Privacy Policy — Hidden Gem — Not Bad Technology

Summary

Hidden Gem is a hidden-object game for iPhone. There is no sign-up. The first time you open the game, your iPhone creates a random Account ID, and our server keeps your gems, level and scenes under that ID. We don't know who you are unless you write to us.

What we handle is that Account ID, your progress and balances, a record of what happens as you play, your purchases, the scene descriptions you type, the scenes you report, and a notification token while notifications are on. We use it to run the game, to review what players create, and to understand, mostly in totals, how the game is played. You can object to that last use without deleting your account (see Analytics and crash reports).

A few outside services take part. Microsoft Azure hosts our server and sends the emails about reports of illegal content, Google Workspace hosts our email inbox, OpenAI turns your scene descriptions into pictures, Expo delivers notifications and Apple handles payments. If you choose to watch an optional ad, Google shows it and collects some data about your device. Before your first ad the game asks whether you are 16 or older, and your answer stays on your iPhone. Players who are 16 or older in the EEA, the UK and Switzerland are asked for consent by Google first. For players under 16 the game shows no Google consent message and marks every ad request as coming from someone below the age of consent. Everywhere, we ask Google for non-personalised ads only.

We don't sell data, and we don't track you across other companies' apps or websites. You can delete your account, together with everything linked to it, in the game under Settings, Delete account. To see or export your data, or for anything else about privacy, write to contact@notbad.tech with your Account ID, which you'll find in the game under Settings.

Who we are

Hidden Gem is published by Protip Norbert Częścik, a sole proprietorship registered in Poland, trading as Not Bad Technology. Under the EU General Data Protection Regulation (GDPR), we are the controller of the personal data described in this policy.

Data controller
Protip Norbert Częścik
Polish Tax Identification Number (NIP): 5242873450
Wyszogrodzka 14/107, 03-337 Warsaw, Poland
Email: contact@notbad.tech

For anything to do with privacy, write to contact@notbad.tech.

Our supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. If you live in another EU country, you can also turn to the data protection authority there.

Data we collect

This is the complete list of what leaves your iPhone and is kept by us. Each item says what it is, why we need it, and the legal basis we rely on under the GDPR.

Account ID. A random 32-character code that the game creates on your iPhone and keeps in the iOS Keychain. It is sent with every request that concerns your account and is the key to your data on our server. The Keychain can keep it after the app is deleted, which is why reinstalling on the same iPhone brings your progress back. Needed to provide the game (Art. 6(1)(b) GDPR, performance of our agreement with you).
Progress and balances. Your level and the gems you have earned towards it, the gems you have found on each difficulty, the number of scenes completed, how many of each kind of gem you hold and whether you have bought or used the Golden Gem, your Health Gems and when they next refill, the days you claimed free gems and your streak, which of your own scenes you have already played and which approvals we have already told you about, whether you have objected to analytics, and whether scene creation has been suspended for your account — and if it has, the date, the reason as a code and as the text you are shown, a note of who made the decision and the state of any appeal. Plus when your account was created, last changed and last in touch with our server. Needed to provide the game (Art. 6(1)(b)).
Game activity record. Short entries, each with the time. The game sends some as you play: a scene started (with the scene number and whether it is the tutorial), a scene finished (with the scene number, the difficulty, the hints used and the time taken) and a hint used; our server reads your Account ID from these only to check whether you have objected, and stores them without it. Our server adds its own entries, stored with your Account ID, whenever your balances change (the gems earned or spent, how many and why), whenever you create a scene and whenever you buy something. Used to keep your balances right (Art. 6(1)(b)) and, in our legitimate interest in improving the game and preventing abuse, to see how the game is played (Art. 6(1)(f)). You can object to the second use without deleting your account; see Analytics and crash reports.
Purchases. For each purchase: the item and what it added to your account, Apple's transaction number, whether it was a real purchase or an Apple test purchase, the time and your Account ID. Needed to deliver what you bought (Art. 6(1)(b)) and, in our legitimate interest, to make sure each purchase is credited only once (Art. 6(1)(f)). The details are in Purchases.
Your scenes. The description you type on the Create scene screen (up to 80 characters), the picture made from it, when it was made, the outcome of our review with the reason if a scene was rejected or removed, and whether the reward for an approved scene has been paid. Needed to provide the feature you asked for (Art. 6(1)(b)). The details are in Scenes you create.
Reports you make in the game. If you report a scene: its number, the reason you picked, the note you add if you choose to (up to 200 characters in the game) and your Account ID. We handle these to meet our obligation to act on notices of illegal content under Article 16 of the EU Digital Services Act (Art. 6(1)(c)) and, where a report is about a breach of the game's rules, in our legitimate interest in keeping the game's content safe (Art. 6(1)(f)). The details are in Reports and moderation.
Notification token. Only while notifications are on both in iOS and in the game (Settings, Notifications): a token that lets our server tell you when a scene you made has been approved. Turning notifications off in the game removes the token from our server straight away; turning them off in iOS removes it the next time the game connects. Based on our legitimate interest in letting you know what happened to your own scenes (Art. 6(1)(f)).
Messages you send us. If you email us or use the form for reporting illegal content, your email address and whatever you write, and on the form also your name. For reports of illegal content we handle them to meet our obligation under Article 16 of the Digital Services Act (Art. 6(1)(c)); see Reports and moderation. Other messages we handle in our legitimate interest in answering you (Art. 6(1)(f)).

Like any internet service, our server sees your IP address while the game is connected to it. The game's server software does not record it. To limit how often requests can be made, it holds the address in memory for at most an hour and then forgets it; see Security.

Every request from the game also carries the game's version number. Our server compares it with the oldest version it still supports, so that an outdated version can ask you to update. The version number is not stored.

Do you have to provide this data? No law requires it. The Account ID, your progress and balances and the game activity record are needed for the game to work, so the game can't be played without them. Everything else is up to you: scene descriptions only if you create a scene, reports only if you report one, the notification token only if notifications are on, purchase records only if you buy something, and messages only if you write to us. You can play without doing any of these.

Some things are kept only on your iPhone: your sound, difficulty and notification settings, whether you have seen the tutorial and the notice about OpenAI, your answer to the age question asked before ads, the schedule of daily reminders, a local copy of your balances and of the scene you are playing, and the lists of scenes you have played and scenes you have reported. The last two lists travel with each request for a new scene, without your Account ID, so that our server can leave those scenes out. The server doesn't store them. Deleting your account in the game clears this local data, including your answer about age.

Data we do not collect

Hidden Gem does not ask for, and we do not receive:

your name, email address, phone number or any other contact details, unless you choose to write to us;
your location, because the game does not use Location Services;
your contacts, photos, camera, microphone or files;
your Apple Account or payment card details, because payment takes place entirely within Apple's App Store;
your advertising identifier (IDFA), because the game never asks for permission to track you, so iOS does not make it available;
health, fitness or any other sensitive data.

There are no third-party analytics or crash-reporting tools in the game, and we don't track you across apps and websites owned by other companies.

How we use data

We use the data described above only to:

run the game: serve scenes, keep your balances and level, refill Health Gems, pay daily rewards and rewards for approved scenes, and restore your progress if you reinstall on the same iPhone;
deliver what you buy, and credit each purchase exactly once;
turn your descriptions into scenes, review them, and share the approved ones with other players;
handle reports about scenes, decide on them and tell the people involved;
tell you, while notifications are on, that a scene you made has been approved;
keep the game fair and its running costs under control, with a daily cap on how many scenes can be created in the game in total and limits on how often requests can be made;
ask you to update when your version of the game no longer works with our server;
understand how the game is played, mostly as totals and averages, so that we can improve it;
answer your messages and handle your privacy requests.

We don't sell your data, use it for advertising or marketing, or build profiles of you. We don't make decisions about you by automated means that have legal or similarly significant effects. The only automated check, the safety screening of scene descriptions, decides whether a picture can be painted; if it can't, you are not charged for it. Every other decision about a scene or an account, including rejecting or removing a scene and suspending scene creation, is made by a person.

Scenes you create

When you tap Create, the game sends your description and your Account ID to our server. The Account ID stays with us; only the description goes on to OpenAI. The game tells you this before you create your first scene.

The description is first checked against a short list of blocked words and by OpenAI's moderation service. If it passes, an OpenAI text model expands it into a more detailed brief, and OpenAI's image model paints the scene from a prompt that includes your description. The finished picture is stored on our server together with your description and linked to your Account ID, so that it appears under My scenes.

A new scene is available only to you until we have reviewed it by hand. If we approve it, it joins the pool of scenes served to all players, who receive the picture alone — without your description, without your Account ID and without anything else about you. If we reject it, it is never shown to anyone else, and you see the reason under My scenes.

If we later remove an approved scene, for example after a report, its picture is deleted and it leaves the pool. The description, the reason and the date stay in your account under My scenes, together with a link to ask us to look again, until the account is deleted.

Please don't put personal information, such as names, addresses or details about real people, into a description. It is sent to OpenAI, it is stored on our server, and a person reads it when reviewing the scene.

Scene pictures are stored under long, random web addresses. They are not listed or published anywhere, but anyone who has an address can open the picture it points to.

Deleting your account deletes every scene you made, including approved scenes that other players can already play. To have a single scene removed, write to us with your Account ID and the scene's description, and we will delete the picture and the scene's record, including from the shared pool.

Reports and moderation

Every scene a player makes is checked by a person before anyone else can see it. After that, there are two ways to tell us about a scene.

From the game. The flag in the corner of a scene lets you report it, choosing a reason and, if you want, adding a note. We receive the scene number, the reason, your note and your Account ID. The scene disappears from your game straight away and for good, whatever we decide. The list of scenes you have reported is kept on your iPhone and is cleared when you delete your account or the app. A report doesn't take the scene away from other players: a person looks at it and decides. We keep your report with your account: where the content is said to be illegal, to meet our obligation under Article 16 of the EU Digital Services Act (Art. 6(1)(c)), and where the report is about a breach of the game's rules, in our legitimate interest in keeping the game's content safe (Art. 6(1)(f)).

On our website. Anyone, including people who don't play, can report content they believe is illegal using the form at notbad.tech/hidden-gem/report/. The form asks which scene the report is about, your name or your organisation's name, your email address, an explanation and a statement that you are acting in good faith. We email you a confirmation with a reference number and, once a person has decided, the decision. If you disagree with it, you can ask us to look again, as described on the appeal page. We handle these reports to meet our obligation under Article 16 of the Digital Services Act (Art. 6(1)(c)).

Decisions. If we reject or remove a scene you made, you see the reason in the game, under My scenes, with a link to ask us to look again. If an account keeps creating content that breaks the rules, a person can suspend scene creation for it. We then keep, with that account, the date, the reason as a code and as the text you are shown, a note of who made the decision, and the state of any appeal you make. You see the reason in the game, on the Create scene screen; you appeal by email, quoting your Account ID, and the appeal page describes the other routes. The rest of the account, including its gems and play, stays as it is.

Reports made through the website are kept for 12 months after our decision, and where a case is disputed or an appeal is under way, their deletion is put on hold until the case ends. The details are in How long data is kept.

Purchases

Purchases are made through Apple's App Store. We never see your payment card, your Apple Account or your billing details. Apple processes your payment data as an independent controller under the Apple Privacy Policy.

When you buy something, your iPhone passes our server the transaction as signed by Apple. Our server checks Apple's signature itself, without contacting Apple, and then adds the item to your account. We keep the item and what it added, Apple's transaction number, whether it was a real purchase or an Apple test purchase, the time and your Account ID. We don't keep the signed transaction.

Everything sold in Hidden Gem is used up once spent, and your balances are kept with your Account ID on our server rather than with your Apple Account. If something you bought doesn't arrive, write to us with your Account ID and we will put it right.

The record of a purchase is what lets us credit it only once. That is why it stays after the account is deleted, but without your Account ID and with Apple's transaction number replaced by a SHA-256 hash, a pseudonymised fingerprint. What stays is the item, what it added, the environment of the transaction and the time. Such a record is deleted at the latest 24 months after the purchase was credited, and our server no longer credits a transaction automatically once more than 23 months have passed without it reaching an account — so every transaction our server can still accept has a record of its own.

Refunds are handled by Apple under its own terms, at reportaproblem.apple.com.

Third-party services

We work with a small number of outside providers, and each receives only what its task requires. Providers that process data on our behalf do so under data processing terms that let them use it only on our instructions and require them to protect it at least as well as this policy describes. Google, for ads, and Apple act as independent controllers, bound by their data protection terms and their own privacy policies.

Microsoft Azure: hosting. Our server, database and scene pictures run in Microsoft data centres in the European Union. Azure Communication Services, part of Azure, sends the emails about reports of illegal content: it receives the recipient's email address, the reference number and the text of the message, but not the reporter's name. It keeps this data in Europe, and tracking of email opens and clicks is switched off. Processor.
Google Workspace (Google Ireland Limited): our email inbox, contact@notbad.tech. Receives the messages you send us, including requests about your data and reports sent by email. Processor.
OpenAI: safety screening of scene descriptions and scene painting. Receives the text of your description, never your Account ID. Under OpenAI's API terms, the data is not used to train its models and is kept for up to 30 days for abuse monitoring, unless the law requires longer. Processor.
Expo (650 Industries, Inc.): notification delivery. While notifications are on, Expo receives your iPhone's Apple push token and gives the game a notification token in return. When a scene of yours is approved, Expo receives that token and the message text and passes the message to Apple for delivery. Processor.
Google AdMob (Google Ireland Limited for users in the EEA and Switzerland, Google LLC elsewhere): the optional rewarded ads. An ad is requested only when you choose to watch one. Before your first ad the game asks whether you are 16 or older, and your answer stays on your iPhone.
1. If you say you are under 16, the game shows no Google consent message and no Ad privacy choices row, and every ad request is marked as coming from someone below the age of consent. Google then serves ads without personalisation and without third-party ad providers. The marking does not mean that Google collects nothing: it still collects the data listed below.
2. If you say you are 16 or older and you are in the EEA, the UK or Switzerland, the first time you tap Watch ad the game shows Google's consent message before any ad is requested, and ads that use your data are shown only with your consent (Art. 6(1)(a)). If you consent, the ads are non-personalised; if you don't, Google may still show limited ads, which it serves with further restrictions on the data it uses. You can change your choice at any time in the game under Settings, Ad privacy choices.
3. Google's advertising software may collect your IP address (used to estimate your general location), an identifier limited to our app or to us, information about the ads you see and how you interact with them, and diagnostic and performance data. We ask Google for non-personalised ads only, and since the game never asks to track you, Google does not receive your advertising identifier. Google uses this data to show and measure ads and to prevent fraud. Some ads may come from other advertising companies that buy ad space through Google; in the EEA, the UK and Switzerland the consent message lists them, and Google keeps that list up to date. Independent controller.
Apple: App Store payments and delivery of notifications. Independent controller.

We don't sell personal data, and we don't share it with data brokers or advertisers.

Analytics and crash reports

Hidden Gem contains no third-party analytics or crash-reporting tools. The only record of how the game is played is the game activity record described in Data we collect. It goes to our own server and is seen only by us. The entries the game sends are stored without your Account ID; the entries our server adds when your balances change are stored with it.

We use it mostly as totals: how many people play each day and come back, which difficulties they choose, how long scenes take, how gems are earned and spent, and how many players buy something. We look at an individual player's record only to answer that player's request, to fix a fault or to investigate abuse.

You can object without deleting your account. Write to contact@notbad.tech with your Account ID. From then on our server no longer records the entries your game sends as you play (scenes started and finished, hints used), and you are left out of all our statistics. Entries about your balances and purchases are still kept, because the game needs them to keep your balances right, but we no longer use them to study how the game is played.

If you have turned on Share with App Developers in iOS (Settings, Privacy & Security, Analytics & Improvements), Apple may give us crash reports and usage statistics without information that identifies you. You can turn that setting off at any time.

Google's advertising software collects its own diagnostic data when an ad is shown; see Third-party services.

How long data is kept

Account ID, progress, balances, your scenes and the reports you made in the game: for as long as your account exists. The account and everything linked to it are deleted when you delete it in the game, when we delete it at your request, or automatically once 24 months have passed both since the game last contacted our server and since the account was created. If we close the game's servers, we delete this data.
Game activity record: 90 days from the moment it is recorded, then deleted automatically. If you delete your account sooner, the entries stored with your Account ID go with the account; those the game sent were never linked to it. Purchase entries follow their own rule, below.
Notification token: until you turn notifications off, in the game or in iOS, or until the account is deleted.
Purchase records: for as long as your account exists. When the account is deleted, we keep only the item, what it added, whether it was a test purchase and the time of purchase, without your Account ID. Apple's transaction number is replaced by its SHA-256 hash, a fingerprint from which the number can't be read back but which lets us recognise the same purchase if it is ever sent again. This pseudonymised record is kept for at most 24 months after the purchase was credited, in our legitimate interest in crediting each purchase only once (Art. 6(1)(f)).
Removed scenes: the picture is deleted at once; the description, the reason and the date stay in your account until the account is deleted.
Scene descriptions at OpenAI: up to 30 days, as described in Third-party services.
Reports of illegal content sent through our website: for 12 months after our decision on them, then deleted automatically. A report stays even if the player who made the scene deletes their account in the meantime. Where a case is disputed or an appeal is under way, we put the deletion on hold; once the hold is lifted, the 12 months run from that day.
Emails, including requests to look again at a decision: for 12 months after the matter is closed.
Backups: deleted data can remain in our database's automatic backups until they expire, which takes no longer than 7 days.
On your iPhone: settings and cached game data stay until you delete the app or delete your account in the game. The Account ID can stay in the iOS Keychain even after the app is deleted.

Your rights

Under the GDPR you can:

get a copy of the data we hold about you (access);
have inaccurate data corrected (rectification);
have your data deleted (erasure); you can delete your account yourself in the game, under Settings, Delete account;
ask us to limit what we do with your data while a question about it is being settled (restriction);
receive your progress, balances, activity record and scenes in a machine-readable format (portability);
object to processing based on our legitimate interests (objection): to the use of your activity record for analytics, as described in Analytics and crash reports, or to the notification token, for which turning notifications off is enough;
withdraw your consent to ads at any time, in the game under Settings, Ad privacy choices. That row appears for players who said they are 16 or older and are in the EEA, the UK or Switzerland; if you answered that you are under 16, Google never asks you for consent, and you can change the answer itself under Settings, Age for ads;
complain to UODO or to the data protection authority in your country.

How to ask. Email contact@notbad.tech and include your Account ID. In the game, open Settings and tap Account ID: the share sheet opens with the full code, ready to copy or send. The game has no sign-in, so the Account ID is the only way we can find the data linked to your game. We act on requests that include it, and if something about a request doesn't add up, we may ask for more information before acting. Please keep your Account ID to yourself: anyone who has it can ask us about, or for the deletion of, the data linked to it.

We reply within one month. If a request is complicated, we may take up to two further months and will tell you why. Requests are free of charge.

When you delete your account in the game, it is deleted at once and the game starts from scratch with a new Account ID. When we delete an account at your request, the game on that iPhone starts from scratch the next time it connects. If you carry on playing, a new, empty account is created under the same Account ID; if you want nothing further to reach us, delete the app as well.

Children's privacy

Hidden Gem is a game for a general audience. It has no chat, no player profiles and no way for players to contact each other, and every scene made by a player is checked by hand before anyone else can see it. We don't ask for age, name or contact details for the account, so we hold no more about a child than about any other player: the data listed in Data we collect, under a random Account ID.

The only age question is asked before the first ad and concerns ads alone: the game asks whether you are 16 or older. The answer stays on the iPhone and never reaches our server. If the answer is "under 16", the game shows no Google consent message and every ad request is marked as coming from someone below the age of consent, so Google serves ads without personalisation and without third-party ad providers. Ads are always optional and non-personalised.

Scene creation sends typed text to OpenAI, so we suggest that younger children use it with a parent, who can also make sure that no personal information goes into a description.

If you are a parent or guardian and want your child's game data deleted, you can delete the account in the game under Settings, Delete account, or send us the Account ID from the child's iPhone (Settings, Account ID) and we will delete it.

Security

All traffic between the game and our server is encrypted with HTTPS.
The database and the scene pictures are kept in Microsoft Azure, which encrypts stored data by default.
Access to player data is limited to the owner of Not Bad Technology, who must sign in first.
Keys for outside services and the database password are kept only in the server's configuration, never in the app.
The Account ID is made from 128 bits produced by the iPhone's cryptographic random number generator and is stored in the iOS Keychain.
Our server limits how often requests can be made from each network address, and, for your game data and for reports, for each Account ID as well. To do that, it holds the address in memory for at most an hour, and never writes it down.
Our server software does not log IP addresses. Microsoft may process connection data briefly to run and protect its platform.

No system is perfectly secure. If a breach affects your data, we will report it to UODO within 72 hours where the GDPR requires it and, if the breach is likely to put you at high risk, tell you directly through a notice in the game.

International transfers

Our server, database and scene pictures are hosted by Microsoft Azure in data centres in the European Union, and the emails about reports are sent by Azure Communication Services, which keeps their data in Europe.

Some providers process data outside the European Economic Area, mainly in the United States. Each transfer rests on its own safeguard:

OpenAI (scene descriptions): the Standard Contractual Clauses adopted by the European Commission, with the UK Addendum where UK law applies, as part of OpenAI's data processing terms;
Expo (notification tokens): the Standard Contractual Clauses, module 2 (controller to processor), as part of Expo's terms;
Google Workspace (our email inbox): the Standard Contractual Clauses, as part of Google's Cloud Data Processing Addendum;
Google (ads): for users in the EEA and Switzerland, Google Ireland Limited is responsible, and Google's onward transfers are covered by its own mechanisms, including the EU–US Data Privacy Framework where it applies;
Apple (payments and notifications): for users in the EEA, the UK and Switzerland, Apple Distribution International Limited in Ireland is responsible, and Apple's transfers rest on the Standard Contractual Clauses.

Write to us for a copy of the safeguards that apply.

Changes to this policy

When this policy changes, the version number and date at the top of this page change with it. If a change matters, such as a new kind of data, a new provider or a new purpose, we will announce it in the game at least 14 days before it takes effect, unless the law requires a faster change. If a change needs your consent, we will ask for it first. Earlier versions stay available on our website at their own addresses, carrying the version number.

Contact

Questions about this policy, and requests to see, correct, export or delete your data, go to the address below. If your question is about your game data, include your Account ID from Settings. We usually reply within a few working days, and always within one month.

contact@notbad.tech

Protip Norbert Częścik · Polish Tax Identification Number (NIP): 5242873450 · Wyszogrodzka 14/107, 03-337 Warsaw, Poland

The same email address is our point of contact under Articles 11 and 12 of the Digital Services Act, both for authorities and for players and anyone else. Messages are read and answered by a person, in Polish or English.