This policy explains what LiveIT does with your personal data, why, and what you can do about it. It covers the LiveIT app from version 1.0.0 and the LiveIT web pages.
In short
We use what the game needs: your account, your proofs and how you play.
Other players see your profile and your proofs. Only what you share yourself leaves the app.
No ads, no tracking, no selling of data.
LiveIT is for people 16 and over. We never store your year of birth.
You can delete your account in the app at any time. Your photos and videos go with it.
1. Who is responsible
The controller of your personal data is Martin Stříž, who runs LiveIT. In this policy “we” means him.
Write to this address about anything in this policy. We answer in English, Slovak and Czech.
2. What we collect
Your account
Your email address and password. Supabase keeps the password only in a scrambled form that no one can read back.
Your username and, if you add one, a profile photo. If you sign up by email, the username is the one you type. If you sign in with Apple or Google, it starts as a random one such as player_482913, never anything from your email address, until you choose your own in Settings.
Your phone’s time zone (for example Europe/Prague), so your day starts at your midnight.
If you sign in with Apple: the email address Apple gives us. It can be a private relay address. We never store a name from Apple.
If you sign in with Google: your email address, your name and the web address of your Google profile photo. We keep them with your account and never show them to anyone else, and the Google photo never becomes your profile photo. If your account was made before this version of the policy, your username may come from your email address and your profile photo may be the Google one. You can change both in Settings.
That you confirmed you are 16 or over, and when. Not your year of birth.
What you post
Proofs: a photo from the camera or your photo library, with a small thumbnail for your collection, or a video of up to 15 seconds filmed in the app, with its sound, and the caption you write.
Comments, Respect, who you follow and who you block.
Reports you send, with the reason and any note you add.
With each proof the app also sends whether it came from the camera or the gallery, when it was taken (from the photo’s own data) and a fingerprint of the file. This keeps the same photo from counting again and again.
Every photo, a proof or a profile photo, is re-encoded on your phone before upload, which drops hidden details such as the place it was taken. If that does not work, nothing is uploaded. Videos can only be filmed in the app, and the app saves no location in them. Test versions from before the public release did not always do this. They uploaded a video from your gallery, and now and then a photo, as it was, so such a file can still hold the place where it was taken. Delete that proof in the app and its file goes with it, or write to us and we delete it.
How you play
The cards you get and the quest you pick, XP, level, streak, umbrellas, badges, your collection, quick wins, weekly events and leagues.
The days you play, and when each proof and quick win happened.
Notifications inside the app, for example when someone gives you Respect.
Technical data
Supabase, which runs our servers, keeps short logs of requests and sign-ins, such as IP address, time and app version, for security. It deletes them after a few days.
When the app checks for an update, it sends Expo a random install ID made on your phone, with the platform and the app version. This ID is not linked to your account.
Apple may share crash reports and anonymous app statistics with us, but only if you turned on Share With App Developers in your iPhone’s settings.
When you write to us
Your email address and your message.
Our web pages
When you open the LiveIT website or these pages, the host (Cloudflare for the website, GitHub for these pages) handles your IP address and browser details to deliver the page and keep it safe.
An invite page reads the @username from its own address, only in your browser. We set no cookies.
What we do not collect
No contacts. You add friends by their exact username.
No GPS or other precise location. The app never asks for it. Only a file from a test version, as described above, can still hold a place.
No date of birth and no year of birth.
No advertising IDs and no tracking across other apps or websites. The app has no analytics or advertising tools.
Your language and your daily reminder stay on your phone. The phone schedules the reminder itself, and only if you turn it on.
The app uses the camera, the microphone and the photo library only when you take or pick a proof or change your profile photo.
3. Why, and on what legal basis
To run LiveIT for you
Your account, the daily cards, proofs, XP, streaks, badges, your collection, friends, leagues, and the emails that confirm your address or reset your password. Legal basis: the contract with you, which is our Terms (Art. 6(1)(b) GDPR).
To show your profile and proofs to other players
This is how LiveIT works. Legal basis: the contract.
To check that you are 16 or over
Legal basis: our legitimate interest in keeping LiveIT to people 16 and over, as our Terms require (Art. 6(1)(f) GDPR).
To keep LiveIT safe and fair
Reports, blocking, the automatic hiding after three reports, the filter for prohibited words in usernames, captions and comments, limits on how often an account can act, the checks on each proof, and records of what we decided. Legal basis: our legitimate interest in a safe community and in handling reports as the law and the App Store require.
To learn whether LiveIT works
In our own database we count sign-ups, how many people come back, add friends and post proofs, which country they likely play in by time zone, and through whose invite new people came. When we start LiveIT with a group of friends, we note their usernames and the date. Some of these counts look at single accounts. We use them only to understand and improve LiveIT, never for ads, and we share them with no one. Legal basis: our legitimate interest in improving LiveIT. You can object (section 13).
To deliver app updates
Legal basis: our legitimate interest in fixing the app quickly.
To answer your messages
Legal basis: our legitimate interest in helping you, or the contract when it is about your account.
To keep records and defend legal claims
Legal basis: our legitimate interest in being able to show how we handled reports and deletions.
To post your proof outside the app
Only with your consent for that one post (Art. 6(1)(a) GDPR). See section 11.
You need an email address, or Apple or Google sign-in, to create an account, and you need to answer the age step to use the app. Without them LiveIT cannot work. Everything else is up to you.
4. Who sees what in the app
Every signed-in player can see your username, profile photo, level and title, streak, badges, collection, your proofs with their captions, your comments, the Respect your proofs got, your XP on the leaderboards, and who you follow and who follows you.
People who follow you see your proofs in their Friends tab. All players see them in the Everyone tab.
If you block someone, or someone blocks you, you no longer see each other.
Your email address is never shown to other players.
Photo and video files are stored at web addresses that are hard to guess. Anyone who has the exact address of a file can open it. The app shows these addresses only to signed-in players.
Nothing leaves the app unless you share it yourself, for example as a story card or a sticker.
5. Who else gets data
We work with these companies. Each one gets only what it needs for its job.
Supabase Inc., USA
Our processor. Runs our database, file storage and sign-in, so it holds the data from section 2. Our project is hosted in the EU (Ireland) region.
Google (Gmail)
Sends the emails that confirm your address or reset your password. Today they go out from our Gmail address, so Google (Google Ireland Ltd., and Google LLC, USA) gets your email address and the email. Google is responsible for this itself, under its own privacy policy.
Discord (Discord Netherlands BV, and Discord Inc., USA)
Delivers the alert about each new report to our private channel (section 9). The alert holds only the kind of item, the reason, the first characters of the report’s random ID, how many reports are open and whether the item was hidden. It names no one and holds no photo or text. Discord is responsible for this itself, under its own privacy policy.
Expo (650 Industries, Inc.), USA
Our processor. Delivers app updates. Gets the random install ID, the platform, the app version and your IP address, not linked to your account.
Cloudflare, Inc., USA
Hosts the LiveIT website. Gets your IP address and browser details when you open it. If we count visits, we use Cloudflare Web Analytics, which sets no cookies.
GitHub, Inc., USA
Hosts these legal pages. Gets your IP address and browser details when you open them.
Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., USA)
Runs the App Store and Sign in with Apple. Apple is responsible for this itself, under its own privacy policy.
Google (Google Ireland Ltd., and Google LLC, USA)
Runs Sign in with Google, and Google Play and the tester group for the Android test. Google is responsible for this itself, under its own privacy policy.
Authorities
Only when the law requires it, or when someone’s life or safety is at risk.
We sell no data and we give it to no one for advertising.
6. Transfers outside the EU
Supabase, Expo, Cloudflare and GitHub are US companies, and Apple, Google and Discord can also process data in the USA. When personal data goes to the USA, the transfer rests on the EU-US Data Privacy Framework where the company is certified under it, or on the standard contractual clauses of the European Commission in its data processing terms. Write to us for a copy of these safeguards.
7. How long we keep data
Your account and everything in it: until you delete your account.
A proof you delete: its photo or video is deleted at once and the post disappears for everyone. A hidden record of the quest (which quest, when, and the caption) stays with your account until you delete the account, so the same quest is not offered again and points stay fair.
Reports, and the records of what we decided about them: three years after the decision. These records hold random IDs of accounts and posts, the reason, the note added to the report, if any, and the time, but no emails or photos.
The record that an account was deleted: three years. It holds only the random ID of the account and the time.
Technical counters that limit how often an account can act: at most three years. They hold an account ID, an action and a time.
An account we stop for breaking the Terms: it can no longer sign in, and its proofs and comments are hidden. Other players still see its username and profile photo. If these break the rules too, we delete the photo and give the account a neutral username. We keep the account while we need it for that case, at most three years, then delete it.
Server logs at Supabase: a few days.
Backups of the database: we make them before every change to the database and once a week. They hold no photos or videos, stay on our own encrypted computer, and we delete each one after 30 days. Data you deleted can stay in a backup until then.
Your consent to post a proof outside the app: while the post is up, and three years after, so we can show we had it.
Emails you send us: as long as we need them to help you.
Data on your phone: until you delete the app.
Three years is the usual time limit for legal claims in Czech and Slovak law.
8. Deleting your account
In the app: You → Settings (the sliders icon at the top right) → Safety → Delete account → Delete forever.
This deletes at once your sign-in and email address, your profile and username, every photo and video you uploaded (with thumbnails and profile photos), your proofs and captions, comments, Respect, follows and blocks, notifications, badges, collection, streak, game history and the reports you sent.
What stays: the record that an account was deleted, the records and counters from section 7 (random IDs only), the reports other people sent about your proofs or your profile (with their reason and note, but no longer linked to you), and copies in backups until they are deleted.
Without the app: write to benchiitrade@gmail.com from the address of your account. We delete it within one month at the latest.
9. Reports and moderation
Every proof, comment and profile has a report option with seven reasons. You can also block any account.
A report reaches us at once, as an alert in our private Discord channel. The alert names no one and contains no photo or text.
When three different accounts report the same proof or comment, it is hidden automatically until we look at it. Profiles are never hidden automatically.
We act on every report within 24 hours. We hide content that breaks our Terms, delete a profile photo that breaks them and replace such a username with a neutral one. We stop the accounts of people who break the Terms. Content hidden by mistake can come back.
To decide, we look at the reported content, the reason and the note. Hidden content stays stored, photo included, as evidence until its author deletes it or the account is deleted. A photo the law does not let us keep online, such as a sexual photo of a child or an intimate photo shared without consent, we delete sooner. If the police ask us to keep it, we keep it only for them, out of public reach.
If needed, we write to the person who reported or to the author by email. We never tell anyone who reported them.
10. Age
LiveIT is for people 16 and over. After you sign in, the app asks once for your year of birth.
If the year means you are 16 or over, the app sends it to our server once to check it. The server keeps only that you confirmed it, and when. The year is never stored.
If the year means you are under 16, the year never leaves your phone. The app asks once whether the year is right, and then deletes the account.
If you think someone under 16 uses LiveIT, write to us and we will delete the account.
11. Your proofs outside the app
Your proofs stay in the app unless you share them yourself. We post a proof on LiveIT’s own social media, such as TikTok or Instagram, or send it to anyone outside the app, only with your explicit consent for that one post. We also need the consent of every person who can be recognised in it, or we blur them. We never show the faces of minors.
We keep a record of each consent. You can withdraw it at any time, and we then take the post down within 24 hours, 48 at the latest.
12. Automated decisions
We make no decisions about you that rest only on automated processing and have legal or similarly significant effects on you. Two things happen automatically: a proof or comment hides after three reports from different accounts, until we check it, and usernames, captions and comments are checked against a list of prohibited words before they are saved.
13. Your rights
You have the right to:
get a copy of your data and learn how we use it (Art. 15 GDPR),
have wrong data corrected (Art. 16). Most of it you can change in the app yourself,
have your data deleted (Art. 17),
have our use of your data restricted (Art. 18),
get the data you gave us in a machine-readable format (Art. 20),
object to any use that rests on our legitimate interest, including the counting in section 3 (Art. 21),
withdraw a consent at any time. This does not affect what happened before.
Write to benchiitrade@gmail.com, ideally from the address of your account. We answer within one month, and it costs nothing. We may ask you to confirm that the account is yours.
You can also complain to a data protection authority:
Czech Republic: Úřad pro ochranu osobních údajů, uoou.gov.cz
Slovakia: Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk
or the authority in the EU country where you live or work.
14. Security
Data travels encrypted. The app keeps your sign-in in the phone’s secure storage. Rules on our server decide what each account can read and change, and a report can be seen only by the LiveIT admin and by the person who sent it. No method is perfectly safe, so use a strong password that you use nowhere else. If a breach puts your data at risk, we tell you and the authority as the law requires.
15. Changes
When we change this policy, we change the date at the top. If a change matters for you, we tell you in advance, in the app or by email.