1. Who is responsible
Hallingcast AS, Torpomoen 27, 3579 Torpo, Norway, is the data controller for personal data processed in the Headit app and on headit.app. Contact: support@headit.app.
2. What we collect
- Account data. A randomly generated account ID (your Player ID), your username, avatar, room and language. A guest account needs nothing else. If you register with email, we also store your email address. If you sign in with Apple or Google, we receive an identifier from that provider and the email address you choose to share (Apple may give us a private relay address). Google also sends the name and profile picture from your Google account; we discard them on arrival and do not store them. For Sign in with Apple we also store a token issued by Apple, used only to revoke your Apple sign-in when you delete your account. We never receive your password from those providers.
- Profile picture (optional). You can add a photo from your camera or photo library. It is cropped to a square and shrunk on your device before upload, stored under a random file name, and shown to other players only after it has passed automatic image moderation (see section 5). Until then only you can see it. A photo that fails moderation is deleted at once; we keep only a note of the category it failed on. You can remove the photo at any time, and a moderator may remove a photo that breaks our rules. The photo is never shown on headit.app invite pages. A photo can reveal information about you — please do not upload a photo of anyone else, and do not upload anything you would not want a rival to see.
- Your username is public. Your rivals see it at the table, and anyone who opens an invite link you created sees your username and avatar on headit.app. Usernames are checked by an automatic filter, and attempts to set a name are logged for 7 days to prevent abuse. A moderator may replace a name that breaks our rules.
- Gameplay data. Your matches; the questions, answers and guesses you type; messages you send in the chat at a table; hints and boosters; coin balance and transactions; items you own; and invite links you create, so the game can work between you and your rivals. Questions, guesses and chat messages are free text that your rival can read — please do not write personal information in them. Chat messages belong to the table and are removed together with it. You can turn the chat off for yourself in Settings.
- Moderation data. If you report a player, we store the reasons you chose, your optional comment, the reported player's username at that moment, and the match, question, guess or chat message the report concerns (for a chat message we keep a copy of its text so a moderator can assess it). We also store the players you block; a record when the automatic filter stops a question, guess, chat message or name (kept as a one-way fingerprint, not the text itself); and actions taken by moderators.
- Push tokens. A device token so we can tell you when it is your turn (Firebase Cloud Messaging).
- Technical data. A Firebase installation identifier, used to deliver push notifications and the app's configuration (Firebase Remote Config); your IP address and device type, stored with your sign-in sessions and in our providers' server logs for security and troubleshooting.
- Usage and crash data — only with your consent. Collected only if you choose Accept all when you first open the app, or later turn on Share usage and crash data in Settings: app events and screens viewed, device model, operating system version, app version, language, approximate country (derived from your IP address), an app installation identifier generated by Firebase, and crash reports. This data is linked to your Player ID so that we can connect a crash to what happened before it. We do not collect your device's advertising identifier (IDFA or Android advertising ID).
- Purchase data. What you bought, the price and currency, the store, transaction IDs and the time of purchase. RevenueCat validates purchases with the App Store or Google Play and passes this to us so we can credit what you bought and handle restores. We never see your card details.
- Messages to support. If you email us, we receive your email address, your message and anything you include (such as your Player ID), so we can answer you.
- Invite codes. If you open an invite link, the invite code is read from the link or from the install referrer so we can seat you at the right table. On iOS, on first launch after installation, the app checks the clipboard once for a Headit invite link. The link is placed there by headit.app when you tap the App Store button on an invite page. iOS asks for your permission before the app reads it; nothing else is read or stored.
3. Why we process it, and our legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account and gameplay data, including your public username | Running the game, seating you with rivals, keeping your progress, sign-in | Performance of our contract with you — Art. 6(1)(b) |
| Push tokens | Telling you when it is your turn | Consent, given through the system notification prompt — Art. 6(1)(a) |
| Usage and crash data | Fixing bugs, measuring whether features work, improving the game | Consent, given in the app — Art. 6(1)(a). This consent also covers storing and reading the analytics identifiers on your device. |
| Account and gameplay data, in aggregated form | Statistics on how the game is used — for example how many players return after a day or a week — so we can improve the game | Legitimate interest in understanding and improving the Service — Art. 6(1)(f) |
| Purchase data | Delivering what you bought, restoring purchases, accounting | Contract — Art. 6(1)(b), and legal obligation for accounting records — Art. 6(1)(c) |
| Technical data | Delivering notifications and app configuration, keeping sign-in secure, troubleshooting | Performance of our contract — Art. 6(1)(b), and legitimate interest in a secure service — Art. 6(1)(f) |
| Support emails | Answering your questions and requests, including privacy requests | Performance of our contract — Art. 6(1)(b), and legal obligation for privacy requests — Art. 6(1)(c) |
| Profile picture | Showing you to the players you share a table with | Consent — Art. 6(1)(a). You choose whether to upload one; playing does not depend on it. |
| Automatic image check | Keeping the game safe and meeting app store requirements | Legitimate interest in a safe service — Art. 6(1)(f) |
| Moderation data and the username filter | Keeping the game safe, preventing abuse, handling reports | Legitimate interest in a safe service for all players — Art. 6(1)(f) |
These statistics are calculated from our own game database and show totals and percentages only. They are not used to build profiles of individual players, and no data is shared with third parties for this purpose.
Where we rely on consent, you can withdraw it at any time: turn off notifications in your device settings, or turn off Share usage and crash data in the app under Settings. Playing does not depend on either. Withdrawing consent does not affect processing that already happened.
4. What we do not do
We do not sell your personal data. We do not use it to build advertising profiles about you, and we do not track you across other companies' apps and websites.
There is no advertising in the app, and we do not collect your device's advertising identifier. If we ever introduce ads, we will update this policy first and explain what the ad provider receives.
5. Who processes data for us
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Supabase | Database, authentication, server functions | European Union (Ireland) |
| Google Firebase | Push notifications, analytics, crash reporting, remote configuration | United States and EU |
| Google Cloud Vision | Automatic moderation of profile pictures (nudity, racy and violent content). Receives the picture only to classify it; it is not kept or used to train models. | United States and EU |
| RevenueCat | In-app purchase validation and receipt handling | United States |
| Microsoft 365 | Our mailbox for support requests | Europe |
| Cloudflare | Hosting headit.app and invite pages; forwarding email sent to support@headit.app | Global edge network |
Each of these processes data on our behalf under a data processing agreement. We do not give them permission to use your data for their own purposes.
Apple (App Store, Sign in with Apple) and Google (Google Play, Sign in with Google) are independent controllers for your store account, payments and sign-in. Their own privacy policies apply to that data.
6. Transfers outside the EEA
Some of our providers are based in the United States, which means your personal data may be transferred outside the European Economic Area.
Where that happens, the transfer is covered by one of the following safeguards: the provider is certified under the EU–US Data Privacy Framework, or we have entered into the European Commission's Standard Contractual Clauses with them, together with additional technical measures such as encryption in transit and at rest. You can ask us for details of the safeguard used for a particular provider.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and gameplay data | For as long as your account exists. When you delete your account, it is removed from our database at once — including the matches you took part in, for both players. |
| Guest accounts | Deleted automatically after 24 months without activity (no sign-in, app use or match activity). |
| Username attempts | 7 days. |
| Profile picture | Until you remove or replace it, a moderator removes it, or you delete your account. The previous picture is deleted when you upload a new one; a picture that fails moderation is deleted at once. Attempts to change the picture are logged for 7 days to prevent abuse. |
| Push tokens | Until the token stops working, is replaced by a new one, you turn notifications off for Headit on your device (removed the next time you open the app), or you delete your account. |
| Sign-in sessions | Until you sign out, the session expires, or you delete your account. |
| Server logs | A few days, as set by our providers. |
| Apple sign-in token | Until you delete your account; it is then revoked at Apple and deleted. |
| Crash reports | Up to 90 days. |
| Analytics events | Up to 14 months. |
| Purchase and accounting records | Five years after the end of the financial year of the purchase, as required by the Norwegian Bookkeeping Act — in our records and at RevenueCat. If you delete your account, the purchase record is kept for this period but detached from your profile. |
| Reports, filter records and moderator actions | Up to 12 months. Reports and filter records are deleted earlier if the account of the reporter or the reported player is deleted. |
| Support emails | As long as needed to handle your request and any follow-up. |
| Blocked players | Until you unblock the player or either account is deleted. |
Analytics and crash data are stored by Firebase under your Player ID, separately from your account. They are not deleted when you delete your account, because once the account is gone the Player ID is no longer linked to you or to anyone else — the remaining events are a random identifier with no name, email or device contact behind it, and we have no way to tell whose they were. They expire by themselves: analytics events after 14 months, crash reports after 90 days. You can stop new data from being collected at any time by turning off Share usage and crash data in Settings.
Backups are overwritten on a rolling cycle and may briefly contain deleted data before they are replaced.
8. Your rights
You can export your data and delete your account directly in the app under Settings. You can change your username in your profile and manage blocked players in Settings.
Under the GDPR you also have the right to access your data, have it corrected, have it erased, restrict or object to how we process it, and receive it in a portable format. For anything you cannot do in the app, email us and we will respond within 30 days.
So that we can act on a request sent by email, we need to identify your account. If you have a registered account, write from the email address on the account. If you play with a guest account, include your Player ID, shown in the app under Settings. A guest account holds no email address or other contact details, so without a Player ID we cannot identify it — it is then deleted automatically after 24 months without activity, as described in section 7.
If you think we have handled your data wrongly, you can complain to your national data protection authority. In Norway that is Datatilsynet (datatilsynet.no); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).
9. Children
Headit is not directed at children under 13, and we do not knowingly collect personal data from them. Where the country you live in sets a higher minimum age for consenting to online services on your own, that age applies instead.
Do not upload a photo of a child as your profile picture, including your own child.
If you believe a child below that age is using the Service, contact us and we will remove the account and the data associated with it.
10. Security
Data is encrypted in transit and at rest. Access to the production database is restricted to named administrators and protected by two-factor authentication. Game state is written through server-side functions rather than directly by the app, which limits what a compromised device can change.
No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and Datatilsynet as required by law.
11. Changes to this policy
We may update this policy as the game develops — for example when new features or ads are introduced. Material changes will be announced in the app or on this page before they take effect. The date at the top shows when it was last revised.
12. Contact
Hallingcast AS · Torpomoen 27, 3579 Torpo, Norway