1. Data controller

The controller of the data collected through the Dareo app and the getdareo.com website is:

• Fibroweb, TO COMPLETE: legal form
• Address: TO COMPLETE: postal address
• SIRET: TO COMPLETE: SIRET number
• Contact: contact@getdareo.com

For any question about your personal data, write to us at this address.

2. Data we collect

You can play without creating an account (guest mode). Depending on what you use, we process the following data, and only this data:

Account and profile

• Account: if you save your account with Apple or Google, the sign-in identifier and the email address that provider sends us (with Apple, this may be a private relay address). A guest has no email address: we only know their internal identifier.
• Username: chosen by you, visible to other players.
• Date of birth: asked only once, at sign up, and not editable afterwards. It is only used to calculate your age: to check that you are at least 13, to never put you in contact with someone from another age group (minor or adult) and to reserve some features for players 16 and up. It is never shown to other players.
• Gender and country: optional. They are only used for opponent filters (gender filter for adults only) and the country leaderboard.
• Bio (80 characters maximum) and profile picture (optional): visible to other players.
• Settings: notification preferences, maximum intensity, blurring, language, leaderboard visibility, who can challenge you, time zone.

Game and interactions

• Answers to challenges: your written answers, your "I did it" confirmations and your reactions, visible only to your opponent in that match.
• Dare photos: taken with the camera inside the app (never from your gallery), visible only to your opponent, blurred on arrival by default. They are deleted automatically after 30 days, and you can delete them earlier from your history.
• Messages: text messages exchanged in the chat with a player you finished a match with.
• Reports and blocks: reports you make or that concern you (reason, details, match, message or challenge concerned) and the list of players you blocked.
• Progress: matches played, results, level, badges, streak, coins and coin history, referrals.
• Dare links and QR codes: the links you create (vibe, hook, duration) and their statistics (scans, installs, matches).

Technical data

• Hashed IP address, for dare links: when someone opens a dare link in their browser, we record a hashed (irreversible) fingerprint of their IP address and browser. It is used to count unique scans and to find the dare when the app is opened right after being installed. It is deleted automatically after 48 hours.
• Notification tokens: if you allow notifications, a device token used to send them to you.
• Purchases: for coin packs, the product bought, the date and the transaction identifier, sent by the App Store or Google Play through our provider RevenueCat. We never see your payment details.
• Error reports: when the app runs into an error, a technical report (error message, system, app version, account identifier) is sent to us. Our servers also keep technical logs (including IP addresses) for the security of the service.
• Support exchanges: the content of the emails and contact form messages you send us (name, email address, subject, message).

We do not collect your location, your contacts, your photo gallery or your microphone. The getdareo.com website uses no cookies, no audience measurement tool and no tracker.

3. Why we use it, and on which legal basis

Your data is never sold, rented or used for advertising or advertising profiling.

4. Who sees what

• All players: your username, profile picture, bio, level and badges, and your leaderboard position if you left it on. Your dare link also shows your username, picture and hook to anyone who opens it.
• Only your opponent: your answers and photos from the match, your reactions, and the messages you send them.
• Nobody: your date of birth, your email, your gender and your country (only used for filters and the country leaderboard).
• Us, when something is reported: the reported content (answer, photo, message, profile), for moderation.

5. Our service providers (processors)

We use the following providers, who process some data on our behalf, only on our instructions and in compliance with the GDPR:

For payments, Apple and Google act as sellers and separate controllers: their own privacy policies apply.

Transfers outside the European Union

Some of these providers are based in the United States. These transfers are covered by the EU-U.S. Data Privacy Framework when the provider is certified, or otherwise by the standard contractual clauses adopted by the European Commission.

6. How long we keep it

• Account, profile, progress and messages: as long as your account is active. After a deletion request, the account is deactivated immediately, your username is replaced with a neutral placeholder and your data is permanently purged within 30 days, backups included.
• Dare photos: 30 days maximum, then automatic deletion. You can delete them earlier from your history.
• Answers in a match: as long as the match stays in your history; deleting a match (or your whole history) erases your answers and photos, for you and for your opponent.
• Hashed IP fingerprint of dare links: 48 hours.
• Reports: while they are handled, then 1 year maximum to deal with repeat offenses, unless a longer retention is required by law.
• Notification token: until notifications are turned off, you sign out or the account is deleted.
• App error reports: 30 days. Server technical logs: 12 months maximum.
• Support exchanges: 3 years after the last exchange.
• Transaction records: 10 years, for accounting obligations (Article L123-22 of the French Commercial Code). Purchase invoices themselves are issued and kept by Apple or Google.

How to delete your account is explained on the Delete my account page.

7. Minors

Dareo is open from age 13. Many players may therefore be minors, and the service is designed accordingly:

• Minimum age: under 13, sign up is refused and the data entered is deleted.
• Minors and adults are never put in contact: a player aged 13 to 17 never plays or chats with an adult, in any mode (new players, QR, link, rematch, chat). This check is done by our server, not by the phone.
• Matches with new players and the CHAOS vibe: reserved for players 16 and up with an account. Players aged 13 to 15 only play with their friends (link, QR, rematch), always within their age group.
• Photos: taken only inside the app, blurred on arrival (always for a minor, and this blurring can't be turned off), deleted after 30 days. No sexual or dangerous content, and nothing involving another person, is allowed.
• Chat: text only, opened only after a match finished together. For minors, phone numbers, email addresses, links and social media handles are filtered out.
• Moderation and reporting: every match, answer, profile and message can be reported and its author blocked. Reports are reviewed by our team; three separate reports within 7 days suspend the account pending review.
• No advertising, no geolocation.

For data processed on the basis of consent (optional fields, notifications), a minor under 15 living in France can't consent alone: the joint consent of a holder of parental authority is required (Article 45 of the French Data Protection Act). These fields are never required to play.

A minor can exercise their rights themselves. A parent or guardian can also write to contact@getdareo.com to request access to or deletion of their child's data. If you believe a child under 13 is using Dareo, let us know: we will delete the account.

8. Your rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

• right of access to your data and to obtain a copy;
• right to rectify inaccurate data (except the date of birth, which can only be corrected on a justified request to support);
• right to erasure (deleting your account, a match or your history);
• right to restriction of processing;
• right to data portability;
• right to object to processing based on our legitimate interest;
• right to withdraw your consent at any time (optional fields, notifications);
• right to set guidelines for what happens to your data after your death.

To exercise these rights, write to contact@getdareo.com with your username (and, if you have an account, from the email address of your Apple or Google account). We answer within one month at most. We may ask you to prove your identity if there is reasonable doubt.

Complaint to the CNIL

If, after contacting us, you believe your rights are not respected, you can file a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr. You can also contact the data protection authority of the EU country where you live.

9. Security

Exchanges between the app and our servers are encrypted (HTTPS). Photos are only accessible to the two players of the match, the IP address of dare links is only kept in hashed form, access to data is limited to the people who need it, and our providers are chosen for their security guarantees. As no system is infallible, we will inform you and the CNIL of any data breach likely to put you at risk, under the conditions set by the GDPR.

10. Changes

We may update this policy, in particular when we add a feature or a provider. The date of the last update is shown at the top of this page. If there is a significant change, we will let you know in the app.

11. Contact

For any question: contact@getdareo.com or the Help & contact page.