Dibs
Privacy Policy
The short version. We collect what the game needs: your first name, the character you pick, your sign-in, the games you play and the proofs you take. Your photos and videos are seen only by the players of the game you sent them to. We do not sell your data, we show no ads and we do not track you across other apps. You can delete your account from the app at any time.
Who we are
Dibs is published by Mathieu Askamp, France ("we", "us"). We are the controller of your personal data. For any question or request about your data, write to us through the contact form.
What we collect
| Data | Why |
|---|---|
| Sign-in: an account identifier from Apple or Google, or your email address if you sign in with email. With Sign in with Apple you can hide your email; we then receive a relay address. | To create your account and let you sign back in. |
| Profile: your first name and the character you pick as your avatar. | To show other players who you are in the games you join. |
| Age: you enter your birth month and year on your phone. We keep only whether you are under 18, and an age range for usage analytics. Never your birth date. In Texas, Utah and Louisiana, we also ask Apple to confirm your age range (Declared Age Range); Apple shares the range, never your birth date. | Dibs is for ages 13 and up, and 18+ packs stay away from players under 18. |
| Game data: games you create or join, invite codes, cards you play and receive, answers, timers, jokers, points, reactions. | To run the game and keep scores. |
| Proofs: the photos and videos you take or pick to prove a card. | To show the players of that game that you did it. |
| Notifications: a push token for your device, and your notification choices. | To tell you when a card is played on you or a timer is about to end. |
| Purchases: whether you have Dibs+ and when it renews or ends. Apple or Google Play handles the payment; we never see your card details. | To unlock Dibs+ for you and the players of your games. |
| Safety: reports you send and players you block. | To review abuse and keep games safe. |
| Usage analytics: which screens you open and what you do in the game (for example a game created, a card played, a proof sent), with your account identifier, your age range (never your birth date), how you heard about Dibs, device model and app version. On by default. To object, write to us through the contact form: we then stop collecting events for your account and delete your usage data at Amplitude. Never your name, email, photos, videos or messages. On this website, page visits and button taps, with an approximate country and without cookies. | To understand what works, fix what does not and improve the game. |
| Technical logs: IP address, device type and request times, kept by our hosting provider for a limited period. | Security and fixing bugs. |
Dibs asks for your camera, microphone and photo library only when you take or pick a proof. We do not use advertising identifiers or ad networks, and we never track you across other apps or websites.
Who sees what
- Players of your games see your first name, your character, the cards you play on them, your proofs in that game, your reactions and your points. Proofs are never public and never shown outside the game they belong to.
- Our service providers process data only to run Dibs, under contract: Supabase (database, file storage, sign-in, servers, hosted in the European Union, Paris region), Apple (Sign in with Apple, push notifications on iPhone, App Store payments), Google (Sign in with Google, Google Play payments, Firebase Cloud Messaging for notifications on Android), Expo (delivery of push notifications, United States), RevenueCat (Dibs+ subscription status, United States), Amplitude (usage analytics, United States) and Vercel (this website, United States).
- Authorities, only when the law requires it.
We do not sell or share your personal data for advertising, as defined by the California Consumer Privacy Act or any other law.
International transfers
Your game data and proofs are stored in the European Union (Supabase, Paris region). RevenueCat, Amplitude, Expo, Vercel, Apple and Google may process some data in the United States. These transfers rely on the safeguards these providers offer under the GDPR: the EU-US Data Privacy Framework where they are certified, or the European Commission's Standard Contractual Clauses.
Legal bases (EU and UK)
- Contract: to provide the game you sign up for (account, profile, games, proofs, Dibs+).
- Legitimate interest: security, abuse prevention, fixing bugs, and measuring how the app is used to improve it (you can object at any time through the contact form).
- Consent: push notifications and device permissions, which you can withdraw in your device settings.
- Legal obligation: keeping purchase records when the law requires it.
How long we keep it
- Your account, profile and proofs: until you delete your account. You can find past games and their proofs in the app while your account exists.
- When you delete your account, we delete your sign-in, profile, push tokens and the photos and videos you posted. In games you played with others, your name is replaced with "Deleted player" so their scores still add up.
- Reports: up to 12 months after they are closed.
- Technical logs: kept by our hosting provider on its own short retention cycle.
- Usage analytics: kept while we use them to improve the game. Ask us through the contact form and we delete yours.
Your rights
You can access, correct, export or delete your data, object to or restrict its use, and withdraw consent. Most of it you can do in the app (Profile). For anything else, use the contact form; we answer within 30 days. If you are in the EU, you can also complain to your data protection authority (in France, the CNIL, cnil.fr). California residents have the right to know, delete and correct their data, and we do not discriminate against anyone who uses these rights.
Delete your account
In the app: Profile, then Delete account. Full steps on the delete your account page. Deleting your account does not cancel a Dibs+ subscription billed by Apple or Google Play: cancel it in your iPhone Settings (your name, then Subscriptions) or in the Play Store (Payments and subscriptions, then Subscriptions).
Security
Data travels encrypted (HTTPS). Proofs are stored in private storage and are only served to the players of their game. Access to the database is restricted to what each player is allowed to see.
Young players
Dibs is for ages 13 and up. Players under 18 never see 18+ packs such as Spicy, and those packs are never offered in a game with a player under 18. If you live in Texas, Utah or Louisiana, you must be 18 or older for now. If you believe a child under 13 uses Dibs, tell us through the contact form and we will delete the account.
Changes
If we change this policy, we update the date above and tell you in the app when the change matters.