1. Who is responsible
DOROBANTI NETWORK S.R.L. (Dorobanti Media), tax identifier CUI 51010254, is the controller of data received for the website, support and commercial administration. Registered office: Aleea Tomești nr. 9, bl. 15, sc. 2, et. 7, ap. 63, Sector 4, București, 042144, România.
For questions or rights requests: contact@dorobantimedia.com or +40 730 000 064.
2. Local game data
Impostor requires no account and sends no gameplay data to a developer server. Devices exchange chosen names, answers, votes, scores and temporary session and reconnection identifiers over Wi-Fi. Data stays in application memory, without persistent history.
The Host’s name is advertised on the local network, including to devices that have not joined. The Host holds the complete state; each player receives only information permitted in the current phase. Answers and their authors appear at Reveal; the impostor’s identity and question appear at Results. Results show vote totals, not who voted for whom.
Use a nickname and avoid sensitive data about yourself or others. A name enables participation; answers and votes let the round progress. Leave the game or revoke Local Network access in Settings to stop the connection. We do not request birth dates or verify age; follow the App Store rating and category warnings.
3. Connections and local diagnostics
The game uses Bonjour for discovery and TCP for connections, without TLS or mutual authentication added by the app. Use a trusted Wi-Fi network. Separating information between roles is not end-to-end encryption.
The app has no analytics, ads, tracking or remote logging. Production system logs contain technical categories, not names, answers or votes. Apple separately manages system diagnostics and optional sharing.
4. Purchases and Apple services
StoreKit supplies the product, price, offer eligibility and verified transactions needed for Impostor+ access. Apple handles the account and payment; we do not receive full card details.
Apple may provide sales, subscription and refund reports for administration and financial records, plus diagnostics if you allow sharing. Apple is separately responsible for data used for its own services.
5. Website, cookies and theme
Vercel Inc. hosts the website. For delivery, security and diagnostics, it may process IP addresses, access times, page addresses and parameters, technical headers, response codes and error or security information.
The website uses no accounts, checkout, contact form, analytics, ads or tracking. It sets no cookies and writes nothing to localStorage or sessionStorage. The address determines the language; the Light/Dark choice stays in memory and resets on reload.
6. Contacting us
To respond, we use your email address, messages, attachments and delivery metadata or, for calls, the number, contact time and information provided. Missing necessary information may prevent us from handling your request.
Only authorised staff can access correspondence. We use iCloud Mail through Apple Distribution International Ltd., Ireland, and Vodafone telephone services. Do not send passwords, card details or unnecessary sensitive data. iCloud Mail is encrypted in transit and at rest, but not end-to-end.
7. Why we may use this data
For Impostor+ access administration and requested support, we rely on performing a contract or steps you request before it (GDPR Article 6(1)(b)). Website security and operation, general correspondence and defending rights rely on the legitimate interests in those purposes (Article 6(1)(f)). Rights requests and mandatory accounting or tax records rely on legal obligations (Article 6(1)(c)).
These grounds concern the company’s own processing. Local Network permission is not GDPR consent and does not replace special conditions for sensitive data. We use no profiling or automated decisions with legal or similarly significant effects.
8. Providers and transfers
Game data is received by the session’s devices, except for the Host name advertised on the network. For the website and contact we use Vercel, Apple, Vodafone and their infrastructure providers. Vercel processes hosted data on our behalf as a processor and its own service data as an independent controller.
Vercel delivers the website through a global network, with server functions configured in the US. Vercel and Apple may process data in the US and other countries; covered transfers use Standard Contractual Clauses and the safeguards in their documentation. Ask our contact address for information and a copy of applicable safeguards.
We disclose to authorities or professional advisers only data needed for a legal obligation or defending a right.
9. How long data is kept
Game data stays in memory until the session is released when you return Home or the app terminates, without a guarantee of immediate overwriting. Disconnection does not erase accepted contributions. We do not control screenshots kept by other participants.
Vercel runtime logs visible in our account are kept for one day, without automatic export. An incident investigation export is deleted within 90 days of closure, except for a documented retention obligation.
Ordinary correspondence is deleted from mailboxes and records we control 30 days after the last contact. Data-rights request records are kept for three years after closure; additional identity-verification copies, no longer than 30 days after verification.
Apple states a maximum of 25 days for iCloud connection and mail logs. We have no verified deadline for all provider backups. Accounting, tax and dispute records are kept separately for the legally required period or resolving the dispute, then deleted or anonymised.
10. Your rights
Subject to the law, you have rights of access, correction, erasure, restriction, portability and objection, including to legitimate-interest processing. Withdraw consent if it is the basis of processing; the operations in section 7 do not rely on consent.
Write to contact@dorobantimedia.com. Requests are normally free. We respond without undue delay, within one month; for complex or numerous requests, we may add two months, giving reasons in the first month. We verify identity only when necessary.
We handle requests for data we control or can access; we have no server from which to retrieve local sessions. You may complain directly to ANSPDCP without contacting us first, and seek a judicial remedy.