Privacy Policy

Who we are

Veros is an online legal-knowledge game.

What we process

• Your account: email address, display name, password (stored only as a hash), language, chosen avatar and, if you tell us, how you heard about Veros. If you sign in with Google, Google gives us your email address and name.
• The game: matches played (score, place, winner, your display name), your answers (right or wrong, and how fast), map territories, leaderboards, ELO, Prestige, achievements and notifications.
• Denarii and payments: your Denarii balance and history, your monthly plan and your Stripe customer id. Card payments are processed by Stripe; we never see or store card details.
• Technical data: IP address and request data, in server logs and, briefly, in request rate limiting (abuse protection). Our own usage events (for example "first match played"), so we understand how the game is used.
• Cookies and local storage: a session cookie that keeps you signed in (and protects forms) and a cookie with your chosen language. Your browser keeps your preferences (theme, welcome tour) and, during a match, a reconnect code. We use no advertising cookies.

Why (legal basis)

• To keep your account and run the game, purchases included: performance of a contract (Art. 6(1)(b) GDPR).
• Leaderboards, statistics, abuse prevention and security: our legitimate interest (Art. 6(1)(f)).
• Keeping payment records: legal obligation (Art. 6(1)(c)).
• Session cookies are strictly necessary and need no consent.

Who else sees the data

• Other players see your display name, avatar, results and public statistics (leaderboard, public profile).
• Providers that help us run the service: Stripe (payments), Google (only if you choose to sign in with Google), the email provider that sends confirmations and password resets. They process data on our behalf, or as independent controllers for their own services (Stripe, Google).
• Where a provider transfers data outside the European Economic Area, it does so with the safeguards the GDPR requires (an adequacy decision or standard contractual clauses).
• We do not sell your data and do not use it for advertising.

How long we keep it

We keep account data while you have an account. When you delete your account, the account, your answers, study data, Denarii history and notifications are deleted, and your map territories are released. Matches played, season boards, the territories' history and monuments stay, but only in anonymized form (no name, no link to you). Payments stay in our records only as an amount and a date, with no link to you; Stripe keeps the payment record, including the email address, as long as tax and accounting law requires. Server logs rotate automatically and keep only the last few tens of MB.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. From your settings you can download all your data or delete your account at any time. For the other rights, write to us. If you are not satisfied with our answer, you can complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or the authority where you live.

Minimum age

You must be at least 16 to create an account.

Changes

When we change something important in this policy, we announce it on the site before it applies.