Privacy policy

1. Data controller

The data controller is KYKS, a French single-shareholder simplified joint-stock company (SASU), registered with the Paris Trade and Companies Register under number 929 633 162, with its registered office at 14 rue Bausset, 75015 Paris, France. For any question about your data, contact us at hello@kyks.io.

2. Data we process

• Account: on first launch, an anonymous technical account tied to this phone is created — no e-mail address, no password. If you choose to link it from your profile with Continue with Apple (iPhone), our authentication service records the identifier Apple provides, the e-mail address you agree to share (your real address or Apple's private relay address) and your name if you share it. With Continue with Google (iPhone and Android), it records the identifier, e-mail address, name and profile-picture URL of your Google account. The app shows that e-mail address (or, failing that, that name) on your profile to indicate the linked account and only uses it to find your profile again on another phone; your in-game first name remains the one you type in the app.
• Profile: the first name you choose (12 characters at most), your needle colour, your counters (games played, wins, bullseyes) and the language chosen in the app, synced with your account so you can find them on another phone. The first name is free text: if you type your real first name, it becomes personal data and is treated as such.
• Online games: the rooms you create or join (code, host, mode, language, card packs, timer, "After midnight" option), your first name, colour and team in the room, your presence (connected or not, last activity) and, for each round, the card, the target, the clue typed by the Tilter (40 characters at most), the needles placed and the points. There is no free chat between players.
• Purchases: the entitlements unlocked by your purchases (packs, Tilto Pass) and the date they were last updated, recorded by our server. Payment is processed by Apple on iPhone and by Google Play on Android — we never have access to your banking details, your name or your billing address.
• Notifications: your phone's notification token and the app's language, only if notifications are allowed on your phone (the app asks when you enter an online room; on Android 12 and earlier, the system allows them by default) and the Profile → Notifications setting is on.
• Diagnostics: in released versions, when the app crashes or hits an unexpected error, a technical report (stack trace, device model and OS version, app version and a random installation identifier specific to Crashlytics) is sent to Google Firebase Crashlytics so we can fix the bug. These reports contain neither your account identifier, nor your first name, nor your e-mail address, nor any game content.
• Camera: only to scan a room's QR code, when you choose "Scan a QR code". The image is analysed on your phone; it is neither recorded nor sent.
• Local settings: sound and haptics preferences, the last timer chosen, the age confirmation and the switch for the "After midnight" pack, and, in single-phone mode, the names of the last table and the game in progress — stored on your device only and never sent to us.

Tilto embeds no advertising, audience-measurement or tracking SDK and does not access your phone's advertising identifier; its only diagnostic tool is the crash reporting described above. We do not collect your location, contacts, photos or microphone. In single-phone mode, the names of the players at the table never leave the device.

3. Purposes and legal bases

• Running online games (rooms, rounds, scores, rematch): your account, first name and game data — performance of the service contract.
• Keeping and syncing your profile (first name, colour, counters): performance of the service contract.
• Finding your profile on another phone: Continue with Apple or Continue with Google, at your own initiative — performance of the service contract.
• In-app purchases and Tilto Pass: your entitlements and the events RevenueCat sends us — performance of the contract and our legal obligations (proof of purchase, refunds, accounting).
• Game notifications (game start, your turn to tilt, time to guess, end of game): your notification token — your consent, given through the system permission and revocable at any time in your phone's settings or in Profile → Notifications. Their text never contains the target or the clue.
• Scanning a QR code: your consent, given through the system camera permission. You can always type the code by hand instead.
• Security and fair play (server-side game logic, target kept secret until the reveal, limits on attempts against abuse, authenticated purchase webhooks, technical logs): our legitimate interest in keeping games honest and the service reliable.
• App stability (crash reports): our legitimate interest in finding and fixing bugs.

4. Visibility between players

In an online room, the other members see your first name, your needle colour, your team, whether you are connected, the scores and, when you are the Tilter, your clue. The target is visible to the Tilter only until the round is revealed, and the needles placed are revealed to the room only at that point. Your profile counters and your account's e-mail address are never shown to other players. In single-phone mode, everything stays on the device.

5. In-app purchases

Tilto includes the Classic pack (200 cards) for free. The Happy hour, Pop culture, Family and After midnight packs are sold individually; the Tilto Pass unlocks every pack, current and future, with a one-time payment. Payment is handled entirely by Apple (App Store) on iPhone and by Google Play (Google Play Billing) on Android, under their own terms: we never see your payment method or your identity. RevenueCat receives the transaction receipts from Apple and Google Play, checks them and notifies our server, which records the active entitlements of your account. Your RevenueCat identifier is your account identifier. Purchases stay tied to your Apple or Google account and can be recovered with "Restore purchases". Refunds are handled by Apple or Google Play under their own terms, not by us.

6. Hosting and processors

We rely on strictly necessary technical providers:

• Google Firebase — authentication, database and server logic. Our server functions run in the europe-west1 region (Belgium) and the database is hosted in the eur3 multi-region (European Union). Authentication, which holds your Apple or Google identifier and e-mail (and, for Google, the name and profile-picture URL of your Google account) if you link your account, is a global Google service.
• Google Firebase Cloud Messaging — routing of game notifications to Apple's notification service (iOS) and to Android: Google sees your notification token and the text of each notification.
• Google Firebase Crashlytics — crash and error reports (stack trace, device and OS, app version, installation identifier), kept 90 days.
• Apple — Sign in with Apple (if you link your account), processing of in-app purchases and delivery of notifications on iOS.
• Google — Google Sign-In (Continue with Google, if you link your account) and processing of in-app purchases on Android through Google Play (Google Play Billing).
• RevenueCat — technical management of in-app purchases (never any banking details), limited to your account identifier and your purchase history. The RevenueCat SDK may also collect device identifiers under its own privacy policy.

Google, Apple and RevenueCat are established in the United States. These transfers outside the European Union rely on the European Commission's standard contractual clauses (Article 46 GDPR) incorporated into their data processing terms (Google Cloud Data Processing Addendum, Apple Developer Program License Agreement, RevenueCat Data Processing Addendum).

No data is ever sold, shared for advertising, or transferred to anyone else.

7. Data retention

• Account, profile and entitlements: as long as your account exists, i.e. until you delete it from the app or ask us to (see section 10).
• Online rooms: a room still waiting 24 hours after its creation is closed, and a game with no activity for 6 hours is stopped; their players are then removed from them. Ended or closed rooms are automatically erased 30 days after their last activity, together with their rounds, targets, clues and needles. Until then, an ended room keeps its players' first names and scores for the end screen and the rematch.
• Purchase history at RevenueCat: as long as your account exists; it is deleted together with it (the deletion is retried automatically if RevenueCat is temporarily unavailable). Accounting records are kept for the legal retention period, in a form that no longer identifies you.
• Notification token: until you turn notifications off in your Profile or it is reported as invalid when a notification is sent, and at the latest until your account is deleted.
• Crash reports: 90 days at Google Firebase Crashlytics.
• Local settings: on your device until you uninstall the app or delete your account.

8. Security

All exchanges are encrypted (HTTPS). Every game action (cards, target, clue, needles, scores) goes through our server, which validates it: the app can only write its own profile and its presence in a room directly. The database access rules keep the target readable by the Tilter only until the reveal, restrict each room to its members and each profile to its owner. Purchases are verified by RevenueCat and our server before anything is unlocked. Your session is stored in your phone's secure keychain on iPhone, and in the app's private storage, inaccessible to other apps, on Android.

9. Audience

Tilto is intended for ages 13 and up. The "After midnight" pack, with its suggestive cards, is reserved for adults: the app asks you to confirm that you are 18 or older before buying it or, with the Tilto Pass, the first time you turn it on, and its cards only enter a game if the host turns them on for the room (off by default). Beyond this confirmation, the app does not verify your age: we rely on the store ratings and on the good judgement of players and parents. We collect no data specifically about children beyond what is described on this page.

10. Your rights and account deletion

Under the GDPR, you have the following rights:

• Access, rectification and erasure of your data.
• Portability, restriction and objection to processing.
• Withdrawal of your consent at any time for notifications and the camera, in your phone's settings (and for notifications, in Profile → Notifications).

To delete your account, open the app, tap your avatar at the top right of the home screen (Profile), then, at the bottom of the screen, Delete my account and Confirm deletion. The effect is immediate: your authentication account, your profile, the entitlements we store, your notification tokens and your history at RevenueCat are erased, so is the app's data on your phone, and the app starts again with a new anonymous profile. If your account is linked to Apple (iPhone), the app also revokes the access granted to Tilto through Sign in with Apple (after asking you to confirm with Apple); if it is linked to Google, it signs you out of Google in the app. Deletion is refused while you are in an ongoing online game: leave it first. If you no longer have access to the app, write to us at hello@kyks.io from the address linked to your account, with the subject "Tilto — account deletion": we delete the account within 30 days and confirm by reply. You can also, on your own: uninstall the app (this erases the settings and data stored in it), revoke "Sign in with Apple" for Tilto in your Apple ID settings and remove Tilto's access in your Google account settings. Details on the Account deletion page.

To exercise any of these rights, write to us at hello@kyks.io. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).

11. Changes

If Tilto evolves in a way that changes the data we process, this policy and the store privacy labels will be updated before that version is released, and the app will ask for your consent where the law requires it. The date at the top of this page indicates the latest revision.

12. Contact

For any question about this policy or your data, write to KYKS at hello@kyks.io or by post at 14 rue Bausset, 75015 Paris, France.