This Privacy Policy outlines how Kverty collects, uses, synchronizes, and safeguards information when you play Name Place Animal Thing (NPAT) across web browsers and mobile platforms.
Welcome to Name Place Animal Thing (NPAT) (Application ID: com.kverty.npat), created and maintained by Kverty ("we", "us", or "our").
NPAT is a fast-paced multiplayer word and party game designed to spark creativity, speed, and friendly competition. We respect your digital privacy. This policy details our clear, transparent data practices regarding single-player practice, daily challenges, online multiplayer rooms, authentication, and in-game advertisements.
No Data Selling: We do not sell, rent, monetize, or trade your personal information, passwords, or gameplay answers to data brokers or advertisers.
2 Information We Collect
We practice data minimization and only collect information essential for delivering seamless gameplay and account management:
A. Account and Profile Credentials
Registered Accounts: When creating a registered NPAT account, we collect your email address, chosen display name / username, and secure password hash. Account security and encrypted authentication are powered by Supabase Auth. Plain-text passwords are never accessible to us or stored in our systems.
Guest Player Mode: You can play NPAT without registering or providing an email address. Guest mode uses a randomly generated, locally stored session identifier so you can join rooms, submit answers, and receive scores.
B. Gameplay, Matchmaking, and Room Synchronization
Multiplayer Rooms: When hosting or joining a multiplayer match, we record and synchronize the 6-character room code, chosen player nickname, room capacity, game state (round number, letter, timer countdown), and turn status.
Round Answers and Scoring: During each round, word submissions entered for Name, Place, Animal, and Thing, judge rulings, awarded points, and match rankings are stored to compute live leaderboards and game history.
Single-Player and Daily Challenges: Your offline scores, daily streak, and practice history are stored locally in your device's browser cache (using IndexedDB) and synchronized with your account profile when signed in.
C. Device Diagnostics and Technical Telemetry
Network & App Telemetry: Approximate device model, browser user-agent, operating system version, app build version, and IP address are processed temporarily for real-time WebSocket room connections, fraud prevention, and crash diagnostics.
Advertising Identifiers: In mobile app builds where in-game advertisements are enabled, Google AdMob processes standard mobile advertising identifiers (such as Android Google Advertising ID — GAID, or Apple IDFA) subject to Google's privacy disclosures and your device settings.
3 Third-Party Services & SDK Integrations
NPAT partners with reputable infrastructure and platform providers to power real-time gaming:
Provider
Component
Function
Privacy Policy
Supabase Inc.
Supabase Auth & Database
Encrypted user authentication, PostgreSQL database, and WebSocket Realtime room state synchronization.
We process your data strictly for legitimate operational purposes:
Core Gameplay Delivery: Creating multiplayer lobbies, matching players, calculating answers, verifying letter constraints, and maintaining live countdowns.
Global & Daily Leaderboards: Calculating high scores and displaying daily rankings across the community.
Account Authentication: Verifying credentials, managing password reset links, and synchronizing player profiles.
Security & Abuse Prevention: Enforcing rate limits, preventing automated bot abuse, and protecting game room integrity.
Application Maintenance: Diagnosing connection latency, repairing bugs, and optimizing mobile rendering performance.
5 Data Storage & Security Architecture
We treat player data with industry-standard security safeguards:
End-to-End Transport Encryption: All client communications with Supabase and APIs are encrypted using modern Transport Layer Security (TLS 1.2+ / HTTPS / WSS).
PostgreSQL Row Level Security (RLS): Every database table is protected by granular RLS policies. Players can only modify their own profile records and valid room submissions.
Zero Client Secrets: No administrative service-role keys or sensitive master credentials are embedded within the web bundle or mobile APK.
Encrypted Passwords: Passwords are cryptographic hashes managed exclusively by Supabase; neither Kverty nor our staff have access to your raw password.
6 Data Retention & Local Storage
Multiplayer Rooms: Live match states are ephemeral. Completed game rooms are automatically archived and purged from active synchronization tables.
Registered Accounts: Profile data and career scores are maintained until you request deletion.
Device Storage & Cache: Local offline game logs stored in your device's browser (IndexedDB / LocalStorage) can be erased at any time by clearing your browser cache or uninstalling the app.
7 Children's Privacy (COPPA & GDPR-K)
NPAT is a family-friendly vocabulary game designed for general audiences of all ages. We do not knowingly solicit or collect personally identifiable information from children under 13 (or under 16 in the European Economic Area) without verifiable parental consent.
If we become aware that personal information of a child has been gathered without parental consent, we will take immediate steps to delete the information from our servers. Parents or legal guardians may contact us at contact@kverty.com to request prompt deletion.
8 Your Privacy Rights & Data Deletion
You have complete control over your data. Regardless of your location, you have the right to access, rectify, export, or permanently delete your NPAT account and all associated gameplay logs.
Request Permanent Account & Data Deletion
Email our support team with your registered email or username. All personal records will be wiped within 30 business days.
Note for Guest Players: Guest accounts do not hold personal email addresses. You can delete all guest session data instantly by clearing your browser's site storage or clearing app storage in your mobile settings.
9 Regional Privacy Disclosures
A. European Union / United Kingdom (GDPR / UK GDPR)
For players in the EU/UK, our lawful basis for processing personal data includes:
Contractual Necessity: Delivering multiplayer games, leaderboard computation, and user accounts.
Legitimate Interests: Securing the app against fraud, debugging crashes, and maintaining server stability.
Consent: Non-essential personalized advertising (where required by applicable regulations).
B. California Residents (CCPA / CPRA)
Under the California Consumer Privacy Act (CCPA), California residents have the right to know what personal information is collected, the right to request deletion, and the right not to be discriminated against for exercising privacy rights. Kverty does not sell personal information.
10 Policy Changes & Updates
We may update this Privacy Policy periodically to reflect enhancements to NPAT, new game modes, or evolving legal frameworks. Any revisions will be published directly to this URL (https://npat.kverty.com/privacy-policy) with an updated effective date. We encourage players to review this page periodically.
11 Contact Us
If you have questions, feedback, or data privacy inquiries regarding Name Place Animal Thing, please contact us:
