Privacy Policy

Steal Risk is for players aged 16 or older. The Spicy pack is for adults only (18+) and must be enabled with an explicit confirmation.

If you are a parent and believe a child under 16 has given us data, write to info@stealrisk.com and we will delete it.

Friends mode, local (offline, no account): the names you type stay on the phone and are never sent to us.

Account (sign-in with Google, Apple or as a guest): user identifier (Firebase UID), email and name provided by the sign-in provider, the display name and profile photo you choose, creation and last sign-in dates, the version of this notice you accepted.

Online play (Friends, Couple and Random rooms): room name, join code, the challenges and questions you write, votes, scores, round results, game state, online presence. In Random mode: photos or videos you upload as proof of a challenge.

Statistics: Friends leaderboard (average risk, games played, position), stored under a pseudonymous identifier derived from your UID; couple affinity history, visible only to you.

Purchases: purchase identifier, product, date and status, received from the stores through RevenueCat. We never receive your card details.

Push notifications: device token, platform, language, time zone, app version and notification preferences.

Technical and usage data: app and device identifiers (advertising identifier if you allow it), device model, operating system, language, usage events (screens opened, modes played, ads shown, purchases), technical errors, IP address.

Reports and moderation: reason for the report, reported and reporting user, reference to the reported content, outcome and moderation notes.

We do not collect biometric data, precise location or special categories of data. The answers you give in the game may however contain personal information you choose to share: think before you write it.

Running the app and your account, managing rooms, games, leaderboards and purchases: performance of a contract (Art. 6(1)(b) GDPR).

Security, abuse and fraud prevention, content moderation, request integrity (Firebase App Check): legitimate interest (Art. 6(1)(f)) in protecting the service and other players.

Aggregate usage statistics to improve the app (Firebase Analytics): legitimate interest; you can object at any time by writing to us, or by limiting tracking in your phone settings.

Personalised advertising (Google AdMob): only with your consent, collected through the form shown at launch in countries where it is required (EU, UK, Switzerland) and changeable from Settings > Ad privacy options. Without consent we show non-personalised ads, based on context rather than on your profile.

Push notifications (reminders, new rooms, events in your rooms): consent, given by enabling notifications on your phone and revocable in Settings.

Compliance with legal obligations (e.g. keeping proof of purchase, answering authorities): legal obligation (Art. 6(1)(c)).

In online rooms, members of the same room see your display name, profile photo, the challenges and questions you write, the votes shown by the game flow, scores and, in Random mode, the proof you upload for a challenge.

In Random mode you play with people you do not know: do not share data that could identify or locate you (surname, address, school, social profiles) and do not upload images of other people without their consent.

In the Friends leaderboard, people who played with you see your name, photo and game statistics. Your data is not public outside the rooms you played in.

We do not sell personal data. We use providers that process data on our behalf or as independent controllers:

- Google LLC / Google Ireland (Firebase Authentication, Firestore, Storage, Cloud Functions, Cloud Messaging, Analytics, App Check, Hosting): infrastructure, notifications and statistics. Servers in the European Union and the United States.

- Google AdMob: in-app advertising. For personalised ads Google acts as an independent controller under its own policy (policies.google.com/technologies/ads).

- RevenueCat, Inc. (United States): in-app purchase and store receipt management.

- Apple Inc. and Google (App Store, Google Play): app distribution, payments, Sign in with Apple and Google Sign-In, under their own policies.

- Google Fonts: some fonts in the app are loaded from Google servers, which receive the device's IP address.

We may disclose data to public authorities where the law requires it.

Some providers (Google, RevenueCat, Apple) also process data in the United States. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework for certified companies and, otherwise, on the standard contractual clauses approved by the European Commission.

- Account, profile, statistics and histories: while the account is active; deleted when the account is deleted.

- Game rooms: abandoned Random rooms are closed after about 60 minutes of inactivity; finished Couple and Friends rooms stay linked to your history while the account is active.

- Random mode photo/video proofs: deleted automatically within 8 hours of upload; if a report is open, within 72 hours at most.

- Notification tokens: while the device stays registered; notification events are deleted after 7 days.

- Reports and moderation decisions: up to 24 months, to handle disputes and prevent repeat abuse.

- Purchase records: 10 years, for tax and accounting obligations.

- Analytics data: up to 14 months in Google systems, aggregated afterwards.

- Accounts blocked for serious violations: deleted automatically within about 24 hours of the block.

From the app: Settings > Delete account. Deletion is immediate and removes the sign-in account, profile and photo, star balance, the rooms you are in, statistics and histories, devices registered for notifications and the link to your purchases.

By email: write to info@stealrisk.com from the address linked to the account; we reply within 30 days.

What we may keep after deletion: moderation reports and pseudonymous technical data, for the periods above. Purchases remain recorded with Apple and Google under their rules.

Full instructions: https://stealrisk.com/delete-account

You can ask us at any time for: access to your data, rectification, erasure, restriction of processing, portability of the data you gave us, objection to processing based on legitimate interest, withdrawal of consent (without affecting processing already carried out).

Write to info@stealrisk.com: we reply within one month. To verify your identity we may ask you to write from the email linked to your account.

If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of the country where you live.

Any player can report inappropriate content from online rooms. Reports are reviewed manually. In case of a serious violation (offensive content, nudity, spam, harassment) the account is blocked and deleted automatically within about 24 hours, with a notice in the app. You can dispute a decision by writing to info@stealrisk.com.

Data is hosted on Firebase / Google Cloud, with encrypted connections, access rules that limit each user to their own data and the rooms they take part in, server-side logic for sensitive operations (credits, purchases, moderation) and app integrity verification (App Check). No system is 100% secure: in case of a breach that puts you at risk we will inform you as required by the GDPR.

The website stealrisk.com is static and uses no profiling cookies or analytics tools. The support form opens your email client and sends nothing to us until you send the email. Store links lead to Apple and Google pages, subject to their own policies.

We may update this notice. The current version is always published at https://stealrisk.com/privacy-policy with its update date. For substantial changes we will ask you to review it the next time you open the app.

Controller: Rocco Carbone

Email: info@stealrisk.com

Website: https://stealrisk.com