Privacy Policy
Vampire Villager ("the app") is published by Berkay Zelyurt (the "we" in this document). This policy explains what personal data the app handles, why, for how long, and what you can do about it. It covers the offline party game and the online multiplayer mode. Contact: zelyurtberkay@gmail.com.
1. Offline play
The offline mode (passing one phone around a table) works without an account and sends no game data to us. The names you type for players stay on the device. What the app does use offline: your language and music settings (stored on the device), advertising (section 6) and purchase status for the Pro upgrade (section 7).
2. Online play: what we collect and why
| Data | Why | Kept |
|---|---|---|
| Email address, password (stored only as an Argon2 hash), username and tag | Your account: signing in, showing your name to other players, resetting your password, contacting you about the account | Until you delete the account (section 9) |
| Apple or Google identity (the provider's user id and the email it reports; Apple may give a relay address) | Sign in with Apple / Google. Apple also gives us a token we must revoke when you delete the account | Until you delete the account or revoke the link on the provider's side |
| Game records: lobbies you joined, roles, actions, votes, results, coins earned and spent | Running the game, paying out coins, resolving disputes and reports | Kept, but anonymised after account deletion |
| Text chat messages (with profanity masked) | Delivering chat, moderation, handling reports | Kept for moderation; no longer linked to you after deletion |
| Reports you file or receive | Moderation | Kept for moderation |
| The list of players you have blocked | Hiding their chat and voice from you, and keeping you out of the same lobbies. The blocked player is never told | Until you unblock them; deleted with your account |
| IP address, device / app version, timestamps of sign-ins, failed attempts and security events | Rate limiting, abuse prevention, security auditing | Security audit log, 12 months |
| Voice chat | Talking to other players during a game. Audio is relayed live through our own server and is not recorded or stored | Not stored |
| Consent to these terms (when, which version) | Legal requirement | Until you delete the account |
3. Legal basis
We process account and game data because it is needed to provide the service you asked for (contract). Security logging, moderation and abuse prevention are our legitimate interest in keeping the game playable and safe. Advertising personalisation is based on your consent (section 6). Where the Turkish Personal Data Protection Law (KVKK) or the EU GDPR apply, you have the rights listed in section 10.
4. Who else sees your data (processors)
- OVHcloud (France): hosts our server and database (EU data centre).
- Resend: sends our transactional email (verification codes, password reset codes, account deletion notices). They receive your email address and the message.
- Apple and Google: when you use Sign in with Apple / Google, the provider handles the sign-in and tells us your identity. Their own privacy policies apply to that step.
- Google AdMob / Firebase: advertising and basic app analytics (section 6).
- Apple App Store / Google Play: purchases of the Pro upgrade. We never see your payment details.
We do not sell personal data and we do not share it with anyone else, except when the law requires it.
5. Other players
Other players in your lobby see your username and tag, whether you are online, what you write in chat, your voice while you hold the talk button, and, after the game, everyone's roles. They never see your email address, and they are never told that you blocked or reported them.
6. Advertising and analytics
The free version shows ads from Google AdMob. On iOS, the app asks for tracking permission (App Tracking Transparency); if you decline, ads are non-personalised. AdMob and Firebase Analytics may collect the advertising identifier, device information and coarse usage events under Google's privacy policy. Pro removes ads.
7. Purchases
The Pro upgrade is bought through the App Store or Google Play. We receive a confirmation that the purchase exists, not your payment details. Online coins are earned by playing or by watching rewarded ads; they have no cash value.
8. Children
The online mode is for players aged 13 or older (16 where local law requires it). We do not knowingly collect data from younger children; if you believe a child has created an account, contact us and we will delete it.
9. Deleting your account
In the app: Play online → Account → Delete account. You confirm with your password (or with Apple / Google for accounts without a password). The account is deactivated immediately and stays recoverable for 30 days: signing in during that time lets you restore it. After 30 days it is anonymised: your email, username, password and Apple / Google links are removed for good, and your Sign in with Apple token is revoked. Your block list is deleted outright, in both directions. Game history, coin records and chat lines remain but are no longer connected to any person. Security audit log entries expire on their own schedule (section 2). If you cannot open the app, email us from the address on the account.
10. Your rights
You can ask us to show you the data we hold about you, correct it, delete it (section 9), restrict or object to processing, or hand it over in a portable format. Email zelyurtberkay@gmail.com; we answer within 30 days. You may also complain to your local data protection authority (in Türkiye: KVKK; in the EU: the authority of your country).
11. Security
Connections are encrypted (TLS). Passwords are hashed with Argon2. Sessions use rotating refresh tokens; a reused token ends every session of the account. Apple tokens are encrypted at rest. Access to the server is limited to the publisher.
12. Changes
When this policy changes materially, the app asks you to accept the new version before you keep playing online. The version and date are at the top of this page.