Privacy Policy for Partygee Applications

Last updated: 24 September 2026

This Privacy Policy explains how GAMEGEE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ ("Gamegee", "Partygee", "we", "us" or "our") processes personal data in connection with the mobile applications covered by this Policy.

This is one common Privacy Policy for our Partygee applications. Section 15 identifies the data and service providers used by each covered application. Not every application uses every service described in this Policy.

1. Controller and Contact Details

The controller of the personal data described in this Policy is:

You may use the email address above for privacy questions and to exercise your data protection rights.

2. Applications Covered by This Policy

This Policy currently covers:

• Melo;
• Truth Or Dare;
• OnThree.

Another mobile application is covered only after it is expressly added to Section 15 and links to this Policy. Before using this Policy for a new application, we will identify that application's processing in Section 15 and update the Policy where necessary.

3. Important Terms

"Application" means a mobile application covered by Section 2.

"User" means a person who installs, opens or uses an Application.

"Personal data" means information relating to an identified or identifiable natural person. Device, app, advertising and pseudonymous identifiers may be personal data even if they do not directly reveal a person's name.

"Local data" means information stored on the User's device and not intentionally sent to us or our service providers, except where a feature or event expressly described in this Policy sends it.

"Service provider" means a third party that supplies hosting, analytics, authentication, subscription, attribution, support or other technology used by an Application.

4. Sources of Data

We obtain data:

• directly from you, for example when you enter a player nickname, select gameplay settings or contact support;
• automatically from your device and the Application, for example app events, technical information and identifiers generated by software development kits;
• from Apple App Store or Google Play in connection with purchases, subscriptions, refunds and entitlement status;
• from our service providers when they return analytics, subscription, attribution, configuration or support information to us.

We do not purchase personal data from data brokers.

5. Data We Process

The categories below apply only where indicated in Section 15 for the Application you use.

5.1 Technical and Device Information

This may include:

• device type, operating system and operating system version;
• Application name, version, installation and launch information;
• language, country or approximate region;
• IP address and network-related information received by online services;
• technical logs, SDK status, error and diagnostic information;
• timestamps and information about interactions with the Application.

We do not collect precise GPS location through the Applications.

5.2 App, Device and Advertising Identifiers

This may include:

• Firebase anonymous user ID;
• Firebase App Instance ID and analytics identifiers;
• RevenueCat app user ID and subscription identifiers;
• Apple Identifier for Advertisers (IDFA), only where available and permitted;
• Android Advertising ID, only where available and permitted;
• Apple AdServices attribution token and similar campaign-attribution identifiers;
• installation, device-generated and SDK-generated identifiers;
• purchase, product, transaction and entitlement identifiers.

These identifiers are pseudonymous, but they may still constitute personal data.

5.3 Analytics and Usage Events

Depending on the Application, analytics data may include:

• app launches, screen views and feature interactions;
• onboarding, paywall and subscription-screen interactions;
• deck, card, game, question or content identifiers;
• selected language, premium status and subscription or paywall variant;
• purchase success, restore purchase and entitlement events;
• rating prompt interactions and rating values;
• help, share, unsubscribe, support and store-opening interactions;
• question type, points, player ID and player nickname where expressly indicated in Section 15.

We ask Users not to enter a real name or sensitive information as a player nickname. We do not intentionally request health data, biometric data, political opinions, religious beliefs or other special-category data through gameplay or analytics.

5.4 Anonymous Authentication

The Applications use Firebase Authentication to create a pseudonymous, anonymous user account. No email address, password or social-login account is required for this authentication.

The generated Firebase user ID may be linked to analytics and RevenueCat subscription information so that subscription access and app services can operate consistently.

5.5 Purchases and Subscriptions

When you view, purchase, restore or manage a product or subscription, the following data may be processed:

• product and offer identifiers;
• price, currency, subscription period and trial eligibility;
• purchase, restore and entitlement status;
• active or expired subscription status;
• store platform and transaction-related technical identifiers;
• RevenueCat customer and app user identifiers;
• Firebase App Instance ID used for permitted subscription attribution.

Apple or Google processes the payment. We do not receive your full payment-card or bank-account details.

5.6 Local Gameplay and Preference Data

Depending on the Application, Local data may include:

• player nicknames and locally generated player IDs;
• selected gameplay gender/category and points;
• selected decks, played cards, achievements and game progress;
• language, app preferences and onboarding state;
• cached product information and subscription status;
• accepted-terms status and review-prompt state.

In Truth Or Dare, player nicknames and player IDs are initially stored locally but are also included in the rate_question analytics event described in Section 15.2. The selected gameplay gender/category is not intentionally sent as an analytics parameter.

Uninstalling the Application or clearing its app data will generally delete data that remains only on the device, subject to device backup and operating-system behaviour. It does not automatically delete data already sent to a service provider.

5.7 Remote Configuration

We use remote configuration to provide settings, content configuration, translations, links, paywall variants and similar Application parameters. The service may receive technical app and device information required to deliver and secure the configuration.

5.8 Support and Communications

If you contact us by email, Messenger or another support channel, we process:

• your contact details and account name used for that channel;
• your message and attachments;
• Application name, version and platform included in the message;
• information needed to investigate and answer your request.

When you choose an external channel such as Messenger, that provider processes your data under its own privacy policy.

6. Purposes and Legal Bases

Where the General Data Protection Regulation ("GDPR") applies, we use the following legal bases.

6.1 Providing the Application and Subscription Features

We process Local data, anonymous authentication identifiers, product information, entitlement status and necessary technical information to provide gameplay, save settings, verify access and restore purchases.

Legal basis: performance of a contract or steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).

6.2 Purchases, Accounting and Legal Compliance

We process purchase and subscription records to complete transactions, handle refunds or disputes, maintain legally required records and comply with consumer, tax and accounting law.

Legal bases: performance of a contract (Article 6(1)(b) GDPR) and compliance with a legal obligation (Article 6(1)(c) GDPR).

6.3 Product Analytics

Firebase Analytics and Amplitude process the usage events and pseudonymous identifiers identified in Sections 5.2, 5.3 and 15. We use this information to understand feature usage, improve content and usability, evaluate onboarding and paywalls, and diagnose product issues.

Legal basis: our legitimate interest in improving and securing the Applications (Article 6(1)(f) GDPR) for limited pseudonymous product analytics where this basis is permitted. Where applicable electronic-communications or data-protection law requires consent for SDK access, storage or collection, the legal basis for that activity is consent (Article 6(1)(a) GDPR), and the activity must not be performed before the required consent.

6.4 Advertising Attribution and Campaign Measurement

For Melo and OnThree, Meta and TikTok may process permitted device or advertising identifiers and the events listed in Sections 15.1 and 15.3. For all covered Applications, RevenueCat and Apple AdServices may process attribution tokens, Firebase App Instance ID and purchase or entitlement information. We use this data to attribute installations or purchases and measure Partygee advertising campaigns shown outside the Applications.

Legal basis: consent where required (Article 6(1)(a) GDPR). Where a limited measurement activity does not legally require consent, we rely on our legitimate interest in measuring campaign effectiveness and preventing attribution fraud (Article 6(1)(f) GDPR). We do not use refusal of optional advertising tracking to block core gameplay.

6.5 Security, Fraud Prevention and Legal Claims

We process necessary technical, transaction and log information to protect the Applications, prevent abuse, investigate errors or fraud, and establish, exercise or defend legal claims.

Legal basis: our legitimate interests in security, fraud prevention and protecting our legal rights (Article 6(1)(f) GDPR).

6.6 Support

We process support communications to answer your request and resolve technical, payment or access issues.

Legal bases: performance of a contract (Article 6(1)(b) GDPR) and our legitimate interest in providing effective support and keeping appropriate support records (Article 6(1)(f) GDPR).

7. Required and Optional Data

The following processing is necessary for the corresponding service:

• Local gameplay data is required only to save the relevant players, game state and preferences;
• Firebase Authentication is required to create the pseudonymous account used with subscriptions and analytics;
• Firebase Remote Config is required to deliver current configuration and remote content;
• RevenueCat, Apple App Store or Google Play data is required only for product display, purchase, subscription, entitlement and restore features;
• security and fraud-prevention data is required where necessary to protect those services.

Firebase Analytics, Amplitude, Meta and TikTok processing is not required for core gameplay. Where it is based on consent, you may refuse or withdraw that consent without losing core gameplay. Where product analytics is based on legitimate interests, you may object as described in Section 12. Aggregated measurement or strictly necessary technical processing may continue where permitted by law.

8. Service Providers and Other Recipients

Depending on the Application, we disclose or make data available to:

8.1 Google Firebase

Firebase Analytics, Firebase Authentication and Firebase Remote Config provide analytics, anonymous authentication and remote configuration.

Privacy information: https://policies.google.com/privacy
Firebase privacy information: https://firebase.google.com/support/privacy

8.2 Amplitude

Amplitude provides product analytics.

Privacy information: https://amplitude.com/privacy

8.3 RevenueCat

RevenueCat provides subscription, purchase, entitlement, trial-eligibility and restore-purchase infrastructure.

Privacy information: https://www.revenuecat.com/privacy

8.4 Meta

Melo and OnThree use Facebook App Events for campaign attribution and advertising-performance measurement. A User may also choose to open Messenger from an Application.

Privacy information: https://www.facebook.com/privacy/policy/

8.5 TikTok

Melo and OnThree use TikTok Business SDK for campaign attribution, event measurement and automatic in-app-purchase measurement.

Privacy information: https://www.tiktok.com/legal/page/eea/privacy-policy/en

8.6 Apple and Google

Apple App Store and Google Play process purchases, subscriptions, refunds, store reviews and related operations. Apple AdServices may provide campaign-attribution information.

Apple privacy information: https://www.apple.com/legal/privacy/
Google privacy information: https://policies.google.com/privacy

8.7 Professional and Public Recipients

Where necessary, data may also be disclosed to professional advisers, auditors, insurers, courts, regulators, law-enforcement bodies or other authorities where required by law or necessary to protect legal rights.

Firebase, Amplitude and RevenueCat generally act as processors when providing services configured for us, although Google may independently process limited data for purposes identified in its terms. Apple and Google act as independent controllers for their app-store and payment operations. Meta and TikTok process campaign and event data under the roles specified in their applicable business terms and may act as independent controllers for their own permitted purposes. Their policies explain their independent processing.

We do not sell personal data for money.

9. Tracking Choices and Withdrawal of Consent

Firebase Authentication, Firebase Remote Config and subscription services may operate automatically because they support core app or purchase functionality. Product-analytics and attribution SDKs may also initialise when an Application starts. Initialisation does not itself permit access to IDFA or any processing for which applicable law requires prior consent.

Where consent is legally required, the consent choice presented in the Application or by the operating system controls the relevant consent-based processing. Consent to one purpose does not constitute consent to another purpose.

On iOS, App Tracking Transparency ("ATT") controls permission for tracking as defined by Apple and access to IDFA. You may change ATT permission in iOS Settings under Privacy & Security > Tracking.

On Android, you may delete or reset the Advertising ID and manage available advertising-privacy controls in Android settings. The exact options depend on your Android version and device manufacturer.

ATT and operating-system advertising settings do not control all product analytics. The current Applications do not collect a separate in-app consent for product analytics. If we introduce such a consent, the same in-app interface used to give it will provide an equally accessible way to withdraw it.

To object to product analytics based on legitimate interests, contact partygee.store@gmail.com and identify the Application and platform you use. We will record the request, stop future processing covered by a successful objection, and instruct relevant processors where applicable. Withdrawal of consent does not affect processing that was lawful before withdrawal.

10. International Data Transfers

Some recipients are located outside the European Economic Area ("EEA"), including in the United States.

For Firebase/Google, Amplitude and RevenueCat services acting as our processors, transfers are governed by the applicable provider data-processing terms incorporating European Commission Standard Contractual Clauses. An adequacy decision, including the EU-US Data Privacy Framework, may instead apply where the relevant recipient is validly certified and the transfer is covered.

For Meta, transfers are governed by its applicable business data-transfer terms, including an adequacy decision where applicable or Standard Contractual Clauses. For TikTok, transfers are governed by its applicable business data-transfer terms, including Standard Contractual Clauses where required.

Apple and Google independently determine the safeguards for transfers they make as app-store or payment controllers and describe them in their privacy documentation.

You may contact us at partygee.store@gmail.com to request information about the safeguard relevant to a particular transfer and, where available, a copy of it. Commercially confidential information may be redacted.

11. Retention

We retain personal data only while it is needed for the relevant purpose and then delete or anonymise it, unless law requires or permits longer retention.

Our retention rules are:

• data that remains only on the device is retained until it is deleted in the Application, the Application's data is cleared, or the Application is uninstalled, subject to device backups;
• event-level analytics and attribution data under our control is retained for no longer than 14 months from collection, unless it must be preserved for a documented security incident, dispute or legal claim;
• aggregated or irreversibly anonymised statistics may be retained without a fixed limit because they are no longer personal data;
• anonymous authentication and RevenueCat subscription identifiers are retained while an entitlement may need to be provided or restored and for up to 36 months after the last recorded Application activity, unless a longer period is needed for fraud prevention, a pending request, dispute or legal claim;
• technical security logs under our control are retained for up to 12 months, unless connected with an incident, dispute or legal claim;
• purchase and accounting records are retained for the statutory period required by tax, accounting, consumer-protection and limitation laws;
• support communications are retained for up to 24 months after the request is closed, unless a longer period is needed for a dispute or legal claim;
• records of consent, withdrawal or objection are retained for the duration of the processing and for up to five years afterwards to demonstrate compliance and respect the choice;
• data-subject request records are retained for up to three years after the request is closed, unless a longer period is needed for a complaint or legal claim.

The limits above apply to data under our control and must be reflected in the settings and instructions we give processors. Apple, Google and other independent controllers determine their own retention periods under their policies.

12. Your Rights

Where the GDPR applies, you may have the right to:

• obtain confirmation whether we process your personal data and receive a copy;
• correct inaccurate or incomplete data;
• request deletion of data;
• restrict processing;
• object to processing based on legitimate interests;
• withdraw consent at any time;
• receive data you provided in a structured, commonly used and machine-readable format where portability applies;
• lodge a complaint with the supervisory authority in your habitual residence, place of work or place of the alleged infringement.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych): https://uodo.gov.pl/

To exercise a right, email partygee.store@gmail.com and state the Application and platform concerned. Because our Applications use pseudonymous identifiers and do not require a named account, we may ask for information reasonably necessary to locate the relevant record and verify that it relates to you, such as an app identifier, platform, approximate installation date or proof of purchase. We will not request more information than reasonably necessary.

If we cannot identify data relating to you, we will explain this where legally permitted. We generally respond within one month, subject to extensions allowed by applicable law.

13. Automated Decisions

We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on Users.

14. Children and Age

The Applications are not directed to children under 16. A higher minimum age may apply where required by the relevant Application's app-store age rating, content or local law. Users must meet the highest applicable minimum age.

We do not knowingly collect personal data from a child who may not lawfully use the relevant Application. If you believe this has occurred, contact partygee.store@gmail.com so that we can investigate and delete data where appropriate.

15. Application-Specific Information

This section forms part of the Policy and explains which processing applies to each current Application.

15.1 Melo

Melo uses:

• Firebase Analytics for app and gameplay analytics;
• Firebase Authentication for a pseudonymous anonymous user ID;
• Firebase Remote Config for configuration and remote content;
• Amplitude for product analytics;
• RevenueCat for purchases, subscriptions, entitlements, restore functionality, trial eligibility and permitted attribution;
• Facebook App Events for app-event and campaign measurement;
• TikTok Business SDK for campaign, event and in-app-purchase measurement;
• Apple App Store, Apple AdServices and Google Play for store and attribution functions.

Melo sends the following named analytics events to Firebase Analytics, Amplitude and Facebook App Events where the corresponding User action occurs: app/game opened; subscription button clicked; subscription success; achievement page opened; deck-change button clicked; deck changed; share clicked; app-store rating page opened; rating submitted; question rated; game-enjoyment question answered; unsubscribe clicked; help opened; and another Partygee game selected.

Depending on the event, its parameters are limited to: deck ID, card ID, language code, premium status, interaction location, numeric rating, like/dislike or yes/no response, number of times a prompt was shown, Partygee game ID, subscription screen location and configured payment/paywall variant. Melo also assigns the Firebase anonymous user ID to Firebase Analytics, Amplitude, Facebook App Events and RevenueCat, and provides the Firebase App Instance ID to RevenueCat.

TikTok Business SDK may automatically measure app lifecycle and in-app-purchase events. Meta and TikTok may receive technical identifiers permitted by the platform and User's applicable consent or settings.

Player nicknames used by Melo are stored locally and are not intentionally included in Melo analytics events.

Melo stores gameplay preferences, player nicknames, achievements, played cards, app state and subscription cache locally on the device.

15.2 Truth Or Dare

Truth Or Dare uses:

• Firebase Analytics for app and gameplay analytics;
• Firebase Authentication for a pseudonymous anonymous user ID;
• Firebase Remote Config for configuration and remote content;
• Amplitude for product analytics;
• RevenueCat for purchases, subscriptions, entitlements, restore functionality, trial eligibility and permitted attribution;
• Apple App Store, Apple AdServices and Google Play for store and attribution functions.

Truth Or Dare sends the following named analytics events to Firebase Analytics and Amplitude where the corresponding User action occurs: app/game opened; subscription button clicked; subscription success; restore subscription clicked; deck-change button clicked; deck changed; app-store rating page opened; rating prompt clicked; rating submitted; question rated; help opened; and unsubscribe clicked.

Depending on the event, its parameters are limited to: deck ID, card ID, question type, points, player ID, player nickname, language code, premium status, rating-prompt location and numeric rating. Truth Or Dare also assigns the Firebase anonymous user ID to Firebase Analytics, Amplitude and RevenueCat, and provides the Firebase App Instance ID to RevenueCat.

Truth Or Dare stores player nicknames, locally generated player IDs, selected gameplay gender/category, points, selected decks and preferences locally on the device.

The selected gameplay gender/category is used locally to select suitable questions. It is not intentionally included as a Truth Or Dare analytics parameter.

Truth Or Dare may open an external Meta Messenger page only after the User selects that option. Meta then processes the interaction under its own privacy policy.

15.3 OnThree

OnThree uses:

• Firebase Analytics for app and gameplay analytics;
• Firebase Authentication for a pseudonymous anonymous user ID;
• Firebase Remote Config for configuration and remote content;
• Amplitude for product analytics;
• RevenueCat for purchases, subscriptions, entitlements, restore functionality, trial eligibility and permitted attribution;
• Facebook App Events for app-event and campaign measurement;
• TikTok Business SDK for campaign, event and in-app-purchase measurement;
• Apple App Store, Apple AdServices and Google Play for store and attribution functions.

OnThree sends the following named analytics events to Firebase Analytics, Amplitude and Facebook App Events where the corresponding User action occurs: app/game opened; subscription button clicked; subscription success; achievement page opened; deck-change button clicked; deck changed; share clicked; app-store rating page opened; rating submitted; question rated; game-enjoyment question answered; unsubscribe clicked; help opened; and another Partygee game selected.

Depending on the event, its parameters are limited to: deck ID, card ID, language code, premium status, interaction location, numeric rating, like/dislike or yes/no response, number of times a prompt was shown, Partygee game ID, subscription screen location and configured payment/paywall variant. OnThree also assigns the Firebase anonymous user ID to Firebase Analytics, Amplitude, Facebook App Events and RevenueCat, and provides the Firebase App Instance ID to RevenueCat.

TikTok Business SDK may automatically measure app lifecycle and in-app-purchase events. Meta and TikTok may receive technical identifiers permitted by the platform and User's applicable consent or settings.

Player nicknames used by OnThree are stored locally and are not intentionally included in OnThree analytics events.

OnThree stores gameplay preferences, player nicknames, achievements, played cards, app state and subscription cache locally on the device.

16. Privacy Information for Certain United States Residents

This section applies only where a United States state privacy law applies to Gamegee and to the relevant processing.

During the preceding 12 months, the categories of personal information processed were identifiers, internet or other electronic-network activity, commercial or subscription information, approximate region inferred by service providers, support correspondence and the gameplay information identified in Sections 5 and 15. The sources are listed in Section 4, purposes in Section 6, retention rules in Section 11 and categories of recipients in Section 8.

For business purposes, we disclose identifiers, technical and usage activity, authentication information and commercial or subscription information to the analytics, authentication, configuration, subscription and store providers identified for each Application in Section 15.

We do not sell personal information for money. Melo and OnThree disclose identifiers and app, gameplay or purchase events to Meta and TikTok for campaign attribution and measurement. Some state laws may define this as "sharing", targeted advertising or a sale. Truth Or Dare does not use Meta or TikTok advertising SDKs.

Where an applicable law provides an opt-out right, you may opt out using available device consent controls and by contacting partygee.store@gmail.com. Browser-based Global Privacy Control signals are not technically received inside the current native mobile Applications; we honour a legally recognised universal opt-out signal where we operate a surface capable of receiving it and applicable law requires us to do so.

Depending on applicable state law, you may have rights to know, access, correct, delete or obtain a copy of personal information, to opt out of sale, sharing, targeted advertising or certain profiling, and to appeal a refusal of your request. We will not discriminate against you for exercising a right. You may submit a request or appeal using the contact information in Section 1.

We do not knowingly sell or share the personal information of children under 16.

17. Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. No transmission or storage system can be guaranteed to be completely secure.

18. Changes to This Policy

We may update this Policy when an Application, processing activity, service provider or legal requirement changes. The date at the top identifies the latest version.

Where required, we will provide additional notice or request a new consent before a material change takes effect. Earlier versions may be requested by contacting us.

19. Contact

For privacy questions, rights requests or complaints, contact: