Privacy Policy

1. Who we are

Survivly is a gamified bushcraft companion app for iPhone and Android, operated by Webforce Studio. This policy explains how we collect, use, store, and delete personal data when you use our website (survivly.app) or the Survivly mobile apps.

Privacy contact: hello@webforce-studio.com

2. Data we process in the mobile app

When you create a Survivly account (optional — guest play is available without an account), we may process:

• Account data: email address, scout display name, authentication identifiers.
• Gameplay data: XP, inventory, lesson progress, Wild Dex discoveries, credits/wallet history.
• Social & patrol data: patrol membership, preset friend messages, marketplace listings you create, join requests and invites.
• Location (optional): when you enable GPS, we use a coarse city/region centroid for weather-aware quests — not continuous background tracking.
• Camera scans: plant/species identification images you submit for AI analysis (processed via our secure backend).
• Push tokens: device tokens if you allow notifications (patrol chat, friend alerts, daily reminders).
• Feedback: optional text you send from the app, plus basic device info to help us reproduce issues.

Guest mode keeps progress on your device. Signing in syncs gameplay to your account in our database (Supabase, EU region).

3. Your GDPR rights

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access and export your data — Settings → Export My Data in the app.
• Delete your account and server-held data — Settings → Delete Account (permanent).
• Rectify inaccurate data — update your scout name in Settings or contact us.
• Object or restrict processing — contact us; you can also play as a guest without an account.
• Lodge a complaint with your local data protection authority.

Account deletion removes your auth user and cascades linked profile, wallet, inventory, lessons, discoveries, and related rows. Some patrol content you posted may remain visible to other scouts in anonymised form until patrol admins remove it — contact us if you need help.

4. Website analytics (cookieless)

We use PostHog (EU cloud) for basic, aggregated website analytics. We run PostHog in cookieless mode with in-memory persistence only:

• No analytics cookies, localStorage, or sessionStorage on your browser.
• No session replay or autocapture on the marketing site.
• Page views are counted per browser session without cross-session tracking.

5. Mailing list

If you join our waitlist, you provide your email voluntarily. Mailchimp processes it for launch updates. You can unsubscribe anytime via the link in our emails. We do not sell your email address.

6. Processors & subprocessors

We use trusted providers under data-processing agreements where required:

• Supabase — authentication, database, edge functions (EU).
• PostHog — cookieless website analytics (EU).
• Mailchimp — waitlist email (if you subscribe).
• Apple / Google — push delivery when you enable notifications.
• Firebase Crashlytics (Android) — crash diagnostics when enabled in production builds.
• Kindwise / OpenAI (via our backend) — species identification when you run a scan.
• Resend — transactional auth emails.

7. Retention

We keep account data while your account is active. When you delete your account, we erase server-held personal data without undue delay. Backups may retain encrypted copies for a limited period before rotation. Waitlist emails are kept until you unsubscribe.

8. Children

Survivly is not directed at children under 13 (or the minimum age in your country). We do not knowingly collect personal data from children. Contact us to request deletion if you believe a child has created an account.

9. Third-party links

Our website or app may link to third-party sites. We are not responsible for their privacy practices.

10. Contact

Questions about this policy or your data rights: hello@webforce-studio.com