GameNighty Privacy Policy

1. Who is responsible for your information

GameNighty is operated by Hamed Navvabian, an individual publisher based in Turkey (Türkiye). Hamed Navvabian is responsible for deciding how personal information is used in GameNighty's website, mobile applications and online game services. In this policy, “we”, “us” and “our” refer to that publisher.

Contact us about privacy, your account or this policy at support@gamenighty.com. Please use “Privacy request” in the subject line. You do not need a GameNighty account to contact us.

Email is our contact channel for privacy requests and all other correspondence.

2. Information we process

Account information: for email accounts, we process your email address, username, account identifier, password hash, account status and account creation information. We use password-reset and account-deletion verification records to protect access. We store a password hash rather than your readable password.

Guest information: you can start as a guest without providing an email address. A guest still has an account identifier, profile and gameplay records. Guest play is not anonymous to our systems.

Profile and gameplay information: this includes your chosen name, avatar settings, language, online status, room membership, game participation, choices and submitted answers, results, levels, progress, virtual balances, inventory and subscription or purchase entitlements. What is recorded depends on the game and features you use.

Device and connection information: our systems and infrastructure receive information needed to handle connections and protect the service, including IP addresses and request metadata. Notification registration includes a delivery token, platform, app identifier, time zone and registration/activity times. The information recorded by infrastructure providers depends on the configured service.

Purchase information: we receive and verify store transaction identifiers, product identifiers, purchase and subscription status, billing-period information and related store verification records. Apple or Google handles your payment method through its own billing service. GameNighty does not operate a browser checkout for these purchases or ask you to submit a payment-card number to our game servers.

Optional analytics: if enabled with your consent, Google Analytics 4 and Firebase process app or browser analytics identifiers, the internal GameNighty user identifier, usage events and properties such as language, guest status, subscription status and environment. Examples include screens visited, room and matchmaking activity, game results and virtual-economy activity. Analytics providers also receive technical information associated with their requests.

Support information: if you contact us, we receive the address you contact us from, your message and information you choose to provide. Please do not send passwords, one-time verification codes, payment-card details or unnecessary sensitive information.

3. Where information comes from

We obtain information directly from you, from your interactions with GameNighty, from other participants in shared games and from the stores and service providers supporting the features you use. Other participants' game actions may form part of a shared match record involving you. We receive purchase verification and subscription updates from Apple and Google.

4. Why we use information and our legal grounds

We use account and gameplay information to provide accounts, multiplayer sessions, game results, progress, virtual items and features you request. Where applicable, the legal ground is taking requested steps or performing a valid service contract. A parent's involvement or another lawful ground may be needed where a child cannot enter that contract.

We use necessary connection, account-security and operational information to prevent abuse, authenticate requests, maintain reliable services and resolve disputes. Where permitted, we rely on legitimate interests in operating a secure and fair service, subject to the rights and interests of the people concerned. We use necessary financial or legal records to meet applicable legal obligations or establish, exercise or defend legal rights.

Optional analytics rely on consent. Notification delivery depends on your device permissions and the applicable legal ground for the notification. A device permission is not a substitute for any separate consent required by law. Accepting our terms does not itself authorize optional analytics.

5. What other players can see

GameNighty shares the information needed for social play with relevant participants, such as your selected name and avatar, room presence, game actions when the rules reveal them, scores and results. Some information, including roles or answers, is deliberately hidden until the game permits disclosure. Do not include private or sensitive information in names or game answers.

Other participants may remember or independently record what they have seen. Account deletion removes or detaches information in our systems as described below; it cannot remove copies another person independently keeps.

6. Service providers and other disclosures

We use OVH to host the website, APIs, databases and network services on servers in Canada; Google Cloud Storage to hold encrypted-at-rest database backups and the record of deleted accounts described in section 10; Resend to deliver account emails and to receive messages sent to our support address; Google Firebase Cloud Messaging and Apple Push Notification service for supported notifications; Google Analytics 4 and Firebase for consented analytics; Google and Apple when you choose to sign in with them; and Apple and Google for native billing and purchase verification. We do not currently use a content delivery network. Providers receive the information needed for the relevant function. Stores and sign-in providers also process information under their own terms and privacy notices.

We may disclose information where required by law or where legally justified to handle security incidents, protect people, enforce lawful rights or respond to a valid legal request. Access to retained financial and deletion records is restricted to their relevant operational and legal purposes.

7. International processing

GameNighty is operated from Turkey. Our servers are hosted by OVH in Canada. Database backups are stored in the United States. Resend stores the content and delivery logs of the emails it sends and receives for us in the United States, whichever sending region we use. The providers supporting mobile platforms, billing, sign-in, notifications and analytics may process information in other countries. The applicable protection and transfer arrangements depend on the recipient, location and law governing the transfer. Contact support@gamenighty.com for information about the safeguards that apply to a particular transfer.

8. Cookies, local storage, analytics and notifications

The browser app uses device storage to maintain sessions, preferences and cached content. The public website also stores choices such as app-banner dismissal. These operational functions are separate from optional analytics. Clearing app data or browser storage may remove guest access, local progress or preferences.

Optional analytics are disabled until the app's consent flow grants permission. You can revisit Privacy options in the app's settings; on native platforms the form offered depends on Google's consent-service requirements. Declining analytics does not prevent ordinary play. Withdrawing consent stops subsequent consent-dependent collection, subject to processing already lawfully performed. It does not automatically erase previously collected information.

Where notifications are supported, change notification choices in the app and revoke delivery permission through your operating system. GameNighty currently does not serve advertisements. Google's native consent software is used for consent collection; its presence does not mean that GameNighty currently displays ads.

9. How long information is kept

We keep active account and gameplay information to provide the service, subject to account deletion and any applicable retention limits. Retention depends on the purpose, legal requirements, dispute needs and whether a less identifying record is sufficient.

After confirmed deletion, we remove the personal profile, credentials, owned progress, virtual balances and inventory, notification registrations and associated account-owned records through the deletion process. Shared match history can retain minimal results with detached participants labelled “Deleted player”, with personal profile data and the deleted player's authored answers removed. Detached records are not necessarily anonymous.

Restricted transaction and subscription evidence, necessary audit metadata, and opaque deletion and recovery records can remain for accounting, reconciliation, security, duplicate-purchase prevention, legal obligations and preventing a deleted account from reappearing after recovery. These records are separate from an active player profile. Usable purchase credentials and raw identity-bearing provider payloads are removed during erasure.

The server's registered analytics identifier expires 30 days after registration unless refreshed and is removed during account deletion. This is not the retention period for information already sent to Google. A completion-email recipient is kept separately until delivery is accepted or, if undelivered, until cleanup following the 24-hour delivery window.

Retention by type of information:

• Accounts and guests: we do not currently remove accounts automatically for inactivity. An account is kept until you delete it. A guest account is kept until you delete it or until you register, when its data is merged into your registered account and the guest account is deleted. A guest who never registers or deletes the account stays in our systems.
• Shared match history: match results are kept for as long as the service runs, because other players' histories depend on them. When a participant deletes their account, their entry becomes “Deleted player” and their profile data and authored answers are removed.
• Purchase and accounting records: restricted transaction and subscription records are kept for 10 years after the transaction, as accounting, tax and dispute-handling rules require, and are then deleted. Usable purchase credentials and raw provider payloads are removed when an account is deleted.
• Support correspondence: messages to support@gamenighty.com are received through our email provider, Resend, which keeps them for 30 days. We do not keep a separate copy.
• Security and audit records: administrative audit records are kept without a fixed end date. When an account is deleted, personal snapshots in them are cleared. Server log files are rotated automatically and keep only recent activity, for days to weeks depending on traffic.
• Record of deleted accounts: the internal account identifier and time of each deletion are kept without a fixed end date, so deletions can be repeated if a backup is restored.
• Account emails: our email provider, Resend, keeps the emails we send you (such as verification codes and password-reset links) for 30 days.
• Analytics: Google Analytics 4 keeps event and user-level data for 14 months. Separately, deleting your account sends Google a request to erase data linked to your user identifier.
• Backups: database backups expire 30 days after they are made (see section 10).

10. Account deletion and external copies

You can begin deletion from your Profile or at https://gamenighty.com/delete-account. Email accounts require password verification, an emailed code and final confirmation. Guests confirm deletion without supplying an email address. If you cannot sign in or cannot access the email on your account, contact support@gamenighty.com; we may need proportionate information to verify authority before acting.

Accepted deletion immediately revokes account access and cannot be cancelled. Cleanup can continue afterward, with retries after temporary failures. The status screen distinguishes pending cleanup from completed application erasure. An optional completion email is not the only evidence of status and delivery can fail.

Account-linked Google Analytics deletion requests are handled separately from our database cleanup. Our integration can submit a user-ID deletion request when configured; provider acceptance does not establish that all device-only activity, exports, independent copies or aggregate reports have been erased. Provider setup and any separately retained copies must be addressed independently.

Backups are not immediately rewritten by account deletion. Database backups are kept in cloud storage in the United States and expire automatically after 30 days. We also keep a record of deleted accounts, consisting only of an internal account identifier and a time, so that if a backup is ever restored we repeat any deletions made after that backup before the service reopens. Deleting an account or uninstalling the app does not cancel an Apple or Google subscription.

11. Children and teenagers

GameNighty is not directed to children under 13. Our Terms of Use set a minimum age of 13, or a higher age where local law or the app store rating in your region requires it. We do not verify anyone's age, and we do not knowingly collect personal information from anyone below that minimum age. If we learn that we have, we delete the account and its information as described in section 10. Teenagers who meet the minimum age may still need a parent or guardian to agree to some uses where local law requires it. Guest accounts and multiplayer features process personal information even without an email address, and online play can involve other people, including players you do not know.

Parents and guardians can contact support@gamenighty.com to ask what information is held about their child, request correction or deletion, or report an account that belongs to someone below the minimum age. We may need to verify the requester's relationship and authority without collecting unnecessary information. We do not ask for full names, home addresses, birth dates or similar sensitive information, and we do not require an email address to play as a guest. Names shown in games are display names chosen by the player. Players should not share personal contact details, passwords or sensitive information in names, answers or support messages.

12. Your privacy rights

Depending on the law that applies, you may have rights to find out whether information is processed, obtain access and a copy, request correction or erasure, learn about recipients, and ask that relevant corrections or erasure be communicated to them. Turkish law also provides rights concerning processing purposes, certain automated outcomes and compensation for unlawful processing.

Where applicable under EEA, UK or other law, rights can also include restriction, portability, objection to certain processing and withdrawal of consent. These rights have conditions and exceptions; for example, a legal retention obligation may limit erasure of financial evidence. Game scoring, matchmaking and some purchase-entitlement checks are automated functions. Contact us about a disputed result or access decision and any applicable right to review.

Email support@gamenighty.com to make a request. We will seek only the verification reasonably needed, explain any applicable limitation and respond within the legally required period. Turkish controller applications must generally be answered within 30 days; GDPR requests generally have a one-month initial response period, with extensions only as permitted. You can also complain to the competent authority, including Turkey's Personal Data Protection Authority where applicable. Contacting us does not remove any independent complaint right available under the relevant law.

13. Security and changes

We use safeguards such as hashed passwords, account verification, access controls and protections against reusing deleted account access. No internet service can guarantee absolute security. Protect your credentials and tell us promptly if you suspect an account problem.

We will publish updates with a revised effective date. Where law requires an additional notice or consent, publication alone is not a substitute for that step. Translated versions should communicate the same practices and preserve rights that cannot lawfully be excluded.