Privacy Policy

1. General information

This Privacy Policy sets out the rules for processing the personal data of users of the mobile application InTouch.

InTouch is a companion app to the in-game character's phone. It lets you use some of that phone's features outside the game: read and send messages, listen to voice messages, browse the character's photo gallery, contacts, call history, banking data and events.

Using the app means accepting the rules described in this Privacy Policy.

2. Data controller

The controller of personal data is:

Realm Gaming Marlena Piękoś

Strachocin 1, 57-550 Stronie Śląskie, Poland

Tax ID (NIP): 8811500841

REGON: 521042044

Email: [email protected]

3. Scope of data processed

3.1. Account data

You sign in to the app only with a Discord account (OAuth). The app has no registration of its own and does not store passwords.

The following data from the Discord account is processed:

• Discord user ID,
• Discord username,
• profile picture (avatar),
• email address, if shared by Discord.

3.2. In-game character data

The vast majority of the content visible in the app is data of the player's fictional character, created as part of gameplay (roleplay), not the user's personal data. This includes:

• text messages, reactions and attachments,
• voice messages and voicemail,
• photos from the character's gallery,
• contacts, favourites and the list of blocked numbers,
• the character's call history,
• the character's banking data (accounts, transactions, bills),
• events,
• the character's in-game phone number.

3.3. Technical data

• push notification token, linked to the character's phone number,
• app installation ID on the device, issued by the server,
• device and operating system information needed to deliver notifications,
• device language, used to choose the interface language,
• information on whether a network connection is available.

The controller does not use users' data for marketing, advertising or profiling. The app contains no ads or analytics tools and does not track users across apps.

4. Device permissions

The app uses one system permission: notifications. The user is asked for it after signing in and can revoke it at any time in the device settings.

The app does not use the following device features and does not ask for access to them:

• microphone — the app doesn't record anything,
• camera,
• photo gallery or files on the device,
• contacts saved on the phone,
• location.

Photos and files shown in the app come from the character's gallery on the game server. The app does not upload any files from the device's storage.

5. Messages and attachments

In the app you can send and receive text messages and attach photos from the character's gallery, contacts, GIFs and reactions.

Content sent by users is processed solely to provide the messaging service and ensure the app works properly.

GIFs come from the external KLIPY library. GIF searches go through the controller's servers, while the image files themselves are downloaded by the device directly from KLIPY's servers, which therefore receive the device's IP address and standard technical request data.

6. Voice messages

The app only lets you listen to voice messages and voicemail. Recordings are made on the character's in-game phone — the mobile app records nothing and has no access to the microphone.

Voice message audio files are stored on a CDN indefinitely. They are not deleted automatically, nor can the user delete them from within the app. Specific recordings can be deleted on request sent to the controller at the address given in section 13.

The controller does not analyse the content of voice messages or use it for marketing or user profiling.

7. Push notifications

The app may send push notifications about new messages, voice messages, missed calls and other events on the character's phone.

Notifications may include a preview of the message content — the sender and part or all of the text — which is visible on the device's lock screen. You can limit notifications in the app settings and turn them off completely in the device's system settings.

Delivering a notification requires passing the notification token to the services described in section 10.

If the app is protected with a PIN and has not been unlocked on a given device, that device receives no notifications at all — this is a deliberate safeguard for message content.

8. Data stored on the device

The following is stored on the user's device:

• session and sign-in tokens — in the secure system storage (Keychain / Keystore),
• the installation ID and device trust data, which let you skip the PIN on a trusted device,
• a local copy of recently viewed content (including messages, banking data and the gallery), so the app starts faster,
• the selected interface language.

This data remains on the device until you sign out or uninstall the app.

9. Purpose of processing

Data is processed solely to:

• authenticate the user and link them to their in-game characters,
• enable the use of the app's features,
• carry out communication between characters,
• deliver push notifications,
• secure access to the app (PIN, trusted devices),
• keep users safe and detect abuse,
• maintain and develop the app.

10. Data sharing and recipients

The controller does not sell users' personal data.

Data may be shared only with parties necessary for the app to work:

• Discord — user authentication (Discord's Privacy Policy also applies),
• Expo (Expo Application Services) — relaying push notifications,
• Google (Firebase Cloud Messaging) — delivering notifications to Android devices,
• Apple (Apple Push Notification service) — delivering notifications to iOS devices,
• KLIPY — GIF library, to the extent described in section 5,
• server infrastructure and CDN providers used by the controller.

Data may be disclosed to public authorities where required by law.

Some of the services listed (Expo, Google, Apple, KLIPY) are based outside the European Economic Area. Data is transferred to them on the basis of mechanisms provided for in the GDPR, in particular standard contractual clauses.

11. Data retention period

• Account data — for as long as you use the app, until the account is deleted.
• Push notification tokens — deleted automatically after 90 days of inactivity of the given device, and on sign-out.
• Text messages, photos and other character content — until deleted, or in line with the game server's rules of operation.
• Voice message audio files — indefinitely, as described in section 6.
• Data stored on the device — until you sign out or uninstall the app.

12. Account deletion

To delete your account together with the related data, send a message to [email protected] from the email address linked to the Discord account used in the app, or giving your Discord username.

Deleting the account covers the account data and the link to your characters. Content visible to other users (e.g. messages you sent) may remain in their inboxes, as with other messaging apps. Voice recordings are deleted on explicit request.

13. User rights

Every user has the right to:

• access their data,
• rectify their data,
• erase their data,
• restrict processing,
• data portability,
• object to processing,
• lodge a complaint with the President of the Personal Data Protection Office (UODO).

To exercise your rights or get more information, contact the controller at: [email protected]

14. Age of users

The app is not intended for people under 13. Signing in requires a Discord account, whose terms set the same minimum age. The game server the app connects to may set a higher age limit.

The controller does not knowingly collect data from people under this age. If such a case is found, the data will be deleted.

15. Data security

The controller applies appropriate technical and organisational measures to protect data against unauthorised access, loss, disclosure, alteration or destruction.

In particular:

• data sent between the app and the servers is protected by an encrypted connection,
• sign-in tokens are kept in the device's secure system storage,
• access to the app can additionally be protected with a PIN, and device trust is tied to a specific character phone number,
• a device locked with a PIN does not receive notifications with message content.

16. Changes to the Privacy Policy

The controller reserves the right to make changes to this Privacy Policy.

The current version of the document is always available at the address where it was published. The date of the last update is given at the top of the document.

17. Contact

Realm Gaming Marlena Piękoś

Strachocin 1, 57-550 Stronie Śląskie, Poland

Tax ID (NIP): 8811500841

REGON: 521042044

Email: [email protected]