Your memories belong to you

Controller and providers

Dominik Mraček is the controller for creating and running games, orders and support. Cloudflare hosts content and technical data under data-processing terms; it determines the purposes of its own security and operational logs. Stripe, Apple, Google, Meta and Resend provide payment, distribution, advertising and email services and may determine purposes for parts of their processing. We share only data needed for each feature. Contact arcflare99@gmail.com for privacy requests.

Game data and legal basis

To create a game we process names or nicknames, memories, questions and answers, photos, gift and message, creation time and acknowledgements of rules and rights to content. Creator data needed for the requested service is used to fulfil the agreement. Paid orders additionally include contact email, amount, order and payment identifiers, receipts, payment, activation, termination and refund times, withdrawal notices and terms version. Our app does not receive or store card numbers or CVC. Game-recipient data comes from the creator. For ordinary private photos and memories we rely on a legitimate interest in providing the expected private surprise; affected people must be informed before upload. Do not upload intimate material, sensitive data or children's data. We do not profile people; affected persons can object and request deletion.

People shown in a game

If you are the recipient or appear in a game, your data came from its creator and may include a name, ordinary photo, memory and answer progress. We use it only to create, provide and secure that private game, not for ads or profiling. Depending on circumstances the basis is performance of the requested service and legitimate interest. You see this notice when first opening the game. To object or request erasure, email us with a link or other way to identify the game safely. Erasure may end it for others; we cannot delete copies saved on other people's devices.

Photos and text generation

Photos are reduced to JPG in the browser, with original metadata removed. Photos never go to the text-generation provider. If you start generation, a text brief, including photo captions and any names, memories, gift or mood you enter, is sent through OpenAI's API. We do not send photos, contact email or order data there. A Cloudflare queue processes the brief; a result remains in D1 for at most two hours so you can return from another app using a random secret token. We do not set the provider's own retention period. Do not include intimate, sensitive or children's data; you can use nicknames and edit the result before ordering.

Hosting and access

The website runs on Cloudflare Workers, stories in D1 and photos in R2. Cloudflare, Inc. in the US may process IP and technical access data and may transfer data internationally under its policies. The app does not build ad profiles. Content is not end-to-end encrypted; the operator and infrastructure provider may technically access it. Games are not publicly listed. A long random link and creator-chosen password protect new games; we keep only a slow salted password hash. Successful entry creates a temporary unlock token. Anyone given the link and password may pass them on. Keep the admin deletion link private. This cannot prevent saving content already shown.

How long data remains

A paid game may await activation for up to 30 days after payment, then remains available for a new period of up to 30 days. An unpaid order closes when its payment link expires and content is removed during cleanup. A free game remains available up to 30 days after saving. Once the server verifies the last task and opens the finale, access ends within three days, even if the browser closes. Replays do not extend the deadline. The recipient or creator may delete it earlier. Older games without this rule retain their original availability; previews do not start the timer. Server cleanup runs every minute, with a fallback when a new game is created; after errors, access stays blocked and deletion is retried. Backups and infrastructure logs follow provider terms; downloaded copies cannot be erased remotely.

Payments, emails and records

For 30 days after a game ends we keep a support record with game ID, admin-token hash, finale-unlock time if any, termination time and reason, and deletion deadline. It contains no names, story, photos or answers and is used to show status and resolve support requests on a legitimate-interest basis. A finale-unlock record does not prove it was read or that the game was defect-free. Separate paid-order records and invoices remain after game deletion. Stripe handles web payments and invoices; Apple and Google handle in-app purchases. Resend emails order confirmations, terms and private order links without open or click tracking. Providers may process data outside the EEA under their stated transfer mechanisms. Unpaid orders and copies of operational emails are deleted within 30 days. Minimal paid-order, terms and consent records remain for three years after termination to resolve claims, longer only where law or a dispute requires. Invoices and accounting or tax records follow statutory retention periods.

Cookies and measurement

Without consent we do not use advertising or analytics cookies, tracking pixels or visitor IDs. Browser storage may keep consent choices, a private pending-order link, a temporary game-unlock token (not the password), an editor draft and reduced photos. An essential dd_bundle30_claim cookie uses a random token for up to 90 days to preserve a claimed bundle code; local storage may retain the code and whether the 30% offer was already shown. These are not used for ad tracking. The server counts daily landing loads from /fb, tagged Meta/Facebook links or Facebook/Instagram referrals without storing IP, device, full referrer or click ID. These are loads, not unique people or verified sales; daily counts older than 400 days are removed. With separate optional consent, anonymous campaign totals may include source, medium, campaign, visits, editor starts, checkouts and completions. Meta Pixel loads only with its own permission and may receive page views, checkout starts and server-confirmed purchases with amount, currency and random order ID, not names, email, game text or photos. You can change both choices below.

If you consent to analytics and open a sample game, we create a random ID for that single session to connect its progress. We record which sample game you opened, the chapter and step reached, main actions, active time and last activity. This measurement stores no IP address, email, names, answers or game text. Detailed session records are deleted within 90 days; only totals without a session ID may remain. Counts represent consenting sessions, not unique people. A hidden page or final activity does not prove that you closed the tab. Without consent we do not run this measurement; you can change your choice below.

Reviews and your rights

Only holders of a private paid-order link or players who finished a paid game can submit a review. We store display name, stars, text, order link and consent time. Only approved name, stars and text appear publicly; consent may be withdrawn by email. Facebook sharing happens only when clicked. Under the GDPR you may request access, correction, erasure, restriction or portability, object to legitimate-interest processing and withdraw consent for future processing. We generally respond within one month, may reasonably verify the relevant content and will inform you of a lawful extension. You may complain to the Czech Data Protection Authority (ÚOOÚ).

Contact forms and finale attachment

If you use Contact us or Report a bug, your name, reply email, subject and message go through Resend to our contact inbox. A bug report can also contain an order number and page path, without URL parameters or secret fragments. We do not store the message in the game database. It remains in our mailbox as needed to handle the request and related correspondence. To limit abuse, we store a one-way IP hash and submission count, never the IP address or message text in that record. Scheduled cleanup removes records older than 48 hours.

An optional image or PDF attached to the final letter is stored as the original file and may retain its metadata. The recipient can access it only after unlocking the finale. It is deleted with the game and is not sent to the text-generation provider.