This policy describes how Simplibot processes personal data when you use Burrito. We comply with the GDPR (EU Regulation 2016/679).
1 Data controller
The data controller is Simplibot. For any question about your data, or to reach our GDPR contact, write to [email protected].
2 No account, no login
Burrito does not ask you to create an account or log in. The app opens an anonymous session, stored in your device's Keychain, that identifies your device — not you personally. We never collect your name, email address, or phone number.
3 Data we process
A random device identifier, kept in Keychain. No name, no email.
When you play online: the display name you type for that round, votes cast, and round scores. This lives only as long as the room does.
Crash reports and app performance events, without personally identifiable data.
Apple processes your payment directly. Burrito never sees your card details.
4 Purposes & legal basis
| Purpose | Legal basis |
|---|---|
| Running a local or online game session | Performance of the contract |
| Managing the Premium subscription | Performance of the contract |
| Crash reporting & reliability | Legitimate interest |
| Anonymous product analytics | Legitimate interest |
5 Hosting & sub-processors
Burrito uses a small number of sub-processors, all committed to GDPR-compliant processing. No advertising tracking, no ATT prompt, and Burrito never sells data.
| Service | Role | Location |
|---|---|---|
| Supabase | Anonymous session & online rooms | EU (Paris, France) |
| PostHog | Anonymous product analytics | EU |
| Sentry | Crash reporting (no personal data sent) | Germany (EU) |
| RevenueCat | Subscription status (via Apple) | USA |
| Apple (App Store) | Payment processing | USA |
6 Retention
- Anonymous session — kept on your device until you delete the app or use "Delete My Data".
- Online room data (display name, votes, scores) — deleted automatically shortly after the room closes.
- Crash reports — kept up to 90 days, then deleted.
- Subscription records — kept for the legal accounting retention period.
7 Your GDPR rights
You have the right to access, rectify, erase, and object to the processing of your data. Because Burrito holds so little data in the first place, the fastest way to exercise your rights is the in-app "Delete My Data" button (Profile screen) — see the Delete my data page for the exact steps.
You can also write to [email protected]; we reply within 30 days. You may also lodge a complaint with the CNIL (French data protection authority) or your local supervisory authority.
8 Security
Data in transit is encrypted (TLS 1.2+). Online room access is scoped by Row-Level Security so a player can only see the room they joined. Burrito performs no advertising tracking and requests no ATT permission.
9 Contact
For any question about your personal data:
[email protected]