Privacy Policy

Version 1.2 · Effective date: 6 August 2026

1. Data controller

The controller of personal data is Jakub Jędrzejczak, a sole trader operating under the business name Jakub Jędrzejczak Trenpreneur, entered in the Polish Central Register and Information on Economic Activity (CEIDG):

• Address: ul. Słoneczna 16, 05-822 Milanówek, Poland
• Tax ID (NIP): 5291862937
• Business ID (REGON): 542257682
• Contact e-mail for data matters: oyey.games@gmail.com

The controller is not required to appoint a Data Protection Officer (DPO) and has not appointed one. For all matters concerning personal data, please write to the e-mail address above.

Processing is governed by the GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

2. Scope — the short version

• The app requires no account and no sign-in.
• The app does not profile users and does no tracking whatsoever. It does not use location, the camera, the microphone, contacts, health data or advertising.
• There is one exception to “we collect no data”: codes. If you claim a reward with a code (from a creator, a discount code or a gift), we record that redemption and your later purchases in the app, so that we can settle the share owed to whoever gave you that code (see section 5). They are tied together by an identifier assigned by Apple that holds none of your details — but we do not call it anonymous, because it links the purchases of one account. Without a redeemed code we record nothing about your purchases.
• Once downloaded, the games run offline; content and settings (e.g. player names, spice level, choice of forfeits) are saved locally on your device and are never sent to us.
• Payments and subscriptions are handled by Apple within the App Store. It is Apple, not us, that processes transaction and payment data (see section 4).
• We process personal data only when you contact us yourself (e.g. a support e-mail or a bug report) — in that case we process the data you send us (see section 7).
• We separately process the data of creators who have joined the code programme and whom we pay a share — the only group whose full identification and payment details we hold (see section 6). If you are a player, that section does not concern you.

3. What data we process and why

Simply using the app (playing) means that we process no personal data at all on our servers. The table below covers the only situations in which data is processed — and shows who the controller is.

4. Payments and subscriptions (Apple)

All in-app purchases (a single game, a game bundle, the weekly subscription) are processed through Apple In-App Purchase. This means that:

• billing runs through your Apple ID account;
• we neither see nor store your card details or full billing data — they are processed by Apple as the payment service provider;
• how Apple processes data is described in the Apple Privacy Policy;
• you manage your subscription (including cancellation) and any refunds in your Apple ID / App Store settings — details in the Terms (§ 6).

From Apple we receive sales reports and also notifications about individual transactions in the app (which product, when, in which country, for how much). They contain no name, no e-mail address and nothing from your Apple account. We need those notifications solely to settle the code programme described in section 5.

5. Codes and the referral programme

You can claim a reward in the app with a code. We issue codes in three situations: as a creator code (someone who recommends Oyey to their audience), as a discount code and as a gift. For you they behave identically, and the App Store always performs the redemption, not us.

What happens after you redeem a code. The app sends us nothing and stores no marker on your device for this purpose. The App Store performs the redemption and we learn about it from Apple's signed notification. That notification carries the identifier Apple assigns to the pair “your Apple account plus our app” (appTransactionId), which stays the same across reinstalls and new phones. That identifier — and nothing else — is how we link your later purchases in Oyey to the code you redeemed.

What that identifier does not contain. No name, no address, no e-mail, no phone number, no device identifier and nothing from your Apple account. It cannot be used to work out who you are, including by us. It is not anonymous data, though, and we will not call it that: it ties together purchases made on one Apple account, and Apple can link it to a person. It is pseudonymised data, which we treat as personal data under the GDPR, with all the rights that gives you (see section 11).

• Data: the identifier assigned by Apple (appTransactionId), the transaction identifier, the product identifier, purchase date, amount and currency, storefront country, refund status, and the name of the offer the code belonged to.
• Purpose: to determine and pay the share owed to the person who referred you, and to settle that programme.
• Legal basis: Article 6(1)(f) GDPR (legitimate interest: settling a partner programme) and Article 6(1)(c) GDPR for accounting and tax obligations.
• Retention: 12 months from redemption (the settlement window), and for records needed for accounting, the period required by law, namely 5 years from the end of the tax year.
• Recipients: the data comes from Apple and stays in our accounting systems. Apple's notifications arrive at an endpoint hosted on Cloudflare which does not store them and only acknowledges receipt. A creator never learns from us who you are: we hand over no identifiers, no e-mail addresses and no “who bought what” list. What they get are numbers: how many people redeemed their code, how many purchases came of it and the amount owed to them — plus, if Apple refunded someone after we had already paid, a correction line with the product name and the refund date and nothing about the person.
• No code, no record: if you redeem no code, your purchases never enter our referral register and leave no trace with us at all.

Exercising your rights. We run no accounts and do not know your identity, so we cannot find your records from a name or an e-mail address. Write to oyey.games@gmail.com and give us enough to find the purchase in the register: the purchase date, the amount and currency, what was bought and the country of your App Store. All of it is on the receipt Apple e-mails you — you can simply forward it. It also helps to say which code you redeemed and roughly when. Apple's transaction identifier speeds things up but is not required: the App Store does not show it in your purchase history. We will delete every matching record except those we are legally required to keep for accounting. See Data deletion.

There is no tracking. We never combine this data with data from other apps, websites or data brokers, we build no advertising profiles, and we do not ask for ATT permission because none is needed. Programme terms are provided to each creator individually when they join.

6. Creators in the code programme

This section concerns creators: people who have joined the code programme and whom we pay a share. It does not concern players — they are covered by section 5. Unlike players, a creator is known to us by name, because money cannot be transferred and an accounting document cannot be issued without that.

• Data: name or company name, address, tax number (NIP) or personal number (PESEL), bank account number, e-mail address, the creator's handle and the code assigned to it, plus invoices or bills and the payout history.
• Purposes and legal bases: entering into and performing the cooperation agreement, including calculating and paying the share — Art. 6(1)(b) GDPR; issuing and keeping accounting documents and settling taxes — Art. 6(1)(c) GDPR (legal obligation, including the Polish Accounting Act and Tax Ordinance); pursuing or defending against claims — Art. 6(1)(f) GDPR.
• Providing the data is voluntary but necessary for payment: without it we can neither transfer the money nor book the payout.
• Retention: for the duration of the cooperation, and data contained in accounting documents for 5 years from the end of the tax year in which the document was issued. After that we delete it together with the records.
• Recipients: the bank holding our account (to make the transfer), the accounting firm that keeps our books, tax authorities and other competent authorities to the extent required by law. We pass creators' data neither to Apple nor to anyone else for marketing purposes.
• Rights: access, rectification, erasure, restriction of processing, portability and objection to processing based on legitimate interest — subject to the fact that data contained in accounting documents cannot be erased before the statutory period expires. You may also lodge a complaint with PUODO (see section 11).
• No profiling. We take no automated decisions about creators and do not profile them.

For matters concerning a creator's data write to oyey.games@gmail.com — here, unlike with players' data, the e-mail address used in the cooperation is enough.

7. Support contact and bug reports

When you e-mail us (support, a question, a complaint, a bug report), we process your e-mail address and the content of your message — solely in order to reply and handle the matter. Providing this data is voluntary, but necessary for us to be able to get back to you.

We handle correspondence using e-mail provided by Google (Gmail). We keep your e-mail for as long as it is needed to handle the matter and for the limitation period for any potential claims.

8. Third-party services and SDKs

To the best of our knowledge as at the date of publication, the app does not use any third-party analytics, advertising or tracking tools (e.g. Google Analytics, Firebase, PostHog, ad networks, pixels). In particular:

• we do not use tracking for advertising purposes (App Tracking Transparency / IDFA);
• we do not use advertising SDKs;
• we do not use AI/ML solutions that process your data;
• we do not embed cookies or similar technologies for marketing purposes.

The third parties involved in the operation of the service are Apple (app distribution and payments), Google (Gmail) as our e-mail provider (handling contact), Cloudflare, which hosts the endpoint that receives Apple's transaction notifications (see section 5), and GitHub (GitHub Pages) and Fastly, which host and deliver this website. Cloudflare does not store those notifications. The website has no forms, sets no cookies and runs no analytics — GitHub and Fastly process only the technical data inherent in serving a page (IP address, browser type, the address of the file requested) and their own server logs.

9. Sharing of data

We do not sell personal data and we do not share it with third parties for marketing purposes. Data may be processed only by:

• Apple — for app distribution and payment handling;
• Google (Gmail) — as our e-mail provider, if you contact us;
• Cloudflare — as the infrastructure provider for the endpoint that receives Apple's transaction notifications (it does not store them);
• GitHub (GitHub Pages) and Fastly — as the hosting and content delivery providers for this website, limited to the technical data inherent in serving it;
• the bank holding our account and our accounting firm — solely for payouts and settlements with creators (see section 6);
• competent authorities — only where required by law.

Using the services of Apple, Google, Cloudflare, GitHub and Fastly may involve transfers of data outside the European Economic Area (including to the USA). All of these providers state that they apply the transfer mechanisms provided for in the GDPR. Apple relies on the standard contractual clauses (SCC) approved by the European Commission for transfers out of the EEA and is not on the list of participants in the EU–U.S. Data Privacy Framework. Google, Cloudflare, GitHub and Fastly are participants in that framework and additionally rely on SCCs. Details in the privacy policies of Apple, Google, Cloudflare, GitHub and Fastly. The current status of any participant can be checked on the programme's list.

10. Retention periods

• In-game data (player names, settings) — stored locally on your device until you delete it or uninstall the app.
• E-mail correspondence — for as long as the matter is being handled and for the limitation period for claims.
• Transaction data relating to purchases — held by Apple, in line with Apple’s policies and accounting regulations.
• Code programme data (see section 5) — 12 months from redemption, and for accounting purposes 5 years from the end of the tax year.
• Creators' data in the code programme (see section 6) — for the duration of the cooperation, and data in accounting documents 5 years from the end of the tax year.

11. Your rights (GDPR)

To the extent that we process your data (when you contact us, when you have redeemed a code — see section 5 — or when you are a creator in the code programme, see section 6), you have the right to: access your data, rectify it, erase it, restrict processing, data portability, object to processing and — where processing is based on consent — withdraw that consent.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise your rights, write to oyey.games@gmail.com. If the matter concerns code programme data, include the purchase date, the amount and currency, the name of the product and the country of your App Store (easiest: forward the receipt Apple e-mailed you). Without that we cannot find the records, because we run no accounts and do not know your identity. Step-by-step instructions: Data deletion.

12. Withdrawing consent

The app does not operate on the basis of consent: code programme data is processed on the basis of legitimate interest and accounting obligations rather than consent (see section 5), and you may object to that processing. If features requiring consent appear in the future (e.g. a marketing newsletter), you will be able to withdraw your consent at any time — without affecting the lawfulness of processing carried out before the withdrawal — by writing to oyey.games@gmail.com or using the relevant option in the message or in the app.

13. Deleting data and accounts

The app does not allow you to create an account, so there is no account to delete. To remove data stored locally, simply clear the app’s data or uninstall it. To have the e-mail correspondence you sent us deleted, write to oyey.games@gmail.com. If you claimed a reward with a code, you can use the same address to request deletion of the code programme settlement data, giving the date and amount of the purchase and the country of the store (see section 5). Details: Data deletion.

14. Age of users

The app is intended solely for adults (18+) — that is also its age rating in the App Store. Inside the app you can additionally switch off the most explicit cards with the “18+ cards” toggle in settings. The app is not directed at minors and we do not knowingly collect their data.

15. Changes to this policy

We may update this policy (e.g. when the app’s features or our providers change). The current version is published at https://oyey.eu/privacy-en.html together with its effective date. We will flag any material changes in the app or on the website.