Privacy Policy

Impostor does not require an account. The game runs locally between nearby participating devices and does not use a developer gameplay server.

During a session, names, answers, votes, and technical data needed for the game are held in memory and exchanged between devices according to the game phase. This does not mean that data never leaves a participant’s device or that no personal data is processed.

In the configuration described here, the app has no analytics, advertising, or tracking SDKs and does not send gameplay-session data to the developer. Local connections use Apple system technologies, while purchases and subscriptions use the App Store and StoreKit. The website has no accounts, checkout, analytics, advertising, tracking, contact form, or embedded third-party content.

This policy separates five contexts: local-session data in the app, Apple purchases and reporting, technical website operation, the in-memory Light or Dark display choice, and direct email correspondence.

It does not describe accounts, profiles, a gameplay backend, cloud storage, newsletters, or a web form because those features are not part of the baseline. If such a feature or a new provider is added, the analysis and policy must be updated before it is enabled.

DOROBANȚI NETWORK S.R.L., CUI 51010254, Trade Register number J2024047810002, with its registered office at București, Sector 4, Aleea Tomești nr. 9, bl. 15, sc. 2, et. 7, ap. 63 and fully paid share capital of 200 lei, is the controller for its processing described in this policy. The company is also the app publisher and developer, European Union trader, digital-content supplier, and support provider. For support or privacy rights, email contact@dorobantimedia.com or call +40 730 000 064. The company does not use fax.

For Customer Data hosted on the Pro plan, Vercel Inc. acts as a processor. Vercel identifies itself as an independent controller for its Contact Data and Service-Generated Data. Apple separately processes data needed for the App Store, StoreKit, and iCloud Mail under its own terms and policies.

The company has not appointed a data protection officer. Its current activities do not meet the criteria in GDPR Article 37: it is not a public authority, and its core activities do not involve large-scale regular and systematic monitoring or large-scale processing of special-category or criminal-offence data. Send privacy requests to contact@dorobantimedia.com.

During a game, the app processes participant-entered names, roster membership, assigned questions from bundled content, answers, votes, scores, game state, ephemeral session/player/command identifiers, and an opaque reconnect credential.

The data comes from participant input, content bundled with the app, and technical values generated for the local session. It is used to create or join a game, show the correct role- and phase-specific information, validate actions, calculate votes and scores, and enable reconnection.

A name and technical session data are needed to participate. If a participant does not provide the answer or vote required in the current phase, the game cannot normally progress until the participant reconnects, contributes, or is removed by the Host.

Data is exchanged between participating devices according to the game phase. The Host maintains authoritative state, but the Host device receives the same role- and phase-appropriate projection as other players’ devices.

At Reveal, the group question and attributed answers become visible to the group, while the impostor identity and impostor question remain hidden. At Results, the impostor identity, group question, impostor question, answers, vote totals, round points, and cumulative local score become visible.

Active state and credentials are held in the active run's memory and released through the app lifecycle on leave, end, or shutdown; this is not a promise of immediate cryptographic memory overwriting. A disconnection does not immediately erase the player or accepted contributions; they remain in the active session until reconnection, Host removal, or session end.

There is no persistent gameplay database and no developer server through which local-session data can later be searched or retrieved.

The app uses local system logging for technical information. Production messages avoid gameplay payload values, and detailed game-session diagnostics are limited to development configurations.

The local connection uses Apple Wi-Fi Aware and Network.framework technologies. The app does not add its own application-level end-to-end encryption layer, so this policy does not describe the session as “end-to-end encrypted,” “completely anonymous,” or free of all third-party participation.

The app does not integrate a developer-operated remote-logging SDK or service. Locally created unified logs remain under device and operating-system control. If you enable optional Apple diagnostic sharing, Apple handles that sharing under your device settings and its policies; it is not collection through an app SDK.

Through StoreKit, the app requests product, offer, storefront, entitlement, and verified transaction-state information. Apple processes App Store account, transaction, storefront, and payment data under its own materials. The app does not receive payment-card details.

Through App Store Connect, the company can access reports Apple provides to administer sales, subscriptions, refunds, and financial records. Neither the app nor these reports gives the company complete payment-card details.

Apple independently determines the processing needed for the Apple Account, App Store, StoreKit, and payment services under its own materials. DOROBANȚI NETWORK S.R.L. remains responsible for the app, support, and data it receives in its own systems.

• Apple Privacy Policy

The website is hosted on the Vercel Pro plan operated by Vercel Inc. Content is delivered through Vercel’s global network, and server functions are configured in the Washington, D.C., United States region.

To deliver, secure, and troubleshoot the website, Vercel may process the IP address, date and time, host, request path and method, search parameters, technical headers such as the user agent, response status, request identifier, region, and cache, firewall, error, or security information.

Vercel uses infrastructure and subprocessors including Amazon Web Services, Microsoft Azure, and Google Cloud Platform. Data may be processed in the United States and other regions where Vercel or its subprocessors operate. Applicable transfers from the European Economic Area use Standard Contractual Clauses.

The website locale is represented by its address: Romanian at the default route and English under /en. The baseline does not need a cookie to remember the locale.

The website starts in Dark mode. The theme control switches only between Light and Dark. The selected mode is held only in module memory for the current client-side navigation session, so it continues across soft navigation while a hard reload returns to Dark.

The theme choice is not written to cookies, localStorage, or sessionStorage. Any later implementation that persists the theme or writes another value to the device requires a policy update before activation. The update must identify the key, purpose, write trigger, lifetime, reset method, and applicable legal treatment.

The website does not include a form submitted to a backend. If you email contact@dorobantimedia.com, we process the sender address, recipients, date and time, subject, message, attachments, technical headers, and later correspondence.

We use this data to understand and handle support, privacy, or other requests. Without a reply address or information needed to understand the issue, we may be unable to resolve the request.

The address uses iCloud Mail with a custom domain, provided by Apple Distribution International Ltd. in Ireland. Apple and its providers may store or process messages and metadata in the United States and other global data centers. Email content is encrypted in transit and at rest, but iCloud Mail is not end-to-end encrypted. Apple states that covered transfers use Standard Contractual Clauses. Do not send sensitive data that is unnecessary for resolving the request.

The baseline does not use analytics, a tag manager, advertising pixels, advertising, fingerprinting, session replay, A/B testing, newsletters, marketing automation, embedded social content, third-party maps or video, or a chat widget.

In the current configuration, the production website does not set cookies or write to localStorage or sessionStorage. It does not show a consent banner because no nonessential storage or tracking technology is active.

If nonessential technology is added later, it must not run before consent analysis, policy updates, and any required mechanism are in place. A functional theme preference will not be misleadingly described as tracking.

Processing needed for local gameplay, administration of the Impostor+ entitlement, and requested support relies on performance of a contract or steps requested before entering into one under GDPR Article 6(1)(b).

Website technical and security logs and general correspondence rely on legitimate interests in providing a secure and functional service, preventing abuse, troubleshooting, answering messages, and defending rights under Article 6(1)(f). We limit the data and retention period, and the right to object applies where the law provides it.

Privacy-rights requests and mandatory transaction, accounting, or tax records rely on compliance with legal obligations under Article 6(1)(c). The current processing described here does not rely on consent, so consent withdrawal does not apply to these operations.

In the game, only participating devices receive the session data needed for the relevant phase. The company does not operate a gameplay server that receives names, answers, or votes.

Website recipients include Vercel Inc. and its infrastructure providers, including Amazon Web Services, Microsoft Azure, and Google Cloud Platform. Email and Apple-service recipients may include Apple Distribution International Ltd., other Apple entities, and their providers.

Vercel and Apple may process data in the United States and other global locations. Covered transfers from the European Economic Area use Standard Contractual Clauses and the security measures described in the providers’ materials.

Active-game data is held in memory for the local run and released through the app lifecycle on leave, end, or shutdown. A temporary disconnection retains state while the session continues so that reconnection or a Host decision remains possible.

Vercel retains project-visible runtime logs for one day on the Pro plan. No Log Drain is configured. Build logs remain associated with deployments while the account retains those deployments; they describe the build process and do not contain local gameplay-session data.

We keep support messages for 12 months after a request closes and privacy-rights requests for three years after closure. Extra identity-document copies used only for verification are deleted within 30 days after verification ends. We review the mailbox quarterly for deletion and review this policy and its retention periods annually.

Apple states that iCloud connection and mail logs may be retained for up to 25 days. Message content remains in iCloud Mail until we delete it under the periods above. App Store reports and transaction records are kept for the period required by accounting or tax obligations or to establish, exercise, or defend legal claims, then deleted or anonymized.

Depending on the operation and legal conditions, you may have rights of access, rectification, erasure, restriction, portability, and objection, and a right to withdraw consent where consent is the actual lawful basis.

Send requests to contact@dorobantimedia.com. We respond without undue delay and usually within one month. If the law permits an extension because of request complexity or volume, we notify you within the first month. We request only the additional information needed to verify identity and handle the request.

Data that exists only in participating devices’ memory is not available in a company backend for search or extraction. We can handle requests concerning email, website logs, and Apple reports only to the extent that we control or can access that data.

The described configuration does not use data for profiling and does not make decisions based solely on automated processing that produce legal or similarly significant effects on a person.

Local calculation of votes and points follows the game rules and determines only the result of the entertainment session; it is not used to evaluate or profile a person outside the game.

You may first send a request to contact@dorobantimedia.com. Whether or not you do so, you have the right to complain to Romania’s National Supervisory Authority for Personal Data Processing under applicable law.

The link below opens the authority’s official complaint information.

• ANSPDCP — complaint information

This policy takes effect on the date shown above. An ordinary website build does not automatically change its version or date.

We update the policy before activating an app, website, provider, browser-storage, or contact-practice change that alters the data or purposes described here. We present material changes clearly.

The Romanian and English versions express the same policy, and neither takes precedence over the other. If you notice an inconsistency, email contact@dorobantimedia.com.