Privacy Policy

Who we are

Eniclic operates VerbaFlip and is the data controller. Contact: info@eniclic.com.

What we collect

• Account: email address, password (hashed by the sign-in system), username, country and — only if you switch it on — your city.
• Gameplay: the games you create or join, moves, scores, streaks and results, so rankings and your stats work.
• Safety: reports you send or receive, players you block, and moderation decisions.
• Legal confirmations: your age 13+ declaration, which versions of the Terms and Privacy Policy you accepted, when you accepted them, and your marketing choice.
• Technical: sign-in session and a "last seen" time so friends can see who is online.
• Rewards and purchases: coin balances, verified reward transactions, cosmetic ownership and payment references. Card details are handled by Stripe, not stored in VerbaFlip.
• Optional voice: when connected, LiveKit carries live audio in invitation-only rooms and receives a short-lived participant identifier. VerbaFlip does not record or store voice audio. Microphone access starts only when you choose to join.

Why we use it

To run the game, leaderboards and your account (contract); to keep players safe and enforce the rules (legitimate interests and safety of children); to honour your legal confirmations (legal obligation); to send updates, competitions and offers only where you ticked the marketing box (consent, withdrawable at any time in your profile).

Sign-in providers

If you choose "Continue with Google" or "Continue with Lovable", that provider shares your name, email address and a unique sign-in identifier with us. We do not receive your provider password.

Where it is kept and who helps us

Your data is stored on a managed cloud platform in an encrypted database, encrypted in transit, with access limited to the system owner and the systems that need it. Email delivery, sign-in providers and — once live — our card payment processor act as processors under contract.

Young players (13–17)

Players must confirm they are at least 13. This is a self-declaration, not verified age assurance. Precise location is never collected; city sharing is optional and off by default. Private rooms require invitation codes. Report, block and voice mute controls are available. Proportionate age assurance and additional safeguards for young players require review before public commercial launch.

How long we keep it

Account and gameplay data are kept while your account exists and erased when you delete your account (profile, role, confirmations, blocks and sign-in record). Safety reports are kept for up to 24 months. Records of which legal versions you accepted are kept as evidence of consent.

Your rights

You can see and edit your data in your profile, download your stats, and delete your account yourself at any time. You can also email info@eniclic.com to access, correct, restrict or erase your data, object to processing, or withdraw marketing consent. If you are in the UK, you may complain to the ICO (ico.org.uk).

Changes

If this policy changes materially we update the version number and ask you to acknowledge the new version before continuing to play.