Privacy policy

Who is responsible for your information?

MAVO MUSIC AS, organisation number 932 426 935, Strandvegen 22B, 7713 Steinkjer, Norway, is the controller for Tapoli and tapoliworld.com. Email [email protected] about privacy or [email protected] for help with the game.

Playing and saving your journey

Tapoli saves your explorer name and character, puzzle progress and moves, rewards, consumable purchase records and settings on your iPhone. You can play without a separate Tapoli account. On supported versions and devices, the game can sync your journey to your private iCloud storage when iCloud is available. This is used to provide the game and let you continue your journey across devices (GDPR Article 6(1)(b)).

You can manage iCloud access in your iPhone settings. To remove app data, manage both the data on your device and any copy in iCloud. Private iCloud storage is linked to your Apple Account. See Apple’s privacy information or contact us for help.

Friends and Game Center

When friend features are available, you can choose to connect Apple Game Center and share progress. Tapoli uses Supabase for comparing puzzle results. The service verifies a scoped Game Center player identifier and signed proof, then stores selected puzzle results with a pseudonymous player reference and sharing settings. Friends you share with can see your results. In versions that support Game Center leaderboards or achievements, Apple receives the corresponding scores or achievements.

Optional sharing is based on consent (Article 6(1)(a)). You can stop sharing in the game. This removes shared puzzle scores and outgoing access grants from Tapoli’s friend service. The service retains a record of your sharing choice, and you can ask us to delete it. Temporary authentication proofs and access grants expire. Apple handles Game Center data held by Apple.

Optional player insights

If you opt in to player insights in a version that offers it, we use GameAnalytics to understand where players get stuck, improve puzzles and learn whether players return. Data may include a random installation ID, technical device and app information, approximate geographic area, sessions, puzzle starts, completions and failures, move counts and use of assistance. The events Tapoli sends exclude your explorer name, email address and full save file.

Player insights are off by default. You can turn them off again in the game settings (Article 6(1)(a)). This stops new events from being sent. GameAnalytics states that raw event data is normally kept for up to 12 months and truncated IP addresses for up to 30 days. Aggregate information that does not identify players can be kept longer. Contact us for access or deletion requests.

Purchases and optional ads

When purchases are available, Apple handles payment. Tapoli uses transaction information from Apple to deliver and restore purchases and prevent duplicate delivery (Article 6(1)(b)). We do not receive payment card details. Transaction details may be kept where necessary for purchase disputes or legal obligations (Article 6(1)(c) or (f)).

In versions with rewarded ads, you can choose to watch an ad. Google AdMob may use IP addresses, approximate location, device information and ad interaction data to deliver and measure ads and prevent misuse. Where consent is required, we rely on consent for this processing and any personalisation. Where available, you can manage ad choices in the game settings. Google’s link describes how it handles this information and how you can control it.

Website and email

Cloudflare and Replit deliver the website. Technical information such as IP addresses, requested pages and timestamps may be processed to serve and secure the site and diagnose faults. The site does not use its own advertising or analytics cookies. Necessary operations and security are based on our legitimate interest in providing a working, secure website (Article 6(1)(f)). Service data is retained according to the providers’ operational and security practices.

If you email us, we use your email address, message and attachments to respond and follow up. We use Google Workspace for email. Our legal basis is our legitimate interest in providing support and responding to enquiries (Article 6(1)(f)), or providing a service you request (Article 6(1)(b)). We keep enquiries for as long as needed to resolve and follow up on the issue, or longer where a legal obligation or dispute requires it.

Recipients and international transfers

We use the providers listed above for the relevant features. Some providers process data outside the European Economic Area. For transfers covered by the GDPR, we use a valid transfer mechanism, such as an adequacy decision or the European Union’s standard contractual clauses. Contact us for more information about the safeguards.

Your choices and rights

You may request access, correction, deletion, restriction and, where applicable, data portability. You can object to processing based on legitimate interests and withdraw consent for future processing at any time. Send requests to [email protected]. We may need to verify your identity before providing access to data. You can also complain to the Norwegian Data Protection Authority or contact your local data protection authority.