(b) when it is about the game you use, otherwise Art. 6(1)(f).

We don't make automated decisions about you that have legal or similarly significant effects, and we don't build profiles. The only automated step is the name filter: a name with a banned word is not accepted, and you can choose another one.

6. Who sees and receives data

Players in your room: your name, your sound, role, "ready" status and scores.
Supabase Inc. — database, sound storage, anonymous sign-in, real-time connection. Our processor under a data processing agreement.
Cloudflare Inc. — hosts the website skiddy.app and the invite links. Our processor.
Apple — App Store purchase and restore, and crash reports if you allowed sharing with app developers in iOS settings. Apple is an independent controller under its own privacy policy.
Public authorities — only when the law requires it.

We don't sell personal data and don't share it for advertising.

7. Transfers outside the EEA

Our database and sound files are stored by Supabase in eu-west-1 (Ireland, EU), inside the European Economic Area (EEA). Supabase and Cloudflare are US companies, and Cloudflare delivers the website from servers around the world, so some data — mainly technical data and provider support access — may be processed outside the EEA. These transfers are protected by the European Commission's Standard Contractual Clauses in the providers' data processing agreements and, where a provider is certified, by the EU–U.S. Data Privacy Framework.

You can ask us for a copy of these safeguards by email.

8. How long we keep data

Automatic cleanup runs every hour.

Rooms with everything in them (players, roles, round times, sounds played, results, presence): deleted 24 hours after the last activity in the room. A room with a round in progress or an open free evening is never deleted.
Leaving a lobby removes you from that room at once.
Your sound on the server: deleted about 1–2 hours after you leave the room or the room is deleted. If your sound was reported, it is kept until 90 days after the report.
Failed join attempts: 24 hours.
Reports: 90 days from the report.
Usage events: 180 days.
Anonymous ID with its sign-in records: deleted after 90 days without use, unless it is still needed for the data below.
Free evening and early creator marks: kept so that the free offer can't be used again, until you use Delete my data.
Blocks of players who broke the rules: while the block lasts.
Provider logs (IP address, device or browser type): for the short period set by Supabase and Cloudflare.
Support emails: until your question is solved, and then up to 12 months in case it comes back.
On your phone: until you use Delete my data, record a new sound or delete the app. The free-game counter and the purchase hint in the iOS Keychain can stay on the phone even after the app is deleted.

9. Delete my data

Open Settings → Delete my data and confirm. Then:

On our server we delete your player records, the rooms where you were the only player, your sound files, your failed join attempts, your free evening and early creator marks and your usage events, and we remove your ID from reports you made.
The app gets a new anonymous ID and erases on the phone your name, your sound, your muted players, the room to return to and the diagnostic log.

What stays:

Reports other players made about you — for 90 days, for safety.
Rooms where other players still are — they stay for them, without you, and are deleted on the usual schedule.
The old anonymous ID in the sign-in service — until the hourly cleanup removes it (after 90 days without use).
Your purchase is kept by Apple: Settings → Restore purchases brings it back. The free-game counter stays on this phone.

During a round the deletion doesn't run: wait until the round ends and tap again. Without internet nothing is deleted, not even on the phone: tap again when you are online.

10. Your rights

Under the GDPR you can ask us for access to your data and a copy of it, correction, deletion, restriction of use, and a copy in a machine-readable form. You can object at any time to the use of your data based on our legitimate interest, including usage events.

The fastest way to delete is the button in section 9. For anything else, write to [email protected]. We don't know who you are, so please tell us the name you used, the room code, the date and approximate time, and if possible attach the diagnostic file (section 4). Without these details we may not be able to find your data — we will tell you if so.

We answer within one month. For complex requests this can be extended by two more months; we will tell you why.

You can complain to the data protection authority of the country where you live or work, or to the Polish authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. In the UK — the Information Commissioner's Office (ico.org.uk).

If you live in the United States: we don't sell or share personal information for cross-context behavioural advertising and don't collect sensitive personal information. You can ask to know, correct or delete your data at the same email. We won't treat you differently for using these rights.

11. Children

Skiddy is not for children under 13. We don't knowingly collect data from children under 13. If you believe a child under 13 has played, write to us with the room code and time, and we will delete the data.

12. Security

All connections are encrypted (TLS).
Database rules let each player read only their own room. Sound files can be read only by players of the same room.
Server keys are never in the app. Only the controller has access to the production systems.

No system is perfectly safe. If a breach puts your rights at risk, we will act as the GDPR requires.

13. Reports and moderation

In the app: tap ⋯ next to the player's name → Report → Hurtful name, Nasty sound or Other. The player is muted for you at once.
Mute works only on your phone and in every room: their sound becomes a standard sound and their name becomes "Player N".
Without the app — anyone, including people who don't play, can report a name or sound they believe is illegal or abusive: email [email protected] with the room code, the player's name, the date and time, what is wrong and, for illegal content, why you think it is illegal. Add your name and email unless the report concerns child sexual abuse material.
We look at reports within 24 hours. We can remove a name or sound and block the anonymous ID from playing. Decisions are made by a person; the only automated tool is the name filter (section 5).
The app has no accounts, so we can't message a blocked player. If you write to us, we will explain the reason for a decision about your content, and you can ask us to review it by replying.
Point of contact for users and for authorities (EU Digital Services Act, Art. 11–12): [email protected], in English, Russian.

14. Website skiddy.app

The website has no cookies, no analytics and no third-party fonts or scripts. If you pick a language, the choice is remembered in your browser's local storage on your device only. Cloudflare processes your IP address, browser type and the page you open (an invite link contains the room code) to deliver and protect the site. The old address skiddy.pages.dev is the same website.

15. Changes

When this policy changes, we update the date at the top. We announce important changes on the website and in the app before they apply. This English version is the binding one; translations are for convenience.