Privacy Policy

This policy explains which personal data we collect when you play Bela Online, why, how long we keep it and what your rights are under the General Data Protection Regulation (GDPR) and the Croatian act implementing it.

1. Who the controller is

[Ime i prezime ili naziv obrta/tvrtke], [Ulica i broj, poštanski broj i grad], Hrvatska.
For any privacy question write to [kontakt@domena.hr]. We have not appointed a data protection officer because it is not required for our size and type of processing.

2. What data we collect

Account

• Email address and, if you register with email, a password (we only store a cryptographic hash, never the password itself).
• If you sign in with Google or Apple: your account identifier at that provider, your email address, and your name and profile picture if the provider sends them. With Apple you can hide your real address; we then only receive Apple's relay address.
• When you registered and last signed in, and whether your email address is confirmed.
• A record of accepting the terms: terms version, time of acceptance and confirmation that you are at least 16.

Profile

• Username, chosen avatar and frame.
• If you enter them: country, city and a short description.
• Game statistics: games played, won, lost and abandoned.
• Bela lessons: completed lessons and the last progress update time linked to your account, and the reward earned for completing the lessons.
• Look: the table, cards, card back and frame you chose, and the items you own.
• Coins: your balance and a list of every change (game earnings, daily bonus, purchases), with times.

Games and chat

• Games: table, seat, moves, declarations, results and times.
• Messages you send in the table chat: text, sounds and voice messages.
• Practice without an account: the game against the bots, a random guest key (also kept in your browser) and your IP address, only to limit the number of tables per network.
• Playing as a guest at a table you were invited to: a random guest identifier (an anonymous sign-in with Supabase, without email or password), the nickname you type, and games and messages as for an account. Guests earn no coins or items and have no public profile.
• Abuse reports you send or that concern you.
• Messages you send us from Settings (a bug, an idea): the text, the page you wrote from, your browser and, if you enter it, an email for our reply.
• Players you have blocked.

Technical data

• IP address, browser and device type, request times and error records (server logs).
• Error reports (Sentry): when the app or server hits an error, the error and where in the code it happened, the page, the last few clicks and requests before it, browser and device type, and your player ID. No name, email, IP address, chat content or anything you typed.
• Data stored in your browser, described in the Cookie Policy.

Usage statistics, only with your consent

• If you turn on "Usage statistics" in the cookie banner: which pages you open, what you click, game events (e.g. table opened, game started and finished, result, number of bots), browser and device type, country and city estimated from your IP address (we do not store the IP address itself) and your player ID.
• If you also turn on "Session recordings": a record of how the page changed while you used it, like a screen video. All input fields, chat and email are masked and never recorded.

We do not collect payment data, precise location or contacts. We do not show ads, sell data or build marketing profiles.

3. Why we process it and on what basis

Without account data we cannot provide the service. We make no decisions based solely on automated processing that have legal or similarly significant effects on you. Bots and matchmaking are only used to play.

4. Who sees your data

• Other players see your username, avatar, profile details, statistics, your moves in shared games and your chat messages. They do not see your email address.
• Processors who handle data for us under a contract and our instructions:

• Google and Apple, if you sign in with their account. They are separate controllers for the data on their side; their privacy policies apply.
• Competent authorities, only when the law requires it.

When data is transferred outside the European Economic Area we only do so with the safeguards of GDPR chapter V (an adequacy decision such as the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses). You can ask us for a copy by email.

5. How long we keep data

• Account, profile, statistics and the terms acceptance record: as long as you have an account.
• Learning progress: until you reset it or delete your account. Resetting progress does not remove an already earned reward.
• Game history: as long as you have an account. When you delete your account, games others played with you only keep a "Bivši igrač" (former player) label with no link to you.
• Coins, bought items and your chosen look: as long as you have an account. They are deleted with it.
• Blocked players and the messages you sent us: while you have an account, deleted with it.
• Chat messages: we do not store them. A table only shows its last 30 messages, and they disappear when the table closes.
• Voice messages: the microphone turns on only when you tap the record button and turns off as soon as you finish. The recording (15 seconds at most) goes through our server straight to the players at the table and is never stored; they keep it only while they are at the table.
• Practice without an account: never written to the database. The game exists only in the server's memory and is gone when the table sits idle for half an hour or the server restarts; the guest key and IP address are gone at most a day after you last played.
• Guests at a friend's table: the identifier and nickname are deleted 30 days after you sat down as a guest, and the games keep only the label "Bivši igrač" (former player). If you make an account on the same device within that time, the guest becomes that account and the games stay yours.
• Server logs: 30 days.
• Error reports: at most 90 days.
• Usage statistics: at most 12 months, session recordings 30 days. When you withdraw consent we stop recording and delete the data in your browser; when you delete your account we also delete your data in PostHog.
• Backups: overwritten within 30 days.
• Data we must keep by law or for a dispute: as long as that obligation lasts.

6. Your rights

You have the right to:

• access your data and get a copy (art. 15),
• have inaccurate data corrected (art. 16),
• erasure (art. 17),
• restriction of processing (art. 18),
• data portability, i.e. your data in a machine-readable format (art. 20),
• object to processing based on legitimate interest (art. 21),
• withdraw consent at any time where processing is based on it, without affecting earlier processing.

You can do most of this right away in your account settings: download all your data as a JSON file and permanently delete your account. For anything else write to [kontakt@domena.hr]. We answer within one month; for complex requests this can be extended by two more months, and we will tell you. We may ask you to confirm that the account is yours.

If you believe we process your data unlawfully you can lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr, azop.hr, or with the authority in your EU country. We would appreciate hearing from you first so we can try to sort it out.

7. Age

Bela Online is for people aged at least 16. If we learn that an account belongs to someone younger, we will delete it. If you are a parent and think your child has an account, contact us.

8. Security

All communication is encrypted (HTTPS). Passwords are only stored as hashes, only the game server can access the database, and administrative access is restricted and protected. If a data breach could put your rights at risk, we will notify the supervisory authority and you as the law requires.

9. Changes

We will update this policy when the way we work changes. We will tell you about material changes in the app or by email before they take effect. The date of the last change is at the top of the page.