Who operates Paranoia
Paranoia is the controller for the online account, multiplayer, purchase-verification and safety data described here. We operate from England and Wales. Contact support@paranoiagame.app for privacy requests or postal contact details.
What we process
Online play requires Game Center on iPhone and iPad, or Google Play Games on Android. Apple or Google supplies a signed player identifier; we verify it, immediately transform it with a keyed one-way hash, and do not retain the raw identifier. We issue an internal account ID and an account token that links your purchases to it.
We process player display names, room membership, consent choices, reports, blocks, enforcement facts, and the App Store transaction identifiers or Google Play purchase references needed to verify non-consumable purchases. For notifications, we process a random installation ID, an encrypted push token (from the Apple Push Notification service on iPhone and iPad, or Firebase Cloud Messaging on Android), its one-way fingerprint, app version and build, device family, locale, time zone, notification preferences, and delivery/read/open status. An installation is linked to an online account only after you sign in to online play. Moderators can see who is in rooms that are open right now, and can search the names players used online in the last 90 days, with when each was used, how many rooms it was used in and the last room code. We don't keep a record of who played with whom. We also process hashed network addresses and redacted security events to prevent abuse. We do not sell personal data, use advertising identifiers or track people across apps or websites.
When you play online, we look up the country your connection comes from using your IP address. We keep only the country, not the address. When you buy something on iPhone or iPad, we also keep the country of your App Store account. Moderators use these to understand where players are.
We also record the app version and the iOS or Android version you play on, and which accounts have used the same device, so moderators can spot someone returning after a ban. We count game events, such as how often each card is played or skipped, without linking them to anyone.
If you leave “Share anonymous play stats” on (Settings › Privacy & Data), the app counts your pass-the-phone games on your device: how many, how long, the number of players, the decks and settings, how rounds ended and how often each built-in card was played or skipped. From version 2.2 it also counts how the app itself is doing: crashes and hangs reported by Apple’s MetricKit on iPhone and iPad, errors such as failed joins, first steps such as the tutorial, where the shop was opened from and whether a purchase finished, which product pages were opened, which settings and comfort options are on, your phone’s language and how long the first question took to appear. Once a day it sends those totals with no name, answers, account or device ID. We use the IP address of that upload only to look up the country, then discard it. Switching the setting off stops this and deletes anything not yet sent.
Live rooms
Authoritative room state, hashed resume tokens, command receipts and host-reviewed custom room content are held temporarily so a room can recover safely after a disconnect or service restart. Rooms expire after no more than four hours.
Secret bundled content is represented by content ID wherever possible and question text is not copied into ordinary logs. When you report a safety concern, we save encrypted evidence with it so a moderator can see what happened: a snapshot of the room (who was in it, when people joined, left, were removed, were blocked or changed their name, the room settings and the limits each person agreed to), the question or forfeit on screen and who was named, and any custom cards that were played or reported, with their authors. It includes display names and internal account identifiers. This information helps moderators understand and act on the report.
Website messages and the Android list
If you use the contact form, we process your name, email address, the category you choose, your message and any room code or app version you add, together with the page you came from and a basic description of your device. We use them only to reply to you and handle your request, and they are delivered to our support mailbox. To limit repeated submissions, the form checks your IP address; the contact service does not store it.
If you join the Android list, we store your email address and the date you joined, and use it for one purpose: telling you about Paranoia on Android. We send one confirmation email when you join and one email when Paranoia launches on Android. After the launch email is sent, the list is deleted. Only our administrators can see the list, and our team is told how many people have joined, not who. You can ask us to remove your address at any time by contacting support.
We rely on our legitimate interest in answering you for website messages, and on your consent for the Android list.
Why we process data
We use account and room data to perform the online service contract; purchase records to perform that contract and meet tax, accounting, fraud-prevention and legal obligations; and safety reports, blocks and security records for our legitimate interests in protecting players and the service. Notification installation and interaction data lets us deliver the online-game and account alerts you keep switched on, send rare service notices about outages, maintenance, required updates, policy or security, diagnose delivery, and record whether an inbox message was read or opened. Account messages always stay in your in-app inbox; the setting only controls the alert. Game night and come back reminders are scheduled on your device and never involve our servers. If you separately enable News & offers, we may also use account, device, purchase and interaction data to select, deliver and measure first-party product, content or offer announcements, at most one a week and never between 21:00 and 09:00 in your time zone. News is off by default and can be withdrawn at any time. We rely on consent where the law requires it.
We do not make decisions with legal or similarly significant effects using solely automated processing.
Retention
- Online account and purchase ledger: while the account is active. After deletion, purchase facts may remain pseudonymously for up to six years for refunds, fraud prevention and legal records.
- To prevent an existing restriction or another player’s block being bypassed by deleting and recreating an account, we retain a keyed one-way identity hash, the previous internal account link and necessary enforcement facts for up to 90 days after deletion. Deleting again within that period does not extend it. Display names are removed from retained block labels. This record is not used to restore the deleted account, purchases or gameplay history.
- Account warnings and player-facing restriction notices: 90 days, or until account deletion. Appeals and website safety/privacy messages follow the moderation evidence schedule.
- App Store notification metadata: 180 days. Raw signed payloads are not stored.
- Notification messages: until their expiry or 90 days, whichever comes first. Completed, cancelled or failed campaign summaries: 180 days.
- Notification installations: while active and seen within the last 180 days. Disabled or invalid installations are deleted within 30 days; any installation not seen for 180 days is deleted automatically.
- Names used online, with when each was used, room counts and the last room code: while the account is active, and for 90 days after it is deleted.
- Online room records (who was in a room, when, its settings and what happened, never cards or answers): while the players’ accounts are active, and for 90 days after an account is deleted.
- Countries seen for your account (from connections and App Store purchases): while the account is active, and for 90 days after it is deleted.
- App and system (iOS or Android) version, and accounts used on the same device: while the account is active, and for 90 days after it is deleted.
- Game statistics that aren't linked to anyone, such as how often each card is played: kept for as long as they're useful.
- Resolved or dismissed moderation evidence: 30 days after the case is closed. Open or reviewing evidence: 90 days. Formally escalated evidence remains until explicitly resolved, then the 30-day period begins.
- Security audit events: 14 days. Redacted operational logs: 7 days. Sent moderation outbox records: 30 days.
- Live rooms and unreported custom content: no more than four hours.
- Website contact messages: while we handle your request, and for up to 12 months after our last reply.
- Android list: until the launch email is sent, then deleted. The confirmation email is not kept.
Security and sharing
Moderation evidence and push tokens are protected with authenticated encryption. Administrative access requires a username, a strong password and an expiring verification code delivered by email. Sessions are revocable and sensitive actions are recorded in a security audit trail. We use Apple for Game Center, App Store and push-notification services on iPhone and iPad, Google for Google Play Games, Google Play and push-notification services on Android, and infrastructure and mail providers acting on our instructions. We may disclose data where law requires it or to protect people from credible harm.
International services
Apple, Google and infrastructure providers may process data outside the UK. Where required, we rely on an adequacy decision or approved contractual safeguards. Contact support for information about the safeguard relevant to your request.
Your rights
Depending on your location, you may ask for access, correction, deletion, restriction or portability, object to processing, or withdraw consent where consent applies. You may complain to the UK Information Commissioner. Review your options on the Privacy Choices page. Account deletion is available in the app and through our account deletion instructions.
Children, cookies and tracking
Paranoia is intended only for adults aged 18 or over. This website does not use advertising cookies, analytics cookies or cross-site tracking. We count page visits and App Store taps on our own server, by country only: no cookies, no identifiers. Your IP address is used only to work out the country and is never stored.