Privacy policy

Who is responsible

Quitapon is a free Android and web game published by Alejandro Fernández Camello. For privacy questions, support or requests about your data, email apps_alejandro@proton.me. This policy covers the app and quitapon.app.

Playing without an account

You can play against the computer, share a device with another player and solve exercises without registering. Local games, settings, reminders, goals, streaks and learning history stay on your device. We do not request access to your contacts, location, photos, microphone or camera. Your operating system may include local data in backups, depending on your settings.

Your account and online play

Email registration stores your email address, public name, username, password hash and email-verification status. Google sign-in provides the basic identity information you authorize, such as your email address, identifier and name; we never receive your Google password. The authentication provider may store tokens needed to link the account.

Sessions use identifiers and tokens, timestamps, IP addresses and browser or device information. Android stores the session credential using the system secure store. Connections to our service use HTTPS and WSS.

Our server stores your avatar, Elo rating, online match results and moves, statistics, friends, invitations, experience, achievements, lessons and synchronized training results. Other players can see your public name, username, avatar and rating; participants can access their matches. Public profiles do not include your email or credentials. Please keep private information out of your public name and username.

If you open a support ticket, we store its subject, text, replies and timestamps linked to your account. Only you and the administration team can access the conversation. Attachments are not supported. Tickets are erased when your account is deleted.

At registration we store the version of the terms you accepted, the time and language as part of your account.

Why we use this information

We use necessary data to create and secure accounts, run matches and invitations, maintain ratings, synchronize progress and respond to support requests. The grounds are providing the service you request and our legitimate interest in protecting it against fraud and abuse.

Verification messages confirm your account. Email recaps and news are optional; manage consent in your account or use the message’s unsubscribe link. Android reminders are scheduled locally and require notification permission. We do not register an Android remote push token. Web push is a separate opt-in that stores your browser subscription.

Service providers and technical data

Cloudflare hosts the website, API, database and online matches, and processes connection information and technical logs to deliver and protect the service. Resend delivers account and optional emails, receiving the recipient and necessary message content. Google handles sign-in when you choose it. Proton Mail processes messages you send to support.

These providers may process data outside your country, including outside the European Economic Area, under their applicable terms and safeguards. We do not sell personal data. Quitapon has no advertising, purchases, advertising tracking or commercial analytics SDK. Internal service metrics are derived from account activity and matches.

Retention and deletion

Account data is retained while you use it and until you request deletion. Delete your account from Settings → Privacy and help → Delete my account, or use the page linked below. The request signs you out everywhere immediately and server cleanup continues in the background. On the web you can sign in and confirm deletion without reinstalling the app.

We verify account ownership and handle requests within one month. We delete or anonymize identifying information, including credentials, sessions, profiles, friendships, subscriptions and progress. Match records needed for an opponent’s history or rating integrity are disconnected from your identity and shown without your name or username.

Workers operational logs may remain for up to 7 days, and D1 recovery backups for up to 30 additional days, depending on the Cloudflare plan. If a legal obligation or a specific security need requires retaining information, we will explain the data, reason and duration when processing your request. Providers also apply their own retention periods to security and delivery logs.

Signing out or uninstalling does not delete your server account. Clear local data through Android storage settings; operating-system and external backups are managed separately.

Your choices and rights

Contact us to request access, correction, portability or deletion, or to raise an objection or restriction request. You can withdraw optional permissions and continue playing locally. If your rights have not been addressed, you can contact the Spanish Data Protection Agency or your local supervisory authority.

Quitapon is not directed at children under 16. Contact us if you become aware of an account belonging to someone below that age. Material changes to data handling will be reflected here and communicated when appropriate.