SoundDrop
1. Data controller
The controller of the personal data collected by the SoundDrop game and its pages on the arkodinstudio.com website is:
- Controller
- Noah Boch, sole trader (entrepreneur individuel, EI) — SIREN 944 453 935, RCS Paris
- Address
- 60 rue François Ier, 75008 Paris, France
- Phone
- +1 (505) 369-4704
- Contact for your data
- contact@arkodinstudio.com
As the publisher is established in France, the General Data Protection Regulation (GDPR) and the French Data Protection Act apply to all our processing, and the competent supervisory authority is the CNIL. We have not appointed a data protection officer, which is not mandatory for our activity: for any question, write to contact@arkodinstudio.com.
2. Data collected
| Category | Details |
|---|---|
| Account identifier | A random technical identifier created on first launch (guest account). |
| Email address | Only if you choose to save your account: it is used to send you a sign-in link or a one-time code, and to sign you in again. |
| Sign in with Apple | If you choose this option: the user identifier Apple assigns to the game, the email address provided by Apple (possibly a private relay address ending in @privaterelay.appleid.com if you choose to hide yours) and, if Apple provides it on your very first sign-in, your name, used only as your account label (Account screen) and never visible to other players. We never receive your Apple password. |
| Profile | Username, avatar, chosen title and frame, favourite music styles and artists, friend code. |
| Game data | Card collection, virtual currencies, level, progress, answers and scores, games played, streaks, badges, season pass, rankings. |
| Social data | Friends list, gifts, trade offers, market listings, auctions, wishlist. |
| Referrals | The referral code used (the referrer’s friend code), who referred whom, the date and the rewards granted. |
| Push notifications | If you allow notifications: your device’s push token (a technical device identifier issued by Apple or Google, via Expo), the platform (iOS or Android), the device language, your account identifier and your per-category preferences (Trades, Friends and gifts, Market and auctions, Signed auctions). Also notifications waiting to be sent and Expo’s technical delivery tickets. |
| Reports | When you report a player: the reason, any optional details you add, the context (the screen the report comes from, e.g. profile or trade) and a snapshot of the reported username at the time of the report, together with your account identifier. Used only for moderation. |
| Blocks | The list of players you have blocked. |
| Purchases | Product purchased, date, status, Apple and RevenueCat transaction IDs, SoundDrop+ expiry date. No banking data: payment is handled by Apple. |
| Messages | What you send us through “A bug, an idea?”, stored with the app version and build number, the operating system version and the device model (to reproduce a bug). What you send by email to support: the “Write to support” button opens your Mail app with a pre-filled message containing your player identifier, the app version, the operating system version and the device model, which you can review and edit before sending. |
| Technical and diagnostic data | Device model, iOS and app version, language. Crash and error reports and performance measurements (Sentry): technical data only (error trace, device, system, version), linked to your account’s technical identifier so we can match them with a support request, with no IP address, no email or username and no personal content. IP address and time of requests in the server’s technical logs. |
| Usage statistics | A closed list of game events (app opened, onboarding finished, tutorial step, pack opened, game finished, purchase started, completed or failed, purchases restored, trade offered, player reported or blocked, theme chosen), linked to an anonymous identifier specific to the app installation: PostHog receives neither your account identifier, nor your email, nor your username. No session replay, no automatic screen capture, no location derived from the IP address, IP address not stored. |
We do not collect your location, contacts, photos, microphone, browsing history or your device’s advertising identifier.
3. Purposes and legal bases
| Why | Legal basis (GDPR) |
|---|---|
| Create and manage your account, save and sync your progress, sign you in (link or code by email, Sign in with Apple) | Performance of the contract (terms of use) — art. 6(1)(b) |
| Run the game: games, rewards, collection, pass, rankings, friends, trades, market, auctions | Performance of the contract — art. 6(1)(b) |
| Deliver in-app purchases, manage SoundDrop+, handle refunds | Performance of the contract — art. 6(1)(b) |
| Manage referrals: grant rewards to the referrer and the new player, and prevent abuse (one referrer per player, no self-referral, cap per referrer) | Performance of the contract (rewards) and legitimate interest (preventing abuse) — art. 6(1)(b) and 6(1)(f) |
| Keep records of sales | Legal obligation (accounting and tax obligations) — art. 6(1)(c) |
| Fight cheating, fraud, multiple accounts and abuse; secure the service | Legitimate interest (a fair and safe game) — art. 6(1)(f) |
| Moderate the game: handle reports, apply blocks between players, filter usernames | Performance of the contract and legitimate interest (the safety of the service and its players) — art. 6(1)(b) and 6(1)(f) |
| Detect and fix crashes and bugs (crash reports) | Legitimate interest (a game that works) — art. 6(1)(f); can be turned off at any time in Profile → Settings → “Crash reports” |
| Measure the game’s audience to improve it (anonymous statistics) | Legitimate interest (improving the game) — art. 6(1)(f), within the consent exemption for audience measurement (article 82 of the French Data Protection Act, CNIL guidance); can be turned off at any time in Profile → Settings → “Usage statistics”: collection stops immediately |
| Answer your messages, support requests and reports, and reproduce reported bugs (app version, system, device model) | Legitimate interest and performance of the contract — art. 6(1)(f) and 6(1)(b) |
| Send you game notifications: trades (offer, counter-offer, reply), friends and gifts, market and auctions (card sold, offer, outbid, auction won), Signed cards (outbid, auction won) | Your consent — art. 6(1)(a), given through your phone’s notification permission; can be withdrawn at any time, category by category in Profile → Settings, or entirely in your phone’s settings |
| Send you reminders (free pack ready, streak), generated on your device | Your consent — art. 6(1)(a), given through the notification permission and changeable in Profile → Settings |
Notifications. Game notifications are sent from our servers. They are grouped and rate-limited (at most one per category every 10 minutes: later ones are combined into a single message) and none are sent between 10 pm and 9 am (Paris time): they wait until 9 am. No notification is sent about a player you have blocked or who has blocked you. Reminders (free pack ready, streak) are scheduled locally on your device, with no server involved.
Cheat detection is partly automated (for example, an answer given in a humanly impossible time is counted as wrong). Any measure on an account (suspension, deletion) is decided by a person and can be appealed (section 15 of the terms of use).
4. What we don’t do
- No advertising in the game and no ad targeting.
- No “tracking” as defined by Apple: we do not link your data with data from other apps or websites, and we do not request tracking permission (ATT).
- We do not sell, rent or share your data for commercial purposes.
- No free-text messaging between players.
5. What other players can see
Your username, avatar, title and frame, level, league, card showcase, scores and rankings (daily challenge, weekly league, an artist’s Top Fan), as well as the cards you offer for trade, sale or auction, may be visible to other players. Your friend code lets other players add you. Your email address is never visible to other players. Choose a username that does not reveal your identity if you prefer.
6. Recipients and processors
Your data is processed by the publisher and by the following providers, which act only on our instructions and under a contract compliant with article 28 GDPR:
| Provider | Role | Where the data is hosted |
|---|---|---|
| Supabase (Supabase, Inc.) | Game database, authentication, server functions, storage | European Union |
| PostHog (PostHog, Inc.) | Anonymous usage statistics (installation identifier, no account identifier; IP address not stored) | European Union (Germany) |
| Sentry (Functional Software, Inc.) | Crash and error reports (technical data, no IP address, email or personal content) | European Union (Germany) |
| Expo (650 Industries, Inc.) | Relaying push notifications to Apple and Google: receives the device’s push token and the notification text, which may contain another player’s username and a card name | United States |
| RevenueCat (RevenueCat, Inc.) | App Store purchase validation and subscription tracking | United States |
| Resend (Resend, Inc.) | Sending sign-in emails (link and one-time code), from the address noreply@arkodinstudio.com | Sent from the European Union (Ireland, eu-west-1 region); company established in the United States |
| Vercel (Vercel Inc.) | Hosting of the arkodinstudio.com website | Global server network; company established in the United States |
| Namecheap (Namecheap, Inc.) | Forwarding by our domain registrar of emails sent to contact@ and support@arkodinstudio.com to the publisher’s mailbox | United States |
Apple distributes the app and sells in-app purchases as an independent controller, under its own privacy policy. We only receive from Apple the information needed to deliver your purchases, never your banking details. If you use “Sign in with Apple”, Apple handles your authentication and only sends us the data described in section 2.
Notification delivery. Push notifications are delivered to your device by Apple Push Notification service or, on Android, by Google’s Firebase Cloud Messaging, which receive the device token and the notification content for this purpose.
Music previews and images. Previews, cover art and artist photos come from Deezer (public API; Deezer is established in France) and Apple (iTunes API). Our servers request them without any data about you. In some cases, your device downloads them directly from these services: like any web page, they then see your device’s IP address and technical connection information. We do not send them your identifier, email or game data. “Listen on” links open Apple Music, Spotify or Deezer, whose privacy policies then apply.
If the operation of the game is taken over by another person or company (for example a company set up by the publisher), your data will be transferred to it so it can keep providing the game; you will be informed in advance. Finally, we may disclose data to the authorities where required by law.
7. Transfers outside the European Union
The publisher is established in France. Game data (Supabase), usage statistics (PostHog) and crash reports (Sentry) are hosted in the European Union.
Some data is nevertheless transferred or accessible outside the European Union: Expo (push notifications), RevenueCat, Vercel and our domain registrar Namecheap (email forwarding) process it in the United States; Apple and Google may do so to deliver notifications; and the US parent companies of Supabase, PostHog, Sentry and Resend may occasionally access it (support, maintenance, security). These transfers are governed by the safeguards of articles 44 et seq. GDPR: the European Commission’s adequacy decision of 10 July 2023 (EU–US Data Privacy Framework) for certified providers and, failing that, the standard contractual clauses adopted by the European Commission (decision 2021/914). You can ask us for a copy of these safeguards.
8. Retention periods
- Account and game data: as long as your account exists. When the account is deleted, this data is erased from the database immediately; it may remain for up to 30 days in technical backups before being overwritten.
- Inactive accounts: an account with no sign-in for 3 years is deleted.
- Push token and notification preferences: as long as your account exists. The token follows the account signed in on the device; it is erased if you withdraw the notification permission (at the next app launch), disabled if it is reported invalid (app deleted, token expired), and deleted with your account.
- Pending notifications and delivery tickets: a notification’s text is kept until it is sent, then erased at most one day later; Expo delivery tickets, usually less than 24 hours.
- Referrals: as long as the referrer’s and the new player’s accounts exist; deleted with either one.
- “Sign in with Apple” data: as long as your account exists; deleted with it.
- Purchase records: 10 years at most from the purchase, as needed to meet our accounting and tax obligations. After your account is deleted, they are no longer linked to your player profile.
- Reports: while they are being handled, then 1 year after the report is closed (period subject to adjustment), to handle appeals and repeat offences.
- Blocks: until you unblock the player, and for as long as your account exists.
- “A bug, an idea?” messages (and the attached technical information): deleted with your account, and at the latest 3 years after being sent.
- Emails exchanged with support: 3 years after the last exchange.
- Crash reports: 90 days at most.
- Usage statistics: 25 months at most.
- Server technical logs (including IP address): a few days, 30 days at most.
9. Storage on your device
The app stores on your device what it needs: your sign-in session, a copy of your game state to start faster, your settings (theme, notifications, usage statistics, crash reports), the last push token sent with a copy of your notification preferences, and the anonymous installation identifier used for usage statistics. Reminders (free pack, streak) are notifications scheduled locally on your device: no data is sent to a server for them. You can turn them off in Profile → Settings or in iOS settings.
10. Minors
The game is intended for people aged at least 13. In France, if you are under 15, a parent’s consent is required before using the game and registering your email address in it (article 45 of the French Data Protection Act). We collect the minimum amount of data and show no advertising. A parent can exercise their child’s rights and request deletion of their account at contact@arkodinstudio.com. If we learn that an account belongs to a child under 13, we delete it.
11. Security
Communications between the app and our servers are encrypted (HTTPS/TLS). Access to data is restricted by database-level security rules (each player can only access their own private data), sensitive operations (rewards, purchases, trades) run only on the server, and admin access is restricted. As no system is infallible, in the event of a data breach we notify the CNIL within 72 hours where it presents a risk to your rights, and inform you as soon as possible if that risk is high, as required by articles 33 and 34 GDPR.
12. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights over your data:
- access (get a copy of your data) and portability (receive it in a machine-readable format);
- rectification (your username and avatar can be changed directly in the game);
- erasure: delete your account in Profile → Account → Delete my account, or ask us by email;
- objection and restriction of processing; you can turn off usage statistics and crash reports yourself at any time in Profile → Settings;
- withdrawal of your consent at any time (notifications: by category in Profile → Settings, or entirely in your phone’s settings);
- setting instructions on what happens to your data after your death.
To exercise these rights, write to contact@arkodinstudio.com from the address linked to your account, or give your username and friend code (Social → Friends screen) if your account has no email. You can also write to Noah Boch EI, 60 rue François Ier, 75008 Paris, France. We may ask you to prove that you own the account. We reply within one month, which may be extended by two months for a complex request.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr) or with the data protection authority of your country of residence in the European Union.
13. The arkodinstudio.com website
SoundDrop’s web pages (presentation, terms, support) are hosted on the arkodinstudio.com website. When you visit them:
- Technical logs: the host Vercel processes your IP address, date and time, requested page, browser and referring page to display the pages, keep the site secure and prevent abuse (legitimate interest — art. 6(1)(f); short retention, under Vercel’s retention policy).
- Language: your approximate country (derived from the IP address) and your browser language are used, at the time of the request and without being stored, to show the home page in French or English.
- A single cookie,
lang(value “fr” or “en”), set only if you choose a language with the FR / EN switcher, for 1 year. It is strictly necessary for the service you request and exempt from consent (article 82 of the French Data Protection Act). You can delete it in your browser settings. - No advertising, no audience measurement, no social media pixel: that is why the site shows no consent banner. Fonts are hosted on the site itself: no calls to Google or any other third party.
The site has no forms and no accounts: we do not collect your name or email address unless you write to us (messages kept 3 years after the last exchange).
14. Changes
We may update this policy, for example if we add a feature or change providers. The date of the last update is shown at the top of the page. For any significant change, we will inform you in the game before it takes effect. This policy is written in French; in case of conflict between this translation and the French version, the French version prevails.
Update of September 26, 2026:
- added push notifications (data, purposes, Expo, Apple and Google, retention periods);
- added “Sign in with Apple” and sign-in with a one-time code received by email;
- anonymous usage statistics (installation identifier, no account identifier) and the “Usage statistics” and “Crash reports” settings;
- technical information attached to “A bug, an idea?” feedback and to the “Write to support” message;
- added referrals;
- details on Resend (sending from the European Union) and on email forwarding by Namecheap.
End of documentBack to top