Vampires & Villagers
Privacy Policy
Applies to the mobile app Vampires & Villagers Online (bundle
identifier com.vampireandvillagers.app) and to this website.
Last updated: 16 August 2026 · Effective: 16 August 2026
The short version. There is no sign-up. You never give us an email address, a phone number or a real name. The app carries no advertising, no analytics and no crash-reporting SDK, and it does not track you across other apps or websites. What we store is the nickname you type, an anonymous account number, and the state of the games you play.
1. Who is responsible
The app is published by an independent developer. For anything in this policy — questions, access requests, deletion requests, complaints — write to necipaky@icloud.com. That address is read by the person who maintains the app.
2. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Anonymous account identifier — a random UUID created the first time you open the app | To tell players in a room apart, to know whose turn it is, and to attach a purchase to you | Performance of the service |
| Nickname — the 2–16 characters you type | So the other players at your table can see who is who | Performance of the service |
| Game records — which room you joined, your seat, your role, the actions you took at night, votes, and timestamps | The game itself: the engine resolves each night and day from these records | Performance of the service |
| Purchase status — whether the one-time VIP purchase is active | To unlock what you paid for, on any device you sign in from | Performance of a contract |
3. What we do not collect
No email address, phone number, real name, postal address or date of birth. No location. No contacts, calendar, photos, camera or microphone access. No device identifier, no advertising identifier (IDFA/AAID), no fingerprinting. No push notification token. No browsing or search history. No analytics events and no crash reports. No payment card details ever reach us — Apple and Google process payments and only tell us that a purchase exists.
We do not track you. The app contains no advertising SDK, no attribution SDK and no analytics SDK, and it does not ask for the App Tracking Transparency permission. Nothing about you is shared with data brokers or used to build a profile.
4. Your nickname is visible to the other players
This is how the game works: everyone in a room sees everyone else's nickname, and it also appears in the narration of the night ("… was found at dawn"). Rooms are private — they can only be joined with the five-character code someone reads out at the table — but if you share that code publicly, strangers who use it will see your nickname.
So: do not use your full legal name, an email address, a phone number or anything else you would not say out loud at the table. You can change your nickname at any time in Settings; note that rooms you have already joined keep the name you had when you joined.
5. What is stored on your phone
Some things never leave the device. The app stores locally: your nickname, your language, appearance, sound and haptics preferences, whether you have finished the intro, the code of the last room you were in, your login token, and a short-lived cache of your profile so the app opens without a network round trip. Deleting the app removes all of it.
6. Who processes data on our behalf
| Provider | What it does |
|---|---|
| Supabase | Hosting, database and anonymous authentication. Everything in section 2 is stored here. Supabase also sees the IP address your phone connects from, in order to rate-limit abuse; that address is not stored in our tables and we do not use it. |
| RevenueCat | Verifies the one-time purchase with Apple and tells the app whether it is active. It receives your anonymous account identifier and the purchase, nothing else — no nickname, no email, no device identifier. |
| Apple (and, for the Android version, Google) | Processes the payment and issues the receipt, under its own privacy policy. We never see your payment details. |
| Vercel | Hosts this website only. It does not receive anything from the app. |
These providers operate servers outside your country, including in the United States. Transfers rely on the providers' own standard contractual clauses. We do not sell data to anyone, and we do not share it for advertising.
7. How long anything is kept
- Finished and abandoned games are deleted 48 hours after they end. An automatic hourly job removes the room together with its players, night actions and narration. A lobby that nobody starts is treated as abandoned after two hours.
- Your profile row — the anonymous identifier, the current nickname and the purchase flag — is kept while the app is installed, so that your purchase and your name survive a restart. It is removed when you request deletion (section 8).
- Purchase records held by Apple and RevenueCat follow their own retention rules; those are also our proof that you own what you bought.
8. Deleting your data
Open Settings → Delete my data in the app. This immediately erases everything held on your device — nickname, preferences and login token — and signs you out. Because accounts are anonymous, signing out is final: there is no password or email that could get you back into that account.
The request is then processed manually within 48 hours, after which the profile row and any remaining game records are removed from the server. If you want written confirmation, or if you deleted the app before making the request, write to necipaky@icloud.com and say so — please include the date you used the app and the nickname you used, since we have no other way to find an anonymous account.
9. Children
The game is rated 12+ for mild thematic violence — it is about accusing people and voting them out — and it is not directed at children under 13. We do not knowingly collect data from them. If you believe a child has done so, write to necipaky@icloud.com and it will be deleted.
10. Your rights
Depending on where you live (GDPR in the EU/UK, KVKK in Türkiye, and comparable laws elsewhere) you may ask us to confirm what we hold about you, to correct it, to delete it, to restrict or object to its use, or to hand it over in a portable form. Write to necipaky@icloud.com; we answer within 30 days. You also have the right to complain to your national data protection authority.
One practical limit, stated plainly: accounts are anonymous by design. We hold nothing that links a row in our database to you as a person, so to act on a request we need you to identify the account from inside the app.
11. Security
All traffic between the app and the server is encrypted in transit (TLS). The database enforces row-level security: a player can only read the rooms they are actually in, and no client can write game state directly — every move goes through a server-side function that checks whose turn it is. No system is perfect, and we make no absolute guarantee.
12. Changes to this policy
If this policy changes, the date at the top changes with it and the new version appears here. Changes that materially affect what we collect will also be announced in the app's release notes.
13. Contact
Questions, requests, complaints: necipaky@icloud.com.