Privacy Policy

Izan Carlo Celis Afonso, based in Spain. Contact for any privacy matter: hola@betweengame.com.

This policy complies with Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), which apply to Between wherever you use it from.

• Account: email, password (handled by our authentication provider and never stored in plain text), display name, optional avatar, your confirmation that you are 18 or older, and a record of which version of these texts you accepted and when. Optionally, how you heard about us (TikTok, Instagram, your partner…).
• Couple: the link with your partner, the date you linked and the invite code. If you add them, the date you got together and the letters in your time capsule, which nobody reads until your anniversary.
• Preferences and limits: which content categories you're into, which ones maybe and which ones not, and the intensity levels you accept. They may reveal information about your sex life, so they are special category data (Art. 9 GDPR).
• Activity: games, challenges shown, completed or skipped, points, streaks, achievements, missions and rewards.
• Long-distance mode: the written answers and votes from each round. Drawings in Draw & Guess travel live between the two phones and are not stored. No photos or audio are uploaded to the app.
• Getting ready while you wait for your partner: your answers to the style quiz and its result, your favorite rewards and the notes you write for your partner.
• Rating (optional): the score you give Between and, if you want, a sentence for the website with the signature you choose (first name, initials or anonymous). The sentence is only published if you tick the permission box, and you can withdraw it at any time in Settings › Help.
• Your rhythm (optional): how often you see each other and how much time you have on a normal day, if you answer those two questions. Your partner doesn't see your answers.
• Notifications: your notification preferences and, if you turn on push notifications, the technical subscription identifier of your browser.
• Plan and payments: your couple's plan (free, Premium or open beta) and, only if you subscribe to Premium, the Stripe customer and subscription identifiers, their status and the end date of the paid period. Your card details never reach Between: you enter them directly on Stripe's payment page.
• Technical data: your device's time zone (for reminders) and the minimum technical information about your session.

• Providing the service: creating your account, linking you with your partner, syncing games and calculating points, and, if you answer "Your rhythm", choosing missions, plans and rewards that fit how often you see each other and the time you have. Basis: performance of the agreement you accept with the Terms (Art. 6(1)(b) GDPR).
• Managing your plan and the Premium subscription: applying what each plan includes, charging the subscription, canceling it and processing refunds. Basis: performance of the contract (Art. 6(1)(b) GDPR). Invoices are kept because tax and commercial law require it (Art. 6(1)(c)).
• Filtering content based on your limits: so that nothing either of you has blocked ever shows up. Basis: your explicit consent (Art. 9(2)(a) GDPR), which you give with a specific checkbox when signing up and when setting your limits. You can withdraw it at any time by changing your limits or deleting your account; processing carried out before remains lawful.
• Sending you push notifications: only if you allow it in your browser. Basis: consent (Art. 6(1)(a)), which you can revoke from Settings or from your browser.
• Security and operation: preventing unauthorized access and fixing bugs. Basis: legitimate interest (Art. 6(1)(f)).
• Knowing how people find us: counting how many visits the home page, the sign-up page and these legal pages get and where they come from, and tallying the answers to "How did you hear about us?". Basis: legitimate interest (Art. 6(1)(f)). These are only counts: they are never combined with your activity in the game.

We do not make automated decisions with legal effects. The random selection of challenges only decides what gets played. We don't build profiles for commercial purposes either.

• Your linked partner sees the shared game activity: games, challenges, written answers from rounds, points and rewards. Secret answers in mini-games aren't shown until you've both answered. Your secret missions aren't shown to them until you decide to reveal them.
• What you prepare while you wait (notes, style quiz and favorite rewards) can only be seen by your partner, and only from the moment you link. You can edit or delete your notes whenever you want.
• Your limits are not shown to your partner as such: they are combined with theirs to decide what content can show up.
• Nobody else. Each couple is an isolated space: no other user can access your data.

To work, Between uses these providers, which only process data following our instructions:

• Supabase: database, authentication and real time. Data is hosted on servers in the European Union (Ireland).
• Vercel: hosting of the web app. It may process requests outside the European Economic Area (United States). Those transfers are covered by the European Commission's standard contractual clauses and the EU-U.S. Data Privacy Framework.
• Cloudflare (Turnstile): checks that you're not a bot when you sign up, log in or reset your password. It processes technical data from your browser and your IP address only for that, not for advertising or to track you across other websites. It may process them outside the EEA, with the same safeguards as Vercel.
• Google (only if you choose "Continue with Google"): confirms your email and gives us your name, your profile picture and an identifier for your Google account, which our authentication system (Supabase) stores. In the app we only use your email and the name you choose. Google receives nothing about what you do in Between; for its part it acts as an independent controller, under its own privacy policy.
• Vercel Web Analytics: counts visits to the home page, the sign-up page and these legal pages (which page, which website you came from, country and device type). It uses no cookies and stores nothing on your device, doesn't identify you and isn't inside the app: not in games, missions or any screen where you're logged in.
• Resend: sends the app's emails, such as the reminder to link your partner. It only receives your email, your display name and the text of the message, which never includes challenges, missions or answers. It may process them outside the EEA, with the same safeguards as Vercel.
• Stripe Payments Europe, Ltd. (Ireland): processes Premium payments. It acts as a processor for the charge and as an independent controller to prevent fraud and meet its own legal obligations, according to its privacy policy. It may process data outside the EEA with the same safeguards as Vercel. It is only involved if you subscribe to Premium.
• Your browser's push services (Google, Apple or Mozilla, depending on your device): they only receive a notification with generic text. It never includes the content of a challenge, a mission or an answer.

There are no ads, no analytics inside the app and no sale or sharing of data with third parties.

• Your data is kept as long as you have an account.
• Written answers and votes from long-distance mode are deleted automatically after 30 days.
• When you delete your account (Settings → Delete account), your account, your limits and your couple space are deleted: games, missions and rewards. Your partner keeps their account, unlinked.
• The subscription data Between stores is deleted along with your couple space. Stripe keeps invoices for the period required by law (six years, Art. 30 of the Spanish Commercial Code).
• Our provider's backups may keep deleted data for a short technical period until it is overwritten.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time. Write to hola@betweengame.com from your account's email. We will reply within one month at the latest.

Some rights are available directly in the app: editing your name and avatar, changing your limits, turning off notifications, downloading a copy of your data (Settings → Privacy → Download my data) and deleting your account.

If you believe we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (AEPD).

We only use technical cookies, essential to keep you logged in and remember the language you choose. We also store small preferences on your device (for example, whether you've muted sound or closed a welcome notice). They are necessary for the service you request and do not require consent (Art. 22.2 of the Spanish LSSI). We don't use advertising, analytics or third-party cookies: the visit count on the home page and sign-up works without cookies. If you pay for Premium, the payment page belongs to Stripe (checkout.stripe.com) and uses its own technical and anti-fraud cookies.

Between is only for people 18 or older. We don't knowingly collect data from minors. If we detect an account belonging to a minor, we will delete it.

Communications are encrypted (HTTPS). Each couple is isolated with access policies in the database. Passwords are not stored in plain text. No system is infallible: if we detect a breach affecting your data, we will let you know and notify the authority when required.

If we change something important, we will let you know in the app before it takes effect. The date at the top shows the last update.