Privacy policy
Applies to the Tapora mobile game and to taporagame.com. Last updated: 15 August 2026.
The short version. Tapora creates an anonymous account on first launch so your progress can follow you. It stores a nickname you choose, your scores, play statistics, game settings and your purchases. It contains no advertising, no analytics SDK and no third-party tracker, and it never asks for your real name, your address or your contacts. You can delete everything at any time from the account deletion page.
1. Who is responsible
The data controller is Spike Flow, publisher of Tapora, a French simplified joint-stock company (SAS) with share capital of €1,000, registered office at 13 rue Max de Reinach, 67210 Niedernai, France, registered under SIREN 980 505 234 (RCS Saverne). Contact: privacy@taporagame.com.
"Tapora" means the mobile game published under the identifier
com.taporagame.tapora on the App Store and Google Play, and the website
taporagame.com.
2. What data is processed
2.1 Created automatically when you first launch the game
| Data | Detail |
|---|---|
| Anonymous account identifier | A random identifier issued by our authentication provider. It is not linked to your name, your phone number or your device identifier for advertisers. |
| Nickname | 1 to 16 characters, chosen by you and generated at random until you change it. It is displayed alongside your scores. Please do not use your real name. |
| Session token | Stored on the device so you stay signed in. |
2.2 Created as you play
| Data | Detail |
|---|---|
| Scores | For each track and difficulty, your best run: points, maximum multiplier, longest streak, number of Perfect, Great, Good and Miss judgements, flicks landed. |
| Play statistics | Number of runs and total time played. |
| Game settings | Your in-game preferences, synchronised so a new device starts configured. Your audio and display latency calibration stays on the device and is never uploaded — it is specific to your hardware. |
| Purchases | The music sets you own, the platform they were bought on, and the transaction identifier issued by Apple or Google — used to restore your purchases. We never see or store your payment card. |
2.3 Only if you link an identity
Linking your account to Sign in with Apple (iOS) or Google Sign-In (Android) is optional. It lets you recover your progress on another device. When you link, we receive an identity token containing a stable user identifier and, depending on the choice you make in the system dialog, an e-mail address — which may be a private relay address if you ask Apple to hide your e-mail. We use that identifier for one purpose only: recognising you at sign-in. We do not e-mail you for marketing.
2.4 Technical logs
Our backend provider records standard server logs when the app synchronises — IP address, timestamp, endpoint called — for security and abuse prevention. They are not used to profile players.
2.5 What Tapora does not do
- No advertising and no advertising identifier (IDFA / AAID).
- No analytics or attribution SDK, no behavioural profiling.
- No access to your contacts, photos, microphone, camera or precise location.
- No sale of personal data, and no sharing for cross-context behavioural advertising.
3. Why, and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Providing the game, saving and synchronising your progress across devices | Account identifier, nickname, scores, statistics, settings | Performance of the contract — our terms of use (art. 6(1)(b)) |
| Delivering and restoring purchased content | Purchases, transaction identifiers | Performance of the contract (art. 6(1)(b)) |
| Recognising you when you sign in with Apple or Google | Provider identifier, e-mail if provided | Performance of the contract, at your request (art. 6(1)(b)) |
| Showing nicknames and scores in rankings | Nickname, score | Performance of the contract (art. 6(1)(b)) |
| Keeping the service secure, preventing fraud and implausible scores | Technical logs, score consistency checks | Legitimate interest in a working, fair game (art. 6(1)(f)) |
| Answering your support requests | What you send us by e-mail | Legitimate interest in answering you (art. 6(1)(f)) |
No decision producing legal effects is taken about you automatically, and no profiling is performed.
4. Who else sees it
| Recipient | Role | What they process |
|---|---|---|
| Supabase, Inc. | Processor — database, authentication and file hosting | All account and progress data described above |
| Apple Inc. | Independent controller — App Store distribution, Sign in with Apple, in-app purchases | Your Apple account relationship and the purchase itself, under Apple's privacy policy |
| Google LLC | Independent controller — Google Play distribution, Google Sign-In, in-app purchases | Your Google account relationship and the purchase itself, under Google's privacy policy |
| Hostinger International Ltd | Processor — hosting taporagame.com | Web server logs |
Other players see your nickname and your scores in rankings — nothing else. We may disclose data to a public authority where the law requires it.
5. International transfers
Our processors may store or access data outside the European Economic Area, in particular in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses, together with the technical measures described in section 9. You can ask us for a copy of the safeguards in place.
6. How long it is kept
| Data | Retention |
|---|---|
| Account, nickname, scores, statistics, settings | For as long as the account exists. Deleted within 30 days of a deletion request. |
| Accounts left completely inactive | Deleted after 3 years without any connection. |
| Purchase records | Kept for the statutory accounting period (10 years in France) after the transaction, in a restricted-access form, even after account deletion — a legal obligation we cannot waive. |
| Technical logs | Up to 12 months. |
| Support e-mails | Up to 3 years after the last exchange. |
Data stored on your own device is removed when you uninstall the game.
7. Your rights
Under the GDPR you can ask us to:
- access the data we hold about you, and receive a copy;
- correct it if it is inaccurate — your nickname is editable in the game at any time;
- erase it — see Delete my account;
- restrict or object to processing based on our legitimate interest;
- port your data to another service, in a structured, machine-readable format;
- withdraw a linked Apple or Google identity, which returns the account to anonymous.
Write to privacy@taporagame.com. We answer within one month. Because accounts are anonymous by design, we may ask you for the account identifier shown in the game's settings screen — it is the only way to be sure we are acting on the right account.
If you believe we have mishandled your data you may complain to your national supervisory authority. In France that is the CNIL — cnil.fr.
If you are in California: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against players who exercise their rights. Requests go to the same address.
8. Children
Tapora is not directed at children under 13, and we do not knowingly collect data from them. In countries where the age of digital consent is higher, a player below that age should use the game with the involvement of a parent or guardian. If you believe a child has created an account, write to privacy@taporagame.com and we will delete it.
9. Security
- All traffic between the game and our servers is encrypted with TLS.
- Data is encrypted at rest by our hosting provider.
- Database access is restricted by row-level security: an account can only read and write its own data, and scores, statistics and purchases can only be written by our server-side functions — never directly by the app.
- Access to production data is limited to the people who need it to run the service.
10. This website
taporagame.com sets no cookie, runs no analytics and embeds no third-party script or font. The host records standard server logs (IP address, date, page requested) for security and troubleshooting. The contact forms on this site open your own mail application with the message pre-filled — nothing is sent until you press send in your mail app, and no form data reaches this website.
11. Changes
We update this policy when the game changes. The date at the top always reflects the current version. A change that materially affects you will be announced in the game before it takes effect.
12. Contact
Privacy: privacy@taporagame.com
Support: support@taporagame.com
Postal: Spike Flow, 13 rue Max de Reinach, 67210 Niedernai, France.