Privacy Policy
Last updated: 15 September 2026
1. Who we are (data controller)
Squimbo is a Discord Activity party game and marketing website operated by Rafał Szołtysik, a sole proprietor established in Poland (NIP 9691672125), ul. Wolna 35, 44-187 Wielowieś, Poland (“we”, “us”, “operator”).
For personal data processed in connection with Squimbo, Rafał Szołtysik is the controller under Regulation (EU) 2016/679 (GDPR) and the applicable Polish data protection law. This policy also explains how we handle privacy expectations for users in the United States.
2. Scope
This policy covers (a) playing Squimbo inside Discord (the Activity and related game API), and (b) visiting squimbo.app or other Squimbo marketing pages we operate. Discord is a separate controller for Discord accounts, voice, and platform features. Your use of Discord is also governed by Discord’s own privacy policy and terms.
3. Personal data we process
Depending on how you use Squimbo, we may process:
- Discord identity used to run the game: Discord user id, display name, and avatar URL obtained through Discord’s OAuth / Embedded App authentication flow.
- Game and session data: Activity instance id, optional Discord channel/guild ids, room membership, round state, votes (who voted for whom), scores, player intent signals, and related timestamps.
- Technical session data: a short-lived Squimbo session token issued after Discord verifies your identity (used to authorize game API calls). We do not store Discord access or refresh tokens in game responses or on this website.
- Website analytics (marketing site only): page views, approximate device/browser information, referrer, and related product-analytics events via PostHog (EU cloud) and Vercel Analytics. Session replay may be enabled for marketing pages where configured.
- Support correspondence: if you email us, the content of your message and contact details you provide.
4. Purposes and legal bases (EEA / UK / Switzerland)
We process personal data for these purposes and GDPR legal bases:
- Providing the Activity (sign-in after Discord verification, room membership, voting, scoring, session continuity): Art. 6(1)(b) GDPR (performance of a contract / steps requested by you to use the service).
- Operating, securing, and troubleshooting the service (abuse prevention, integrity of votes/rooms, service reliability): Art. 6(1)(f) GDPR (legitimate interests). You may object where applicable.
- Website analytics and product improvement on marketing pages: Art. 6(1)(f) GDPR (legitimate interests) and, where required by ePrivacy / local cookie rules for non-essential cookies or similar technologies (including certain analytics or session replay), Art. 6(1)(a) GDPR (consent).
- Responding to support or privacy requests: Art. 6(1)(b) or (f) GDPR, and Art. 6(1)(c) where we must comply with a legal obligation.
- Complying with law, enforcing terms, or establishing/defending legal claims: Art. 6(1)(c) and/or (f) GDPR.
5. Sharing and processors
We do not sell personal data and we do not share game data with advertisers. We use service providers that process data on our instructions to run Squimbo, including:
- Discord Inc. / Discord affiliates: identity verification and hosting the Activity inside Discord.
- Vercel Inc.: hosting of the marketing site and related infrastructure / analytics.
- PostHog (EU region where configured): product analytics for the marketing site.
- Database and infrastructure hosts for the game API and PostgreSQL storage (configured for production deployment).
These providers may process data in the EU and/or other countries where they operate. Where a transfer outside the EEA/UK occurs, we rely on appropriate safeguards such as the provider’s Standard Contractual Clauses or an adequacy decision, as applicable.
6. Retention
We keep personal data only as long as needed for the purposes above:
- User profile fields tied to Discord identity (discord id, display name, avatar URL): retained while you may return to play and for ongoing product features that rely on history; deleted or anonymized on a verified deletion request unless we must retain a subset for legal claims or compliance.
- Rooms, rounds, votes, and scores: retained to operate sessions and preserve game history (including future product features such as profiles). You may request deletion of your linked history.
- Squimbo session tokens: short-lived; expire according to our API configuration.
- Marketing analytics: retained according to our PostHog / Vercel retention settings (typically up to 12-24 months unless deleted earlier).
- Support emails: typically up to 24 months after the last message, unless a longer period is needed for an ongoing matter.
7. Security
We use technical and organizational measures appropriate to the risk, including HTTPS in transit, server-side authorization for game actions (membership / session checks), minimized API responses, and short-lived session tokens minted only after Discord verifies identity. No method of transmission or storage is perfectly secure.
8. Your rights (EEA / UK / Switzerland)
Subject to GDPR and local law, you may have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.
To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with a supervisory authority. In Poland, that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl). You may also contact the authority in your country of residence.
9. United States privacy notice
If you are a resident of a US state with a comprehensive privacy law (including California under the CCPA/CPRA, and similar laws in states such as Virginia, Colorado, Connecticut, Utah, and others as they apply), we provide the following notice.
Categories of personal information collected in the last 12 months may include identifiers (Discord user id, display name), internet / network activity (site analytics), and inferences are not used to profile you for advertising. We collect this information from you (via Discord auth and your use of the Activity/site) and from our analytics providers.
We use personal information to provide Squimbo, secure the service, communicate about support requests, and understand marketing-site usage. We do not sell personal information and we do not “share” it for cross-context behavioral advertising as those terms are defined under California law. We do not use or disclose sensitive personal information for purposes that require a right to limit under the CPRA, beyond what is necessary to provide the service.
Depending on your state, you may have rights to know/access, delete, correct, and obtain a portable copy of certain personal information, and to appeal a denied request. We will not discriminate against you for exercising privacy rights. Submit requests to the contact email below. We may need to verify your identity (for Discord-linked data, we may ask you to demonstrate control of the relevant Discord account or provide enough detail to locate your records). Authorized agents may submit requests where state law allows, subject to verification.
10. Children
Squimbo is intended for users who are allowed to use Discord and to participate in the channel where the Activity is launched. We do not knowingly collect personal data from children in violation of applicable law (including COPPA in the United States or age rules under GDPR). If you believe a child has provided us data unlawfully, contact us and we will take appropriate steps.
12. Contact
Privacy questions and data-subject requests: use the contact options on the Support page. Postal address: Rafał Szołtysik, ul. Wolna 35, 44-187 Wielowieś, Poland.
13. Changes
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be highlighted on the website or within the Activity where practical. Continued use after an update means you acknowledge the revised policy, except where consent is required by law.