This policy explains what personal data we process in the YoDuel game, for what purposes, on what legal bases, and how you can exercise control over your data, in compliance with the EU Regulation 2016/679 (GDPR) and Italian law.
Password: stored hashed with bcrypt, unreadable even by us
Cowboy name (public nickname shown in duels and leaderboards)
Avatar / profile photo (optional, uploaded by you). See dedicated section 2.5.
Device ID (random local identifier, not tied to hardware)
2.2 Gameplay data
Duel statistics (wins, losses, best reaction time)
Actions recorded during each duel (reaction ms, shooting angle, validity)
Tournament participation, brackets, results
Friends / challenges sent and received
Redeemed reload codes
2.3 Location data
GPS coordinates (lat/lng): collected when you use the "Radar" feature to find cowboys nearby
If you grant "Always" permission, we send your position every 3 minutes even with the app in background, to notify you when another cowboy enters the range you configured
We only store the latest position, no history: each update overwrites the previous
2.4 Push notifications
FCM token (Firebase Cloud Messaging) / APNs token (Apple): anonymous device identifier to send you challenge and proximity notifications
2.5 Profile photo (face)
What we collect: if you choose to upload a profile photo we store the image (JPG/PNG/WEBP) on our servers, resized and optimised. Uploading is optional.
Why: the photo is shown as your public avatar (Wanted poster, leaderboards, profile) and unlocks the second ammo magazine in gameplay (from 6 to 12 total bullets). The unlock is permanent: even if you change or remove the photo later, you keep the second magazine.
What we do NOT do:
We do NOT perform face recognition
We do NOT extract or store biometric data (no face embeddings, no face templates, no facial measurements)
We do NOT use artificial intelligence to analyse the photo content
We do NOT identify individuals through the photo
We do NOT send your photo to third-party analysis services (e.g. Amazon Rekognition, Google Vision, Apple Vision)
The image is stored as a standard avatar file, in the same way as any generic avatar. It therefore does not fall under the special categories of data referred to in Art. 9 GDPR (biometric data for the purpose of uniquely identifying a natural person).
Where we store it: on our server in Italy/EU, in a private directory (uploads/avatars/), publicly accessible only through the direct URL of your image (used as the avatar in-game).
How to delete it: by uploading a replacement (the previous one is automatically deleted) or by deleting your account from "Profile → Delete account".
"Upload a face" theme: for consistency with the gameplay we ask you to upload a photo of your face. It is an honour-based request. We do not automatically verify that the image actually depicts a face: you may upload a different type of image if you prefer (e.g. graphic avatar, symbol). The data processing remains exactly as described above.
2.6 Technical data and logs
Access IP address (retained 30 days, required by Italian anti-fraud law)
Login timestamp and last activity
Device type and operating system (aggregate only)
3. Purposes of processing
Purpose
Legal basis
Data used
Providing the game service (auth, duels, tournaments)
Contract performance
Account, gameplay
Showing cowboys in "Radar" range
Consent (location permission)
GPS location
Notifying challenges and nearby cowboys
Consent (notification permission)
Push token
Public leaderboards (cowboy name + wins)
Contract performance / Legitimate interest
Cowboy name, stats
Anti-cheat and dispute resolution
Legitimate interest
Duel logs 30 days
Security / fraud prevention
Legal obligation
IP, access logs
4. Third parties we share data with
Aruba S.p.A. (Italian server hosting) — application data, EU-located
Railway (WebSocket server infrastructure) — real-time session data only, no storage
Google Firebase Cloud Messaging — for push notifications; data transfer to Google (Privacy Shield + SCC)
Apple APNs — for iOS push notifications (handled by Apple)
We do not sell or share your data with third parties for advertising or profiling purposes.
5. Transfers outside EU
Firebase/Google servers may be located in the United States. Transfer occurs under the Standard Contractual Clauses (SCC) approved by the European Commission.
6. Retention periods
Active account: as long as you use the app + 30 days after deletion request
Duel logs: 30 days (anti-cheat)
Access/IP logs: 30 days (legal obligation)
Last GPS position: overwritten on each update, deleted with account
Aggregated leaderboard data (no name): may be retained indefinitely in anonymous form
7. Your rights (GDPR art. 15-22)
Access: request a copy of your data
Rectification: correct inaccurate data (editable from the app)
YoDuel is intended for users aged 13 or older. We do not knowingly collect data from minors under 13. If you find that a minor has created an account, contact us: we delete the account within 48 hours.
9. Security
All communications use HTTPS/TLS
Passwords hashed in DB with bcrypt (cost factor 12)
Session tokens with expiration
No proprietary crypto algorithms — only standard
10. Policy changes
Substantial changes will be notified in-app and via email to the account address. The last update date is shown at the bottom of the page.