The full version follows. It explains exactly what happens to your data, and it is the version that governs.
The data controller is:
| Service owner | Emil Rustamzade Valeh oglu, individual entrepreneur |
|---|---|
| VÖEN (tax number) | 1007379292 |
| Country of registration | Republic of Azerbaijan |
| Contact for anything about data | help@founday.me |
Below, "we" means the entrepreneur named above, "Founday" or "the app" means the Founday mobile game, and "you" means the player.
We collect only what the game cannot work without. Nothing "just in case", and nothing for advertising.
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address | Signing in, confirming your address, password recovery, replying to your support email | Performance of our contract with you |
| Password | Signing in. We never store the password itself — only an irreversible hash of it (Argon2id), from which the password cannot be recovered | Performance of contract |
| Google account identifier and its email — if you sign in with Google | Passwordless sign-in | Performance of contract |
| Public @handle and display name | How other players see you in the feed and rankings. Your real name is not required | Performance of contract |
| Date of birth | Only to enforce the 13+ age limit. Never shown to other players, never used for advertising or analytics | Legal obligation and protection of children |
| Photos taken in the app | This is the game itself: a photo is checked, credited and — if all is well — published to the day's feed and your collection | Performance of contract |
| Game progress: streak, finds, likes, freezes, ranking positions | The point of the game, and the stats shown on your profile and in rankings | Performance of contract |
| Session technical data: device model, last active time, interface language, app version | Showing you the list of your sign-ins so you can end one that is not yours; account security | Legitimate interest (account security) |
| IP address | Processed on every request to our servers — communication is physically impossible otherwise. Used to defend against attacks and abuse; not stored on your profile and never shown to other players | Legitimate interest (service security) |
| Reports, players you blocked, moderation flags and appeals | Handling reports, community safety, preventing repeat abuse | Legitimate interest (safety) and performance of contract |
| Support correspondence | Answering you and fixing the problem | Performance of contract and legitimate interest |
| Game events: task opened, photo submitted, verdict received, streak changed | Understanding how the game actually behaves and fixing what breaks. This is our own product analytics: it is not shared with advertisers, not joined with data from other apps, and stored on EU servers | Legitimate interest (improving and fixing the service) |
| Notification settings | Sending the daily task reminder and the streak-at-risk warning exactly as you chose | Consent (withdrawn with the toggle in settings) |
| Camera | The only way to take a photo for the task |
|---|---|
| Internet | Talking to our server |
| Vibration | Haptic feedback in the interface |
The app requests no other permissions.
We work with providers who process data on our instructions and only to run the service (data processors under the GDPR). Each receives the minimum its job requires.
| Who | What they receive | Why |
|---|---|---|
| Google Ireland Ltd. / Google LLC | Account identifier when you sign in with Google; subscription purchase data | Google sign-in, app distribution and subscription payment through Google Play |
| Google (Gemini service) | The photo submitted for checking and the task text | Automated checking: whether the task is completed and whether the photo contains anything prohibited. Google processes the image as the provider of that service, on its own terms |
| Cloudflare, Inc. | Photos, network traffic, mail sent to @founday.me addresses | Photo storage, content delivery, attack protection, receiving support email |
| Hetzner Online GmbH | All service data (servers and database) | Server hosting. Data centres are in Germany and Finland, i.e. inside the EU |
| Sendinblue SAS (Brevo) | Email address and message body | Sending confirmation codes and password-reset emails |
| PostHog | Game events and the account identifier | Product analytics: how many people opened the task, how many reached a find. We use the European deployment (eu.i.posthog.com) |
| Functional Software, Inc. (Sentry) | Technical details of an app or server error | Finding and fixing crashes |
We may also disclose data where the law or a lawful authority request requires it, or where it is necessary to protect someone's life and safety.
Our main servers and database are located in the European Union (Germany, Finland). Some providers listed in section 5 are US companies, so part of the data is transferred outside the EU. Such transfers rely on the European Commission's Standard Contractual Clauses and other safeguards provided by law.
| Photos of failed or unpublished attempts | 30 days, then deleted automatically |
|---|---|
| Photos in your collection and the feed | As long as the account exists, or until you ask us to remove them |
| Account data and game progress | As long as the account exists |
| After account deletion | Erased within 30 days, except where the law requires specific records to be kept (payment records, for example) |
| Security logs | Up to 90 days |
| Support correspondence | Up to 12 months after the request is closed |
A photo under an open appeal is kept until the appeal is resolved — otherwise there would be nothing to review.
Founday has a shared feed, so some data is public by the very nature of the service:
Your email, date of birth, session list and settings are never visible to other players.
Remember: a find card can be saved and forwarded. Anything that reaches the shared feed can be seen, saved and reshared by other people, as in any social network. Do not shoot what you are not ready to show the world.
You must be at least 13 to play. We ask for a date of birth at sign-up and do not create accounts for anyone younger.
If you live in an EU country with a higher digital-consent age for children (between 13 and 16, depending on the country) and you are below that age, you may use Founday only with the consent of a parent or legal guardian.
If we learn that an account belongs to a child below the permitted age, we delete the account and the data attached to it. If you are a parent and believe your child signed up without your consent, write to help@founday.me and we will delete the account.
Under data-protection law (including the GDPR for players in the EU and EEA) you have the right to:
Some of these you can exercise inside the app: change settings, end other sessions, delete the account. For everything else write to help@founday.me from the address linked to your account, and we will respond within 30 days. There is no charge.
No one's protection is absolute. If a breach does occur and creates a risk to your rights, we will notify you and the supervisory authority within the deadlines set by law.
If this policy changes materially, we will tell you in the app or by email before the change takes effect. The version date is always shown at the top of this page, and we keep previous versions available on request.
For anything about data: help@founday.me. The same address handles access, correction and deletion requests.