Privacy Policy

1. Controller and contact

Controller: Adrian Waltrowski.

For privacy rights and questions contact [email protected].

2. Account and authentication

We process email, opaque user ID, the account name (including a name supplied by Google sign-in), account credentials and authentication/session records, which can include connection IP address and browser user agent as stored by Better Auth to create accounts, sign users in and protect them. Google sign-in, when configured, associates a Google authentication account; Google processes the sign-in under its own terms. Password hashes, tokens and session secrets are never part of self-service export. The basis for core account processing is service performance; security processing may rely on legitimate interests or legal obligations where applicable.

Authentication and verification records persist while needed for the account and security; exact Better Auth record expiry and server-log retention require deployment review.

3. Game and profile state

We process username, display name, optional Google avatar URL, wallet ledger, cart, virtual order snapshots, closet, saved pieces, Dream Piece, challenge completions, Daily Reward and Daily Quiz attempts and answers to provide the simulator. Wallet and order values are fictional. This data normally remains while your account is active and is deleted with the account unless a valid reason requires retention. Core service processing is based on performance of the service agreement.

4. Legal choices and analytics

We record Terms acceptance, age-16 attestation and consent choices by version and time. We do not collect a full birth date for the attestation. Necessary storage supports login, security and your cookie preference. Optional PostHog analytics, autocapture, heatmaps, web vitals and Session Replay run only after Analytics consent. Session Replay masks inputs and sensitive elements. We identify consented users to PostHog by opaque user ID, never email. Withdrawal stops future tracking; it does not itself erase historical PostHog records. The basis for optional analytics is consent.

5. Infrastructure, security and email

Cloudflare may process connection and security data and Turnstile responses to protect forms. Hetzner hosts the application/database. Turnstile is security functionality, not product analytics. We use Resend to deliver transactional account and security email. It may process the recipient email address, message content and delivery metadata. In local development, Mailpit captures these messages without external delivery. Cloudflare Email Routing handles incoming support and privacy email. Security and application logs may contain technical request data. We do not use marketing email consent for transactional mail.

6. Recipients, transfers and retention

Current integrations include Cloudflare, Hetzner, Resend for transactional email, Google OAuth when enabled, and PostHog Cloud EU when configured. Their processing locations, agreements, subprocessors and any international transfers require review of actual accounts and contracts. We do not assert that all data stays in Poland or the EU. Active account state is kept while necessary to operate the account. Account deletion removes local account and game data, consent history and legal acceptances. An external analytics cleanup request retains the old opaque account ID until operator-confirmed erasure, then removes the ID. Provider backups, logs, analytics and email records have separate settings and obligations.

7. Your rights

Subject to applicable conditions you may request access, correction, erasure, restriction, objection and portability where applicable. You may withdraw Analytics consent at any time through Cookie settings. Withdrawal does not affect the lawfulness of processing before you withdrew consent. Use Privacy & Data to download your core FakeRich account and activity data or delete your account. This self-service JSON export does not necessarily include all technical data held by external processors or infrastructure systems. Contact [email protected] for additional access or privacy requests. For inaccessible accounts, former users, disputed data, restriction, objection or portability questions, contact [email protected]. Formal requests are handled within applicable legal timeframes; erasure is not absolute where lawful retention applies. You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO).

8. Children and updates

FakeRich requires users to attest that they are at least 16. We do not ask for a full date of birth. We may update this notice with a new version and date.