Privacy policy
This policy explains what personal data Snaptapp (“Snaptapp”, “we”, “us”) collects when you use our websites and applications, why we collect it, who processes it on our behalf, and what you can do about it. It applies to snaptapp.us, to More or Less, and to any future Snaptapp product that links to this page.
Contents
1. Who is responsible
Snaptapp is the data controller for the personal data described in this policy. For any privacy matter, write to privacy@snaptapp.us. We do not currently operate in a jurisdiction that requires us to appoint a data protection officer; the founding partners handle privacy requests directly.
2. Data we collect
Account data
If you create an account, we collect the email address and password hash held by our authentication provider, or — if you sign in with Google — the email address, display name, and profile image URL that Google returns. We also store the display name you choose in the product and any avatar you upload.
Gameplay data
Scores, correct and incorrect answers, response times, streaks, daily challenge results, head-to-head challenge outcomes, leaderboard standings, room membership while a multiplayer session is active, and the topics you enter. This is the data the product is made of; without it there is no streak to continue and no leaderboard to appear on.
Device and technical data
Device or browser model, operating system version, app version, language and region settings, coarse location inferred from your IP address at the network level, crash reports and stack traces, performance traces such as start-up and network timings, and diagnostic logs. IP addresses are processed by our edge network for delivery, rate limiting, and abuse prevention.
Advertising identifiers
On iOS and Android only, the advertising SDK we use may access your device advertising identifier and limited device signals in order to select and measure ads. See section 6. The web version of More or Less does not serve advertising.
Anti-abuse signals
We use device attestation and bot-detection services to confirm that requests come from a genuine app or browser rather than a script. These produce a signed token and a pass or fail result; they are not used to build a profile of you.
What we do not collect
We do not collect precise GPS location, contacts, photos beyond an avatar you deliberately upload, microphone or camera input, health data, or biometric data. We do not ask for payment card numbers — see section 5.
3. Why we use it
| Purpose | Data used |
|---|---|
| Create and authenticate your account | Account data |
| Run games, rooms, streaks, and leaderboards | Account data, gameplay data |
| Generate rounds for a custom topic you type | The topic text you entered |
| Diagnose crashes and fix defects | Device and technical data |
| Measure which features are used, in aggregate | Analytics events, device data |
| Prevent abuse, cheating, and quota exhaustion | Anti-abuse signals, IP address, account identifier |
| Serve and measure advertising on mobile | Advertising identifier, device signals |
| Answer your support and privacy requests | Your email and the contents of your message |
| Meet legal and tax obligations | Transaction records, where applicable |
We do not use your personal data to train our own machine-learning models, and we do not make automated decisions that have legal effects on you.
4. Legal bases
If you are in the United Kingdom, the European Economic Area, or another region with equivalent law, we rely on the following bases:
- Contract — providing the product you asked for: accounts, gameplay, rooms, leaderboards, and support.
- Legitimate interests — keeping the service secure and available, preventing abuse, fixing defects, and understanding aggregate feature use.
- Consent — personalised advertising and any optional analytics where consent is required. You can withdraw it at any time in your device settings or by contacting us.
- Legal obligation — retaining records we are required to keep.
5. Who we share it with
We do not sell personal data and we do not share it for cross-context behavioural advertising outside the advertising described in section 6. We use the following processors and service providers, each under contract and each limited to the purpose listed:
| Provider | What it does for us |
|---|---|
| Google — Firebase (privacy) | Authentication, profile and gameplay database, file storage, analytics, crash reporting, performance monitoring, remote configuration, in-app messaging, and app attestation |
| Google Cloud — Vertex AI (privacy) | Generating trivia rounds from a custom topic, and hosting the service that does it |
| Google AdMob (policy) | Serving and measuring advertising in the mobile apps |
| Cloudflare (privacy) | Website and API delivery, edge caching, real-time multiplayer sessions, bot detection, cookieless website analytics, and email routing for our published addresses |
| Bugfender (privacy) | Remote diagnostic logging from the app during faults |
| Apple and Google app stores | Distributing the mobile apps and, where a purchase is offered, processing payment. We never receive your card details |
We may also disclose data where we are legally required to, to enforce our terms of service, or to protect the rights and safety of our users. If Snaptapp is ever involved in a merger or acquisition, we will give notice on this page before personal data becomes subject to a different policy.
6. Advertising
More or Less is free to play. The iOS and Android builds show interstitial and rewarded advertising supplied by Google AdMob to cover running costs. The web version does not serve ads.
You control this:
- iOS — Settings › Privacy & Security › Tracking. Declining App Tracking Transparency limits ads to non-personalised.
- Android — Settings › Google › Ads, where you can delete or opt out of the advertising ID.
- Anywhere — Google's own controls at adssettings.google.com.
Opting out does not remove advertising; it makes the advertising you see non-personalised.
7. Custom topics and generated content
When you type a custom topic, that text is checked by a content filter and, if it is not already covered by our curated fact bank, sent to a Google generative model on Vertex AI together with instructions to produce trivia rounds. The model is also permitted to run web searches to ground the numbers it returns.
We send the topic text and nothing about your identity. We do not send your email address, account identifier, or device identifiers to the model. Generated rounds may be cached at our edge and reused for other players who enter the same topic.
Generated facts are checked automatically and rejected when they fail our rules, but no automated check is perfect. If you spot an error, please tell us.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | Until you delete your account |
| Gameplay history, streaks, leaderboard entries | Until you delete your account |
| Crash reports and performance traces | Up to 90 days |
| Diagnostic logs | Up to 30 days |
| Cached generated rounds | Up to 30 days, and not linked to any account |
| Support and privacy correspondence | Up to 24 months |
| Records required by law | The statutory period and no longer |
9. Your rights
Depending on where you live, you have some or all of the following rights:
- Know what personal data we hold and get a copy of it
- Correct data that is wrong
- Delete your data
- Restrict or object to certain processing
- Withdraw consent you previously gave
- Receive your data in a portable format
- Not be discriminated against for exercising any of these rights
To exercise any of them, email privacy@snaptapp.us from the address on your account. The step-by-step process for access and deletion is on our support page. We respond within 30 days. There is no charge, and we will not ask you to create an account in order to make a request.
California residents: we do not sell or share personal information as those terms are defined by the CCPA as amended by the CPRA, and we do not process sensitive personal information for the purpose of inferring characteristics. You may use an authorised agent, and we will verify their authority before acting.
If you are in the UK or EEA and you think we have got this wrong, you can complain to your national supervisory authority. We would rather you told us first so we can fix it.
10. Children
Our products are not directed to children under 13, and we do not knowingly collect personal data from them. Where local law sets a higher age for consent to data processing — 16 in parts of the EEA — that age applies instead. If you believe a child has given us personal data, email privacy@snaptapp.us and we will delete the account and its data promptly.
11. International transfers
We operate from the United States and our providers run globally distributed infrastructure, so your data may be processed outside your country. Where data leaves the UK or EEA, our providers rely on the European Commission's standard contractual clauses or another approved transfer mechanism. You can ask us which one applies to a particular provider.
12. Security
All traffic to our sites and APIs is encrypted in transit with TLS. Access to production data is limited to the founding partners and protected by multi-factor authentication. Server-side rules restrict every account to reading and writing only its own records, and requests are attested and rate limited before they reach our services.
No system is perfect. If you find a weakness, please report it to security@snaptapp.us — our policy is at /.well-known/security.txt. If a breach ever affects your personal data, we will notify you and any required regulator within the legally mandated timeframe.
13. Changes
When this policy changes we update the effective date and the version at the top of this page. For changes that materially reduce your rights or expand what we collect, we will give notice in the product or by email before they take effect. Previous versions are available on request.
14. Contact
Privacy and data requests:
privacy@snaptapp.us
General enquiries: hello@snaptapp.us
Security: security@snaptapp.us
This policy is provided in good faith and describes our actual practice. It is not legal advice, and it is not a substitute for review by a qualified lawyer in your jurisdiction.