The short version
WitDuel uses data to run the game—not to build an advertising profile.
WitDuel is a Witlio project operated from Iceland. This policy covers the public website, hosted web tester, Android and iPhone test builds, and the API used by those products during the closed beta.
Data we handle
Most data comes directly from you or from your use of WitDuel. Google and Firebase provide the verified account identifier and email used for sign-in. A diagnostic report is created locally and redacts tokens, email addresses and display names; it leaves your device only when you choose to copy or share it.
Why we use it
- Provide the service: authenticate you, maintain your profile, run matches, calculate results and progression, deliver challenges and restore active play.
- Operate the beta: manage tester registration, invitations, essential testing updates and voluntary withdrawal.
- Keep play reliable and fair: synchronize live matches, limit abuse, investigate failures, prevent duplicate actions and enforce account restrictions.
- Improve quality: understand question performance, review reports and diagnose technical problems without behavioral advertising.
- Meet legal and safety duties: respond to valid requests, protect users and establish or defend legal claims where necessary.
The principal legal bases are performance of the service you request, legitimate interests in security, integrity and beta improvement, consent for optional notifications and beta communications, and legal obligations where they apply. Consent can be withdrawn without affecting earlier lawful processing.
Server rules automatically score answers, select matchmaking preferences, calculate in-game ratings and choose adaptive bot difficulty. These decisions affect game play and virtual progression only; they do not create legal or similarly significant effects.
What other players can see
Your display name, selected avatar and frame, visible level or rank, match results and leaderboard position may be shown to rivals or other signed-in players. Your email, authentication identifier, push token and private diagnostic information are not part of the public player profile.
Service providers and transfers
WitDuel uses a small set of providers to deliver the beta:
- Google Firebase: authentication and account identity.
- Neon: hosted PostgreSQL database in the Frankfurt region.
- Render: API and real-time service hosting in the Frankfurt region, including operational logs.
- Cloudflare: DNS, security, and hosting for the public and tester web surfaces.
- Expo: app builds, updates and optional push-notification delivery.
- Google Play and Apple: test distribution when their respective testing channels are used.
These providers process data under their own infrastructure and terms. Some provider operations may involve access from or transfer to countries outside Iceland or the EEA. Their published privacy terms describe the transfer mechanisms and safeguards they use; information about safeguards relevant to your data can also be requested through support.
We may also disclose information when required by law, to protect users or the service, or during a future reorganization of the project with appropriate notice and safeguards.
How long data is kept
Account, profile and gameplay records are kept while your account is active and while they are needed to provide history, rankings, integrity and safety. Beta registration is kept until you withdraw or the program no longer needs the record. Push tokens are kept until disabled, replaced or no longer useful. Short-lived rate-limit records expire automatically; hosting logs follow limited operational retention set by the hosting service.
When you delete your account, WitDuel removes the account email, profile, progression, beta registration, push devices and active play state. Completed-duel records are anonymized so another player’s result remains coherent. A minimal inactive identity tombstone and essential security or audit records may remain where needed to stop an old session from restoring erased data, preserve integrity, resolve disputes, or meet legal obligations. Provider backups and operational logs expire under their limited retention schedules.
Security
WitDuel uses authenticated requests, server-side authorization, encrypted HTTPS connections, bounded request bodies, rate limits, restricted admin operations and redacted diagnostic output. No online service can promise absolute security, but access and collection are deliberately limited to what the beta needs.
Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. You may also complain to the Icelandic Data Protection Authority (Persónuvernd) or another competent supervisory authority.
You can permanently delete your account in WitDuel under Profile → Account & privacy → Delete account. If you cannot access the app, follow the verified support path on the public deletion page.
Children
The closed beta is not directed at anyone who cannot lawfully agree to these terms or provide the permissions required in their country. If you are below the age of legal majority where you live, use WitDuel only with the involvement and permission of a parent or guardian.
Public website
The public site does not set advertising or behavioral-analytics cookies. Cloudflare may process standard connection and security information when serving the site. Links to the hosted tester and third-party services are governed by those destinations when opened.
Changes and contact
This policy may change as the beta gains new capabilities or moves toward public release. Material changes will receive a new effective date and, where appropriate, an in-product notice.
Controller contact: WitDuel / Witlio, Iceland — [email protected].
For independent information about data-protection rights, visit the European Commission privacy guide or Persónuvernd.