Privacy Policy — Memoryca

Last updated: 11 October 2026

1. Who is responsible for your data

The data controller is Boris Glušević, a private individual and owner of the Memoryca project, Put Vrila 9, 21400 Supetar, Croatia.
Email: info@memoryca.com

This policy explains what data Memoryca (the website www.memoryca.com and the Android and iOS apps) collects, why, who it is shared with, and what your rights are. Processing complies with the General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR.

2. Who the app is for

• Memoryca is intended for people aged 13 and over. You enter your date of birth when you register. People under 13 cannot create an account. If we learn that an account belongs to someone under 13, we will delete it.
• In Croatia you must be 16 to give consent to data processing yourself. For players under 16 we therefore:
  • do not use their photos for promotional purposes,
  • show only non-personalised ads,
  • run everything else the same as for other players, because it is needed for the game itself.
• We recommend that players aged 13–18 use the app with the knowledge of a parent or guardian.

3. What data we collect

Account:

• name, username, email address, password (stored only in encrypted form), profile photo, date of birth, chosen team
• if you sign in with Google or Apple, we receive your name and email address from them

Game:

• submitted tasks (photo, submission time, status and administrator note)
• points, level, badges, activity streaks, battle points and boosts
• reward codes and where they were redeemed

Location (only if you allow it in your device settings):

• precise coordinates and location accuracy when you submit a task, and the distance from the task's location
• your last known location
• a task's location can no longer be picked manually
• we do not read or store location data (GPS, EXIF) from photos; it is removed when the photo is processed

Social content:

• stories, reactions and story views
• groups and group messages, global chat
• friends, user reports and referrals

Technical data:

• IP address, device type and operating system, time of use
• push notification token and time zone
• anonymous page-speed measurements
• the device advertising identifier, processed by Google AdMob when showing ads

Organisers (tourist boards, towns, associations):

• organisation name, email, website, logo, and the location and address of gatherings they organise

4. Why we process data and on what legal basis

• Providing the service: account, sign-in, tasks, points, battle map, rewards, groups, chat. Basis: performance of a contract (Art. 6(1)(b) GDPR).
• Location: checking that you completed a task at the right place, awarding points to your zone, nearby tasks and weather effects. Basis: your consent, given through the device location permission, which you can switch off at any time (Art. 6(1)(a)). Without location, some tasks will not be available. A task colours a zone in the Battle for Croatia only if it was submitted within 5 km of the task's location or in the same place. When reviewing, the administrator can see whether a task was submitted at its location.
• Promotional use of your photos (social media, website, promotional materials): only for players aged 16+, and only if they switch it on themselves. Basis: consent (Art. 6(1)(a)). You can switch it on or off in Menu → “Promotional use of my photos”.
• Push notifications: only if you allow them on your device. Basis: consent.
• Rewarded video ads: the app is free, and you watch ads only if you choose to, in exchange for a reward. All players are shown non-personalised ads only. Basis: legitimate interest in funding a free service (Art. 6(1)(f)).
• Security and cheat prevention: action limits and points protection. Basis: legitimate interest.
• Automatic translation of task texts. Basis: legitimate interest.
• Complying with legal obligations. Basis: Art. 6(1)(c).

5. Automated checks

The app automatically limits how often certain actions can be performed and rejects suspicious attempts (e.g. collecting points too quickly). Such attempts are logged. We never block accounts automatically: any measure against an account is decided manually by the administrator.

6. Who can see your data

• Other players in the app see your name or username, profile photo, team, points and badges, photos of submitted tasks, stories, and messages you send in groups and chat. Other players do not see your precise location.
• Organisers see statistics for their own tasks (completions, views and participants by area) and photos submitted to their tasks.
• Partners and sponsors do not receive your data. You show the reward code yourself.
• We do not sell your data.

7. Service providers (processors)

• Supabase: database, sign-in and photo storage
• Vercel: app servers (Frankfurt, Germany) and anonymous page-speed measurement
• Google: Google sign-in, AdMob (ads), Firebase Cloud Messaging (Android notifications)
• Apple: Sign in with Apple and iOS notifications
• Lovable (Sweden): sending emails (account confirmation, password reset, reward codes) and automatic translation of task texts
• BigDataCloud: converting coordinates into a place name
• Open-Meteo: weather for your area (coordinates are sent)
• browser push services (Google, Apple, Mozilla) for web notifications

The Buy Me a Coffee link opens an external site. If you open it, their privacy policy applies.

8. Transfers outside the EU

Some providers (e.g. Google, Apple, BigDataCloud) may process data outside the European Union. Such transfers rely on a European Commission adequacy decision (including the EU–US Data Privacy Framework) or on Standard Contractual Clauses.

9. How long we keep data

• Your account, submitted tasks with location, points, badges, stories, messages and reward codes are kept while your account is active.
• When you delete your account, we delete your data immediately. It disappears from backups within 30 days at the latest. Tasks you created may remain in the game without your name.
• Notifications are deleted automatically after 10 days, except those containing a reward code, which are kept while your account is active.
• Battle map events are deleted after 7 days, and activity feed posts after 90 days.
• Your last known location is overwritten by the new one; older ones are not kept.
• The push token is deleted when you log out, turn off notifications or delete your account.

10. Your rights

You have the right to:

• access your data,
• rectification,
• erasure,
• restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time.

How to exercise them:

• In the app: Menu → “Download my data” or “Delete account”.
• Data not included in the export (e.g. messages, stories, location) is available on request by email.
• Email: info@memoryca.com. We reply within 30 days.

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), www.azop.hr.

11. Security

• All data is encrypted in transit (TLS).
• Database access rules ensure each user can only see what they are allowed to see.
• Only the controller has administrative access.
• In case of a personal data breach we will notify AZOP within 72 hours, and you without undue delay where the law requires it.

12. Cookies and on-device storage

• We do not use cookies for tracking or advertising.
• We use only one technical cookie (sidebar state).
• On your device we store what the app needs to work: sign-in, theme, language, sound, display settings, viewed-story markers, filters and a temporary cache for faster loading.

13. Changes to this policy

If we make significant changes, we will notify you in the app and update the date at the top.

14. Contact

Boris Glušević, Memoryca
Put Vrila 9, 21400 Supetar, Croatia
info@memoryca.com