Privacy policy

Last updated: 24 October 2026

Tembira is a conversation game you play out loud, on one phone you pass around. The questions are on the screen; the answers are spoken in the room. The app never hears, records or stores what anyone says.

1. Who we are

This policy covers the Tembira app for iPhone (and for Android, once it's released) and the backend we run for it.

The data controller is ZARFA s.r.o., registered in the Czech Republic, ID 04573021, registered office at Arnošta Valenty 639/5, 198 00 Praha, Czechia. Write to us at support@tembira.app. We have not appointed a data protection officer.

2. What we collect

• Guest id. You don't need an account to play. The first time you open Tembira, Firebase Authentication creates an anonymous user id for that install, a guest id. It carries no email address and no name. It keeps your purchases, votes and feedback together, and it's the Support ID in Settings, so we can find them when you write to us.
• Your account, if you have one. An account is optional: in some cases you can create one or sign in, with Sign in with Apple, Google Sign-In, or an email address and password. Only then do we keep an email address and the identifiers that come with your sign-in (a Firebase user id, and your Apple or Google account id). If you use a password, Firebase Authentication stores it hashed; we never see or keep it in plain text. Email accounts get a verification email and, if you ask, a password-reset email.
• General app settings. Tembira keeps your general settings, such as the question language, Keep screen on, Haptics, Evening nudge and your analytics answer, so the app works the way you set it up. They hold no names, questions or answers. For now they stay on your phone.
• Your email address, if you give it to us. You can add an email address in the app's Settings. It's optional and never needed to play or to buy. We use it to help you when you write to support, as an easy way to show it's you, and, only if you tick the box for it, for email about Tembira (section 3). We send you a link to confirm the address, from mail.tembira.app. With the address we keep whether it's confirmed and a record of your choice about email about Tembira (when you agreed or stopped, to which words, and how). You can change or remove the address in Settings at any time.
• A promo sign-up, if you make one. If you claim a free-packs offer (a page at app.tembira.app/promo/…; links to tembira.app/en/promo/… lead there), we keep the offer's code, a hashed form of your email address (not the address itself), which packs the offer opens and until when. When the same address is confirmed as your email in the app, we match the two and give that guest id the packs through RevenueCat. To stop abuse we also count sign-ups per connection for a day, again only as a hashed form of the IP address, and the page uses Firebase App Check with Google reCAPTCHA Enterprise, which looks at signals from your browser and device to tell people from bots (Google's privacy policy applies to that). The legal basis is giving you the offer you asked for.
• Purchases. Packs (and subscriptions, if we offer them) are bought through the App Store (or Google Play, once the Android app is out). Apple or Google takes the payment; we never receive your card details. We receive a record of what you bought, and for a subscription its status (active, renewing, cancelled), which we keep against your Firebase user id (your guest id, or your account if you have one). Your purchases belong to your Apple ID or Google account, so on a new phone Restore purchases brings them back. RevenueCat handles this for us. If you have an account, RevenueCat also gets its email address and, if your account has one, your name (a Google account has one, and so does an Apple one if you shared your name), so we can find your purchases when you write to support.
• Crash reports. If the app crashes or hits an error, Firebase Crashlytics sends us a report (what went wrong, the device model, OS and app version, and your Firebase user id, which is your guest id or your account's) so we can fix it. This is on whenever you use the app and isn't part of the analytics choice below.
• Analytics and performance, only if you allow them. Seeing how people really use Tembira tells us what to fix and what to make next, so the app works well and the way you like it. The first time you open Tembira, it asks whether it may measure how the app is used, and measures nothing unless you tap Allow. You can change your answer any time in the app, in Settings › Analytics. What we collect, through Firebase Analytics and Performance Monitoring: which screens you reach, which buttons you tap, where you get stuck, how long things take to load, which packs you look at and how a purchase or restore turned out, and each conversation in numbers (the pack and level, how many players, how many questions were answered and skipped, how long it lasted, and your thumbs up or down, without saying which question). When you buy a pack, we also learn what it cost: RevenueCat sends the pack, its price and the currency to our Google Analytics. This too only happens if you allow analytics. Firebase adds what it collects on its own: your device's model, operating system, language and app version, a rough location (such as city or country) that Google derives from your IP address without keeping the address, and an app instance id. All of it is linked to your Firebase user id (your random guest id, or your account's, if you have one), never your name or email. Never a player's name, a question's text or anything anyone says or types. We use it only to understand how Tembira is used and make it better, and we never sell it. It doesn't use your device's advertising identifier, Google's advertising features are switched off for it, and we don't track you across other companies' apps or websites, so the app doesn't show Apple's tracking prompt.
• Which ad brought you, only if you allow analytics. If we advertise Tembira and you install it from one of our ads, we may learn which campaign it was, so we can tell which ads lead to people playing and buying. For Apple's own ads we use Apple's AdServices attribution, which gives us the campaign but nothing about you; we keep it with your purchase records. Other ad networks only get anonymous, aggregated counts through Apple's SKAdNetwork and AdAttributionKit, which run inside iOS. Neither uses your advertising identifier or follows you across other apps.
• App integrity. Firebase App Check (Apple App Attest and DeviceCheck) confirms that requests come from the real Tembira app, to keep the backend from being abused. It doesn't identify you.
• Votes and feedback on questions. You can give the question on screen a thumb up or down. We keep your most recent vote on each question (up or down, and on a thumb down the reason you picked, if any) with your Firebase user id, so the same guest id or account can't count twice on one question within 12 hours. The totals per question don't say who voted. After a thumb down you can also type a few words about what didn't work. That's optional and up to 500 characters. We keep it with your Firebase user id and read it to make the questions better. It never goes to analytics or crash reports. Please leave out names and anything personal. When you move past a question with Another question, we add one to that question's skip count, so we can find the questions people would rather not answer. The count holds no user id or device id, so nothing in it says who skipped. Votes, feedback and skip counts are sent whatever your analytics answer is.
• Support email. If you write to us, we get what you send. When the app opens an email for you (Email support in Settings, or, if you have an account, asking us to delete one you can't sign into on this phone), it fills in your Support ID (your Firebase user id), platform and app version, and your sign-in methods if you have an account, so we can find your data without asking you for more.

What stays on your phone

Some things never leave the device. We can't see them, and they're not part of what we hold for you:

• the names of the players you add to a conversation, and, if you have an account with a name, your first name when the app fills it in as the first player (section 4);
• the conversation in progress (which questions came up, when, which were skipped, how long each turn took), so you can pick up where you left off. Only the skip counts above, which don't say who skipped, leave the phone;
• your stats (conversations played, questions answered, your most played pack);
• a copy of the last question catalogue we sent, so packs you own play offline.

The evening nudge is a reminder your phone schedules for itself. We don't run a notification server and don't hold a token to send you anything. Delete my data clears the conversation in progress and your stats from the phone, and so does deleting an account; signing out of an account clears the conversation in progress.

What we don't do

We don't show ads. We don't sell or rent personal data, or share it for advertising. We don't record your screen or your sessions, and we don't use your microphone or camera. We don't build a profile of you or make automated decisions about you.

3. Why we use it (legal bases)

• To provide the app (contract): creating your guest id (and your account, if you make one), sending you the questions, unlocking and restoring what you bought, verification and password-reset email if you have an account, and answering you when you write to us.
• Your consent: analytics, performance measurement and ad attribution, which you give on that first screen. You can withdraw it any time with the switch in the app's Settings, and collection stops straight away. You can also ask us to delete the analytics data linked to your Support ID. Withdrawing doesn't make what was collected before unlawful.
• Our legitimate interests: keeping the app stable (crash reports), keeping the backend secure (App Check, rate limits on things like password resets), improving the questions from your votes, feedback and skips, and running a reliable service. You can object by writing to us.
• Legal obligations: tax and accounting rules, and the app stores' rules, where they apply.

Email about Tembira. We may email you about Tembira (new packs, seasonal bundles and news) and about other apps, products or services from ZARFA s.r.o. We only have an email address if you give it to us, in the app's Settings or, if you have one, with your account. We never give your address to anyone else for their marketing.

• Legal basis: your consent, for everyone, whether or not you've bought anything. Buying a pack never signs you up. We only send this email if you gave us an address, ticked the box that says "Send me new packs, seasonal bundles and news from Tembira and our other apps. I can unsubscribe any time." (it starts unticked), and confirmed the address with the link we send you. We keep a record of when and how you agreed, and to which words, so we can show it.
• Stopping it: turn it off in the app's Settings, or use the unsubscribe link in any such email, and we'll stop, no questions asked. Unsubscribing doesn't stop account email (verification and password reset) or the link that confirms your address.

For now we don't send this email at all: we keep the list of who agreed up to date, so it's ready. The only email we send from Tembira today is account email and the confirmation of your address.

4. Data from Apple and Google sign-in

This section applies only if you have an account. Playing as a guest uses neither.

When you sign in with Apple or Google, we ask only for what's needed to create and recognise your account, and your name:

• Sign in with Apple: your email address, or the private relay address Apple creates if you choose Hide My Email, Apple's id for your account, and your name if you choose to share it. Apple offers it only the first time you sign in, and you can change it or leave it out on Apple's sheet.
• Google Sign-In: your email address, your Google account id, and the basic profile Google shares with every sign-in (your name and profile picture address). The app never uses your picture.

Firebase Authentication keeps these on your account record. Your name is used for two things only. When you start setting up a conversation and the player list is empty, the app fills in your first name as the first player; it stays on your phone like every player's name, and you can change or remove it. And RevenueCat gets your name, so we can find your purchases when you write to support. It's never sent to analytics or crash reports.

We use this data only to sign you in, fill in your first name as a player, keep your purchases with your account, find them when you write to support, and contact you about your account. We don't ask for access to your contacts, calendar, files or anything else in your Apple or Google account. We don't sell this data, use it for advertising, or let people read it except where needed for security, to answer you, or where the law requires it. Tembira's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Deleting your Tembira account deletes it (section 7), and you can also remove Tembira's access from your Apple ID or Google Account settings.

5. Who helps us run it

These companies process data for us, on our instructions. None of them gets your players' names or anything said during a conversation, because we don't have those either.

• Google (Firebase), Google Ireland Limited and Google LLC: Authentication (your guest id, and your account if you have one), Cloud Functions and Cloud Firestore (your purchase records, and your votes, feedback and skip counts on questions), Crashlytics, Analytics and Performance Monitoring (only if you allow them), and App Check. Firebase privacy.
• RevenueCat, Inc.: records your purchases against your Firebase user id (your guest id, or your account's), so they unlock and restore, and, if you allowed analytics, which ad campaign brought you (section 2). If you have an account, it keeps its email address and, if your account has one, your name, so we can find your purchases when you write to support. It also passes each purchase (the pack, its price and the currency) to our Google Analytics, again only if you allowed analytics. RevenueCat privacy.
• Resend: sends account email for us (verification, password reset), if you have an account, and, where section 3 allows it, email about Tembira. It gets your email address and the message. Resend privacy.
• Apple: App Store payments, and Sign in with Apple if you use it. Apple privacy.
• Google: Google Sign-In, if you use it (and Google Play payments, once the Android app is out). Google privacy.

Resend also sends the link that confirms an address you give us in the app, and keeps our contact list for email about Tembira. Once you confirm the address, Resend holds it with your choice for each kind of email (Tembira news, and other apps from us), so the choice in the app and an unsubscribe in an email stay in step. Removing the address, or deleting your data, removes it from Resend too.

The roadmap link in the app opens our public board at tembira.canny.io, run by Canny. It's a separate service with its own account and privacy policy; anything you post there isn't covered by this one.

6. Where it's processed

Our database and backend functions run in Google Cloud's europe-west1 region (Belgium). Some services, including Firebase Authentication, Crashlytics, Analytics, and RevenueCat and Resend, may process data in the United States and other countries. For users in the EU, EEA and UK, we rely on each provider's transfer safeguard: the EU-US Data Privacy Framework where the provider takes part in it, or Standard Contractual Clauses otherwise. Write to us for the details for a particular provider.

7. How long we keep it

We keep your guest id, or your account, and your purchase records for as long as the guest id or account exists. Crash reports and analytics follow Firebase's retention periods (crash reports are kept for 90 days; analytics for up to 14 months). Server logs, which may include an IP address, are kept only as long as we need them to run and secure the service.

Your most recent vote on each question is kept while your guest id or account exists. Feedback you type after a thumb down is deleted 24 months after you send it, or when you delete your data or account, whichever comes first. The totals and skip counts per question stay, because they don't say who voted or skipped.

Deleting your data: in the app, Settings → Delete my data. That deletes your guest id and what we keep with it in our database (purchase records, votes and feedback), clears your play data and stats from the phone, and the app carries on with a new guest id. Uninstalling the app removes the guest id from the phone, but not the data tied to it on our servers. If you can't use the app, email us the Support ID from Settings and we'll delete the data tied to it.

Deleting an account, if you have one: in the app, Settings → Delete account. That deletes your Firebase account, your purchase records, votes and feedback in our database, and the personal details RevenueCat holds for you (your email address and name among them), and clears your account's data from the phone. If you can't sign in on this phone to confirm, the app offers to email us instead, and we'll delete it for you. Apple and Google keep their own record of what you bought: packs stay with your Apple ID or Google account, and come back with Restore purchases. Deleting your data or account doesn't cancel a subscription, if you have one: cancel it in your Apple ID's or Google Play's subscription settings.

Backups: our database is backed up once a day, so we can put things back if something goes wrong. The backups are encrypted, stay in the same europe-west1 region, and are used only to recover from errors. Each one is deleted automatically after 14 days. So when you delete your data or account, it leaves our live database straight away, and the last copies in our backups are gone within 14 days.

Your email address and consent record: an address you give us in the app, and the record of your choice about email about Tembira (when you agreed or stopped, to which words, and how), are kept while the address is with us. Remove it in the app's Settings, or delete your data or account, and both are deleted.

Promo sign-ups: deleted automatically 30 days after the free time ends; the per-connection count, after two days. Deleting your data or account in the app also unlinks your guest id from any promo sign-up.

We may keep what the law requires us to (for example, accounting records). If you stop email about Tembira, or remove an address that was getting it, we keep a hashed form of the address (not the address itself) on a do-not-email list for as long as we send such email, only so we don't write to it again.

8. Your rights and choices

Depending on where you live (including the EU, EEA, UK and California), you can:

• see, correct or delete the personal data we hold about you;
• get a copy of the data you gave us, in a portable form;
• withdraw your analytics consent at any time, in the app's Settings (section 3);
• object to, or ask us to restrict, processing based on our legitimate interests;
• stop email about Tembira at any time, in the app's Settings or with the unsubscribe link in any such email;
• complain to a data protection authority. In the Czech Republic that's the Úřad pro ochranu osobních údajů (ÚOOÚ).

To delete your data, use Settings → Delete my data in the app (or Settings → Delete account, if you have one), or email us the Support ID from Settings. For anything else, write to support@tembira.app. It's free, and we'll answer as soon as we can, within one month. We may need to confirm it's really your data first. California residents: we don't sell or share personal information as the CCPA defines those terms.

9. Children and families

Tembira is rated 4+ and has questions written for families to play together, children included. Children play at the table, on a grown-up's phone. Nobody needs an account to play, children included, and the app collects nothing about them: the names you type for players stay on the phone, and nothing anyone says is recorded. If you send feedback on a question, please don't name anyone or write about the people at the table.

Accounts, which are optional, are meant for adults. We don't knowingly create accounts for, or collect personal data from, children below the age of digital consent where they live (15 in the Czech Republic, 16 under GDPR unless a country sets it lower, and 13 in the United States). If you think a child has made an account, write to us and we'll delete it.

10. This website

tembira.app has no cookies, no scripts, no forms and no analytics. Its /promo/ links send you on to the promo sign-up on app.tembira.app, and section 2 says what we keep from it. Cloudflare, which hosts it, sees the ordinary connection details any website needs to serve a page (such as your IP address and browser), and we don't use them to identify you.

11. Changes

If we change this policy, we'll update the date at the top. If a change affects something you consented to, we'll ask you again where the law requires it. Anything new we'd want to collect, such as advertising or recording sessions, would need its own consent first; the analytics choice doesn't cover it.

The rules for using Tembira, including purchases, are in our Terms of use.