Privacy Policy

1. Data controller

SIAL Consulting d.o.o., Bizeljska cesta 5, 8250 Brežice, Slovenia, is the controller for BLUFF. Privacy requests: info@sialconsulting.com.

2. Data we process

• Account data: Firebase/Google account identifier, email, display name and profile image when you sign in.
• Gameplay data: scores, answers, streaks, modes, achievements, Dossier progress, event participation, SWEAR ledger entries and anti-abuse records.
• Billing data: Stripe customer, Checkout and subscription identifiers, plan, status and billing dates. Stripe processes card details; BLUFF does not store full card numbers.
• Technical data: browser/device characteristics, IP-derived request security data, app version, errors, performance and local identifiers.
• Acquisition data: campaign parameters, referral token, landing page and sharing events. Referral tokens identify a share source, not a public profile.
• Optional content: handle, duel name and content you deliberately submit.

3. Why we use data

We process data to provide and secure the game, preserve progress, run leaderboards and events, prevent fraud, deliver subscriptions, respond to requests, diagnose errors, measure product performance and understand which acquisition channels work. Depending on the activity, the legal basis is contract performance, legitimate interests, consent or compliance with legal obligations.

4. Service providers

BLUFF uses providers that process limited data for us, including Vercel (hosting, server functions, privacy-preserving Web Analytics and Core Web Vitals), Google Firebase (authentication and data storage), Stripe (payments and subscriptions) and, for selected generated content or voice features, AI providers such as Anthropic or OpenAI. PostHog product analytics and Sentry error monitoring may also be used when configured. Their processing is governed by their terms and data-protection commitments.

5. Cookies and local storage

BLUFF uses browser storage for language, game state, free-play counters, first-touch attribution, referral tokens and offline/PWA operation. Vercel Web Analytics is first-party and cookie-free; it uses anonymized request-derived identifiers to count visits. Authentication and other configured providers may use cookies or similar storage. You can clear site data in your browser, but this may remove anonymous progress and sign you out.

6. Retention

We keep account and gameplay records while the account or service relationship remains active and as needed for security, dispute prevention and service recovery. Billing and transaction records are retained as required by tax, accounting and consumer law. Short-lived event, rate-limit and anti-replay records expire according to their operational purpose. We delete or anonymize data when it is no longer needed, subject to legal obligations and backups.

7. International transfers and security

Some providers operate outside the European Economic Area. Where required, transfers rely on recognized safeguards such as adequacy decisions or standard contractual clauses. We use access controls, signed payment webhooks, server-side entitlement checks and transport encryption, but no online service can guarantee absolute security.

8. Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where consent is the basis. You may also complain to your local data-protection authority. Contact info@sialconsulting.com; we may need to verify your identity.

9. Children

BLUFF is not directed to children under 13. A person starting a paid subscription must have legal authority to use the payment method and enter the subscription, or act with the required parent or guardian involvement.

10. Changes

We may update this policy as BLUFF evolves. The effective date above shows the latest version. Material changes will be communicated where required.