1. Scope and contact
This policy covers the JustABitSmarter iPhone app operated by Nextify Technologies Limited. Contact Info@nextify.space for privacy requests and support. Other company products and the private web preview have separate data flows. This page does not grant access to the private game.
2. Accounts and sign-in
Email accounts supply an email address and password to Supabase Auth for authentication, verification and password resets. We keep an account identifier, player name and sign-in information. Email is the currently visible sign-in method. Google is configured on the backend but its button is not shown in this app version; Apple and Facebook sign-in are unavailable. If enabled later, Google sign-in requests only openid, email and profile for identity, which may return a name, email, profile image URL and Google identifier. It does not request Gmail, Drive or contacts access.
3. Game records and public information
We process answers, question identifiers, scores, timing, progress, game admissions and multiplayer records for synchronization, rankings, gameplay rules and abuse prevention. Public rankings may expose a player name, account identifier, score and timing. Other personal saves are available to their owner and authorized administrators. The default name is the part of the email before @ and may disclose personal information; review it in My Account. Players can change it once, and report inappropriate names to support.
4. Children and parents
The updated app asks for an age group stored on the device, not a full birth date. Under-18 players currently have offline guest play only: no accounts, ads, purchases, analytics or account requests. Epic Kids Web Services (KWS) is prepared for integration but inactive; no parent or child data is sent to KWS. Future child online accounts require verified parent identity, direct notice, explicit consent, withdrawal and deletion controls. Ordinary email verification, or adult verification alone, is not parental consent.
5. Advertising and optional analytics
Google AdMob provides rewarded ads. Debug builds use official test ads; Release builds configure the production unit, with delivery subject to Google review and privacy consent. Requests use the non-personalized parameter and UMP handles applicable regional consent. Production ads are blocked when privacy permission is unavailable. The SDK may still process IP addresses, device identifiers, diagnostics, performance and ad interactions; non-personalized does not mean no data collection. The app does not request ATT cross-app tracking permission or directly read IDFA. Adults can use available ad privacy options in Settings. Optional category-click, page and interaction analytics are off by default and can be disabled, clearing the unsent queue. Necessary gameplay, security and transaction records are separate.
6. Purchases and entitlements
Apple handles in-app purchases and payment card information; we do not receive card numbers. The server verifies Apple-signed product, transaction identifier, status, amount, currency and account binding. Permanent ad removal is a one-time purchase linked to the original game account and is not automatically transferable after account deletion. Deleting the game account does not delete Apple’s own purchase records or refund processes.
7. Retention and backups
“Seven years” applies only to production purchase, refund and accounting records, not all member data. Purchases are retained for seven years from the verified Apple transaction completion date; refunds/revocations from the first verified server observation of that event. Resynchronization does not extend the original period. The separate ledger keeps transaction/product identifiers, amount, currency, status and completion dates, without member UUIDs, email, names or card data. Transaction identifiers remain protected data. A daily job removes expired records. Member and gameplay data remain until account deletion; optional analytics for up to 90 days; minimal deletion receipts used to prevent restoration of deleted accounts for 32 days. Current Pro daily database backups rotate over up to seven days with PITR disabled and cannot be erased row by row immediately. Pre-deletion copies expire through rotation. Before restoring a backup, operators must export current deletion receipts, then reapply deletions and expiry before reopening service. Provider security logs and Apple/Google records follow their own policies; deleting an account does not instantly erase all their copies.
8. Deletion and privacy rights
In My Account → Delete Account, enter DELETE to confirm; recent sign-in may be required. The app calls the server to permanently delete the Auth account and associated cloud saves, completion progress, rankings, multiplayer data, member purchase links and personal analytics, then clears that member’s local credentials and cache. Signing out ends the session and does not delete data. The separate accounting ledger and short-lived deletion receipts are the exceptions described above. If the app is unavailable, email Info@nextify.space to request access, correction, deletion or consent withdrawal. We verify identity first; do not send passwords, full card details or sign-in links.
9. Providers, international processing and security
Supabase provides authentication, database, image storage and Edge Functions. The game database is configured in Singapore (ap-southeast-1); network-edge and support processing are not guaranteed to remain there. Resend sends verification and password-reset emails over SMTP, processing email addresses, message content and delivery status. Google handles ads and sign-in when enabled; Apple handles the store, payments and transaction verification. These global providers may process data in the United States and other jurisdictions; a single processing region has not been verified for them. We use HTTPS, Keychain credential storage, access controls and server verification, but no system is completely secure. We do not sell member data.
10. Device storage and updates
Offline progress, settings, age group and analytics choices are stored locally; adult sign-in credentials use the system Keychain. Health questions are general knowledge entertainment, do not collect medical records and do not replace medical advice. Topic names do not imply endorsement by a brand or person. Updates show a revision date; material changes in use will be notified and renewed consent obtained where needed.