Privacy policy
Applies to the Tapora mobile game and to taporagame.com. Last updated: 15 August 2026.
The short version. Tapora creates an anonymous account on first launch so your progress can follow you. It stores a nickname you choose, your scores, play statistics and game settings — and nothing else. There is no sign-in, no e-mail address, no advertising, no analytics SDK and no third-party tracker, and the game never asks for your real name, your address or your contacts. You can delete everything at any time, from the game itself or from the account deletion page.
1. Who is responsible
The data controller is Spike Flow, publisher of Tapora, a French simplified joint-stock company (SAS) with share capital of €1,000, registered office at 13 rue Max de Reinach, 67210 Niedernai, France, registered under SIREN 980 505 234 (RCS Saverne). Contact: privacy@taporagame.com.
"Tapora" means the mobile game published under the identifier
com.taporagame.tapora on the App Store and Google Play, and the website
taporagame.com.
2. What data is processed
2.1 Created automatically when you first launch the game
| Data | Detail |
|---|---|
| Anonymous account identifier | A random identifier issued by our authentication provider. It is not linked to your name, your phone number or your device identifier for advertisers. |
| Nickname | 1 to 16 characters, chosen by you and generated at random until you change it. It is displayed alongside your scores. Please do not use your real name. |
| Session token | Stored on the device so you stay signed in. |
2.2 Created as you play
| Data | Detail |
|---|---|
| Scores | For each track and difficulty, your best run: points, maximum multiplier, longest streak, number of Perfect, Great, Good and Miss judgements, flicks landed. |
| Play statistics | Number of runs and total time played. |
| Game settings | Your in-game preferences, synchronised so a new device starts configured. Your audio and display latency calibration stays on the device and is never uploaded — it is specific to your hardware. |
2.3 No sign-in, no e-mail address
The current version of Tapora has no login screen and offers no Sign in with Apple or Google Sign-In. Your account is anonymous from beginning to end: we hold no e-mail address, no name and no phone number, and we never send you marketing.
One consequence is worth knowing before you rely on it: because nothing identifies you beyond the device, an account cannot be recovered on a different phone. If we later add an optional way to link an identity, this policy will be updated before the feature ships.
2.4 Purchases
The game sells nothing at present — there is no in-app purchase, and no payment data of any kind reaches us. If paid music sets arrive, payment will be handled entirely by Apple or Google and this policy will say so beforehand.
2.5 Technical logs
Our backend provider records standard server logs when the app synchronises — IP address, timestamp, endpoint called — for security and abuse prevention. They are not used to profile players.
2.6 What Tapora does not do
- No advertising and no advertising identifier (IDFA / AAID).
- No analytics or attribution SDK, no behavioural profiling.
- No access to your contacts, photos, microphone, camera or precise location.
- No sale of personal data, and no sharing for cross-context behavioural advertising.
3. Why, and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Providing the game, saving and synchronising your progress across devices | Account identifier, nickname, scores, statistics, settings | Performance of the contract — our terms of use (art. 6(1)(b)) |
| Showing nicknames and scores in rankings | Nickname, score | Performance of the contract (art. 6(1)(b)) |
| Keeping the service secure, preventing fraud and implausible scores | Technical logs, score consistency checks | Legitimate interest in a working, fair game (art. 6(1)(f)) |
| Answering your support requests | What you send us by e-mail | Legitimate interest in answering you (art. 6(1)(f)) |
No decision producing legal effects is taken about you automatically, and no profiling is performed.
4. Who else sees it
| Recipient | Role | What they process |
|---|---|---|
| Supabase, Inc. | Processor — database, authentication and file hosting | All account and progress data described above |
| Apple Inc. | Independent controller — App Store distribution | Your Apple account relationship as the store that delivered the app, under Apple's privacy policy |
| Google LLC | Independent controller — Google Play distribution | Your Google account relationship as the store that delivered the app, under Google's privacy policy |
| Hostinger International Ltd | Processor — hosting taporagame.com | Web server logs |
Other players see your nickname and your scores in rankings — nothing else. We may disclose data to a public authority where the law requires it.
5. International transfers
Our processors may store or access data outside the European Economic Area, in particular in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses, together with the technical measures described in section 9. You can ask us for a copy of the safeguards in place.
6. How long it is kept
| Data | Retention |
|---|---|
| Account, nickname, scores, statistics, settings | For as long as the account exists. Deleted within 30 days of a deletion request. |
| Accounts left completely inactive | Deleted after 3 years without any connection. |
| Technical logs | Up to 12 months. |
| Support e-mails | Up to 3 years after the last exchange. |
Data stored on your own device is removed when you uninstall the game.
7. Your rights
Under the GDPR you can ask us to:
- access the data we hold about you, and receive a copy;
- correct it if it is inaccurate — your nickname is editable in the game at any time;
- erase it — from the game, at the bottom of the profile screen, or through Delete my account;
- restrict or object to processing based on our legitimate interest;
- port your data to another service, in a structured, machine-readable format;
Write to privacy@taporagame.com. We answer within one month. Because accounts are anonymous by design, we may ask you for the account identifier shown in the game's settings screen — it is the only way to be sure we are acting on the right account.
If you believe we have mishandled your data you may complain to your national supervisory authority. In France that is the CNIL — cnil.fr.
If you are in California: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against players who exercise their rights. Requests go to the same address.
8. Children
Tapora is not directed at children under 13, and we do not knowingly collect data from them. In countries where the age of digital consent is higher, a player below that age should use the game with the involvement of a parent or guardian. If you believe a child has created an account, write to privacy@taporagame.com and we will delete it.
9. Security
- All traffic between the game and our servers is encrypted with TLS.
- Data is encrypted at rest by our hosting provider.
- Database access is restricted by row-level security: an account can only read and write its own data, and scores, statistics and purchases can only be written by our server-side functions — never directly by the app.
- Access to production data is limited to the people who need it to run the service.
10. This website
taporagame.com sets no cookie, runs no analytics and embeds no third-party script or font. The host records standard server logs (IP address, date, page requested) for security and troubleshooting. The contact forms on this site open your own mail application with the message pre-filled — nothing is sent until you press send in your mail app, and no form data reaches this website.
11. Changes
We update this policy when the game changes. The date at the top always reflects the current version. A change that materially affects you will be announced in the game before it takes effect.
12. Contact
Privacy: privacy@taporagame.com
Support: support@taporagame.com
Postal: Spike Flow, 13 rue Max de Reinach, 67210 Niedernai, France.