Proy Interactive Labs Ltd, a company incorporated in the United Kingdom, is the “data controller” responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This means we decide why and how your personal data is processed in connection with the Service.

You can contact us about any privacy matter at info@umati.games. Section 10 below explains how to exercise your rights and how to complain to a supervisory authority if you are not satisfied with our response.

The information we collect depends on how you use the Service — whether you create a registered account or join a lobby as a guest.

2.1 Information you provide directly.

• Account information. If you create an account using email and password, we collect your email address, a display name, and a securely hashed password. We never store your password in plain text.
• Sign-in via Google or Discord. If you choose to sign in with Google or Discord, we receive basic profile information from that provider — typically your name, email address, and profile picture — as permitted by your settings with that provider. We do not receive your password for these services.
• Magic link sign-in. If you sign in using a one-time email link instead of a password, we use your email address solely to send and verify that link.
• Profile details. You may optionally provide a date of birth and select an avatar from our preset avatar gallery. If you sign in with a third-party provider and choose to keep the profile image supplied by that provider, we may also process that image as your avatar on the Service. We do not currently support direct image uploads from your device.
• Guest information. If you join a lobby without creating an account, we only ask for a display name and, optionally, a preset avatar or an existing profile image. See Section 12 (Guest and anonymous use) for more detail on how guest participation works.
• Gameplay content. When you play, we process the in-game actions you take that are necessary for the game to function — for example, the answers, guesses, clues, or votes you submit, and any reactions you send during a session.
• Communications with us. If you email us for support or contact us for any other reason, we keep a record of that correspondence, including your email address and the content of your message, so we can respond and keep track of the conversation.

2.2 Information collected automatically.

• Session and log data.When you sign in, we record a session token, together with the IP address, browser, and device (“user agent”) associated with that session, and when it was created and expires. This is used to keep you securely signed in and to detect suspicious activity.
• Gameplay and lobby records. We keep a record of the lobbies you have joined or hosted, the games played in them, your scores, rankings, and any achievements you unlock, so that leaderboards, statistics, and your player history work correctly.
• Usage analytics. We use Vercel Web Analytics to understand, in aggregate, how the Service is used — for example, which pages are visited and what type of device or browser is used. We also use Vercel Speed Insights to understand performance characteristics of the Service, such as page speed and responsiveness. These tools are designed to operate without building an advertising profile of you across other websites.
• Local device storage.We store a small number of values in your browser’s local storage rather than in traditional cookies, including a randomly generated identifier used to help recognise guest or anonymous-lobby participation and your sound-effect on/off preference. See Section 5 (Cookies and similar technologies) for more detail.

2.3 Information from third parties. If you choose to sign in with Google or Discord, those providers share the profile information described above with us, subject to your settings and permissions with them. We do not otherwise purchase, rent, or receive personal data about you from data brokers or other third parties.

We use the information described above to:

• create and maintain your account and authenticate your sign-ins;
• operate the core functionality of the Service, including creating lobbies, matching players together, running games in real time, and calculating scores and leaderboards;
• remember your preferences (such as your chosen avatar or sound setting);
• communicate with you about your account, security notices, and changes to the Service or these policies;
• respond to support requests and other communications you send us;
• monitor, secure, and improve the Service, including investigating and preventing fraud, abuse, cheating, and other harmful conduct;
• understand aggregate usage trends so we can prioritise fixes and new features; and
• comply with our legal obligations.

We do not use your personal data to serve you third-party advertising, and we do not sell your personal data.

Where UK GDPR applies, we rely on the following legal bases to process your personal data:

• Performance of a contract — to create your account, run lobbies and games, and otherwise deliver the Service you have asked us to provide;
• Legitimate interests — to keep the Service secure and reliable, prevent abuse and cheating, understand aggregate usage, and improve the Service, provided these interests are not overridden by your rights;
• Consent — where we ask for it specifically, for example if we ever introduce optional marketing communications (we do not currently send any); and
• Legal obligation — where we need to process or retain data to comply with the law, respond to lawful requests from authorities, or establish, exercise, or defend legal claims.

We keep our use of cookies and similar tracking technologies to a minimum.

• Authentication cookie. If you sign in, we set a strictly necessary session cookie so you remain signed in as you navigate the Service. Without this cookie, you would need to sign in again on every page. You cannot opt out of this cookie while remaining signed in, but it is not used to track you across other websites.
• Local storage values.As described in Section 2.2, we store a guest identifier and your sound preference in your browser’s local storage rather than as cookies. These values stay on your device and are not shared with third parties. You can clear them at any time by clearing your browser’s site data.
• Analytics. Our analytics provider (Vercel Web Analytics) and performance-monitoring provider (Vercel Speed Insights) are designed to operate without placing third-party advertising cookies on your device.

We do not use the Service to serve third-party advertising cookies or cross-site tracking pixels.

We do not sell your personal data. We share personal data only in the following limited circumstances:

• With other players. Your display name, avatar, in-game actions, scores, and reactions are necessarily visible to other participants in the same lobby, in real time, so that gameplay works. Guests only ever see the display name and avatar you have chosen — never your email address or account details.
• Service providers. We use a small number of third-party providers to operate the Service on our behalf, including hosting and infrastructure providers, our transactional email provider (used only to send verification, password reset, and magic-link emails), and our analytics and performance monitoring providers. These providers process data on our instructions and are contractually required to protect it and use it only for the purposes we specify.
• Identity providers. If you sign in with Google or Discord, those providers act as independent controllers of the data they hold about you, governed by their own privacy policies.
• Legal and safety reasons. We may disclose information if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect the rights, property, or safety of Proy Interactive Labs, our users, or the public, or investigate and prevent fraud, security incidents, or abuse of the Service.
• Business transfers. If Proy Interactive Labs is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

Some of our service providers operate outside the United Kingdom, including in the United States. Where we transfer personal data internationally, we use appropriate safeguards recognised under UK data protection law — such as the UK International Data Transfer Agreement, an addendum to the EU Standard Contractual Clauses, or reliance on an adequacy decision — to ensure your data continues to receive an appropriate level of protection.

• Account data is retained for as long as your account is active, and for a reasonable period afterwards in case you wish to reactivate it, and to meet our legal, security, and record-keeping obligations. If you request deletion of your account, we will delete or anonymise your personal data within a reasonable period, except where we are required or permitted by law to retain it.
• Guest and anonymous-session datamay exist in your browser’s local storage and in temporary or persistent records on our systems that support anonymous authentication, lobby participation, fraud prevention, and account-linking if you later register. We keep this data only as long as reasonably necessary for those purposes.
• Live game data (such as in-progress moves, chat, or reactions) is held only for the duration of the lobby and is automatically and permanently deleted no more than 24 hours after the lobby becomes inactive.
• Game results, scores, and achievements linked to a registered account are retained as part of your account history until your account is deleted or you request deletion, subject to any legal retention obligations.
• Session logs (IP address, device information) are retained only as long as reasonably necessary for security and troubleshooting purposes.

We use industry-standard measures to protect your information, including encrypting data in transit, hashing passwords so that we never store them in readable form, and restricting internal access to personal data to what is necessary to operate the Service. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and the relevant supervisory authority where required by law.

If UK GDPR applies to you, you have the right to:

• ask us to confirm what personal data we hold about you and provide you with a copy of it (right of access);
• ask us to correct inaccurate or incomplete personal data (right to rectification);
• ask us to delete your personal data in certain circumstances (right to erasure);
• ask us to restrict the processing of your personal data in certain circumstances (right to restriction);
• ask us to provide your data to you or a third party in a portable format (right to data portability);
• object to our processing of your personal data based on legitimate interests (right to object); and
• withdraw your consent at any time, where we rely on consent to process your data.

To exercise any of these rights, contact us at info@umati.games. We may need to verify your identity before responding, and we will respond within the timeframes required by law. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with your local data protection authority if you are located outside the United Kingdom.

The Service is not directed at children under the age of 13, and you must be at least 13 years old to use it. If you are between 13 and 17 years old, you should have your parent or guardian’s permission to use the Service. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us at info@umati.games.

Umati is designed so that people can join a game lobby without completing full account registration. In practice, when you join a lobby without signing in, we may create a temporary anonymous account or session on our systems so the Service can authenticate you, keep you connected to the lobby, preserve scores and state during the session, and support a later upgrade to a registered account. We typically ask only for a display name and, optionally, an avatar or existing profile image, and we may also use a random identifier stored in your browser’s local storage to help recognise the same device or participant in the lobby context.

Anonymous or guest participation is still subject to server-side logging, security monitoring, and session management described in this Policy. We do not use these identifiers to serve third-party advertising or track you across unrelated third-party websites.

The Service may contain links to third-party websites, or allow you to sign in using third-party identity providers such as Google or Discord. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing them with information.

We may update this Privacy Policy from time to time to reflect changes to the Service or our legal obligations. If we make material changes, we will notify you by updating the “Last updated” date above and, where appropriate, through the Service or by email. Your continued use of the Service after a change takes effect means you accept the revised Policy.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at info@umati.games.

Proy Interactive Labs Ltd
Umati is a product of Proy Interactive Labs Ltd, a company incorporated in the United Kingdom.