Privacy Policy

Data controller

Henoch Schmohe (sole trader / autónomo (Spain)), tax ID X4159627P. Contact: henoch@zwist.app. Site: zwist.app.

What we process

• Player profiles and match results (the name you choose, emoji, colour, language, scores): stored on your device and mirrored to our database against a random device identifier. No real identity required.
• Email (optional): only if you enter it at purchase, so the unlock can be restored on your other devices.
• News email (optional): if you join the news list (e.g. the Android launch alert), we store your email, chosen language and the dates you signed up, confirmed and unsubscribed. We use double opt-in: no news is ever sent until you confirm your address via the link we email you.
• Payment data: handled by Stripe via RevenueCat. Zwist never sees or stores your card details.
• Aggregated, cookieless usage analytics (Vercel Web Analytics & Speed Insights). We do not profile you or track you across sites.

Purposes & legal basis (GDPR Art. 6)

• Running the game and syncing your profiles/history: provision of the service and legitimate interest.
• Processing the full-game purchase: performance of a contract.
• Measuring usage in aggregate to improve the product: legitimate interest (no cookies, no profiling).
• Sending you Zwist news by email: your consent (Art. 6(1)(a)), which you can withdraw at any time via the unsubscribe link in every email or by writing to us.

Processors & providers

We share only what is necessary with these providers, each under its own data-processing agreement:

• Neon — database (hosted in the EU, Frankfurt).
• Vercel — hosting and content delivery.
• RevenueCat — purchase and entitlement management.
• Stripe — payment processing.
• Apple — in-app purchases on the iOS version (where applicable).
• Resend — delivery of the confirmation, welcome and news emails (only if you join the list).

International transfers

Data is hosted primarily in the EU. Where a provider operates outside the EEA (e.g. the US), the transfer relies on Standard Contractual Clauses or other safeguards set out in its data-processing agreement.

Retention

Local data stays on your device until you tap “Reset all data” in Settings. The database mirror is kept while you use the app. Purchase records are kept for the period required by tax and accounting law.

If you unsubscribe from the news list we stop emailing you immediately; we keep a minimal record of the signup and opt-out as proof of consent, and delete it entirely if you request erasure.

Your rights

You may exercise access, rectification, erasure, restriction, portability and objection. “Reset all data” in Settings deletes your local data; email us to delete the database mirror. You may lodge a complaint with the Spanish DPA (AEPD, www.aepd.es) or your local supervisory authority.

Contact: henoch@zwist.app.

Children

Zwist is not directed at children under 14 and does not knowingly collect their data.

Changes

We may update this policy; the current version is posted on this page with its date.