The full version follows. It explains exactly what happens to your data, and it is the version that governs.
The data controller is:
| Service owner | Emil Rustamzade Valeh oglu, individual entrepreneur |
|---|---|
| VÖEN (tax number) | 1007379292 |
| Country of registration | Republic of Azerbaijan |
| Contact for anything about data | [email protected] |
Below, "we" means the entrepreneur named above, "Founday" or "the app" means the Founday mobile game, and "you" means the player.
We collect only what the game cannot work without. Nothing "just in case", and nothing for advertising.
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address | Signing in, confirming your address, password recovery, replying to your support email | Performance of our contract with you |
| Email left on the founday.me waitlist | One message — that the app has launched. Nothing else: no newsletters, no advertising. The list is kept separately from game accounts, and every email we send carries a one-click unsubscribe | Your consent, which you may withdraw at any time |
| Password | Signing in. We never store the password itself — only an irreversible hash of it (Argon2id), from which the password cannot be recovered | Performance of contract |
| Google account identifier and its email — if you sign in with Google | Passwordless sign-in | Performance of contract |
| Public @handle and display name | How other players see you in the feed and rankings. Your real name is not required | Performance of contract |
| Date of birth | Only to enforce the 13+ age limit. Never shown to other players, never used for advertising or analytics | Legal obligation and protection of children |
| Photos taken in the app | This is the game itself: a photo is checked, credited and — if all is well — published to the day's feed and your collection | Performance of contract |
| Game progress: streak, finds, likes, freezes, ranking positions | The point of the game, and the stats shown on your profile and in rankings | Performance of contract |
| Session technical data: device model, last active time, interface language, app version | Showing you the list of your sign-ins so you can end one that is not yours; account security | Legitimate interest (account security) |
| IP address | Processed on every request to our servers — communication is physically impossible otherwise. Used to defend against attacks and abuse; not stored on your profile and never shown to other players | Legitimate interest (service security) |
| Reports, players you blocked, moderation flags and appeals | Handling reports, community safety, preventing repeat abuse | Legitimate interest (safety) and performance of contract |
| Support correspondence | Answering you and fixing the problem | Performance of contract and legitimate interest |
| Game events: task opened, photo submitted, verdict received, streak changed | Understanding how the game actually behaves and fixing what breaks. This is our own product analytics: it is not shared with advertisers, not joined with data from other apps, and stored on EU servers | Legitimate interest (improving and fixing the service) |
| Anonymous visit statistics for founday.me and legal.founday.me: page address, referrer, country, device type | Knowing whether anyone reaches the site, and from where. No cookies and no identifiers: we do not recognise the same visitor tomorrow or on another site, and these statistics are never joined with a game account | Legitimate interest (knowing whether the site works) |
| Notification settings | Sending the daily task reminder and the streak-at-risk warning exactly as you chose | Consent (withdrawn with the toggle in settings) |
| Camera | The only way to take a photo for the task |
|---|---|
| Internet | Talking to our server |
| Vibration | Haptic feedback in the interface |
The app requests no other permissions.
We work with providers who process data on our instructions and only to run the service (data processors under the GDPR). Each receives the minimum its job requires.
| Who | What they receive | Why |
|---|---|---|
| Google Ireland Ltd. / Google LLC | Account identifier when you sign in with Google; subscription purchase data | Google sign-in, app distribution and subscription payment through Google Play |
| Google (Gemini service) | The photo submitted for checking and the task text | Automated checking: whether the task is completed and whether the photo contains anything prohibited. Google processes the image as the provider of that service, on its own terms |
| Cloudflare, Inc. | Photos, network traffic, mail sent to @founday.me addresses, anonymous website visit statistics | Photo storage, content delivery, attack protection, receiving support email, and Web Analytics on our websites — a cookieless counter that reports page views without identifying anyone |
| Hetzner Online GmbH | All service data (servers and database) | Server hosting. Data centres are in Germany and Finland, i.e. inside the EU |
| Sendinblue SAS (Brevo) | Email address and message body; the website waitlist itself is stored there too | Sending confirmation codes and password-reset emails, and the launch announcement to everyone who left an address on founday.me |
| PostHog | Game events and the account identifier | Product analytics: how many people opened the task, how many reached a find. We use the European deployment (eu.i.posthog.com) |
| Functional Software, Inc. (Sentry) | Technical details of an app or server error | Finding and fixing crashes |
We may also disclose data where the law or a lawful authority request requires it, or where it is necessary to protect someone's life and safety.
Our main servers and database are located in the European Union (Germany, Finland). Some providers listed in section 5 are US companies, so part of the data is transferred outside the EU. Such transfers rely on the European Commission's Standard Contractual Clauses and other safeguards provided by law.
| Photos of failed or unpublished attempts | 30 days, then deleted automatically |
|---|---|
| Photos in your collection and the feed | As long as the account exists, or until you ask us to remove them |
| Account data and game progress | As long as the account exists |
| After account deletion | Erased within 30 days, except where the law requires specific records to be kept (payment records, for example) |
| Security logs | Up to 90 days |
| Support correspondence | Up to 12 months after the request is closed |
| Anonymous website visit statistics | Up to 6 months on Cloudflare's side, and never tied to a person at any point |
| Waitlist email | Until you unsubscribe — or until the list is no longer needed: the launch message goes out once, and no later than 12 months after launch the list is deleted entirely |
A photo under an open appeal is kept until the appeal is resolved — otherwise there would be nothing to review.
Founday has a shared feed, so some data is public by the very nature of the service:
Your email, date of birth, session list and settings are never visible to other players.
Remember: a find card can be saved and forwarded. Anything that reaches the shared feed can be seen, saved and reshared by other people, as in any social network. Do not shoot what you are not ready to show the world.
You must be at least 13 to play. We ask for a date of birth at sign-up and do not create accounts for anyone younger.
If you live in an EU country with a higher digital-consent age for children (between 13 and 16, depending on the country) and you are below that age, you may use Founday only with the consent of a parent or legal guardian.
If we learn that an account belongs to a child below the permitted age, we delete the account and the data attached to it. If you are a parent and believe your child signed up without your consent, write to [email protected] and we will delete the account.
Under data-protection law (including the GDPR for players in the EU and EEA) you have the right to:
Some of these you can exercise inside the app: change settings, end other sessions, delete the account. For everything else write to [email protected] from the address linked to your account, and we will respond within 30 days. There is no charge.
No one's protection is absolute. If a breach does occur and creates a risk to your rights, we will notify you and the supervisory authority within the deadlines set by law.
If this policy changes materially, we will tell you in the app or by email before the change takes effect. The version date is always shown at the top of this page, and we keep previous versions available on request.
For anything about data: [email protected]. The same address handles access, correction and deletion requests.