Sova Privacy Policy

1. Data We Collect

1.1 Account data

• Anonymous account ID (a random UUID) — created automatically the first time you open the App, so you can play without giving us any personal information. You can keep playing anonymously as long as you like.
• If you later sign in to an account you already have, the games you played anonymously on this device are merged into that account and the anonymous record is deleted.
• Email address and name — only if you choose to sign in with Apple or Google. We use them to keep your progress across devices and to recover your account. They are never shown to other players. With Sign in with Apple you can hide your email; we then only receive Apple's relay address.

1.2 Sign in with Apple

• When you sign in with Apple, we receive a token from Apple that we store on our servers only so that we can revoke Sova's access to your Apple ID when you delete your account.
• When you delete your account we ask Apple to revoke it and delete it with the rest of your data. If Apple can't be reached, your account is still deleted and you can remove Sova yourself in iPhone Settings → your name → Sign-In & Security → Sign in with Apple.

1.3 Gameplay data

• Game results, scores, attempts and timestamps, and whether a game was a daily, archive, practice or multiplayer game.
• Used to run the daily puzzles, streaks, achievements, leaderboards, leagues and multiplayer matches.

1.4 Your public alias

• Leaderboards, leagues and multiplayer show players under a generated alias such as "Sova 4821", derived from the account ID. You cannot enter a public name, and your Apple or Google name is never published.
• Anonymous players do not appear on public leaderboards.
• In a multiplayer match, the other players in that match see your alias and your results in that match.

1.5 Analytics data (first-party)

• Event type, game, mode, outcome, duration, app version, platform, a cohort bucket (0–15, derived from a hash, not your UUID) and whether the account is anonymous.
• Events contain no email, name or advertising identifier, but they are linked to your pseudonymous account ID. Our server stamps that ID from your sign-in token; the App cannot set it.
• Used only to improve the App and keep it reliable. Not shared with any third party. No third-party analytics SDKs are used.

1.6 Crash and error reports

When the app crashes or runs into an unexpected error, Sova sends a diagnostic report to Sentry (Functional Software, Inc.), the service we use for crash reporting. A report contains the technical error and stack trace, the app version, the device model and operating system version, the app language, and a short trail of technical events before the error (for example which screen was open and which network requests failed, without their parameters). Reports do not contain your name, email address, account ID, public player name or screenshots. Email addresses and sign-in tokens are removed from reports, and IP addresses are not stored. We do not record performance data or usage sessions. We use these reports only to find and fix bugs and to keep the app stable. Sentry processes them on our behalf in the European Union, and they are deleted within 90 days.

1.7 IP addresses and abuse prevention

• IP addresses are processed transiently by our hosting providers (Supabase, Cloudflare) to deliver the service.
• We use rate limits to prevent abuse. They count requests per account and, for content reports, per IP address. These rate-limit records are deleted by a daily automatic cleanup, at the latest about two days after they are created.

1.8 Data stored only on your device

• Your language, settings, practice-mode state and, if the App asks for it, your age band. These stay on your device and are not sent to our servers.

1.9 Data we do not collect

• Location, contacts, photos, microphone or camera data, payment data, advertising identifiers or your exact age.

2. No Ads and No Purchases in Version 1.0

• Version 1.0 of the App shows no ads and offers no in-app purchases. No ad network is active, no advertising identifier is requested and no payment data is processed.
• Version 1.0 includes no advertising SDK (such as Google AdMob or Google's consent SDK) and no purchase SDK (such as RevenueCat).
• If a later version adds ads or an optional purchase, we will update this policy and the store privacy labels before that version is released.

3. Why We Use Your Data (Legal Bases)

• To provide the game you asked for — accounts, daily puzzles, rankings, multiplayer (performance of our agreement with you, i.e. these terms).
• To keep the App secure, prevent cheating and abuse, and improve it with first-party analytics (our legitimate interests).
• Signing in with Apple or Google is always your choice; you can stay anonymous.

4. Children

• Sova is a general-audience puzzle game. It shows no ads to anyone and needs no personal information to play.
• Analytics events for every user, including children, contain no email, name, advertising identifier or age band.
• No behavioural data beyond basic gameplay outcomes is collected for any user.
• If you are a parent and want a child's data removed, use Delete account in the App (Section 8); for a child who signed in with Apple or Google you can also write to podrska@sovaapp.ba.

5. Service Providers

We do not sell your data. We share data only with these providers, only for the stated purpose:

• Supabase — hosting, database and sign-in for our backend (account ID, sign-in tokens, gameplay and analytics data).
• Sentry (Functional Software, Inc.) — crash and error reports (see 1.6); no name, email, account ID or screenshots.
• Apple and Google — only if you choose to sign in with them; they confirm your identity to us under their own privacy policies.
• Wiktionary (Wikimedia Foundation) — to check whether an unusual word guess is a real word, our server may look the word up. Only the word is sent, never your identity.
• Cloudflare — hosts the website sovaapp.ba (see Section 12).

Some providers may process data outside Bosnia and Herzegovina, for example in the EU or the United States. Where required, such transfers rely on the providers' data processing terms and standard contractual clauses.

6. Data Retention

• Analytics events are deleted automatically after 90 days. For crash reports, see 1.6.
• Account, alias and gameplay data are kept while your account exists, so your results, streaks, achievements, leagues and rankings keep working.
• When you delete your account, this data is deleted immediately. Copies in encrypted backups are overwritten automatically within a limited period.
• Emails you send us are kept only as long as needed to handle your request.

7. No Tracking

• The App does not track you across other companies' apps or websites and does not ask for App Tracking Transparency (ATT) permission.
• The App uses no third-party analytics or advertising SDKs, only crash reporting (see 1.6). The website sets no cookies and loads no third-party scripts.

8. Account Deletion

You can delete your account and its data at any time, whether you are signed in or anonymous:

1. Open the App.
2. Go to Me › Settings (the gear icon).
3. Tap Delete account.
4. Confirm the deletion.

This permanently removes your profile and alias, gameplay history, achievements, league membership, analytics events, multiplayer matches you created, and your sign-in record (including a stored Apple token, see 1.2). The App then starts a fresh anonymous session so you can keep playing.

In-app deletion is the main path for everyone. If you signed in with Apple or Google, you can also email podrska@sovaapp.ba from that account's email address; we find the account by that address (details: https://sovaapp.ba/delete-account). Anonymous accounts can only be deleted in the App.

9. Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted (see Section 8);
• object to or restrict processing;
• receive your data in a portable format.

To exercise these rights, write to podrska@sovaapp.ba. We answer within 30 days. You can also complain to the Personal Data Protection Agency of Bosnia and Herzegovina or to the data protection authority where you live.

10. Security

Data is encrypted in transit (HTTPS/TLS). Access to the database is restricted, and every player can only read and change their own private data.

11. Changes to This Policy

We may update this policy. Changes are announced through App updates and on this page, and the "Last updated" date at the top shows the latest revision.

12. The Website sovaapp.ba

The website is a static site hosted by Cloudflare. It uses no cookies, analytics or third-party scripts. Cloudflare processes technical data such as your IP address to deliver the pages and protect them from attacks.

13. Contact

Questions about this policy or your data:

Data controller: Haris Ovčina, Bosnia and Herzegovina — email: podrska@sovaapp.ba