Privacy Policy

Last updated: 2026-10-20

This policy explains how FLAZZA processes personal data when you use flazza.com, the FLAZZA mobile app, and related gameplay services. For privacy requests, contact support@flazza.com. Arabic version: العربية.

1) Data we process

• You provide: name, email, password stored as a one-way hash, display name, avatar, interests, educational content you create, reports, feedback, and support messages.
• Apple: the app-specific Apple user ID and the name and email Apple lets you share (which may be a Hide My Email relay). We exchange the authorization code for a refresh token and store it encrypted so we can revoke access when you delete the account.
• Google: Google user ID, name, email, profile photo URL if provided, and email verification status. We use this only to sign you in. We do not request Gmail, Drive, Calendar, phone number, or location access.
• Guest play: a random device identifier and a guest record so scores, streaks, and level work without a real name or email.
• Gameplay: answers, results, answer times, points, level, badges, streaks, duels, invites, live sessions, blocks, and reports.
• Device and operations: IP address, device and OS type, app version, time zone, session identifiers, and security logs. Crash reports use a random session ID and are not linked to your player account.
• Notifications: the device push token, permission status, time zone, and reminder preferences if you enable notifications.
• Camera: used on-device only to scan a QR code to join a live session. We do not save or upload the image.

2) Purposes and legal bases

• Performing the service you request: accounts, sign-in, saving progress, play, leaderboards, duels, live sessions, and content.
• Consent when you choose a third-party sign-in, notifications, or optional data. You can withdraw consent in device settings or by deleting the account, unless another legal ground applies.
• Legitimate interests permitted by law to protect the service, prevent abuse, review reports, and measure stability, with regard to user rights.
• Legal obligations or a request from a competent authority.

3) What others can see

Other players see only your display name, avatar, results, ranking, duel performance, and other public play. We do not show your email or Apple/Google IDs. Avoid putting your real name or sensitive information in your display name if you do not want it public.

4) Service providers and disclosure

• Apple and Google: to verify identity when you choose that sign-in method.
• Google Firebase Cloud Messaging and Apple Push Notification service: to deliver notifications you allow. Firebase and Google Sign-In SDKs bundled in the app may process diagnostic data or technical identifiers as those SDKs declare, solely to operate sign-in and push delivery — not for advertising.
• Hosting, email, and infrastructure providers: to run, protect, back up, and support the service.
• OpenAI: only when you use the website content-generation tool; we send the prompt and content needed for that request, not sign-in credentials.

Any third party that processes user data on our behalf — including Apple, Google, Firebase, and our hosting, email, and infrastructure providers — will provide the same or equal protection of that data as stated in this policy and as required by applicable law and the App Store Review Guidelines. We do not sell your data and we do not use Google user data for ads, credit scoring, or surveillance.

Some processing may occur outside Saudi Arabia when a provider operates in another country, only as needed to provide the service and with appropriate safeguards. We may disclose specific data if required by law or by a competent authority.

5) Retention and deletion

• Account and progress data: for as long as the account exists or the service needs it, then deleted or detached from identity on deletion.
• Apple tokens: encrypted while the account is linked, revoked with Apple, then deleted on account deletion. We do not store a long-lived Google access token for sign-in.
• Crash and diagnostic sessions: not linked to the account; kept up to 90 days.
• Reports and moderation logs: for as long as needed to review reports, prevent abuse, document action, or meet a legal duty. Direct links to your account are removed on deletion; a display name and context may remain in a report filed by someone else.

You can delete an account or guest data immediately from Settings → Delete account in the app, or request deletion at the account deletion page. A successful in-app deletion removes operational data and disables the user record after personal fields are cleared.

6) Your rights

Under the Saudi Personal Data Protection Law, you may — subject to legal exceptions — be informed, access and obtain a copy of your data, request correction or completion, request destruction, and withdraw consent where consent is the basis for processing. Email support@flazza.com from the address on the account. We may verify that you own the account without collecting extra data. You may also complain to the competent data-protection authority in Saudi Arabia.

7) Children

The service is general audience and is not directed at collecting children’s data. Guests can play without an email. A minor should use the service with a parent or guardian and in line with the permitted age. Sign-in is optional and not required to play. If we learn we collected a child’s data contrary to law, we will take appropriate steps to delete it.

8) Security

We apply technical and organizational measures including encrypted transport, password hashing, token verification, encrypted Apple refresh tokens, session and permission limits, and data minimization. No transmission or storage is perfectly secure; we review controls and handle incidents as required by law.

9) Changes and contact

We may update this policy when the service or legal requirements change. We will update the date and give appropriate notice if a change is material. For privacy questions use the contact page or support@flazza.com.