Privacy Policy

1. Introduction

This Privacy Policy describes how Niccolò Baldini ("we", "us", "our"), as the developer of the Compass Sniper mobile application (the "App"), collects, uses, and shares information about you when you use the App.

We have built Compass Sniper with privacy in mind: there is no sign-up, no profile, and the great majority of your data never leaves your device. This document explains the limited cases in which data is processed, by whom, and your rights.

2. What data we process

2.1 Approximate location (coarse)

• Source: device location services (GPS and system providers).
• Purpose: at session start, we use your approximate location to select landmarks relevant to your region (adaptive region selection).
• Sent to: the OpenStreetMap Nominatim reverse-geocoding service to determine your country or region. No precise coordinates are persisted by us.
• Storage: we do not store your location on our servers.
• Permission: requested at runtime via the iOS system prompt. You can revoke it at any time in Settings → Privacy → Location Services → Compass Sniper. If you decline, the App falls back to a default region.

2.2 Device sensor data (compass / orientation)

• Purpose: reading the direction your device is pointing during gameplay.
• Processing: entirely local on your device.
• Storage: never stored or transmitted.

2.3 Online profile and scores (via Supabase)

Creating an online profile is optional and only happens if you choose to set a username, which is required to take part in the leaderboard. If you do not set a username, no profile or score data is sent to our backend — you can play the entire game offline without any server-side record being created.

When you opt in, data is organised in two tables on Supabase:

Profile — created only when you choose a username:

• id — anonymous Supabase Auth identifier (random UUID; not linked to your email, phone, or real identity).
• username — the display name shown on leaderboards.
• created_at — timestamp of profile creation.

Scores — created each time a game session is recorded:

• id — internal record identifier.
• user_id — link to the anonymous Profile above.
• score — total score for the session.
• region — the world region played (e.g. Europe, Asia).
• game_mode — the game mode used (single player, challenge, etc.).
• rounds_data — a structured record of each round in the session, used for anti-cheat verification (the server recomputes your total score from these inputs rather than trusting a client-reported total): the landmark name shown, the bearing you submitted, the correct bearing to that landmark, the angular error in degrees, and the points awarded for that round. Your real-world coordinates are not included in this field.
• created_at — timestamp of the submission.

What is NOT stored: we do not collect your email, phone number, real name, precise real-world coordinates, or any contact information in connection with your profile or scores.

Operational logs: Supabase, as our backend provider, may automatically log standard request metadata (such as IP address) for security and abuse prevention. This is governed by Supabase's own privacy policy.

Purpose: displaying global and regional leaderboards, supporting the multiplayer challenge feature, preventing cheating and abuse, and ensuring fair play.

2.4 Local game data (on-device only)

• What: statistics, achievements, and game progress.
• Where: stored locally on your device via app storage / localStorage.
• Transmission: never leaves your device.
• Deletion: automatic when you uninstall the App, or via in-app reset where available.

2.5 Advertising data (via Google AdMob)

• We display advertising via Google AdMob. AdMob may collect:
• — the iOS Advertising Identifier (IDFA), only if you grant permission via the App Tracking Transparency prompt; if you decline, only contextual (non-personalized) ads are shown;
• — aggregated information about ad impressions, clicks, and interactions;
• — approximate location derived from IP address.
• You can disable cross-app tracking system-wide in Settings → Privacy & Security → Tracking. See Google's Privacy Policy.

3. Third-party services

The App relies on the following third parties, each with its own privacy policy:

• Google AdMob — advertising. Privacy policy.
• Supabase — leaderboard backend (anonymous auth + database). Privacy policy.
• OpenStreetMap Foundation (Nominatim) — reverse geocoding. Privacy policy.

4. Legal basis for processing (GDPR)

For users in the European Economic Area, the United Kingdom, or Switzerland, we process data under the following legal bases:

• Performance of the service: compass / GPS data for gameplay, leaderboard submission, region selection.
• Consent: advertising identifiers (collected only after you accept the iOS ATT prompt).
• Legitimate interest: maintaining the integrity of the leaderboard, preventing abuse, and basic operational logging.

5. Data retention

• Approximate location: not retained — processed in-memory for the session only.
• Profile and Scores on Supabase: retained until you request deletion or until the App is discontinued.
• Local game data: retained on your device until you delete it or uninstall the App.
• AdMob and Supabase retain operational data according to their own policies.

6. International transfers

Supabase and Google may process data outside the European Economic Area. These providers offer Standard Contractual Clauses or equivalent safeguards as required by Article 46 GDPR.

7. Your rights

Under GDPR (EU/EEA, UK), the Italian Codice Privacy, the California Consumer Privacy Act (CCPA), and similar laws, you may have the right to:

• access, rectify, or delete data we hold about you;
• restrict or object to processing;
• data portability;
• withdraw consent at any time (e.g. revoking ATT or location permissions);
• lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali.

Because we do not collect personal data tied to your real-world identity, most of your data is either on your device (which you control directly) or under an anonymous identifier on Supabase. To request deletion of your profile and scores, please contact us using the address below and include the username you used in the App so that we can locate your records.

8. Children

Compass Sniper is rated 4+ and is intended for general audiences. We do not knowingly collect personal data from children. Parents or guardians who believe a child has used the App and submitted data may contact us to request its deletion.

9. Security

• All communications with Nominatim, Supabase, and AdMob are made over HTTPS.
• Leaderboard data on Supabase is protected by Supabase's standard security practices, including row-level security policies.
• Local data is sandboxed by iOS but is not separately encrypted by the App.

10. Changes to this policy

We may update this policy from time to time. The "effective date" at the top of this page indicates the latest revision. Material changes will be announced inside the App or via this page. We encourage you to review the policy periodically.

11. Contact