Legal

Privacy policy

Effective 14 August 2026 · Last updated 14 August 2026

This policy explains how Avitus IT AB (“we”, “us”) handles personal data in the Who on Earth Am I mobile app and this website. We are the data controller.

Contact: christoffer@avitusit.se

What the app does

Who on Earth Am I is a party guessing game. You can play as a guest, optionally link Google or Apple, buy energy or packs, subscribe to Premium, watch a rewarded ad for a bonus round, and play solo against an AI that answers yes or no.

Data we collect

Account and profile

• A user ID from Firebase Authentication (including anonymous guest accounts).
• Email and name if you sign in with Google or Apple.
• A display name you type for rooms and leaderboards.

Gameplay

• Room state, scores, energy, pack unlocks, and leaderboard entries.
• Names players write for each other during a round (user-generated content stored while the room exists).
• Solo vs AI: the yes/no questions you ask are sent to Google Gemini on our Cloud Functions so the AI can answer.

Purchases

• Purchase and subscription status via Apple, Google Play, and RevenueCat. We do not collect your card number. Stores process payment.

Analytics

• App events and a few person properties (user ID, optional email, subscription tier) via PostHog. We may also use Firebase Analytics.

Advertising

• Google AdMob rewarded ads may collect device identifiers, advertising data, and approximate location inferred by Google, used to show and measure ads. This can be used to track you across apps and websites for advertising.

This website

• Standard hosting logs (IP address, user agent) on Firebase Hosting for security and operations.

Why we use it

• Run the game, rooms, energy, unlocks, and leaderboards.
• Restore purchases and Premium on your account.
• Answer solo questions with Gemini.
• Understand how the app is used and fix problems.
• Show rewarded ads if you choose that path for extra energy.
• Respond to support and legal requests.

Legal bases under GDPR: performance of the contract (providing the app), legitimate interests (security, analytics, improving the game), and consent where required (optional sign-in details, advertising identifiers / ATT on iOS).

Who we share with

We use processors and platforms. We do not sell your personal information.

• Google Firebase (Authentication, Firestore, Cloud Functions, Hosting) — EU region europe-west1 for functions.
• Google Gemini — solo yes/no answers.
• Google AdMob — rewarded ads.
• RevenueCat — purchase status.
• Apple and Google — sign-in and in-app purchases.
• PostHog — product analytics (EU host when configured).

These providers may process data in the United States or other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

How long we keep it

Guest and account data stays while you use the app. If you delete your account in Settings, we delete the profile, energy, pack unlocks, and leaderboard scores we store. Room content is not kept as a long-term archive. Analytics and ads partners keep data under their own retention rules. Backups may take a short time to fully expire.

Your rights

If you are in the EEA, UK, or a similar jurisdiction, you can ask for access, correction, deletion, restriction, objection, or portability, and you can complain to your data protection authority. Email christoffer@avitusit.se.

To delete data we store: open the app → Settings → Delete my account. That does not cancel Apple or Google subscriptions.

Children

The app is a mixed-age party game, but it is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe we have, email us and we will delete it. Parents should supervise play.

Security

We use HTTPS, Firebase security rules, and signed-in access for private data. No method is perfectly secure.

Changes

We may update this policy. The date at the top will change. Continued use after an update means you accept the new policy.