Privacy Policy Vicino

This is a courtesy English translation of the German original (/datenschutz), which is the legally binding version for users in Germany/the EU.

As of: 28 September 2026 · Applies to the app Vicino (iOS and Android, com.slash.vicino).

Contents

1. Controller
2. Overview
3. Anonymous account (Firebase Authentication)
4. Linking your account with Apple/Google
5. Game data, statistics, streaks (Firestore)
6. Leaderboard and display name
7. Reporting and moderation
8. Sharing the word bridge (system share sheet)
9. Server-side processing (Cloud Functions)
10. Puzzle files (Cloud Storage)
11. These legal pages (Firebase Hosting)
12. App Check
13. Advertising, analytics and crash reporting
14. Server logs and audit trails
15. Backups
16. Retention and account deletion
17. Recipients and transfers to third countries
18. Legal bases at a glance
19. Your rights
20. Audience and minors
21. Changes to this notice

1. Controller

Karim Belkacem – SB-Techworks
Lilienthalstr. 38
93049 Regensburg
Germany

E-mail: info@sb-techworks.de

A separate legal notice (Impressum, German § 5 DDG) is available at sb-techworks.de/impressum. A data protection officer has not been appointed, given the scope and size of this operation (Art. 37 GDPR does not require one at this scope of processing).

2. Overview

Short version, details in the following sections:

The app processes no target word and no puzzle solution in a way that relates to you as a person — target words and raw leaderboard data are game content, not personal data. We currently do not use advertising, analytics tools or crash reporting (section 13).

3. Anonymous account (Firebase Authentication)

On first launch, the app automatically signs you in anonymously with Firebase Authentication. This creates a random id that is unique to you (uid). This uid is needed so that your game progress, your statistics and your leaderboard placements can be attributed to you without you having to register with a name, e-mail address or phone number. Without this anonymous sign-in the app cannot load daily-puzzle content, because it works exclusively through server-checked access.

If an anonymous account stays inactive for about 13 months (396 days), an automatic deletion is planned. That clean-up job is still switched off during the closed test and will be switched on before the general store launch.

Legal basis: Art. 6(1)(b) GDPR (providing the game feature you requested).

4. Linking your account with Apple/Google

Optionally, you can link your anonymous account with Sign in with Apple or Sign in with Google. The sole purpose is to back up your game progress across devices — the uid stays the same, no new profile is created. From Apple/Google the app only takes the technical sign-in proof, no additional profile data such as your real name or contact list. If the same Apple/Google address is already linked to another account, the app switches to that existing account after a warning; the previous anonymous account is deleted immediately in that case.

If you sign out of a linked account, the app continues anonymously again; your data is kept and comes back once you sign in again.

Legal basis: Art. 6(1)(b) GDPR (you actively request the linking).

5. Game data, statistics, streaks (Firestore)

For the daily puzzle, only the server (never the app itself) stores the following in Firestore:

• Profile (users/{uid}): display name/pseudonym, creation time, UI language, puzzle language and similar settings.
• Daily-puzzle game saves (users/{uid}/dailyGames/…): your guesses with rank and timestamp, hints used, start/solve time. Only you can read these documents.
• Statistics (users/{uid}/stats/…): puzzles played/solved, current and best streak, average number of guesses.

For Endless and Archive, checking instead runs entirely on your device (open leaderboard files, no server access needed); these game saves never leave your device unless you actively share them (section 8).

Abuse protection: so that leaderboards are not distorted by automated or implausibly fast runs, the server checks a rate limit per guess (at least 250 ms apart, at most 3,000 guesses per daily-puzzle game) and internally flags conspicuous solves (very few guesses, very short time, a large jump in rank) as flagged. This flag only matters for abuse protection and the public leaderboard, it is not otherwise hidden from you.

A multiplayer mode is planned for a later version; once it is available, we will update this notice (section 21).

Legal basis: Art. 6(1)(b) GDPR for the core function, Art. 6(1)(f) GDPR (legitimate interest in a working, fair leaderboard) for the rate limit and plausibility check.

6. Leaderboard and display name

When you solve a daily puzzle, your result (display name or an automatically assigned pseudonym, score, number of guesses, hints needed, duration) can appear on a publicly readable daily leaderboard. By default you get an automatically generated, localised pseudonym (e.g. "Curious Fox 042"); a custom display name is optional and is filtered (a profanity filter across all 5 languages). You can hide yourself from public leaderboards at any time in settings; your result still counts for your own statistics but no longer appears to others.

Conspicuously fast/short solves (section 5) do not appear on the public top list, but still appear in your own statistics.

Legal basis: Art. 6(1)(b) GDPR (you actively take part in the leaderboard and can hide yourself at any time).

7. Reporting and moderation

You can report display names on the leaderboard if you find them inappropriate. A report creates an entry in a server-readable-only queue (no client, not even the reported user, can see it). A human — at launch, the owner in person — reviews open reports with a command-line tool using their own Google credentials and decides (reset the name, ban, or dismiss the report). Every decision is logged (a review log without the reported name/uid in plain text in the note). Every report also automatically expires after at most 180 days even if nobody has decided on it; reports about you or by you are additionally removed immediately with your account deletion (section 16). There is no automatic ban based solely on a number of reports.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a community without abusive display names, App Store guideline 1.2 for user-generated content).

8. Sharing the word bridge (system share sheet)

On the solution screen you can share your "word bridge" (your guess history, without the target word) through your device's own share function (system share sheet), e.g. by mail or messenger. The app itself does not send anything to our servers when you do this; you choose which app receives the text in the system dialog, and that app's own privacy policy then applies to any further processing.

Legal basis: No processing by us takes place here; to the extent handing text to the operating system is considered processing at all, Art. 6(1)(a) GDPR (you actively decide whether and how to share).

9. Server-side processing (Cloud Functions)

Daily-puzzle guesses, hints and the word bridge run through Cloud Functions (Google Cloud, region europe-west3, Frankfurt). This is a deliberate architecture decision: the target words and the corresponding rank data of these protected modes exist only server-side, so they cannot become known in advance by analysing the app's data. Every call requires a valid (anonymous) sign-in and an App Check attestation (section 12). Cloud Functions instances run under a dedicated, least-privilege Google service account (vicino-functions, or — for account deletion — vicino-functions-account, each with only the rights the respective function actually needs).

Legal basis: Art. 6(1)(b) GDPR.

10. Puzzle files (Cloud Storage)

The app loads vocabulary and leaderboard files from two Google Cloud Storage areas:

• Public bucket (Firebase's default bucket, technically located in region US-EAST1): contains only the public puzzle data for Archive and Endless mode (vocabulary, leaderboard binary files). These files contain no personal data, only language data (words, neighbourhood relations). For cost reasons, reading it also requires an (anonymous) sign-in; a direct, unauthenticated download is not provided.
• Private bucket (a separate Google Cloud Storage bucket, region europe-west3, accessible only through Google IAM permissions, never linked to Firebase Storage): contains the protected puzzle data for the daily puzzle. Clients have no direct access to it; only Cloud Functions read from it.

Both storage areas contain exclusively game/language data, no user profiles.

Legal basis: Art. 6(1)(b) GDPR.

11. These legal pages (Firebase Hosting)

This privacy policy and the other legal pages (overview, delete account) are served through Firebase Hosting (Google). Visiting them produces the technical access logs any web server produces (IP address, timestamp, page requested, user agent). These pages themselves use no cookies, no tracking and no embedded third-party content — only a self-hosted font and a stylesheet, both served from the same server (see hosting/README.md, "Security headers"). The Impressum deliberately does not live on this site; it is at sb-techworks.de/impressum (section 1).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the site securely).

12. App Check

So that guesses and hints do not come from manipulated apps, bots or automated scripts, Firebase App Check verifies the authenticity of the app installation: on Android via Play Integrity, on iOS via App Attest. Google or Apple transmit a device/app integrity attestation; no user profile and no persistent device advertising id is transmitted. In development mode (not in the published store build), a debug procedure is used instead.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in abuse and cost protection).

13. Advertising, analytics and crash reporting

We do not currently use advertising, analytics or crash reporting; before that changes, we will update this notice and obtain your consent where required.

14. Server logs and audit trails

Every call to a Cloud Function produces technical application logs (which function, status, language, puzzle number, response time) — deliberately without the target word, guess content or uid in plain text: a redaction step replaces your uid and affected document paths in these logs with placeholders. Retention: 30 days (Google platform default for Cloud Logging).

In addition, two kinds of platform logs arise that are outside our control and cannot be switched off:

• Firebase/Identity Platform audit logs (e.g. "account deleted", "account info changed") name your uid in plain text and are kept by Google for 400 days.
• Request logs of the execution environment (Cloud Run) contain your device's IP address and user agent (but no uid) for 30 days.

Both of these logs remain with Google for the stated duration even after an account deletion — deletion "without any trace" is technically not possible here, which we are explicitly disclosing to you.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operational security, error diagnosis and abuse detection).

15. Backups

For Firestore, daily backups run with a 7-day retention. Deleted data (e.g. after an account deletion) therefore disappears within up to 7 days from these backups too, not immediately.

16. Retention and account deletion

As long as you use the app, your profile, game saves and statistics are kept. An inactive anonymous account is automatically deleted after about 13 months (section 3, subject to the caveat named there).

Deleting your account: In settings, you can delete your account completely. Technically this runs in two steps, so that the deletion is reliably completed even after an interruption:

1. Immediately: your account is blocked for new sign-ins (access tokens already issued are invalidated).
2. After about 65 minutes: your profile, all game saves (dailyGames), your statistics, all leaderboard entries, open and closed reports about or by you, and your moderation history are permanently deleted; your Firebase Auth account is removed.

After completing these two steps, per the architecture no trace of your account remains findable in Firestore or Firebase Authentication — with the exceptions named in sections 14 and 15 (platform audit logs 400 days, IP logs 30 days, backups up to 7 days), plus open reports about you, which separately expire after at most 180 days regardless (section 7). If your account was linked with Apple or Google, the app additionally revokes the sign-in authorisation with that provider (for Apple through re-authentication, for Google through disconnect()).

If you switch your anonymous account to an already existing account through account linking (section 4, conflict case), the previous anonymous account is deleted immediately, not only after 13 months.

Contact channel without the app: For deletion requests, access requests or other privacy matters, if you no longer have the app installed:

info@sb-techworks.de

We confirm receipt and complete the deletion; our internal target is a response within 24 hours.

17. Recipients and transfers to third countries

Processors/recipients of your data:

Where data is transferred to the USA or other countries outside the EU/EEA, this relies on Standard Contractual Clauses (SCCs) from the respective data processing agreement (Google Cloud/Firebase Data Processing Addendum) and/or the respective provider's self-certification under the EU-US Data Privacy Framework (DPF).

18. Legal bases at a glance

• Art. 6(1)(b) GDPR (performance of a contract/pre-contractual measure): anonymous account, game saves, statistics, the daily-puzzle feature, the leaderboard, account linking and deletion — everything you actively use by starting the app or selecting a feature.
• Art. 6(1)(f) GDPR (legitimate interest): abuse and cost protection (App Check, rate limits, plausibility checks), moderation of user-generated display names, operational security/logging, operating these legal pages securely.
• Art. 6(1)(a) GDPR (consent): would only become relevant once we introduce advertising or analytics tools (section 13) — not applicable at present.

19. Your rights

Under the GDPR, as far as the respective requirements are met, you have the right to:

• access the data stored about you (Art. 15 GDPR),
• correct inaccurate data (Art. 16 GDPR),
• erasure ("right to be forgotten", Art. 17 GDPR) — achievable directly in the app via "Delete account", see section 16,
• restrict processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) for data processed automatically on the basis of a consent or a contract,
• object to processing based on legitimate interest (Art. 21 GDPR),
• withdraw a consent with effect for the future (Art. 7(3) GDPR), should we ever collect one from you,
• lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de — the authority responsible for the controller (section 1, Bavaria).

To exercise these rights, contact the details in section 1 or 16.

20. Audience and minors

Vicino targets an audience 16 years and older (because of the German age of consent under Art. 8 GDPR for information-society services). The app is not specifically directed at children under 16 and does not knowingly collect data from them. This age limit is a product decision, not an exhaustive review of every app store/Play child-safety requirement.

21. Changes to this notice

This notice is updated with every material change to data processing, in particular once we introduce advertising, analytics tools or crash reporting (section 13) or release a multiplayer mode (section 5). The version applicable at any time is the one retrievable through the app or the web page at the time you use the app.

Version date: 28 September 2026. Last updated: 28 September 2026.