Vokably Add Puzzle

Privacy Policy

Last Updated: October 18, 2026

Introduction

Welcome to Vokably. This Privacy Policy explains how Cosmin Albulescu ("we," "us," or "our"), as data controller, processes personal data when you use the Vokably mobile game and related services. The public website is https://vokably.aham.ro; the game service is available through https://vokably.app.aham.ro.

We process personal data under the General Data Protection Regulation (GDPR) and applicable Romanian law. This notice describes the Android app and its connected services; the privacy terms of independent third-party services also apply to their processing.

For details about cookies used by the app's sign-in flow, see our Cookie Policy.

Information We Collect

Account and device information

When you sign in using our identity service at https://id.aham.ro/0f9s2, we and that service process:

  • Account details: email address, username, first and last name, avatar (if supplied), and a service account identifier.
  • Device and app details: device type/model, operating system, app version, language, time zone, and a push-notification device token.
  • Network and security details: IP address and technical request information that may be recorded by the app and service providers when the app connects to our services.
  • Install-referrer information: where available, a Play Store campaign or referral string may be sent to our game service to attribute an installation.

Gameplay and location

The game service at https://vokably.app.aham.ro processes:

  • Gameplay data: puzzles played and completed, answers/interactions, scores, hints, completion times, progress, and achievements.
  • Content you submit: riddles, profile/avatar content, and related moderation or account activity.
  • Precise location: only if you grant the app location permission. The app may read a current or last-known location and send its coordinates, accuracy, and timestamp to the game service when you answer a puzzle. Location is optional; denying or revoking permission stops future location access, but does not by itself erase location already attached to past game records. Contact us to request its deletion.
  • If you use location-based marketplace features, coordinates associated with a puzzle may also be sent to the Nominatim reverse-geocoding service operated by the OpenStreetMap Foundation to derive a city/country label.

App diagnostics, analytics, ads, and notifications

  • Firebase Analytics: the app records screen views and interaction events. Collection is enabled by default and can be disabled in the app's account settings. The app also sends its service account UUID as the Analytics user ID, so this data is pseudonymous and can be linked to an account; it is not anonymous.
  • Firebase Crashlytics: production crash reports, errors, and diagnostic information may be sent to Google to diagnose failures.
  • Google Mobile Ads: when ads are enabled, the app requests interstitial ads. Google may process device/ad identifiers, IP address, app and ad interactions, and diagnostics for ad delivery, measurement, and fraud prevention. Personalized advertising is subject to applicable consent requirements and Google settings.
  • Firebase Cloud Messaging (FCM): an FCM device token is registered with the game service for push delivery. Android notification permission and the app's notification settings control whether notifications can be shown.
  • Sign-in: authentication uses the system sign-in flow with our identity service. That service may use essential authentication cookies in the sign-in browser.

How We Use Your Information

We use the collected information solely for:

  • Account management - creating and maintaining your account
  • Game functionality - saving your progress and providing gameplay features
  • Service improvement - understanding how players interact with puzzles
  • Security - protecting against unauthorized access and fraud
  • Communication - sending important updates about the service (if necessary)

We rely on these legal bases under GDPR Article 6:

  • Account creation, gameplay, saving progress, and handling content you submit: necessary to perform our contract with you (Article 6(1)(b)).
  • Puzzle location: your consent (Article 6(1)(a)), expressed through the app's location disclosure and your device's location permission. You can withdraw it by revoking permission; withdrawal does not affect earlier processing.
  • Optional push notifications: your choice and device notification permission (Article 6(1)(a)); you can disable them in app or device settings.
  • Service security, abuse prevention, maintenance, and crash reporting: our legitimate interests in protecting and operating the service (Article 6(1)(f)). You may object to processing based on legitimate interests.
  • Analytics and feature improvement: our legitimate interests in understanding and improving the game (Article 6(1)(f)); Analytics can be disabled in account settings and you may object. The account UUID is attached to Analytics events, as explained above.
  • Ad delivery and measurement when enabled: our legitimate interests in funding the free service and preventing invalid ad activity (Article 6(1)(f)). Where consent is legally required for personalized advertising or access to device identifiers, that processing must be based on your consent.
  • Optional marketplace or blockchain actions you initiate: performing your requested action (Article 6(1)(b)); public blockchain records are controlled by the relevant network and may be permanent.

Data Sharing

We disclose data only as needed to operate the service:

  • Our service providers: the identity service at id.aham.ro and Vokably game service at vokably.app.aham.ro, operated for us.
  • Google: Firebase Analytics, Crashlytics, Cloud Messaging, Google Mobile Ads, and Google Play services/Install Referrer. Google may process data under its own privacy terms and, for some services, as our processor.
  • OpenStreetMap Foundation/Nominatim: when a location-based marketplace function requests reverse geocoding, it receives the coordinates needed for that lookup.
  • Wallets and public blockchain networks: only when you choose a related marketplace/wallet feature. Blockchain transactions and wallet addresses may be public and cannot normally be changed or erased by us.
  • Authorities or other parties: where required by law, to protect users, or to establish or defend legal claims.

These providers may process data in or outside the European Economic Area. Where required, transfers rely on an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses. For provider-specific practices, review Google's Privacy Policy and the OpenStreetMap Foundation Privacy Policy.

Data Storage and Security

Storage

  • Core account and gameplay records are stored in PostgreSQL databases on our servers; SDK-related data is handled by the providers listed above
  • Account data is managed through our identity service (id.aham.ro)
  • Gameplay data is stored separately in the Vokably service database

Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Retention

We keep account, gameplay, submitted-content, and puzzle-location data while your account is active and as needed to provide the service. When account deletion is completed, the identity account and associated game/favorite records are removed from the active systems that support that process. Contact us to request deletion or erasure of specific data.

Push tokens are kept while registered for the account/device and should be removed when no longer needed for delivery or security. Security logs are retained only as needed to protect the service, investigate incidents, and meet legal obligations. Backups are retained until overwritten under the applicable backup rotation. Firebase and advertising data follow the retention controls configured for those Google services and Google's applicable terms; they may not be deleted by deleting the Vokably account alone. Data recorded on a public blockchain cannot be erased by us.

Your Rights (GDPR)

Under GDPR and Romanian law, you have the following rights:

  • Right to access - request a copy of your personal data
  • Right to rectification - correct inaccurate or incomplete data
  • Right to erasure - request deletion of your account and personal data, subject to legal exceptions
  • Right to restriction - ask us to limit processing in certain circumstances
  • Right to data portability - receive your data in a structured format
  • Right to object - object to processing based on legitimate interests
  • Right to withdraw consent - withdraw consent at any time, without affecting processing already carried out

To exercise these rights, contact us at vokably@aham.ro. You may also lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), including through its complaints page, or with another competent supervisory authority.

Age Restriction

Vokably is intended only for people aged 16 years and older. Article 8 GDPR, together with Article 5 of Romanian Law no. 190/2018, requires parental authorisation for consent-based processing of a child's personal data through an information-society service if the child is under 16. We have chosen a 16+ minimum because the app does not provide a verified parental-authorisation process. If you believe a person under 16 has provided us with personal data, contact us so we can restrict access and address deletion.

Cookies

The mobile app does not use website tracking cookies for gameplay. The system browser used to sign in may store an essential authentication cookie for id.aham.ro. The app also uses third-party SDKs described above, so it would not be accurate to say that no third-party analytics or ad-related data is processed.

Changes to This Privacy Policy

We may update this notice when our processing changes or the law requires. We will update the date above and provide additional notice where required. A policy update does not replace any consent that the law requires us to obtain.

Contact Information

Vokably is operated by Cosmin Albulescu, an individual in Romania, who is the data controller for the purposes of these Terms and the Privacy Policy.

For privacy questions or to exercise your rights, please contact:

Governing Law

This Privacy Policy is governed by the laws of Romania and the European Union's General Data Protection Regulation (GDPR).

Thank you for playing Vokably and trusting us with your information!

Return to home