🎲 Dice Cat Privacy Policy

Your privacy matters to us

Last Updated: June 15, 2026
Effective Date: June 15, 2026

1. Who We Are

Dice Cat is operated by Caitlyn Carmabella Nayeli ("we," "us," or "our"). Dice Cat is a mobile application designed to help adult tabletop gamers (18+) find compatible gaming partners in their area.

2. Age Requirement

3. Information We Collect

3.1 Information You Provide

• Account Information: Username, display name, email address, date of birth, pronouns, and bio
• Profile Information: Custom avatar design (body shape, colors, accessories), profile photos (optional), gaming preferences
• Gender (optional): You may optionally tell us your gender and the genders you are most comfortable gaming with. This powers an optional comfort and safety feature and is never required. See Section 3.3 on sensitive information.
• Location Information: The city, state, and country you provide, plus the approximate coordinates of that location, which we use only to estimate distance for matchmaking. We do not track your device's live or background GPS location.
• Gaming Preferences: Favorite games, skill levels, play styles, preferred game types (board games, RPGs), online platforms, and gaming availability schedule
• Communication: Messages sent through our chat system, group messages, session planning details, and any images you choose to send
• Minigame Data: Progress and preferences in optional minigames (such as the word puzzle and creature-collection games)

3.2 Information Automatically Collected

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Pages viewed, features used, time spent on the app, interaction patterns
• Push Notification Tokens: Firebase Cloud Messaging (FCM) tokens for Android or Apple Push Notification Service (APNS) tokens for iOS to send you notifications
• IP Address: For security and analytics purposes
• Error and diagnostic logs: When the app encounters an error, we record technical details (error message, stack trace, the in-app screen, app version, and device/browser type) in our own database to diagnose and fix problems. These logs are stored on our servers (not a third party), retained for 90 days, and email-like text is stripped before storage.

3.3 Sensitive Information (Special Categories)

• Gender: Gender is optional and, where it is treated as sensitive, we process it only with your consent (GDPR Article 9(2)(a)), which you give by choosing to fill it in. It powers an optional comfort and safety feature and reduces your matches when set. You can remove it at any time in Edit Profile. We do not infer or record your sexual orientation; the "comfortable gaming with" setting is about gaming groups, not dating.
• Free-text fields and chat: Your bio, messages, and images are free-form, so please do not share sensitive personal information (such as health, religion, political views, or sexual orientation) in them. If you choose to make such information public, we rely on Article 9(2)(e) (information you have manifestly made public) and we do not analyze or profile the contents.
• Photos are not biometric data: We do not use facial recognition or any technology that identifies you from your photos or avatar, so these are ordinary images, not biometric special category data.

4. How We Use Your Information

4.1 Core Services

• Matchmaking: We use your location (city-level), game preferences, availability, and play styles to suggest compatible gaming partners through our algorithm
• Profile Display: Your profile information is shown to other users when you appear in their matches
• Communication: Enable messaging, group chats, and session planning between matched users
• Notifications: Send push notifications about new matches, messages, session invitations, and app updates
• Minigames: Save your progress and preferences in optional minigames

4.2 Safety and Security

• Detect and prevent fraud, abuse, and violations of our Terms of Service
• Process reports of inappropriate behavior and enforce our community standards
• Maintain blocked user lists and enforce user blocks
• Preserve evidence in cases of harassment or safety concerns

4.3 Service Improvement

• Analyze usage patterns to improve matchmaking algorithms
• Understand how users interact with features to enhance user experience
• Fix bugs and technical issues
• Develop new features based on user behavior

5. Information Sharing

5.1 With Other Users

We share your profile information (display name, username, bio, avatar, gaming preferences, and location) with other users when:

• You appear in their match suggestions
• You connect with them
• You join a gaming session or group together
• You send them messages

5.2 With Service Providers

We share information with third-party service providers who help us operate Dice Cat:

• Supabase: Database hosting, authentication, and file storage
• Firebase Cloud Messaging: Push notifications for Android
• Apple Push Notification Service: Push notifications for iOS
• RevenueCat: Mobile subscription management (no payment card data stored by Dice Cat)
• Stripe: Web payment processing and subscription billing (payment card data is handled directly by Stripe; Dice Cat never sees or stores card numbers)
• Resend: Transactional email delivery (e.g., account-deletion verification emails)
• BoardGameGeek API: Game information and metadata (no personal data shared)

Each of these providers acts as a data processor under a Data Processing Agreement (DPA) and is contractually obligated to protect your information and use it only for providing services to Dice Cat. See our internal processor registry (DPA-COMPLIANCE.md) for details.

5.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Legal process (subpoena, court order, etc.)
• Law enforcement requests
• Protection of our rights or safety of our users
• Investigation of fraud or security issues

5.4 Business Transfers

If Dice Cat is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or app notification before your information is transferred.

6. Data Retention and Deletion

6.1 Active Accounts

We retain your information for as long as your account is active and as needed to provide you services.

6.2 Account Deletion

You can request account deletion at any time through the Account Settings page. For your protection, deletion requires password confirmation and email verification, and is subject to a 30-day grace period during which you can cancel by logging back in. After the grace period, deletion is processed automatically.

6.3 Other Retention Periods

Where we retain data rather than deleting it on request, we apply defined retention limits:

• Chat messages (in active accounts): automatically deleted after 2 years
• Security audit logs: 2 years
• Rate-limiting records: 7 days
• Completed/cancelled deletion request records: 1 year (audit trail)

To make a specific data request after account deletion, contact us at carma@dice-cat.com with your former username. We will review on a case-by-case basis.

6.4 Inactive Accounts

Accounts inactive for 2+ years may be deleted. We will notify you via email 30 days before deletion.

7. Your Privacy Rights

7.1 Access and Correction

You can access and update your profile information at any time through the app's Edit Profile section.

7.2 Data Portability

You can request a copy of your data by emailing carma@dice-cat.com. We will provide your data in a portable format (JSON) within 30 days.

7.3 Deletion

You can delete your account and most associated data through the app's Account Settings page. See Section 6.2 above for details on what is deleted vs. anonymized.

7.4 Marketing Opt-Out

You can opt out of marketing emails by clicking the unsubscribe link in any marketing email or by adjusting your notification settings in the app.

7.5 Push Notifications

You can control push notifications through your device settings or in-app notification preferences.

7.6 Additional Rights for EEA, UK, and Swiss Users (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR (and equivalent UK/Swiss law):

• Right of access – obtain confirmation of, and a copy of, the personal data we hold about you (see Section 7.2; an in-app data export is available in Account Settings).
• Right to rectification – correct inaccurate or incomplete data (see Section 7.1).
• Right to erasure ("right to be forgotten") – delete your account and associated personal data (see Section 6.2).
• Right to restriction of processing – ask us to limit how we use your data in certain circumstances.
• Right to data portability – receive your data in a structured, machine-readable (JSON) format.
• Right to object – object to processing based on our legitimate interests, and to opt out of any direct marketing at any time.
• Right to withdraw consent – where we rely on consent (e.g., analytics/error reporting), withdraw it at any time via the in-app cookie/privacy settings, without affecting prior lawful processing.
• Right not to be subject to solely automated decisions that produce legal or similarly significant effects (our matchmaking is a suggestion tool only; you always decide who to connect with — see Section 12).

To exercise any of these rights, contact us at carma@dice-cat.com. We will respond within one month.

7.7 Right to Lodge a Complaint

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with your local data protection supervisory authority. EEA residents can find their authority at the European Data Protection Board; UK residents can contact the Information Commissioner's Office (ICO). We would, however, appreciate the chance to address your concerns first.

7.8 Legal Basis for Processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) – to create and operate your account, provide matchmaking, messaging, and subscriptions.
• Consent (Art. 6(1)(a)) – for optional analytics and any marketing communications. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) – to keep the service secure, prevent fraud and abuse, investigate safety reports, and improve the app, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) – to comply with applicable laws, including financial record-keeping by our payment processors and responding to lawful requests.

Where any data is treated as a special category (see Section 3.3), we rely on your explicit consent (Art. 9(2)(a)) for optional gender information, and on Art. 9(2)(e) for special category information you choose to make public in free-text fields. We do not otherwise process special category data.

8. Security Measures

8.1 Protection Measures

We take data security seriously and implement various measures to protect your information:

• Encryption: Data is encrypted in transit using SSL/TLS
• Authentication: Secure authentication through Supabase Auth
• Access Controls: Limited employee access to user data
• Monitoring: Regular security monitoring and updates
• Data Minimization: We collect only necessary information

8.2 Security Limitations

However, no method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8.3 Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify affected users within 72 hours of discovering the breach
• Notify via email to the address on file and/or in-app notification
• Describe what information was compromised
• Explain what steps we are taking to address the breach
• Provide recommendations for protecting your account
• Notify relevant authorities as required by law

9. Children's Privacy

10. International Data Transfers

Dice Cat is operated from the United States, and our service providers may process data in the United States and other countries. Where we transfer personal data of EEA, UK, or Swiss users outside their region, we rely on appropriate safeguards as required by the GDPR — primarily the European Commission's Standard Contractual Clauses (SCCs) incorporated into our Data Processing Agreements with each processor, together with supplementary technical measures such as encryption in transit. You may request a copy of the relevant safeguards by contacting us at carma@dice-cat.com.

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, and share
• Right to delete personal information (with exceptions for legal obligations)
• Right to opt-out of sale of personal information (we do NOT sell your information)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us at carma@dice-cat.com.

12. Algorithm and Automated Decision-Making

Dice Cat uses algorithms to suggest compatible gaming partners based on your preferences, location, and gaming habits. This automated matchmaking helps you find gamers who share your interests.

How it works:

• We analyze your game preferences, play styles, and availability
• We compare these with other users in your area
• We calculate compatibility scores to suggest potential matches
• You always have final control over who you connect with

You can adjust your preferences at any time to influence matchmaking results.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal/regulatory reasons. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• For material changes, we will notify you via email or in-app notification
• Your continued use of Dice Cat after changes take effect constitutes acceptance of the updated policy

We encourage you to review this policy periodically.

14. Third-Party Links

Dice Cat may contain links to third-party websites or services (such as BoardGameGeek for game information). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information.

15. Your Consent

© 2025 Dice Cat. All rights reserved.