Privacy Policy

Service: Gamification of Life (the “App”)
Effective date: 30 May 2026
Last updated: 8 June 2026

This Privacy Policy describes how GOL (“we”, “us”, or “our”) collects, uses, and shares information when you use the Gamification of Life mobile application and related backend services. By creating an account you agree to this policy. If you do not agree, do not use the App.

1. Who we are

Gamification of Life is a social gamification platform where users log real-life activities across eight universal categories (fitness, learning, creative, social, etc.), join groups, react to each other’s activities, and earn experience points (XP) and category-specific levels. The App is operated by GOL. The backend is hosted in the European Union.

2. Information we collect

2.1 Information you provide when you sign in

You sign in with Google. We receive the following from Google’s OAuth response:

Your Google account email address
Your name as it appears on your Google profile
Your Google profile picture URL
Your Google account ID (an opaque identifier)

We verify that your email is marked as verified by Google. We do not receive or store your Google password.

2.2 Profile and preferences

A username (auto-generated from your name on first sign-in; you may change it)
Optional profile picture, bio, and other profile fields you choose to edit
Privacy and notification preferences you configure in settings

2.3 Activity content you create

Text descriptions of activities you log
The category you assign to each activity
Photos you attach to activities (uploaded to our image storage; resized and re-encoded server-side)
A “private” flag on each activity (private activities are visible only to you)
Timestamps

2.4 Social graph and engagement

Groups you create, join, or are invited to, and your role in each (admin or member)
Group invitations you send or receive
Reactions you give to other users’ activities (emoji-based, e.g. “Celebrate”, “On Fire”)
“Hype” you give to other users’ activities (tiered: star, fire, diamond)
Notifications generated about your account (invites, reactions, level-ups, etc.)

2.5 Derived gamification data

XP totals per category
Level / tier per category, including badges earned

2.6 Device and technical information

Push notification token (Expo push token) and platform (iOS or Android), if you grant push permission
IP address (transiently, in server access logs)
Approximate request metadata (HTTP method, path, timestamps) in server logs for security and debugging
Authentication tokens we issue to you (access JWT and a hashed refresh token; we never store the raw refresh token)

We do not collect: precise GPS location, contacts, microphone, calendar, health data, payment information, or biometric data. The App has no advertising SDKs and no third-party analytics SDKs at this time.

3. How we use your information

Purpose	What we use	Legal basis (GDPR)
Create and authenticate your account	Google identity, JWT/refresh tokens	Performance of a contract
Show the App’s social features (groups, feeds, reactions, hype, leveling)	Activities, group memberships, reactions, hype, XP/levels	Performance of a contract
Send push notifications (invites, reactions, level-ups, new activities from group mates)	Expo push token, notification events	Consent (push permission) + performance of a contract
Keep the service secure and prevent abuse	Server logs, IP, refresh-token reuse detection	Legitimate interest
Debug and improve the service	Server logs, error traces	Legitimate interest
Comply with legal obligations	As required	Legal obligation

4. How information is shared inside the App

The App is intentionally social. By default, the following is visible to other users in the App:

Your username, display name, and profile picture
Activities you post that are not marked private — visible to members of any group the activity is posted to
Your per-category XP and level — visible to people who share at least one group with you
Reactions and hype you give — visible alongside the activity

Activities you mark as private are visible only to you and cannot receive reactions or hype. You can toggle the private flag at any time on your own activities.

5. Third parties that process data on our behalf

We rely on the following sub-processors. They process data only to provide infrastructure to us and not for their own purposes.

Provider	Purpose	Data	Location
Google Cloud Platform (Cloud Run, Cloud Build, Secret Manager, Cloud Storage)	Application hosting, image storage, secret storage, build pipeline	All backend data, uploaded images	europe-west1 (Belgium)
Neon	Managed PostgreSQL database	All structured account, activity, group, reaction, and progress data	eu-central-1 (Frankfurt)
Google Identity Services	OAuth sign-in and ID-token verification	Your Google ID token at sign-in	Global (Google)
Expo (Expo Application Services)	Push notification delivery	Your push token, notification payloads	United States
Apple Push Notification Service / Firebase Cloud Messaging	Final delivery of pushes to your device	Push token, notification payloads	Global
GitHub Actions	Continuous deployment of our backend	Source code only; no user data	Global (Microsoft)

We do not sell your personal information. We do not share your personal information with third parties for advertising or marketing.

6. International transfers

Our primary storage is in the European Union. Some sub-processors (Expo, Apple, Google) may process data in the United States or other regions. Where required, transfers outside the EU/EEA are protected by Standard Contractual Clauses or the EU–U.S. Data Privacy Framework where the provider participates in it.

7. How long we keep data

Account data: kept while your account is active.
Activities, reactions, hype, XP: kept while your account is active.
Refresh tokens: only the SHA-256 hash is stored; rotated on each refresh and revoked on logout or suspected reuse.
Server access logs: typically retained for up to 30 days for security and debugging.
Account deletion: when you delete your account, your user record and the data tied to it via foreign-key cascades are hard-deleted from our database so you can re-sign-up cleanly. Backups may persist for a short period and are overwritten on a rolling basis.

8. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate data (most profile fields are editable in-app).
Erasure — delete your account from within the App, or contact us.
Restriction / objection — ask us to limit processing.
Portability — receive your data in a machine-readable format.
Withdraw consent — revoke push permission in your device settings; revoke Google OAuth via your Google account.
Lodge a complaint with your local supervisory authority (EEA/UK users).

California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and to opt out of “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

To exercise any right, email us at gameoflife71320@gmail.com. We will respond within the timelines required by applicable law.

9. Security

All traffic between the App and our backend is encrypted in transit (HTTPS/TLS).
Database connections use TLS.
Authentication uses short-lived JWT access tokens (default 1 hour) and rotating refresh tokens stored only as SHA-256 hashes.
Suspected refresh-token reuse triggers revocation of all sessions for that account.
Secrets are stored in Google Secret Manager with least-privilege access.
Uploaded images are validated by MIME type and size, re-encoded server-side, and stored under per-user prefixes.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and the relevant authority as required by law.

10. Children

The App is not directed to children under 13 (or under 16 in jurisdictions where that is the minimum age for digital consent without parental authorization). We do not knowingly collect personal information from such children. If you believe a child has provided us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date at the top, and for material changes we will notify you in-app. Continued use of the App after a change takes effect constitutes acceptance of the updated policy.

12. Contact

GOL
Email: gameoflife71320@gmail.com