Privacy

Who we are

Zaragata is run by Rafael Simoes, a sole trader in New South Wales 2213, Australia. This page is our privacy policy under the Australian Privacy Act 1988 and the Australian Privacy Principles, and it applies wherever you play from. Anything in it you can ask about by writing to [email protected].

Who this is for

Zaragata is for adults. You have to be eighteen or over to play, to write, or to hold an account, and we do not knowingly keep anything about anyone younger. If you think a child has an account, write to us and it goes.

What we keep when you have an account

Playing needs no account. An account is for writing: rule sets, rules, favourites. When you sign in with Google we keep:

• Your email address, and the id Google gives your account. Never your Google password; we never see it. Your email is how we recognise you and how we would reach you. Nobody else is shown it.
• Your handle, which you choose. It is shown to everyone beside the rule sets you publish. Delete your account and the handle goes, with every rule set you wrote.

As you use the workshop we also keep:

• The rule sets and rules you write, drafts included: the rule, its consequence, the character who reads it and how it is said.
• The recordings made from them. A line is recorded once for a voice and kept, so the same line is never recorded twice.
• What you ask the rule writer for: the game, the brief you typed, and what came back. A game name you typed that we did not recognise is kept too.
• Your favourites, and the authors you block. Blocking is private; the person you blocked is never told.
• The decks of cards you set up: each deck's name and game, and each card's label and the number on its sticker. They are kept so your cards follow you to a new phone, and nobody else is ever shown them. A Zaragata card is registered to the account that first adds it to a deck, and let go the moment you remove it or delete your account.
• For the daily allowance of recordings: your account, and a random number your phone makes for itself. It says nothing about you or the phone. These rows go after thirty days.

What we keep when you only play

• A table. The name you chose for the night, the cards you tapped as yours, the cards played and the deal they came from. A word you lock a room with is kept scrambled. All of it is deleted within a day of the last time anyone used the table.
• Rules from friends. When you ask friends for rules, we keep the link, the name friends see you by, any names you list, and each rule they write until you keep it or drop it. A rule is stored without the names it mentioned and without who wrote it. A friend's browser holds a private token that lets them change their own, and we keep only a scrambled copy. Once you decide, the words leave our copy of the request (a kept rule lives in your rule set, which is private until you publish it); whether it was kept goes 30 days later. A request that never became a rule set goes after thirty days. Deleting the rule set deletes everything friends wrote into it.
• A card. A card's tag has a number on it. When you tap a card, that number goes to the table so everyone's phone agrees what was played. It is the same as a table: gone within a day.

Reports

When you report a rule set, a rule, an author or a room, we keep what you picked, anything you wrote and what was reported. We also keep who sent it: your account if you have one, and if you were a guest in a room, the network address the report came from. We keep a settled report for a year, and an open one until somebody has dealt with it.

The network address

Every request to our server arrives from an address. We use it to stop one machine from sending thousands of requests, and it appears in the server's own logs. Those logs are there to run and protect the service, they roll over on their own, and we do not use them to follow anyone.

On your phone

The app keeps these on the phone itself: your sign-in, the name you use at tables, your drafts and any saves waiting for a connection, the tables you have joined lately, that you told us you are eighteen or over, a few choices you made, and the random number mentioned above. Signing out clears the sign-in and everything of your account the phone kept: your rule sets, your decks of cards and any saves still waiting.

• Camera. Used live to read a table's QR code, and for nothing else. It records nothing and no picture is kept.
• NFC. Used to read the number on a card's tag. It never reads what the rule on the card is.
• Bluetooth. Used to reach the speaker on the table. It is never used to find where you are.
• Battery. The level is read on the phone to warn you before a long night, and never leaves it.
• Android install. Once, after you install, the app asks Google Play which table sent you to the store, so it can take you there.

The web pages keep your age answer, the rules you wrote and the name you used in your browser, and nowhere else. There are no cookies and no trackers.

What we do not do

No ads. No analytics. We do not sell anything about you, and we do not ask for your location, your contacts, your photos or your microphone.

Where it is kept, and who helps us

Our server is in Sydney, Australia. Everything above that we keep is kept there, except the recordings. These do part of the work, and each gets only what that part needs. All of them are American companies, so what we hand them leaves Australia, mostly for the United States.

• Google signs you in, in the app and on the page where you delete your account. We check the proof Google gives and keep your email address and account id from it.
• ElevenLabs turns a rule into a voice. It is sent the words to be spoken and the voice to speak them in. Not your name, your email or your handle.
• OpenRouter passes your text to the language model that writes and checks rules. It is sent what you typed (a brief, or a game name), the rule, its consequence and its character, and each rule you publish is read once to check it. Not your name, your email or your handle.
• Cloudflare stores the recordings, and sits in front of our website, so the traffic to it passes through them.
• DigitalOcean runs the machine in Sydney that our server is.

Each of them has its own privacy policy for what it does with what it is handed.

Seeing it, correcting it, and having it deleted

You can delete your account yourself, at any time, in either of two places: in the app, under Settings, Delete my account; or on the web, at zaragata.app/account/delete, signed in with Google. This is what it does.

Deleting your account happens at once and cannot be undone. It signs you out everywhere.

What goes

• Your account: your email address, your Google sign-in and your handle.
• Every rule set you wrote, published or not, with its rules and recordings.
• Your favourites, and the authors you blocked.
• The decks of cards you set up, as they were kept with your account.
• What you asked the rule writer for, and the rows kept for your daily allowance of recordings.
• Your sign-in on every phone.

What stays

• Copies other people made of your rule sets. They are theirs and stay under their names, and the oldest one takes your rule set’s place at the head of its copies. Nothing in them points to you.
• Reports. The ones you sent keep what they said and no longer point to your account; a report about you, and what was done about it, is kept for a year.

Your handle, your rule sets and your rules you can change or delete yourself, any time, in the app. For anything else, such as seeing what we hold about you or correcting it, write to [email protected] (also on the contact page), from the address on your account if you have one. A person reads that mail and answers within thirty days.

If you think we have handled something about you wrongly, write to us first. If our answer does not settle it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you live elsewhere, your own country's law may give you rights of its own over what we hold, and we honour them the same way: write to us.

If this changes

If we change what we keep, or who we hand it to, in a way that matters, we will say so here before the change takes effect.