Privacy Policy

This policy explains what YOSI collects when you play, why, who else handles it, and what you can do about it. YOSI is made by ARIVON. If anything here is unclear, write to team@nunporul.com.

What we collect

Your account

When you sign in with Google, Apple or an email address, the sign-in provider tells us who you are. We keep the provider's identifier for your account, your email address and whether it is verified, and a phone number only if your provider sends one. We never see or store your password.

Your profile

Your handle, display name, country, language, the avatar you upload, and your referral code. Your handle and avatar are visible to other players.

How you play

The games you play and the moves made in them, your ratings and statistics, your season, quest, achievement and battle pass progress, replays you bookmark, and tournaments you enter.

What you share with others

• Friend requests, friendships and the players you block.
• Clubs you create or join, and the messages you post in club chat.
• Parties you form.
• Reports you file about another player, and feedback you send us, including any screenshot you attach.
• Replay links you create. Anyone holding a replay link can watch that game until you revoke the link.

People you invite

If you invite someone by email or phone, we keep a normalised form of that address so we can deliver the invite and so we never contact someone who has asked us not to. We do not keep the text you typed.

When someone opens an invite link, we record that the link was opened, along with a salted, one-way hash of their IP address and the broad type of device they used — the platform, the major version of its operating system, and the screen size. This is how we connect an install to the invite that led to it, which Apple gives us no other way to do. We never store the raw address, and these records are deleted after 90 days whether or not the person joined.

Your device

A push notification token for each device you sign in on, and your session tokens, which we store only as one-way hashes. To detect shared devices and networks, which is how collusion between accounts is caught, we keep a salted, one-way hash of your device identifier and IP address. We never store the raw identifier or address for this.

Diagnostics and usage

When the app crashes or misbehaves, a crash report is sent to Sentry. It can include a screenshot of the screen at the time and a description of the screen's layout; we strip tokens and other secrets from reports before they leave your device.

Where usage analytics are switched on, we record how the app is used with PostHog: the screens you open and the actions you take. If screen recording is enabled with it, anything you type into a text field is masked in the recording. Analytics are not always enabled, and while they are not, nothing is sent to PostHog at all.

What we do not do

• We do not sell your personal data.
• We do not show advertising, and there are no advertising SDKs in the app.
• We do not use your data to decide anything about you outside the game.

How we use it

• To run your account and the games you play.
• To rate games fairly and keep ratings honest, including detecting cheating and collusion.
• To let you find, play with and message other players, and to deliver the notifications you receive.
• To answer reports and feedback, and to moderate chat.
• To find and fix faults, and to understand which parts of the game work.

Who else handles it

We use a small number of providers to run YOSI. Each handles your data only to do that job for us.

• Google Firebase for sign-in and push notifications.
• Google Cloud for hosting, the database, and storing avatars and feedback screenshots.
• Sentry for crash reports.
• PostHog for usage analytics, where those are switched on.
• Resend for sending invite emails.

We will disclose data where the law requires us to, or where it is needed to protect players from fraud or abuse.

How long we keep it

• Your account and profile, until you delete your account.
• The move-by-move record of a game, for 90 days — longer only for a game someone has bookmarked or reported.
• Usage events, for 180 days.
• A device's push token, for 30 days after it stops working.
• A record of each email or notification we sent you — what it was, when, and whether it reached you — for 180 days, and the delivery events behind it for 90 days. The message content itself is cleared after 7 days.
• A record that an invite link was opened, for 90 days.

Deleting your account

You can delete your account from Settings in the app. When you do, we remove your sign-in identities, your devices and your block list, and clear your display name, country and avatar. Your handle is replaced so it no longer names you.

Finished games, ratings and messages you posted are shared with other players, so they are kept, but they are no longer linked to your name.

Your rights

You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Write to team@nunporul.com from the email address on your account, and we will answer within 30 days. The same address reaches our grievance officer if you want to complain about how your data is handled.

Children

YOSI is not meant for children under 13. If you are under 18, you need a parent or guardian's permission to use it. If you believe a child has given us data without that permission, write to us and we will delete it.

Security

Connections to our servers are encrypted. Session tokens and device fingerprints are stored only as hashes, and access to player data inside ARIVON is limited to the people who need it to run the game.

Changes to this policy

When this policy changes, we publish the new version here and change the date at the top. If a change affects how we use data we already hold, we will tell you in the app before it takes effect.

Contact

ARIVON — team@nunporul.com