Privacy Policy
- No accounts, email, ads, analytics, tracking or payments.
- We only use the display name you type when joining a room and a random player ID created on your device, and only to run the game.
- Room data (names, votes, round results) is automatically deleted from the server a few minutes after everyone has left, and at the latest about 3 hours after the last activity in the room.
- We don't sell your data or share it for advertising. Only our hosting provider, Cloudflare, processes it on our behalf.
1. Who is responsible (data controller)
Yusuf Örnek (individual developer, Türkiye)
Address: Istanbul, Türkiye
Email: support@playshifty.com
2. What we process and why
We keep only anonymous daily totals derived from game events (such as the number of rooms per day), not linked to anyone.
Your game statistics, Solo progress and settings stay on your device. In the iOS app, if iCloud is on, they are backed up to your own iCloud account through Apple's iCloud service; we cannot access this backup.
| Data | Source | Purpose | Where / how long |
|---|---|---|---|
| Display name (max. 16 characters) | You type it when joining a room | Showing you to the other players in the room and running the game | Room server: while the room is open, at most ~3 hours after its last activity. Your device: remembered for convenience until you change or delete it |
| Player ID (randomly generated code, UUID) | Created automatically by the app or browser on first launch | Recognising you in a room, letting you rejoin as the same player after a disconnect, linking host status and votes to the right player | Your device (UserDefaults on iOS, local storage in the browser). The room server, for at most ~3 hours |
| Game data: room code, player list, host, game settings (mode, category, language, number of impostors, timer), dealt roles and word, votes, round results, typed clues (Remote mode, max 24 characters) and the host's custom word list | Created during play | Running the game and showing results to the room | Room server. Deleted automatically when the room closes (a few minutes after everyone leaves, at the latest ~3 hours after the last activity) |
| Technical connection data: IP address, request time, requested URL (may contain the room code), browser and device type, approximate region derived by Cloudflare | Generated automatically when your device connects | Delivering the service, security, abuse prevention, debugging | Cloudflare systems. Application logs are kept for up to 3 days |
| Reports (only when someone taps Report): room code, time, game mode and round, the reporting and reported player's random IDs and display names, the reported player's clues in that round, the host's custom word list if the reported player is the host, and the display names of the players in the room. No IP address, device or location data is added to a report | Created when a player reports another player | Reviewing reports and acting against abusive users | Cloudflare application logs, up to 3 days. Also emailed to the developer and deleted after review |
| Push notification registration (only if you turn on notifications in the iOS app): the push token Apple assigns to your device, a random installation ID, the notification topics you chose, app language, App Store country, time zone, app and iOS version, and the state of your notification permission | Sent by the app when you turn on notifications; refreshed when it changes and at least once a week | Sending you notifications about the topics you chose (for example events, new categories and the weekly challenge) in your language. You can turn off your chosen topics anytime in Settings. Taps on a notification are only counted in aggregate and are not linked to you | On our notification server until you turn notifications off or tap "Reset my data". Deleted automatically if you don't open the app for 240 days; delivery records are deleted after 30 days |
Data that stays on your device
- Motion sensors (gyroscope and accelerometer): used only for the tilt effect on the invite ticket and processed on your device in real time. Never stored or sent.
- Haptics, your app preferences (such as language) and the list of players you've blocked stay on your device.
What we don't collect
We don't collect accounts, email addresses, phone numbers, location, contacts, photos, the advertising identifier (IDFA) or health data. The app contains no analytics, advertising or tracking SDKs, and we don't track you across other companies' apps or websites. Shifty itself doesn't use cookies. Our hosting provider, Cloudflare, may set strictly necessary security cookies (for example for bot protection).
Game friends
Only after both players request a link in the same game, our server keeps a random link ID, SHA-256 hashes of each device's secret, optional push installation IDs, and creation and last-use times. Friends' display names stay on your devices. An invite briefly carries the sender's name and room code; it expires after 15 minutes and its content and delivery record are erased after the send attempt or expiry. Either player can remove the link; unused links are deleted after 365 days. Resetting your data also removes your links. The legal basis is providing the feature you requested (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)). Invites can be disabled in notification settings.
3. Legal bases (GDPR)
- Performance of a contract (Art. 6(1)(b) GDPR): display name, player ID and game data are needed to provide the game you asked to play.
- Legitimate interests (Art. 6(1)(f) GDPR): technical connection data, for security, abuse prevention and keeping the service running. You can object at any time (see section 6).
- Legal obligation (Art. 6(1)(c) GDPR): responding to lawful requests from authorities.
- Consent (Art. 6(1)(a) GDPR): push notifications (events, new categories and announcements) are sent only if you explicitly turn them on in the app. You can withdraw consent at any time in Settings → Notifications or in your device settings.
Apart from push notifications, we don't rely on consent for this processing. Access to motion sensors is controlled by your device's permission system, and you can turn it off in Settings at any time. For users in Türkiye, the corresponding legal bases under KVKK Art. 5(2)(c), (f) and (ç) apply, and explicit consent (Art. 5(1)) for push notifications. See the Turkish notice.
4. Who receives your data
- Other players in your room see your display name and, as part of the game, round results (for example who the impostor was and how people voted). Rooms can only be joined with a room code, invite link or QR code. There are no public room lists and no chat.
- Cloudflare, Inc. (processor: servers, network and logging). Data may be processed on Cloudflare's global network, including in the United States. Transfers of EU/EEA personal data rely on Cloudflare's Data Processing Addendum, including the EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework. Transfers from Türkiye take place under the same Data Processing Addendum. Cloudflare is contractually bound by this addendum to protect your data at least to the standard described in this policy.
- Apple: when you download the app from the App Store, Apple processes download and purchase data as an independent controller under its own privacy policy. If you turned on "Share with App Developers", Apple may share crash reports and aggregated usage statistics with us that don't identify you.
- Apple Push Notification service (APNs) delivers push notifications to your device. Apple only receives the push token and the notification text.
- Authorities, only where required by law.
We do not sell or rent personal data, and we do not "share" it for cross-context behavioural advertising.
5. Retention and deletion
- Room data (names, player IDs, votes, results) is automatically and permanently deleted from the server when the room closes. That happens a few minutes after everyone has left, and at the latest about 3 hours after the last activity.
- Technical logs are kept at Cloudflare for up to 3 days, then deleted automatically.
- Notification registration: turning notifications off stops delivery, and "Reset my data" deletes the registration from the server. Registrations of devices that haven't opened the app for 240 days are deleted automatically, and delivery records after 30 days.
- Data on your device (display name, player ID, preferences): delete it by deleting the app or clearing your browser data, or via Settings → "Reset my data".
6. Your rights
Depending on where you live, you have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interests. In the EU/EEA you also have the right to lodge a complaint with your local data protection supervisory authority. In Türkiye you can complain to the Personal Data Protection Board (KVKK).
How to make a request: email support@playshifty.com. Since there are no accounts, please include the room code, the display name you used and the approximate date and time so we can find your data. Most room data has already been deleted after 3 hours. We respond within one month (30 days under KVKK), free of charge.
7. Children
Shifty is a party game for a general audience and is not directed at children under 13. We recommend that children under 13 play with a parent or guardian, and that everyone uses a nickname rather than their real name. We don't knowingly collect more data than the game needs. If you believe a child's data should be deleted, contact us.
8. Security
All connections between the app and the server are encrypted (HTTPS/WSS with TLS). We keep data to the minimum needed for the game and delete room data automatically after a short time. No online service is 100% secure. In the event of a data breach we will notify authorities and users as required by law.
9. Changes and future features
We may later add optional accounts (for example Sign in with Apple or Google), game history and stats, custom word lists or in-app purchases. If a feature involves new kinds of data, we will update this policy before the feature launches and ask for your permission where required. We announce material changes in the app or on this page, and the current version is always at this address.
10. Contact
Questions about privacy: support@playshifty.com