Privacy Policy

Reversi Zen by Witzora · Version 11 · Last updated: 2026-09-21

1. Who We Are

Reversi Zen is developed and operated by Witzora ("we," "us," or "our"), based in Sweden.

• Contact email: contact@witzora.com
• Privacy inquiries: contact@witzora.com
• Website: witzora.com/zenreversi

We are the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.

We have not appointed a Data Protection Officer, as our processing activities do not require one under Article 37 GDPR. For all data protection inquiries, please use the email address above.

2. Scope and Applicability

This Privacy Policy applies to the Reversi Zen application in all the forms in which we publish it: the web app, and the Android and iOS apps. The same policy is shown inside the app in Swedish, with the same version number; this page is the full English version.

Age requirement: Reversi Zen is intended for users aged 13 or older. In some jurisdictions the minimum age for consenting to data processing is higher (for example, 16 in Germany and the Netherlands). If you are below the digital age of consent in your country, you must have your parent's or guardian's permission to use Reversi Zen.

3. The Short Version

Reversi Zen collects very little, and we think it is fair to say so before the detail:

• You can play without giving us anything. Playing as a guest requires no account. Those games are computed on your device and are never sent to us.
• There is no advertising. No ad network, no advertising identifiers, no ad profiling.
• There is no usage analytics. We do not use Firebase Analytics, Google Analytics, or any other measurement of how you use the app. Crash reports are sent when the app crashes, without any link to you, and you can turn them off.
• We never sell personal data.
• Your game data is stored in the EU. Our database and server functions run in Google's europe-west1 region (Belgium).

4. Data We Collect

4.1 Playing without an account

You can play Reversi Zen as a guest. In guest mode, games run locally on your device, the opponent is computed on the device, and no game data reaches our servers. Your settings are stored locally on your device only.

4.2 Account data

You can sign in with Google, Apple, or email and password. When you do, we store:

• An account identifier — a technical ID that connects your games to you.
• Your alias, which you choose yourself in the app and can change. The account name from Google or Apple is not stored.
• Your country and your town, which you choose yourself when you register and can change in your profile. The country gives you the flag next to your name and your place on the leaderboards per country and continent, and it is visible to other players. The town is currently shown only in your own profile. We never read your device's location.

When you search for a town, the text you type and the country you selected are sent to Google's place search (Places). Your account is not sent with it.

Your email address is held by Firebase Authentication for signing in, not in your profile, and is never shown to other players. If you choose Apple's "Hide My Email," we receive a relay address. We never see your password: Firebase Authentication stores it encrypted, and you reset it by email.

4.3 Crash reports

If the app crashes, a report is sent to us through Firebase Crashlytics: device model, operating system, the app's build, where in the code it happened, and an identifier for the installation, so that several crashes from the same device can be grouped. Never your account identifier, your alias or your email address, and nothing about your games.

The reports exist to keep the app working — our legitimate interest — and are how we find faults on devices we do not own. They are on from the start, and you turn them off under Settings → Help us improve the app; your choice is saved on your account. Google processes the reports, including outside the EU, under the same framework as sign-in. The web app sends no crash reports. We collect no usage analytics.

4.4 Game data

When you are signed in, we store:

• Results and final positions of finished games
• Statistics: games played, wins, losses, draws, score distribution
• Your Glicko-2 rating, rating deviation, and volatility
• Thinking time per move and per game, used for the analysis views
• Your settings
• If you have allowed notifications: a device key for push notifications, so that we can tell you when it is your turn
• Whether you have the app open right now, and which game you have open, so that others can see that you are here and your opponent can see whether you have left the board. No history is kept.

When you play against other people online, the game is stored with both players' aliases and moves. Other players can find you by your alias and invite you. There is no chat and no messaging.

Games played on the same device stay on the device. We only count how many local games are played, how often the game analysis is opened after a win or a loss, and how often the Game Analysis, the Turning Point and the local scoreboard are opened and given a thumbs-up or thumbs-down — never by whom.

When you give feedback in the app, the post is stored with your account, the time, the app's language, your country and your platform. An image of the screen you were on is attached unless you remove it in the form. If we reply, and you reply back, those lines are stored with the post. Only you and the person who runs the app can see the post, the conversation and the image.

4.5 Technical data

Like any internet service, ours receives standard technical information as a consequence of your device talking to it: your IP address, the type of device or browser, and the app version. This reaches Google Firebase, which operates our infrastructure and keeps short-lived operational logs. We do not build profiles from it, and we do not derive or store your location from it.

4.6 What we do not collect

• No location. The app never asks for location permission and uses no positioning service.
• No contacts, photos, microphone, or camera access.
• No advertising identifiers (no IDFA, no AAID).
• No usage analytics: no analytics events and no session tracking. Crash reports are described above.
• No cross-site tracking.

5. Legal Basis for Processing (GDPR)

Purpose	Legal Basis	GDPR Article
Creating and managing your account	Performance of contract	Art. 6(1)(b)
Saving games, statistics, and rating; online play and notifications	Performance of contract	Art. 6(1)(b)
Showing leaderboards and comparisons	Performance of contract	Art. 6(1)(b)
Handling your feedback	Performance of contract	Art. 6(1)(b)
Security, abuse prevention, and service integrity, including the review of aliases	Legitimate interest	Art. 6(1)(f)
Crash reports, to keep the app working	Legitimate interest	Art. 6(1)(f)
Anonymous counters, to know which features are used	Legitimate interest	Art. 6(1)(f)
Meeting legal obligations	Legal obligation	Art. 6(1)(c)

You turn crash reports off in Settings; the counters carry no information about you. We do not rely on consent as a legal basis, because we run no processing that would require it — there is no advertising and no usage analytics. You have the right to object to processing based on legitimate interest (see Section 9).

6. Data Sharing and Third Parties

We do not sell your personal data.

Reversi Zen is built on Google Firebase, and Google is our only processor:

Service	Data	Purpose
Firebase Authentication	Email address, account identifier	Signing you in and keeping you signed in
Cloud Firestore	Profile, games, statistics, rating, settings, feedback	Storing your data
Realtime Database	Whether you are online, your country, the game you have open	Presence
Cloud Functions	Games, results, invitations	Recording games, computing rating, sending notifications
Cloud Messaging	Device key, notification text	Push notifications
Cloud Storage	The screen image in a feedback post	Storing the image
Crashlytics	Crash reports without account data	Finding faults
Vertex AI (Gemini)	The alias you choose — nothing else	Reviewing aliases, run in the EU
Places	The town text you type and the country you selected	Town search
Firebase Hosting	Technical request data	Serving the web app

The bots' moves are computed on your device or on our servers in the EU, never by a third party.

We may also disclose data when required by law or legal process, to protect the rights, safety, or property of Witzora, our users, or the public, or in connection with a merger, acquisition, or sale of assets — in which case you will be notified.

Visible to other players: other signed-in players can see your alias, your country, your rating and your results, on leaderboards, in comparisons and in finished games. Your email address is never shown to other players.

7. Where Your Data Is Stored

Cloud Firestore, Realtime Database, Cloud Storage and our Cloud Functions run in Google's europe-west1 region (Belgium), inside the EU. Your games, statistics, rating and feedback stay there. The review of aliases runs in the Netherlands, also inside the EU.

Firebase Authentication is operated by Google as a global service, and the account data it holds — your email address and account identifier — may be processed outside the EU/EEA, including in the United States. Those transfers are covered by:

• the EU-US Data Privacy Framework, under which Google LLC is certified, and
• Standard Contractual Clauses, incorporated into Google's Data Processing Terms.

Crash reports go to Crashlytics, which Google also operates globally; they contain no account data. The same applies to the town search: only the search text and the country are sent.

For details, see firebase.google.com/support/privacy.

8. Data Retention

Data	Retention
Account data, statistics, and rating	For as long as you have an account.
On deletion	Account data, statistics and rating are deleted. Your feedback is deleted, with its conversation and screen images. Games against the bots are removed. Games against other players remain in their history without your name and without your account identifier, so that their numbers stay correct. Your alias is locked for 30 days and can then be taken by someone else.
Push notification device keys	Removed when you sign out, and after 90 days without use.
Anonymous counters	90 days, then deleted automatically.
Local settings on your device	Until you clear the app's data or uninstall it.
Infrastructure logs (Google Cloud)	30 days.

9. Your Rights

9.1 Under the GDPR (EU/EEA)

• Access your personal data and receive a copy (Art. 15)
• Rectification of inaccurate or incomplete data (Art. 16)
• Erasure — the right to be forgotten (Art. 17)
• Restriction of processing in certain circumstances (Art. 18)
• Data portability in a structured, machine-readable format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Not be subject to automated decision-making with legal or similarly significant effects (Art. 22)

9.2 California residents (CCPA/CPRA)

You have the right to know what personal information we collect and how we use it, to have it deleted, to have it corrected, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we run no targeted advertising to opt out of.

9.3 Other US state privacy laws

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws have comparable rights. Contact us to exercise them.

9.4 How to exercise your rights

Delete your account yourself in the app, under Profile → Delete account. The account is removed after seven days, and you can change your mind in your profile until then. No email exchange is needed. The steps are also set out on a page of their own: Delete your account.

Get a copy of your data yourself in the app, under Profile → My data: a file in a format other programs can read, with your profile, statistics, rating, games, settings and feedback, which you can save on your device. Rectification is done in your profile. A single feedback post you remove yourself on the page Your feedback: the text, the conversation and the screen image are deleted, and all that remains with us is a serial number and a status, with no link to you. To remove everything, delete your account; there is no other partial deletion with the account kept.

If something cannot be done in the app, email contact@witzora.com from the address associated with your account, so that we can confirm the request is yours. We respond to GDPR requests within 30 days and CCPA/CPRA requests within 45 days.

We will never treat you differently for exercising a privacy right.

10. Children's Privacy

Reversi Zen is not directed at children under 13, and we do not knowingly collect personal data from them. If we learn that we hold data from a child under 13, we will delete the account and its data promptly. If you believe a child under 13 has an account, contact us at contact@witzora.com.

In EU member states where the digital age of consent is higher than 13, users below that age must have parental or guardian consent.

11. Automated Decision-Making and Profiling

We do not use automated decision-making that produces legal effects or similarly significantly affects you. The bots calculate moves, and the rating system calculates a number from your results — neither decides anything about you as a person, and neither restricts your access to the service.

There is one automated step: your alias is reviewed by an AI service (Google's Gemini) that looks for offensive names and names that pretend to be the app or its staff. If the name is rejected you are told at once and can choose another. If the service does not answer at all, the name is let through and may be reviewed by us afterwards. The assessment concerns only the name — never you, your games, or your access to the service.

The bots that play against you make no decisions about you. Zenith computes its moves with minimax search and learns nothing. Juno is a neural network, that is, AI — but a model of our own, trained in our own project by playing against itself in this game, not a general AI service. It sees only the board: no information about you, your games or your account goes into it, and it does not use your games for training.

12. Cookies and Local Storage

Web app: we use local storage and cookies set by Firebase Authentication to keep you signed in, and local storage for your settings. There are no analytics cookies and no advertising cookies, because there is no analytics and no advertising.

Mobile apps: settings are stored locally on your device. No advertising identifiers are read.

You can clear this at any time through your browser settings or by clearing the app's data. Signing in again will be required afterwards.

13. Security

We protect your data with:

• Encryption in transit (TLS) and at rest
• Security rules that restrict who can read and write what
• Authentication handled by Firebase Authentication — we never see or store your password
• Server-side game logic in Cloud Functions rather than trusting the client
• Restricted access to production data

No system is completely secure, and we will not claim otherwise. If we become aware of a breach that poses a risk to your rights, we will notify you and the relevant authorities as the law requires.

14. Supervisory Authority

If you are in the EU/EEA and believe we have not handled your data properly, you may lodge a complaint with a supervisory authority. Ours is:

Integritetsskyddsmyndigheten (IMY)
Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden
Website: www.imy.se
Email: imy@imy.se
Phone: +46 8 657 61 00

You may also complain to the supervisory authority in your own country of residence.

15. Changes to This Privacy Policy

We may update this policy to reflect changes in the app, in technology, or in the law. When we do, we will update the version and the "Last updated" date above, and for significant changes we will notify you in the app. The app shows the full version history at the bottom of its privacy page. If we ever add advertising, analytics, or any other processing that requires your consent, we will ask for it before we start — not afterwards.

16. Contact Us

Email: contact@witzora.com
Website: witzora.com/zenreversi

We aim to respond to all inquiries within 30 days.