Privacy policy

1. Data controller

The data controller is KYKS, a French single-shareholder simplified joint-stock company (SASU), registered with the Paris Trade and Companies Register under number 929 633 162, with its registered office at 14 rue Bausset, 75015 Paris, France. For any question about your data, contact us at hello@kyks.io.

2. Data we process

• Game identity: a nickname of your choosing (14 characters at most), a colour, an accessory and the eyes of your avatar. The nickname is free text: if you type your real first name, it becomes personal data and is treated as such.
• Account: by default, an anonymous technical account created on first launch, tied to this phone. If you choose to link it from your profile with Sign in with Apple (iPhone), the identifier Apple provides and the e-mail address you agree to share (your real address or Apple's private relay address). If you link it with Continue with Google (iPhone and Android), our authentication service records the identifier, e-mail address, name and profile-picture URL of your Google account; the app reads neither that name nor that picture, and your in-game nickname remains the one you chose in the app. These e-mail addresses are kept in our authentication service only: the app does not use them for anything other than finding your account again on another phone.
• Games: the rooms you join (code, host, room names typed by the host, options), your role, missions and allies (secret, readable by you only), the room you declare, your alive/dead status, meetings, votes, the event timeline and the end-of-game rewards.
• Progression: your experience points, your sonars (the in-game currency), the number of games played and won, the cosmetics you own, your achievements and the status of your INTRUS+ subscription, including whether you have already used the 7-day free trial.
• Purchases: a log of your in-app purchases (product, type of event, date, what was granted and, if a purchase is transferred from or to another Intrus account, the identifier of that account). Payment is processed by Apple on iPhone and by Google Play on Android — we never have access to your banking details, your name or your billing address.
• Notifications: a notification token, only if you allow notifications when the app asks (on Android 12 and earlier, where the system allows them by default, as long as you have not turned them off in your phone's settings), and the app language (French or English), saved on your profile so that notifications are written in your language.
• Bluetooth: a token generated by our server for each game and used to detect nearby players. Proximity itself is measured on your phone only (see section 5).
• Diagnostics: when the app crashes or hits an unexpected error, a technical report (stack trace, device model and OS version, app version and build, your anonymous account identifier) is sent to Google Firebase Crashlytics so we can fix the bug. These reports contain no nickname, no game content and no location.
• Local settings: sound, haptics and animated-eyes preferences, stored on your device only and never sent to us.

Intrus embeds no advertising, audience-measurement or tracking SDK; its only diagnostic tool is the crash reporting described above. We do not collect your location, contacts, photos, camera or microphone, and the app does not store any file or profile picture.

3. Purposes and legal bases

• Running the game (rooms, roles, missions, meetings, votes, results): your account, game identity and game data — performance of the service contract.
• Keeping your progression (XP, sonars, cosmetics, achievements): performance of the service contract.
• Finding your profile on another phone: Sign in with Apple or Continue with Google, at your own initiative — performance of the service contract.
• In-app purchases and INTRUS+ entitlements: your purchase log and the events RevenueCat sends us — performance of the contract and our legal obligations (proof of purchase, refunds, accounting).
• Game notifications (game start, meeting called, oxygen/reactor crisis, end of game): your notification token — your consent, given through the system permission and revocable at any time in your phone's settings. Their text only contains the name of the rally room or of the consoles typed by the host.
• Bluetooth proximity (radar, eliminations): your consent, given through the system permission. Declining it keeps the game playable in "honour mode".
• Security and fair play (server-side validation of every action, authenticated purchase webhooks, technical logs): our legitimate interest in keeping games honest and the service reliable.
• App stability (crash and error reports): our legitimate interest in finding and fixing bugs.

4. Visibility between players

Intrus is a social game: the other members of a room see your nickname, your avatar, your INTRUS+ badge if you have one, the room you declare, whether you are alive, the outcome of meetings (who was ejected, vote counts). Your role, your missions and your allies are not visible to other players during the game; once it has ended, the roles of every player and the event timeline (who eliminated whom) are revealed to the members of the room. If the host enables the corresponding option, the role of an ejected player is revealed at the end of the vote. Individual votes are never readable by any player — only the totals are. Intruders, and every player when the host enables the "unmasked radar" option, can see the names of nearby players; otherwise the radar is anonymous.

5. Bluetooth and proximity

During the game phase only, your phone broadcasts a short Bluetooth Low Energy signal containing a temporary token generated by our server for that game, and listens for the tokens of the other players in the same room. The strength of the received signal is smoothed and classified into rough zones (very close, close, far) — never into a precise distance.

The token is generated by our server and kept in your private game data (it is what lets your phone match a received token with a player of the room). Proximity itself is computed on your phone only: signal strength, zones and encounters are never sent to our servers or stored. When an intruder eliminates a player, the app only sends the target's identifier. The token changes with every game and is not reused outside of it.

Intrus does not geolocate you. On iOS, the app only requests the Bluetooth permission. On Android 12 and later, it only requests the "Nearby devices" permission, declared to the system as never used to derive your location. On Android 11 and earlier, the system requires the location permission in order to scan for Bluetooth devices; the app never reads your position. If you decline Bluetooth, the game switches to "honour mode" and remains fully playable.

6. In-app purchases

Intrus offers an INTRUS+ subscription (monthly, yearly or lifetime) and sonar packs. Payment is handled entirely by Apple (App Store) on iPhone and by Google Play (Google Play Billing) on Android, under their own terms: we never see your payment method or your identity. RevenueCat receives the transaction receipts from Apple and Google Play, checks them and notifies our server, which credits your sonars or activates INTRUS+ and records the event in your purchase log (product, event type, date, what was granted, and whether it came from the production or test environment). The monthly and yearly plans start with a 7-day free trial, which converts into a paid subscription unless you cancel before the end of the trial in your Apple settings (iPhone) or in the Play Store (Android); your profile remembers that you used the trial. If a purchase is transferred from another Intrus account (same Apple ID or same Google account), the purchase log keeps a trace of it. Your RevenueCat identifier is your anonymous account identifier. Refunds and subscription management (renewal, cancellation) are handled by Apple or Google Play, not by us: in your Apple account settings on iPhone, or on Android in the Play Store (profile → Payments & subscriptions → Subscriptions).

7. Hosting and processors

We rely on strictly necessary technical providers:

• Google Firebase — authentication, database and server logic. Our server functions run in the europe-west1 region (Belgium) and the database is hosted in the eur3 multi-region (European Union). Authentication, which holds your Apple or Google identifier and e-mail (and, for Google, the name and profile-picture URL of your Google account) if you link your account, is a global Google service.
• Google Firebase Cloud Messaging — routing of game notifications to Apple's notification service (iOS) and to Android: Google sees your notification token and the text of each notification.
• Google Firebase Crashlytics — crash and error reports (stack trace, device and OS, app version, anonymous account identifier), kept 90 days.
• Apple — Sign in with Apple (if you link your account), processing of in-app purchases and delivery of notifications on iOS.
• Google — Google Sign-In (Continue with Google, if you link your account) and processing of in-app purchases on Android through Google Play (Google Play Billing).
• RevenueCat — technical management of in-app purchases (never any banking details), limited to your anonymous account identifier and your purchase history. The RevenueCat SDK may also collect device identifiers under its own privacy policy.

Google, Apple and RevenueCat are established in the United States. These transfers outside the European Union rely on the European Commission's standard contractual clauses (Article 46 GDPR) incorporated into their data processing terms (Google Cloud Data Processing Addendum, Apple Developer Program License Agreement, RevenueCat Data Processing Addendum).

No data is ever sold, shared for advertising, or transferred to anyone else.

8. Data retention

• Account, game identity and progression: as long as your account exists, i.e. until you delete it from the app or ask us to (see section 11).
• Ended games: kept with their summary, timeline and the players' game data for the history of the room, then automatically erased 90 days after the end of the game, together with all of their data. When you delete your account, your player data is anonymised in them straight away; your nickname is replaced everywhere, including in the private game data of other players, and only your pseudonymous account identifier remains in them until they are erased.
• Rooms that never started: automatically erased 7 days after their creation.
• Purchase log: as long as your account exists; erased when you delete it. RevenueCat keeps the history of your transactions, under your pseudonymous account identifier, until you ask us to have it deleted by writing to hello@kyks.io. Accounting records are kept for the legal retention period, in a form that no longer identifies you.
• Notification token: replaced each time your phone renews it, erased when your account is deleted.
• Bluetooth tokens: specific to one game and kept with it (see Ended games); proximity measurements are never stored.
• Crash reports: 90 days at Google Firebase Crashlytics.
• Local settings: on your device until you uninstall the app.

9. Security

All exchanges are encrypted (HTTPS). Data access is partitioned per player at the database level: while the game is running, your role, missions and allies are technically readable by you only (they are revealed to the room once the game has ended, see section 4), individual votes are readable by no player, and every game action (roles, missions, eliminations, votes, rewards) is computed and validated server-side — the app can only read them. Purchases are verified by RevenueCat and our server before anything is credited. Your session is stored in your phone's secure keychain on iPhone, and in the app's private storage, inaccessible to other apps, on Android.

10. Audience

Intrus is a party game about bluffing and eliminating your friends in good fun, which we recommend for ages 13 and up. The app does not verify your age: we rely on the store ratings and on the good judgement of players and parents. We collect no data specifically about children beyond what is described on this page.

11. Your rights and account deletion

Under the GDPR, you have the following rights:

• Access, rectification and erasure of your data.
• Portability, restriction and objection to processing.
• Withdrawal of your consent at any time for notifications and Bluetooth, in your phone's settings.

To delete your account, open the app and go to Profile → Settings (gear icon) → Delete my account. The effect is immediate: your authentication account, your profile, your progression and your purchase log are erased, your player data is anonymised in your ended games and the app restarts with a new anonymous profile. The app also revokes the access you had granted to Intrus through Sign in with Apple (iPhone) and signs you out of Google in the app. RevenueCat, which manages in-app purchases, keeps the history of your transactions under your pseudonymous account identifier: to have it deleted, write to us at hello@kyks.io. If you no longer have access to the app, write to us at hello@kyks.io: so that we can find your account, tell us the e-mail address of the Apple or Google account you linked or, for an anonymous account, your nickname and the code of a room you played in recently, sent from the phone that holds the account, and we will handle the request within 30 days. Deleting your account does not cancel an ongoing INTRUS+ subscription: manage or cancel it from your Apple account on iPhone, or in the Play Store on Android (profile → Payments & subscriptions → Subscriptions). You can also, on your own: uninstall the app (this erases the local settings and the anonymous session of this phone), revoke "Sign in with Apple" for Intrus in your Apple ID settings and remove Intrus's access in your Google account settings. Details on the Account deletion page.

To exercise any of these rights, write to us at hello@kyks.io. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).

12. Changes

If Intrus evolves in a way that changes the data we process (for instance new features relying on Bluetooth data), this policy and the store privacy labels will be updated before that version is released, and the app will ask for your consent where the law requires it. The date at the top of this page indicates the latest revision.

13. Contact

For any question about this policy or your data, write to KYKS at hello@kyks.io or by post at 14 rue Bausset, 75015 Paris, France.