Privacy Policy

1. Who we are

Skepia (the “App”) is operated by VPoint Labs LLP, which acts as the data controller for the personal data described in this policy.

2. Data we collect

We collect only the data we need to run the App:

• Account data. When you sign in with Google or with Apple, we receive your email address and name. If you use Sign in with Apple and choose to hide your email, we receive only Apple’s relay address. You may add or change a display name and avatar in the App.
• Game and progress data. Puzzles played, results, scores, streaks, achievements and in-App settings.
• Creativity exercise content. The text answers you submit in creativity exercises, which are sent to our AI providers to generate feedback (see section 5).
• Usage and device data. App events, session data, feature interactions, device model, operating system version, language, app version, crash and diagnostic reports, and device or installation identifiers, including the Android Advertising ID (AAID/GAID) when available. We collect events only — we do not record your screen or replay your sessions.
• Push notification token. A device token used to deliver notifications, if you allow them.
• Subscription data. Subscription status, purchase and renewal events, and the anonymous purchase identifiers provided to us by the App Store and Google Play.
• Social data. Friend connections you create, and invitation links you open or share.

We do not collect precise location data, we do not access your contacts, photos, microphone or camera, and we do not require you to enter payment card details.

3. How we use your data

• To create and manage your account and authenticate you.
• To provide the games, save your progress and show your statistics.
• To generate AI feedback on your creativity exercises.
• To run friend lists, invitations and shared challenges.
• To send push notifications about new games, if you have allowed them.
• To manage subscriptions and premium entitlements.
• To measure how the App is used, fix crashes and improve the product.
• To use the Android Advertising ID, when available, for product, subscription and paywall analytics.
• To prevent abuse, fraud and violations of our Terms of Service.

We do not sell your personal data, we do not show third-party advertising, and we do not use your data to build advertising profiles.

4. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract to provide the App, your account and your subscription; consent for push notifications and for analytics where consent is required; legitimate interests to keep the App secure, prevent abuse and understand aggregate product usage; and legal obligation where we must retain records such as transaction data. You can withdraw consent at any time in your device or App settings, without affecting processing carried out before the withdrawal.

5. AI-generated feedback

Creativity exercises use third-party large language models. When you submit an answer, the text of that answer and the exercise prompt are sent through our AI routing provider (OpenRouter) to the model provider that handles the request, which may include Google, OpenAI or Meta models. We do not send your name, email address or account identifier together with the answer.

AI feedback is generated automatically. It is not a profiling decision that produces legal or similarly significant effects for you, and it must not be treated as professional advice.

6. Who we share data with

We share personal data only with service providers that process it on our behalf, under their own privacy terms:

• Google Firebase — authentication support, analytics, crash reporting (Crashlytics) and push delivery.
• Amplitude — product analytics (event tracking only), including processing the Android Advertising ID when available.
• Adapty — subscription management and paywall analytics, including processing the Android Advertising ID when available.
• OpenRouter and the underlying model providers — AI feedback on creativity exercises.
• Apple and Google — sign-in, app distribution, payments and subscription management.
• Hosting and infrastructure providers that run our servers and database.

We may also disclose data if required by law, or in connection with a merger, acquisition or sale of assets, in which case we will notify you.

7. What other users can see

If you add friends or accept an invitation, those users can see your display name, avatar, scores, streaks and results on shared challenges and leaderboards. They cannot see your email address or your creativity exercise answers unless you choose to share them. You can remove a friend at any time in the App.

8. Tracking and advertising identifiers

On Android, the App and its analytics and subscription SDKs may collect the Android Advertising ID (AAID/GAID) provided by Google Play services, when it is available. This resettable identifier is sent to Amplitude and Adapty for the analytics purposes described above. Advertising ID collection is disabled in our Firebase Analytics configuration.

You can reset or delete your advertising ID in your Android device settings. Availability and the names of these settings depend on your Android version. If the ID is unavailable or deleted, the App remains usable and analytics may continue using other app or installation identifiers. Resetting or deleting the advertising ID does not delete data already collected; to request deletion of your data, use the options in section 12.

We do not use your data for cross-app or cross-site advertising and we do not share it with data brokers. The App does not use the iOS advertising identifier and does not ask for App Tracking Transparency permission, because we do not track you across other companies’ apps or websites. The analytics described above are first-party only: they tell us how Skepia itself is used.

9. Payments

Subscriptions are purchased through the Apple App Store and Google Play. Those stores process your payment and handle billing, cancellations and refunds. We never receive or store your card number or bank details — only the subscription status linked to your account.

10. International transfers

We are based in Kazakhstan and our providers operate globally, so your data may be transferred to and processed in other countries, including the United States. Where we transfer personal data out of the EEA, the UK or Kazakhstan, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the corresponding UK addendum.

11. How long we keep data

• Account and progress data — while your account is active.
• Analytics data — up to 24 months.
• Crash and diagnostic reports — up to 12 months.
• Creativity answers and AI feedback — while your account is active, so that you can revisit them.
• Transaction records — as long as required by accounting and tax law.

After you delete your account, personal data is deleted within 3 days, except where we must keep records to meet a legal obligation. Backups are purged on their normal rotation, within 30 days.

12. Deleting your account and data

You can delete your account and all data linked to it at any time:

• In the App, open Progress → Account → Delete account, or
• email mail@vpointlabs.com from the address linked to your account and ask us to delete it.

Deletion removes your profile, game progress, creativity answers, friend connections and analytics identifiers within 3 days. Deleting your account does not cancel your subscription — cancel it in your App Store or Google Play account settings.

13. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data protection authority. Write to mail@vpointlabs.com and we will respond within 30 days.

We do not sell or share personal data as those terms are defined under California law, and we do not discriminate against users who exercise their privacy rights.

14. Security

We use encryption in transit (HTTPS/TLS), hashed credentials, access controls limiting employee access to production data, and regularly updated infrastructure. No system is perfectly secure, but we will notify you and the competent authority of a personal data breach where the law requires it.

15. Children

The App is not directed to children. You must be at least 13 years old to use it, or at least 16 if you are in a country where 16 is the minimum age for consenting to online services. We do not knowingly collect data from children below that age; if we learn that we have, we will delete the account and its data. Parents or guardians can contact us at mail@vpointlabs.com.

16. Third-party links

The App and this site may link to third-party services. We are not responsible for their content or privacy practices — please read their policies.

17. Changes to this policy

We may update this policy. We will change the effective date above and, for significant changes, notify you in the App or by email before they take effect.

18. Contact