Privacy Policy

Summary: Roundivo stores tournaments, names, results, the change history, backups, and exports only on your device. There is no account, advertising, or tracking or analytics SDK. Data leaves the device only when you start the optional Live Board (end-to-end encrypted; we cannot read the content), export or share a file, send us a message, or buy, restore, or have Pro verified (Apple or Google and RevenueCat).

1. Controller

2. Data on your device

Everything you enter in Roundivo is stored by the app only on your device. We do not receive this data.

• Tournaments: name, format, participants, stations, results, and the change history that makes corrections and “Undo” work.
• Settings: language, appearance, and round-timer settings.
• Pro status: the result of the last purchase check, cached locally so that Pro stays available without a network.
• “Free tournament used” marker: so that the free tournament cannot be used again after a reinstall, the app stores a marker on your device (iOS: Keychain, Android: Block Store). It contains only an identifier and a timestamp, is never transmitted, and is not backed up to iCloud or any other cloud.
• Live Board details: when a Live Board was first started for a tournament (so that a restart does not extend the lifetime), a random installation identifier, and the secrets you use to update or stop a board. The secrets and the installation identifier are kept in the operating system’s secure storage.

Roundivo does not need access to contacts, location, camera, microphone, or photos. The app reads the clipboard only when you paste names from it. The round timer alerts you through your device’s local notifications; nothing is transmitted, and the app uses no push service.

3. Backups, exports, and sharing

You create backups (.roundivo files) and image, PDF, and CSV exports yourself. They are not encrypted and contain names and results. Through your operating system’s share sheet they reach only the destination you choose. Roundivo cannot delete such copies remotely. The free image export carries the line “Created with Roundivo”.

Whether operating-system backups (for example iCloud or Google) contain app data depends on your device settings and the rules of Apple or Google. We can neither read nor manage these backups.

4. Live Board: data on the server

The Live Board is optional and starts only when you turn it on for a tournament. The app encrypts the state (tournament name, participant names, matches, results, stations, and round timer) on your device and uploads only the encrypted content. The key is only in the link or QR code you share, behind the “#”, which a browser never sends to a server. We cannot read the content.

Anyone with the link or QR code can read the board. Enter only names you may share with those people, and share the link only with people who should see it.

On the server we store:

• Content and board data: the encrypted content, a random board ID, timestamps from your device, a revision counter, and the permitted number of viewers. They stay until the board expires (24 hours with Free, 7 days with Pro, counted from the first start of the board for that tournament) or until you stop it. We then delete them within about one to two minutes.
• Verification values: verification values (HMAC) of the write and revocation secrets, not the secrets themselves, for as long as the content.
• Receipt: for ended boards, the board ID and timestamps, without content, for 14 days, so that old requests cannot bring an ended board back.
• Abuse protection: for rate limiting the server counts publishing attempts. It stores no plain values, only hashes (HMAC) made with a secret key from your IP address, the installation identifier, and the board ID, each with a counter and a time window. The window lasts one hour; the counters are deleted regularly afterwards, after one day at the latest.
• App authenticity on iOS: the identifier and public key of the app key verified with App Attest, a counter, and the environment, until 90 days after last use. One-time challenges (stored only as a hash) are valid for 5 minutes at most.
• No backups: we do not back up Live Board data. If the database is lost, running boards end and you start a new one.

The server writes no access logs. Technical error messages contain no board content, keys, secrets, tokens, or RevenueCat identifiers.

5. Live Board: viewers in the browser

Anyone who opens the link loads the page from live.roundivo.darkstone.app and fetches the encrypted board; decryption happens in the browser. The IP address is technically required for this but is not logged. The page sets no cookies, uses no local storage, no tracking, and no analytics, and loads nothing from third-party servers. The key in the link is never sent to the server; after loading, the page removes it from the address bar.

For the real-time view the server counts concurrent connections per board (10 with Free, 100 with Pro). It does not store viewer identifiers. At the end of the page a note points to the Roundivo product page; darkstone.app is contacted only when you click it.

6. App authenticity check

So that only genuine Roundivo apps can publish boards, the Live Board checks app authenticity when publishing. This happens only when you start or update a Live Board.

• iOS (Apple App Attest): Your device creates a key and has Apple confirm it. Apple receives the key identifier and a checksum (hash) of the request for this. The server does not call Apple.
• Android (Google Play Integrity): The app requests an integrity token through Google Play services (with a checksum of the request and the app’s project number). The server passes the token to Google’s Play Integrity API for evaluation and does not store it.

7. Purchases, Pro, and RevenueCat

Roundivo Pro Lifetime is a one-time in-app purchase without a subscription. The Apple App Store or Google Play handles payment, store account, and refunds; we receive no payment data. To show the price, handle the purchase, unlock Pro, and restore it, the app uses RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA). For this the app contacts RevenueCat even if you buy nothing. RevenueCat processes:

• a randomly generated, anonymous RevenueCat App User ID,
• product identifier, store, purchase history, and entitlement status,
• Apple receipt or Google purchase token, price, currency, and transaction time,
• technically necessary data such as IP address, platform, app and operating-system version, language, and store country.

Tournaments, participant names, and results are not sent to RevenueCat. Automatic collection of device identifiers is switched off in the app; advertising, attribution, and third-party usage analytics are not built in.

If you start a Live Board with Pro, the app sends your RevenueCat App User ID to our server when the board is created. The server uses it to ask RevenueCat whether Pro is active and does not store the ID; it keeps only the result in memory for at most 10 minutes. With Free no ID is sent.

The legal basis is Article 6(1)(b) GDPR for purchase, unlocking, and restoration and Article 6(1)(f) GDPR for a reliable entitlement status and abuse prevention. RevenueCat may process data in the United States and provides, among other safeguards, EU Standard Contractual Clauses in its Data Processing Addendum. More information: RevenueCat Privacy Policy.

8. Website, hosting, and server

The websites at darkstone.app are static, set no cookies, and contain no analytics, advertising, social-media, or tracking services. The web server and upstream proxy keep no regular access logs; security-critical technical messages may be processed briefly.

The website and the Live Board run on a server that we operate at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centre Falkenstein, Germany). The legal basis is Article 6(1)(f) GDPR; our interest is secure and reliable operation. More information: Hetzner Privacy Policy.

9. Support contact

When you contact us by email, we process your sender address, message content, and any information you provide voluntarily only to handle the request. Our email service is provided by Google; processing by Google Ireland Limited and affiliated companies may therefore take place. More information: Google Privacy Policy.

Please do not send real participant lists, passwords, complete store receipts, payment data, or device identifiers. For a diagnosis, the app version, device model, operating system, and a description of the problem are usually enough.

10. Legal bases, recipients, and transfers

• Contract performance, Article 6(1)(b) GDPR: app functionality, the Live Board you start, support, and purchase and restoration.
• Legitimate interest, Article 6(1)(f) GDPR: secure operation, rate limiting, app-authenticity checks, and reliable purchase entitlement.
• Your deliberate action: Live Board, export, sharing, import, and support contact are triggered only by you.
• Recipients: Apple, Google, RevenueCat, Hetzner, and the email service only for the task described.
• Third-country transfers: Apple, Google, or RevenueCat may process data outside the EEA; their safeguards, contracts, and privacy notices apply.

Where service providers act as processors for us, they are contractually bound to documented purposes, confidentiality, appropriate security measures, and applicable data-protection duties. Apple and Google process store and account data partly as independent controllers under their own terms.

11. Retention and deletion

• Tournaments and settings on the device: until you delete a tournament or uninstall the app. The “free tournament used” marker can outlast an uninstall, because preventing exactly that is its purpose.
• Live Board: until it expires or you stop it; the periods in section 4 apply afterwards.
• Exports, backups, and email attachments: until you delete them at the chosen destination.
• Device backups: according to your platform and account settings and the rules of Apple or Google.
• Purchase and entitlement data: according to statutory duties and the retention rules of the store or RevenueCat; the purchase remains restorable.
• Support messages: until the request is resolved and no statutory or legitimate evidentiary interest remains, usually three years after closure at most.

You delete all data on the device by uninstalling the app. Exported files, external backups, provider mailboxes, and store receipts are out of reach. A store purchase is not cancelled by deleting the app and can be restored.

12. Your rights and changes

Under the GDPR you may in particular request access, rectification, erasure, restriction, data portability, and object to processing. Where processing is based on consent, you may withdraw it for the future. Contact: darkstone.app@gmail.com. You can delete a Live Board yourself at any time with “Stop”. Because we cannot read content and cannot attribute a board to a person without the link, we need the board ID from the link for a request about a board. We may ask for reasonable proof of identity before disclosing or deleting data related to a support request or a RevenueCat identifier.

You may lodge a complaint with a data-protection supervisory authority, in particular the Austrian Data Protection Authority. This policy will be updated when features, providers, or the legal situation change materially; the current version remains available at this URL.