Privacy Policy

1. Data controller

Tavlino (tavlino.promptolook.com) is operated by Keenvo Tech OÜ, registered in Estonia (17457927), Kotkapoja tn 2a-10, 10615 Tallinn, Estonia. Keenvo Tech OÜ is the data controller responsible for your personal data under applicable data protection laws (including the GDPR and the LGPD). Advertising, traffic acquisition, and monetization services are provided by ActiveView OÜ, registered in Estonia (16639782), Kotkapoja tn 2a-10, Tallinn 10615, Harju, Estonia. You can reach the controller at support@keenvotech.com.

2. What we collect

Tavlino is a Promptolook game you can play without an account. We collect your gameplay and progress, the records of your online matches, the email address you choose to save your progress with, the display name you set, your country (from your connection, or the one you choose), purchases, messages you send to support, and basic usage telemetry (page views, clicks, outcomes, approximate country and device type). Each is described below.

3. Playing without an account

You can play Tavlino without an account. To keep your progress (streak, experience, World Tour stars, achievements and settings) we create an anonymous player record linked to a random visitor id stored in a first-party cookie. Games against the AI run on your device; when one finishes, your browser reports the result and the moves so we can check the game is legal and update your progress. AI games never affect ratings or leaderboards of human players.

If you choose to save your progress, we store your email address and use it to sign you in on other devices with a one-time code, and to send the messages you ask for. We send marketing emails only if you agree, and every such email has an unsubscribe link. You must confirm you are 13 or older before giving us an email address.

4. Online play and what other players see

When you play online, your opponent and anyone who opens a public profile, leaderboard or finished match can see your display name (only for players who verified an email address; everyone else appears as an anonymous player number), your country, your rating and its history, your results, achievements and your record against them. Messages during a match are limited to preset emotes; there is no free-text chat.

For every online match we store the moves, dice, timings, result and rating changes, and the fairness data of the dice: the server seed and its published commitment, and a random seed your browser contributes (it contains no personal data). Anyone who has the match link can recompute every roll after the match. Full move records are kept for 180 days; results and ratings are kept while your player record is active. If you report a player, we store the report with the match it refers to. If you block a player, we store that choice.

If you turn on notifications, we store your browser's push subscription, language, time zone and the topics you chose (daily position, streak reminders, your turn in a daily game, accepted invitations), and the time each message was sent so we never send the same reminder twice. Tavlino sends at most one reminder per topic per day.

5. Supporter purchases and ads

Tavlino is free and shows ads, including optional rewarded videos you can watch to get an in-game item such as a hint or a take-back; we record that a video was completed, with your player record, to grant the item and apply daily limits. Players who buy the Supporter status are never shown ads.

The Supporter purchase is processed by Stripe. We receive and store the purchase record (amount, currency, country, the price shown, time, and Stripe identifiers) linked to your player record and email address, so the status follows you to every device where you sign in. We never receive or store your card number.

6. How we use it

We use this data only to run the game: keep your progress, sign you in on other devices, match you with other players, compute ratings and leaderboards, show public profiles, let anyone verify the dice of a finished match, remove ads for Supporters, prevent cheating and abuse, and send the notifications and emails you ask for. Telemetry is used to improve the game, measure conversion and run A/B tests. We do not sell personal data.

7. Third-party services

Authentication and data storage are handled by Supabase. Payments are processed by Stripe; we never store your card number, CVC, or full card details, only a Stripe customer ID. Hosting is provided by Vercel. Transactional email is delivered through Resend. If you sign in with Google, we receive your name and email from your Google profile.

Online matches run on Cloudflare (Workers and Durable Objects), which relays the moves between the two players. Push notifications are delivered through your browser vendor's push service.

8. Advertising

Free accounts may be shown ads served through Google’s ad network (Google Ad Manager) and certified ad partners. These third-party vendors use cookies and similar technologies to serve ads based on your prior visits to this and other websites. Opting out disables interest-based targeting only; you may still see non-personalized, contextual ads. Paid subscribers are not shown ads.

You can opt out of personalized advertising at Google My Ad Center or aboutads.info. To learn how Google uses information from sites that use its services, see How Google uses information from partner sites.

9. Push notifications

If you enable push notifications, we store your browser push subscription endpoint to deliver the alerts you opted into. You can disable push at any time from your browser settings or your account page.

10. Cookies and analytics

We use first-party cookies for your authentication session, locale preference, an anonymous visitor ID, and campaign attribution (UTM parameters), which also power our product experiments. Usage telemetry (page views, clicks, feature usage) is collected on our own infrastructure and mirrored to PostHog for product analytics.

11. Data retention

Progress, results, ratings and your email address are retained while your player record is active. Full move records of online matches are deleted after 180 days. You can ask us to delete your data by writing to support@keenvotech.com from the address you saved progress with; we remove all personal data within 30 days, except purchase records we must keep by law. Anonymized, aggregated analytics may be kept longer for reporting.

12. Your rights

You can access, update, or delete your account at any time from the app, or request a data export or deletion by emailing support@keenvotech.com. Depending on where you live, the following data protection laws grant you additional rights:

13. Children's privacy

Tavlino is not directed to children and is not intended for anyone under 13. We do not knowingly collect personal information from children under 13; if you believe a child has provided us personal information, contact us and we will delete it.

14. Security

We use industry-standard measures including encryption in transit (TLS) and database row-level security. No method of transmission over the internet is 100% secure.

15. Changes to this policy

We may update this policy from time to time and will post the updated version here with a new "Last updated" date. Continued use of Tavlino after changes constitutes acceptance.

16. Contact

Keenvo Tech OÜ · support@keenvotech.com · Support form