Privacy notice

1. Data controller

The data controller is the operator of Contagify, a private individual, who can be contacted at info@contagify.com. For any question about your data or to exercise your rights, write to this address.

2. What data we process

• Guest identifier. On your first visit the server creates an anonymous player and links it to your browser with a technical cookie (viral_guest), which contains only a signed random code and lasts one year.
• Account. If you sign in with Google, GitHub or Microsoft, we receive an identifier from the chosen service and, depending on the service, your email address (Google, Microsoft) or your username (GitHub). We do not receive or store passwords.
• Profile picture. Once you are signed in, the bar at the top shows your Google or GitHub profile picture, if you have one, otherwise the initial of your name. Google sends it together with the account name: we neither use nor store the name, and the picture's address is kept only in the session cookie. Your browser loads the picture directly from Google's or GitHub's servers, which therefore receive your IP address, as with any image.
• Game data. Cards and viruses in your collection, matches, scores, levels, badges, upgrades and missions.
• Public name. The name you choose (optional) appears in the daily leaderboard and in the country records, together with your level, score and starting country. Only signed-in players appear in the leaderboard; without a name you appear as “Giocatore” (“Player”) followed by four random characters.
• Feedback. Type, rating, text and the page it was sent from, linked to your player and public name. We do not ask for your email: please do not include personal data in the text.
• IP address. Used only in memory, for a few minutes, to limit abuse (for example too many new guests or feedback submissions from the same network). It is not stored.
• Technical errors. Error messages from the site and the page on which they occurred, without identifiers or IP addresses, and anonymous daily usage counters.

3. Purposes and legal basis

• Letting you play (saving your collection and progress, managing sign-in, showing the leaderboard): performance of the service you requested (Art. 6(1)(b) GDPR).
• Security and abuse prevention (IP-based limits, technical errors): legitimate interest in keeping the game working and protected (Art. 6(1)(f)).
• Improving the game with the feedback you choose to send: legitimate interest (Art. 6(1)(f)).

4. Cookies and browser storage

We use only technical tools that are necessary for the service to work and do not require consent: the viral_guest cookie, the session cookies when you sign in (viral_session for Google, which lasts 30 days, and the Azure platform cookie for GitHub and Microsoft) and a few preferences saved in the browser (audio, card back, guide and intro already seen, last match). No profiling or third-party cookies. Fonts and the map are served by the site itself; only the profile picture, once you are signed in, comes from Google or GitHub.

5. Who processes data on our behalf

• Microsoft Azure (Static Web Apps, Azure Functions, Cosmos DB) hosts the site and the database as data processor. The servers are located in the United States (East US 2 region): the transfer is based on the EU-US Data Privacy Framework, to which Microsoft adheres, and on the European Commission's standard contractual clauses.
• Google, GitHub and Microsoft, when you use them to sign in, process your login data as independent controllers, in accordance with their own privacy notices.

Data is never sold or passed on to anyone.

6. How long we keep data

• Game data, account, public name and feedback: until you delete them.
• Technical errors: 30 days. Anonymous counters: 400 days.
• IP address: in memory only, it is not retained.

7. How to delete your data

Sign in and, in your profile, use “DELETE MY DATA”: we immediately erase your account, collection, matches, public name, leaderboard entries, records and feedback. If you have only played as a guest, signing in moves your progress to the account and the deletion covers it; alternatively, write to info@contagify.com.

8. Your rights

You can request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest (Arts. 15–21 GDPR), by writing to info@contagify.com. We reply within one month. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

9. Minors

The game is reserved for people aged at least 14. If we find out that an account belongs to someone younger, we delete it.

10. Changes

If this notice changes, we update the date at the top. We also flag significant changes in the game. See also the terms of use.