Privacy Policy

01 What personal data we process and why

The personal data we process depends on how you use Takyo. Sections A to D and K concern the app, sections E and F the e-shop and its games, sections G to J apply to both the app and the website.

A. User account in the app

You register and log in to the Takyo app exclusively through a Google or Apple account; we do not offer registration by email and password (your Google/Apple account password never reaches us). From your chosen login provider, we obtain and further process:

• your email address: used as the account identifier and for communicating with you,
• your name: to address you within the app,
• your profile photo, if provided to us by the login provider (typically Google; Apple does not provide a photo); we display it in your profile.

We also maintain technical data related to your account: the date your account was created, the date of your last login, which login provider (Google/Apple) you use, and the app language.

Providing this data is a contractual requirement: a registered account cannot be created without it. If you don't want to provide it, you can use the app in guest mode: in this mode we do not collect your email, name or profile photo; we keep records of app usage (see below) for guests too, but only under an anonymous technical identifier.

The legal basis for this processing is performance of a contract (Art. 6(1)(b) GDPR).

B. Guest account

You can also use the Takyo app without registering, as a guest. In that case, we process only a random technical identifier (UUID) and the technical data listed above (date created, last login); the identifier is not linked to your name, email or any other data that would allow us to directly identify you.

The legal basis for this processing is performance of a contract (Art. 6(1)(b) GDPR).

C. Use of app content

So that we can display the app correctly and return you to where you left off, we process, in connection with your account:

• onboarding progress: the steps you completed during the initial setup and the answers you chose there, so that we don't have to walk you through it again and can guide you to suitable content,
• content progress: which dates, questions or games you have opened, which step you are on, whether you have completed them and how you work with the cards (for example opening a link or sharing a secret task); this lets us mark content as in progress or completed and avoid offering you again what you have already done,
• unlocked content: an overview of the dates available to you beyond the purchased packs (the date for signing up and referral rewards), so that we can show them to you,
• referrals: every user has a unique referral code they can share with others; if someone enters your code, we process information about who entered the code, whose code was used and what reward each party received, solely so that we can correctly grant the rewards.

This data is used to operate the app; in aggregated form we also evaluate it to improve the app (see section I).

The legal basis for this processing is performance of a contract (Art. 6(1)(b) GDPR).

D. Purchases in the app

Content in the app is purchased on a one-time basis: you purchase a specific content pack, not a recurring subscription. Payments are processed by external payment service providers, the Apple App Store and Google Play. These providers process your payment details (card number, etc.) under their own privacy policies; we do not have access to this data and do not store it.

On our side, we retain only:

• purchase data: payment confirmation, transaction ID, the purchased pack and the purchase date, so that we can give you access to the purchased content,
• accounting records: documents we are required to archive under accounting and tax regulations.

The legal basis for processing purchase data is performance of a contract (Art. 6(1)(b) GDPR); for accounting records, compliance with a legal obligation (Art. 6(1)(c) GDPR).

E. Purchases in the e-shop

You buy games in the e-shop without registering and without an app account. We do not link your purchase to the app or to its user account. When you make a purchase, we process:

• the email address you enter at checkout: we send the order confirmation, the download link and the proof of payment to it,
• order data: the games purchased and their quantity, price, currency, date and time of purchase, the payment and order identifier at Stripe and the delivery status of the confirmation email,
• a record of your consent to the terms and conditions and to immediate access to digital content, including the version of the terms valid on the day of the order; we keep this record as evidence that consent was given,
• your choice whether you want to receive our newsletter (see section G),
• download access data: a secure access code for the download link (we store only its one-way hash, not the code itself), its validity and the number of times the link has been opened.

Payment is processed by the payment service provider Stripe. You enter your payment details (card number, cardholder name and the billing details Stripe asks for at checkout) directly on Stripe's secure payment page. Stripe processes them as an independent controller under its own privacy policy, among other things to process the payment and to prevent fraud. We have no access to your card number and do not store it; from Stripe we receive only the result of the payment and the data listed above.

If you buy a game as a gift and pass the files on to the recipient, we do not process the recipient's personal data.

Providing an email address is a contractual requirement: without it we cannot deliver the game. The legal basis for processing order data is performance of a contract (Art. 6(1)(b) GDPR); for accounting records, compliance with a legal obligation (Art. 6(1)(c) GDPR); and for the consent record, our legitimate interest in demonstrating that we have met our statutory obligations towards consumers and in defending any claims (Art. 6(1)(f) GDPR).

Persons over 18 may buy in the e-shop; younger persons only with the consent of their legal guardian.

F. E-shop games and their reviews

The online parts of the games (for example entering a code and unlocking the end of the story in the game Noc v grandhotelu) do not require logging in or entering any personal data. We do not store the code you enter and do not link it to you; we process only the technical data described in section I.

After finishing a game, you can voluntarily send us a review. We process:

• the number of stars (1 to 5) and the text of your comment,
• your name or nickname, if you fill it in (it is optional),
• the name of the game, the date and time of submission and the status of the review (awaiting approval, published, rejected).

We do not link reviews to your order or email. We publish them on takyo.cz, and possibly in our promotional materials, together with the name or nickname you chose, and only after a manual check. Please do not write anything in your comment that could identify you or other people, especially children (full names, addresses, contact details); we will not publish such information.

The legal basis for processing and publishing reviews is your consent (Art. 6(1)(a) GDPR), which you give by submitting the form. You can withdraw your consent at any time by emailing ola@takyo.cz; we will then remove the review.

The love languages test processes your answers and calculates the result only in the open page of your browser. It does not send the answers or the result to us, and they disappear when you reload the page. If you copy your result, it contains only the score, not your individual answers.

G. Newsletter

You can subscribe to our email newsletter (for example the weekly “Mission of the Week”, new games and promotions) in three ways: via the form on takyo.cz, when ordering in the e-shop by choosing “Yes, I want Takyo news”, or by ticking the box in the app (during the initial setup or in your account settings) if you have a registered account. Without this choice we do not send newsletters to e-shop customers. We process your email address, the way, date and time of subscribing and the confirmation of the subscription; for a subscription made in the app also the wording of the consent you agreed to and the app language. A new subscription via the website form or when ordering is confirmed by clicking a link in an email (double opt-in), so that nobody can subscribe on your behalf. In the app we do not require email confirmation, because your address has already been verified by signing in with Google or Apple. For the emails we send, we evaluate whether they were opened and which links you clicked, so that we can improve the newsletter.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 7(2) of Act No. 480/2004 Coll.). You can withdraw your consent at any time with a single click on the unsubscribe link in every email or by writing to ola@takyo.cz. Withdrawal does not affect the lawfulness of processing carried out before it.

Sending news to registered app users on the basis of the statutory exception is described in Section 03.

H. Communication with us and customer support

If you write to us or call us (for example with a question, a request for a new download link, a complaint or a withdrawal from the contract), we process your contact details, the content of the communication and the information you give us in it (for example an order number or a bank account number for a refund).

The legal basis is performance of a contract (Art. 6(1)(b) GDPR) where the communication concerns your order or account, compliance with a legal obligation (Art. 6(1)(c) GDPR) for complaints and withdrawals from the contract, and otherwise our legitimate interest in answering your question (Art. 6(1)(f) GDPR).

I. Technical operation and security

When you use the app and the website, we automatically process technical data necessary for their operation, security, troubleshooting and for measuring how the app is used:

• access logs: IP address, time of access, requested URL and status code,
• records of app usage: a random installation identifier and a record of the app being launched,
• device information: device type, operating system, browser type and app version,
• operational logs of the app and the e-shop: error logs and request logs used for diagnostics, stability and protection against misuse (for example repeated attempts at unauthorised access to a download).

We measure traffic on takyo.cz with Plausible Analytics, without cookies, without storing IP addresses and without cross-site tracking. We evaluate how the app is used ourselves, from our own records, without any third-party analytics tool. The use of cookies and similar technologies (for example the temporary storage of your cart in your browser) is governed separately by our Cookie Policy.

The legal basis for this processing is our legitimate interest in the secure and functional operation of the app and the website and in improving the app (Art. 6(1)(f) GDPR).

J. Voluntary feedback surveys

In a voluntary feedback survey we process your answers, the date and time of submission, technical data about your browser and device, the time taken to fill it in and, where applicable, the identifier of the invitation link. The identifier can link the answers to the recipient of the invitation; the survey therefore may not be anonymous. We use the data to evaluate experiences with Takyo and to improve the service on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Filling in the survey is voluntary and you can object to the processing at ola@takyo.cz. Please do not include names, contact details or sensitive information about yourself or other people in the free-text answers. We store the answers in a secured operational copy at Websupport.

K. Notifications in the app

If you allow notifications in the app, we process a technical identifier of your device used for delivering notifications (push token), the platform (iOS/Android), the app language and the permission status. We send you notifications related to your account, for example about a referral reward. You can turn notifications off at any time in your phone settings or in the app; we then stop using the token.

Delivery is handled by Expo (Expo, Inc.) and by Apple (APNs) or Google (Firebase Cloud Messaging), see Section 02.

The legal basis is performance of a contract (Art. 6(1)(b) GDPR); sending is subject to your permission on the device.

02 Recipients of personal data

To operate and secure Takyo, we use the third-party services listed below. Processing of personal data with these providers is governed contractually in accordance with Art. 28 GDPR, through data processing terms that form part of their terms of service. We do not disclose or sell your data to anyone for their own purposes.

Supabase (Supabase, Inc., USA; servers in the EU, Ireland and Germany)

• Services: database, backend, authentication and app hosting; for the website, the database and server functions of the e-shop: order processing, storage and secure delivery of download files, code checks for the online parts of games and storage of game reviews
• Link: Privacy Policy

Websupport (Websupport s.r.o., Slovakia; servers in the EU)

• Services: hosting of the takyo.cz website including the e-shop pages
• Link: Privacy Policy

Stripe (Stripe Payments Europe, Limited, Ireland; Stripe, Inc., USA)

• Services: payment processing in the e-shop. Stripe acts as an independent controller for processing payment data and preventing fraud.
• Link: Privacy Policy

Ecomail (Ecomail.cz, s.r.o., Czech Republic; servers in the EU)

• Services: sending emails with the order confirmation and the download link, managing newsletter subscriptions and sending the newsletter
• Link: Privacy Policy

Apple (USA, Ireland)

• Services: Sign in with Apple, payments via the App Store, notification delivery (Apple Push Notification service)
• Link: Privacy Policy

Google (Google Ireland Limited, Ireland; Google LLC, USA)

• Services: Sign in with Google, payments via Google Play, customer support mailbox (Google Workspace), notification delivery on Android (Firebase Cloud Messaging)
• Link: Privacy Policy

Sentry (Functional Software, Inc., USA; servers in the EU, Germany)

• Services: application error and crash monitoring
• Link: Privacy Policy

Expo (Expo, Inc., USA)

• Services: delivery of app notifications (Expo Push Service)
• Link: Privacy Policy

Plausible Analytics (Plausible Insights OÜ, Estonia; servers in the EU, Germany)

• Services: traffic measurement for takyo.cz with no cookies, no IP addresses stored and no cross-site tracking
• Link: Privacy Policy

If we are required to disclose data by law or by a decision of a competent authority, public authorities may also be recipients. Accounting records may also be processed by our external accountant, to the extent necessary for bookkeeping.

Transfers of data outside the EU/EEA

Your data is primarily processed within the European Union. Some providers, however, are based in the USA, and in connection with their services, data may be transferred outside the EU/EEA. These transfers take place in accordance with the GDPR, on the basis of:

• the European Commission's adequacy decision under the EU-US Data Privacy Framework: applicable to Apple, Google and Stripe,
• Standard Contractual Clauses (SCCs) approved by the European Commission: applicable to Supabase, Sentry and Expo.

In addition to this legal basis, we implement appropriate technical and organisational measures to protect your data: communication between the app, the website and our servers is encrypted, data is pseudonymised where appropriate, access codes for download links are stored only as a one-way hash, and access to data is limited to what is necessary.

03 Marketing and service communications

In connection with the operation of Takyo, we may send you service messages, for example purchase or order confirmations, a download link, information about the handling of a complaint, notice of account deletion or notification of changes to our terms or this Policy. These messages are not marketing communications, and sending them is part of providing the service. We do not track opens or clicks in emails containing a download link.

In addition, we may occasionally email app users with a registered account news about our own services, in particular news about the app, new dates, questions and games, new games in the e-shop, or promotions and pre-sales. We send these communications on the basis of the statutory exception for existing customers (Section 7(3) of Act No. 480/2004 Coll.). If you ticked the newsletter consent in the app (Section 01, part G), we send them to you on the basis of that consent; if you did not, we may send them to you under this exception until you opt out. We send news to e-shop customers only if they chose it themselves when ordering (Section 01, part G). We will never send you third-party offers, and we do not share your email with anyone for marketing purposes.

You can opt out at any time with a single click on the unsubscribe link included in every such email, or by writing to ola@takyo.cz. Opting out has no effect on how your account works, on the delivery of purchased games or on the lawfulness of earlier processing.

Subscribing to the newsletter on the basis of your consent (the website form, the choice when ordering or the box in the app) is described in Section 01, part G.

04 How long we retain personal data

We retain your personal data only for as long as necessary for the purpose for which we received it, so that we can meet your needs or fulfil our legal obligations.

We keep answers from voluntary surveys in identifiable form for no longer than 12 months from submission. After that we anonymise or delete them, including operational copies; we keep only aggregated results from which no individual can be identified.

Overview of retention periods:

• User account and related data: for as long as the account exists. Upon its deletion, without undue delay and no later than within 30 days, we delete the personal data associated with registration (email, name, profile photo) and anonymise the remaining data by assigning it a new random identifier, so that it can no longer be linked to you.
• Guest account: we retain the guest technical identifier (a random UUID) for as long as you actively use it; after 30 days of inactivity, we automatically delete it, or anonymise it by assigning a new random UUID. Clearing your device cache or uninstalling the app will cause you to lose access to the account from your device sooner, but the record itself remains stored on our servers until this period elapses. In both cases, the data can no longer be linked to a specific device or person.
• Records of app usage (onboarding and content progress, referrals, unlocked content, records of app launches and usage): for as long as the account exists, and thereafter in anonymised form.
• Notifications: we keep the push token until you turn notifications off or for as long as your account exists; it is deleted together with the account.
• E-shop orders and the consent record: 10 years from the purchase, because they form part of accounting and tax records and serve to demonstrate that we have met our obligations towards consumers.
• Download access: the download link is valid for 30 days from the purchase; we keep the hash of the access code and the data on link openings together with the order.
• Game reviews: published reviews until you withdraw your consent or we remove the review; rejected reviews are deleted no later than 30 days after the decision.
• Customer support communication: for the time needed to handle your request and then 3 years, when it may be needed to resolve possible claims (for complaints and withdrawals from the contract); ordinary questions are deleted sooner, once we no longer need them.
• Technical and operational logs: access and operational logs at Supabase, 7 days from creation; error logs at Sentry, 30 days from creation; website access and error logs at Websupport, 14 days.
• Accounting and tax records: 10 years from the date of the transaction, pursuant to accounting and tax legislation.
• Email for sending newsletters: until you opt out of the newsletter or withdraw your consent; for app users at most for as long as the account exists. After you unsubscribe, we keep only your email address on the list of unsubscribed addresses, so that we don't send you the newsletter again by mistake.

In exceptional cases we may retain data for longer if required by law, by a decision of a public authority, or if necessary to resolve a legal dispute. Once the reason for retention ceases to exist, we will delete the data without undue delay.

05 Your rights

We want you to be in control of your data. Under the GDPR, you have the following rights:

• Access: you may request information about what data we process about you and obtain a copy of it.
• Rectification: you may request correction of inaccurate data or completion of incomplete data.
• Erasure: you may request deletion of your data if there is no longer a reason for its processing. We cannot carry out erasure if we need the data to comply with a legal obligation (for example accounting records for an e-shop order) or to defend legal claims. You may also delete your app account, including all data, at any time directly in the app.
• Restriction of processing: you may request that we temporarily stop using your data, for example if you dispute its accuracy.
• Data portability: you may request an export of the data you provided to us, in a machine-readable format.
• Objection: you may object to processing based on legitimate interest, including the sending of newsletters. Once we receive your objection, we will reassess the processing, or stop sending newsletters, as applicable.
• Withdrawal of consent: if processing is based on your consent (newsletter, game reviews), you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Not to be subject to automated decision-making: Takyo does not use automated decision-making that would have legal effects on you or similarly significantly affect you, nor do we create advertising profiles based on your data. Fraud checks that Stripe carries out during payment as an independent controller are governed by its own policy.

You may exercise your rights by sending a request from the email address to which the personal data relates, to ola@takyo.cz. For an e-shop purchase, please state the email address used for the purchase. We will respond to your request without undue delay, and no later than within 30 days; in more complex cases we may extend this period by a further two months, of which we will inform you. Exercising your rights is free of charge; we may only charge a reasonable fee or refuse a request in the case of manifestly unfounded or excessive requests.

If you believe that we are processing your data in violation of applicable law, you have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic; phone: +420 234 514 111; email: posta@uoou.cz; www.uoou.cz). You may also lodge a complaint with the supervisory authority in another EU member state (in Slovakia, the Office for Personal Data Protection of the Slovak Republic, www.dataprotection.gov.sk); a list of authorities can be found on the website of the European Data Protection Board. We would, however, appreciate the opportunity to address your concerns directly first.

06 Final provisions

We may update this Policy from time to time, for example when adding new features or products or when changing service providers. We will inform you of material changes in the app or by email; the current version is always available at www.takyo.cz. The effective date of the current version is stated in the header of this document.

The Takyo app is intended for persons who have reached the age of 16; if you live outside the European Economic Area, the United Kingdom and Switzerland, the minimum age is 13. Persons over 18 may buy in the e-shop; younger persons only with the consent of their legal guardian. The children's games from the e-shop are played by children together with an adult; we do not process any personal data about the children who play them. We do not knowingly process the personal data of persons who do not meet the stated age; if we discover that such processing has occurred, we will delete the data without undue delay.

The processing of personal data and this Policy are governed by the laws of the Czech Republic and directly applicable European Union law, in particular the GDPR.

This Policy is drawn up in the Czech and English languages; in the event of any discrepancy between the language versions, the Czech version shall prevail.