Obertà Privacy Policy

Last updated: 29 October 2026

Obertà is a party game. This policy explains what data we process, why, for how long, and what your rights are (EU Regulation 2016/679, "GDPR").

Data controller

Nicolai Tana — privacy contact: [email protected] — certified email (PEC): [email protected]

Playing without an account

You can play on a single phone without an account. In that case no personal data leaves the device: the players' names and photos (if you take any) and the settings (sound, language) stay on the phone only.

The "Notify me at launch" list (website)

If you leave your email in the form on oberta.app:

What we keep: the email address, the language (to write to you in Italian or English), the date and time of the sign-up and of the welcome email, and the version of the consent text you accepted, as proof of consent. We do not store your IP address with the email: to stop abuse we keep, for one hour at most, only a fingerprint of the IP hashed with a secret key, then delete it.
Why: only to tell you when Obertà comes out and, rarely, for news about Obertà. No other use, no profiling, no selling or sharing with third parties.
Legal basis: your consent (art. 6.1.a GDPR), given by ticking the box, which is never pre-ticked. You can withdraw it at any time, with no consequences; withdrawal does not affect what was done before.
Signing up: ticking the box and sending the form subscribes you (single opt-in). We keep the time and the exact version of the text you accepted, as proof of consent. You get a welcome email straight away with the unsubscribe link; if the address was already on the list we send nothing. Every subscriber gets the launch email.
Age: you must be at least 14 (art. 2-quinquies of the Italian Privacy Code).
How long: until you unsubscribe, and in any case no longer than 12 months after the game comes out; then we delete the whole list.
Unsubscribing: every email has a one-click unsubscribe link that deletes your address immediately. For access, rectification, erasure or withdrawal of consent you can also write to [email protected].
Who processes it for us: Supabase (database, European Union, Ireland) and Brevo by Sendinblue SAS (sending the emails, France, servers in the European Union).

The website uses no profiling, advertising or analytics cookies and loads no third-party tracking services, which is why there is no cookie banner. Cloudflare, which serves the site, may use strictly necessary technical security cookies to protect it from attacks.

What we process with an online account

Your Apple (or Google) account identifier and the email address provided at sign-in; with Apple this may be a private relay address ("Hide My Email").
If you sign in with email: the address you type. We send you an email with a 6-digit code (and, on phones, a link) to sign in: no password, none stored.
The unique username (handle) you choose and your preferred language.
If you sign in with Steam (desktop app): your SteamID, your Steam profile name and the address of your Steam profile picture, read from your public Steam profile at each sign-in. Only you see your Steam name (we use it to suggest your handle); other players see your Steam picture only if you choose it as your profile picture. We never receive your Steam password.
The platforms linked to your account (Steam, Apple), shown to other players as a small logo next to your name: only yes or no, never the identifier.
Your look (avatar face and clothes).
Level, experience and virtual coins.
Match statistics, missions, medals (achievements) and roles played. Other players see your public file (name, portrait, level and, unless you close it in Settings → Privacy & data → "Public profile", your match numbers, medals and favourite roles); leaderboards show only your name and rank.
Friends and friend requests.
Rooms you join, seats and match history.
Chat messages you write in rooms, automatically moderated (offensive-word filter and rate limits).
Table voice chat, only if you turn it on, in friends rooms: your voice goes out live and is never recorded or transcribed. It travels from your device to the other players through LiveKit (servers in the European Union) while you speak, and is kept nowhere: neither we nor LiveKit store the audio. LiveKit receives only the audio stream, a temporary label for your seat (never your name or account) and technical connection data (IP address).
The coin ledger (coins earned by playing and spent in the shop).
Records of abandoned matches, used for penalties.
The reports you make and the ones made about you (reason, optional note, a copy of the reported message and the name at that time) and the players you blocked. A reported player never learns who reported them; only you see your blocks.
Your device type (for example "iPhone" or "Mac") and the app's build number, to keep only one device active at a time and never deal you a role your version does not know.
If your phone uses Game Center (iPhone) or Google Play Games (Android), or you play on Steam: the medals you unlock are also recorded there, on your account on that platform. We receive nothing from Game Center or Play Games.
Server technical data (IP address, request timestamps) kept by the hosting provider in its logs.

We do not process location, contacts, photos or health data. The microphone is used only for table voice chat: it turns on only if you choose it, and transmits only while you hold the talk button, when the game gives you the floor.

What we do NOT do

No advertising.
No tracking across other apps or websites.
No selling or sharing of data.
No cookies in the app.
No profiling or analytics cookies on the website, hence no cookie banner.
No recording, transcription or analysis of voice.

Why, and on what legal basis

Providing online play, the account, friends, rooms, table voice chat and cosmetics: performance of a contract (art. 6.1.b).
The website's "Notify me at launch" list: consent (art. 6.1.a), which you can withdraw at any time.
Chat moderation, reports and blocks, abandon penalties, cheat and abuse prevention, server security: legitimate interest in a fair and safe game (art. 6.1.f).

How long

Account data: as long as the account exists. If you delete it, we erase it immediately.
Email sign-in code and link: they work for 15 minutes, once, and are useless after that.
Chat messages: 90 days, then deleted automatically.
Table voice chat: nothing is kept. Your voice goes out live and is never recorded or transcribed.
Match and abandon records: as long as the account exists.
Blocks: until you remove them, or as long as both accounts exist.
Reports: as long as the reported account exists. If the reporter deletes their account, the report stays with no link to them.
Coin ledger: as long as the account exists. Nothing in the game is sold for real money, so we keep no payment data.
Technical logs: according to the hosting provider's retention (usually a few days).

Who processes data on our behalf

Supabase Inc. — hosting and database, with servers in the European Union (Ireland, region eu-west-1). Any transfers outside the EU are covered by Standard Contractual Clauses.
LiveKit, Inc. — live transmission of table voice chat (LiveKit Cloud, servers in the European Union). No recording, transcription or storage of audio. Any transfers outside the EU are covered by Standard Contractual Clauses.
Sendinblue SAS (Brevo) — sending the emails of the "Notify me at launch" list and the sign-in code emails (France, servers in the European Union).
Cloudflare, Inc. — serving and protecting the website. Any transfers outside the EU are covered by Standard Contractual Clauses and the EU-US Data Privacy Framework.
Apple Inc. — Sign in with Apple and, on iPhone, Game Center for medals. For Game Center Apple acts as an independent controller under its own policy. There are no purchases in the app.
Google LLC — only if you choose to sign in with Google (Android) or use Google Play Games; for Play Games Google acts as an independent controller under its own policy.
Valve Corporation (Steam) — only if you sign in with Steam: it confirms the sign-in and provides your public Steam profile. Valve acts as an independent controller under its own privacy policy.

Minimum age

Online play includes text and voice chat with other players: you must be at least 14 to use it (art. 2-quinquies of the Italian Privacy Code). Under 14 you can play on a single phone only, without an account.

Your rights

Access and portability: download all your data as JSON from Settings → Privacy & data → "Download my data".
Rectification: change your name, look and profile picture in the app. Your Steam name and picture update from Steam.
Erasure: on your phone, delete your account from Settings → Account → "Delete account"; from PC (Steam), write to [email protected] and we delete it within 30 days.
Withdrawing consent to the website list: the "Remove me from the list" link in every email, or write to [email protected].
Objection and restriction: write to [email protected].
Complaint to the supervisory authority: Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of your EU country.

We answer requests within 30 days.

Changes

If we change this policy we will update the date above and, for important changes, tell you in the app.