This Privacy Policy explains how Bhan AS (“we”, “us”, or “our”) collects, uses, stores, and shares personal data when you use the EloX mobile application (“the App”). We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.
The data controller for the purposes of GDPR is Bhan AS, Norway. Contact: support@bhan.no.
1. What Data We Collect
Account and Profile Data
- Email address (used for authentication)
- Username (chosen by you)
- Avatar image generated from your username
- Optional: city and country (set by you for profile display)
Match and Rating Data
- Match results you submit (game type, variant, outcome, timestamp)
- Opponent’s user ID for each match
- Glicko-2 rating and rating deviation (RD) per game type/variant
- Leaderboard position and match statistics
- QR confirmation tokens used to let another player review and confirm a pending match
- Time zone and local date key used when confirming a match
Suggestions and Feedback
- Feature and game suggestions you submit
- Votes on suggestions, including your user ID for vote tracking
Technical and Usage Data
- Firebase Authentication UID (internal identifier)
- App usage events and analytics (via Google Analytics for Firebase / GA4, where enabled), including screen views and feature interactions, collected in aggregate and pseudonymously
- Crash reports (via Firebase Crashlytics, where enabled), including device model, OS version, and stack traces, without direct personal identifiers
- IP address (processed by Firebase infrastructure; not stored by us directly)
- Operational logs from our backend, which may include location search text and returned city suggestions when you use location search
Data We Do NOT Collect
- Precise location (GPS)
- Contacts or address book
- Payment information
The App requests camera access only to scan match QR codes. QR scanning happens on your device, and we do not store or upload camera images or video.
2. How We Use Your Data
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Providing and operating the App (accounts, match logging, ratings, leaderboards) | Account data, match & rating data | Performance of a contract (Art. 6(1)(b)) |
| Displaying your profile, confirmed match history, suggestions, and rating to other signed-in users | Username, rating, match data, suggestion data, optional location label | Performance of a contract (Art. 6(1)(b)) |
| Improving and operating the App (analytics and crash reports where enabled, operational logs) | Usage events, crash data, diagnostic logs | Legitimate interests (Art. 6(1)(f)) - improving reliability and quality |
| Responding to support requests | Email address, relevant account data | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations | As required by law | Legal obligation (Art. 6(1)(c)) |
3. Data Storage and Infrastructure
The App is built on Google Firebase (Cloud Firestore, Firebase Authentication, Cloud Functions). Your data is stored on Google’s infrastructure in the European Union (region: europe-west1). Google acts as a data processor on our behalf under Google’s standard Data Processing Addendum.
Where enabled, analytics data is processed by Google Analytics for Firebase (GA4), which may process data across Google’s global infrastructure. Where data is transferred outside the EEA, Google relies on Standard Contractual Clauses (SCCs) as a transfer mechanism.
For more information on Google’s data practices, see Google’s Privacy Policy and Firebase’s Privacy and Security.
4. Data Retention
- Account and profile data: Retained for as long as your account is active. Deleted promptly upon account deletion.
- Match, rating, and suggestion data: Retained for as long as your account is active. Deleted or anonymised upon account deletion where required and technically feasible.
- Analytics data: Retained per Google Analytics default retention settings (14 months for user-level data), or as configured by us.
- Crash reports: Retained for 90 days in Firebase Crashlytics.
- Auth and QR tokens: Used to authenticate sessions or confirm pending matches. QR tokens become unusable once a match is confirmed or rejected.
We may retain certain data for longer where required by law or for legitimate business purposes (e.g., fraud prevention), but only to the extent necessary.
Operational logs are retained only as long as necessary for debugging and operational purposes.
5. Third Parties
We share your data only with the following categories of third parties:
- Google / Firebase: Infrastructure, authentication, database, analytics and crash reporting where enabled, and backend logs (see Section 3).
- Geoapify: If you use the location search feature, your search query (city name) is sent to Geoapify’s API through our backend. No account data is shared with Geoapify. See Geoapify’s Privacy Policy.
- Robohash.org: Avatar images are generated by Robohash.org based on your username/seed. This is a public API; see robohash.org.
We do not sell your personal data. We do not share your data with advertisers or data brokers.
6. Your Rights (GDPR)
If you are located in the EU/EEA (including Norway and Sweden), you have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”): Request deletion of your personal data. You can delete your account directly in the App (via Settings > Account > Delete Account), which will trigger deletion of your profile and associated data. You may also contact us at support@bhan.no to request erasure.
- Right to data portability: Request your data in a structured, machine-readable format.
- Right to restriction of processing: Request that we limit how we process your data in certain circumstances.
- Right to object: Object to processing based on legitimate interests.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at support@bhan.no. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g., Datatilsynet in Norway, IMY in Sweden).
7. Account Deletion
You can delete your account at any time. To delete your account:
- Open the App and go to your Profile.
- Tap the settings icon → Account → Delete account.
Alternatively, contact us at support@bhan.no with the subject line “Account Deletion Request”. We will delete your account and associated personal data within 30 days.
Note: Match records that have been confirmed by another player may be retained in an anonymised form (i.e., without identifying you) as part of the opponent’s match history, as this data is necessary for the integrity of other users’ ratings.
Certain records may be retained where required by applicable law or to prevent fraud and abuse.
8. Children’s Privacy
The App is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you become aware that a child under 13 has provided us with personal data, please contact us and we will take steps to delete it. For users between 13 and 16 in the EU/EEA, parental consent may be required depending on applicable national law.
9. Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or disclosure. These include encryption in transit (TLS), Firebase security rules restricting data access, and server-side-only rating computations. However, no system is completely secure, and we cannot guarantee absolute security.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email at least 30 days before the changes take effect. The “Effective date” at the top of this page will always reflect the date of the latest revision.
11. Contact
For privacy-related questions, requests, or complaints, contact us at:
Bhan AS, Norway
Email: support@bhan.no