Privacy Policy

What we collect

• An account identifier.When you first use Thatafy we set an anonymous, randomly-generated id in a cookie on your device. It isn't linked to your name, email, or any other real-world identity unless you choose to give us one (see below).
• Gameplay and vote history. Which songs you pick in a battle, your streaks and stats, and — separately — an anonymised record of individual battle picks (winner and loser song, which playlist or daily heat it was part of, a rough country-level region, and the same anonymous device id above). We use this to run the game itself and to understand, in aggregate, how people play.
• Cookieless analytics.We use Vercel Analytics for basic, aggregate page-view statistics. It doesn't use tracking cookies and doesn't build an individual profile of you.
• Country-level region.Derived from your network connection when you play (e.g. "GB", "US") — never a precise location, and never stored alongside anything that identifies you personally.
• Optional account recovery. If you choose to save a sign-in code so you can use Thatafy on another device, that code (and a username we generate for you — never your real name) is stored against your account.

What we don't collect

We don't ask for your name, date of birth, or precise location. We don't use advertising trackers or sell any data to third parties.

Why we process this (lawful basis)

• Legitimate interests — running the core game, keeping your streak and stats working across visits, preventing abuse of features like challenge links and voting.
• Consent — appearing on the public leaderboard, shown by default once you have a username but easy to turn off any time from the account menu (see below).

Who processes it for us

We use two infrastructure providers to run Thatafy, both of which process data on our behalf under their own data processing terms:

• Vercel — hosting, and the cookieless analytics described above.
• Neon — our database, where account and gameplay data is stored.

Song titles, artwork, and preview audio come directly from Apple Music/the iTunes API and are Apple's content, governed by Apple's own terms — see our Terms.

How long we keep it

Account and gameplay data is kept for as long as your account exists. Our anonymised vote-history archive is kept indefinitely as a long-term record of aggregate play patterns — it's not linked to any personal identity beyond the same anonymous device id used elsewhere. You can ask us to delete your account and associated data at any time using the contact details below.

Your rights

If you're in the UK or EU, UK GDPR and EU GDPR give you the right to access, correct, delete, or export your data, and to object to or restrict certain processing. To exercise any of these, email us (below) with your account's username or sign-in code so we can find your data.

Contact

Questions or requests about your data: privacy@thatafy.co.uk