1. Who is responsible
DOROBANTI NETWORK S.R.L. (Dorobanti Media), tax identifier CUI 51010254, is the controller of data received for the website, support and commercial administration. Registered office: Aleea Tomești nr. 9, bl. 15, sc. 2, et. 7, ap. 63, Sector 4, București, 042144, România.
For questions or rights requests: support@dorobantimedia.com or +40 730 000 064.
2. Local game data
Impostor requires no account and sends no gameplay data to a developer server. Devices exchange chosen names, answers, votes, scores and temporary session and reconnection identifiers over Wi-Fi. Gameplay data stays in application memory, without persistent history. The app separately saves only its language (System / Romanian / English) and appearance (System / Light / Dark) preferences on the device. System is the default; these choices contain no gameplay data or purchase authority. Player-authored names and answers remain unchanged.
The Host’s name is advertised on the local network, including to devices that have not joined. The Host holds the complete state; each player receives only information permitted in the current phase. Answers and their authors appear at Reveal; the impostor’s identity and question appear at Results. Results show vote totals, not who voted for whom.
Use a nickname and avoid sensitive data about yourself or others. A name enables participation; answers and votes let the round progress. Leave the game or revoke Local Network access in Settings to stop the connection. We do not request birth dates or verify age; follow the App Store rating and category warnings.
3. Connections and local diagnostics
The game uses Bonjour for discovery and TCP for connections, without TLS or mutual authentication added by the app. Use a trusted Wi-Fi network. Separating information between roles is not end-to-end encryption.
The app has no analytics, ads, tracking or remote logging. Production system logs contain technical categories, not names, answers or votes. Apple separately manages system diagnostics and optional sharing.
4. Purchases and Apple services
StoreKit supplies the product, price, offer eligibility and verified transactions needed for Impostor + access. Apple handles the account and payment; we do not receive full card details.
Apple may provide sales, subscription and refund reports for administration and financial records, plus diagnostics if you allow sharing. The developer does not download or retain copies of TestFlight feedback or crash reports. Apple is separately responsible for data used for its own services.
5. Website, cookies and theme
Vercel Inc. hosts the website. For delivery, security and diagnostics, it may process IP addresses, access times, page addresses and parameters, technical headers, response codes and error or security information.
These pages are now hosted on the Dorobanți Media website. The information about the app and support remains specific to this game.
The Dorobanți Media privacy policy and cookie policy apply to browsing this website. They explain website preferences and optional measurement enabled according to consent.
6. Contacting us
To respond, we use your email address, messages, attachments and delivery metadata or, for calls, the number, contact time and information provided. Missing necessary information may prevent us from handling your request.
We use support information only to handle the request, without marketing, tracking or profiling.
The developer personally handles support and privacy requests and is the only person with mailbox access. We use Apple iCloud Mail for email. Support calls are not recorded; necessary notes may be kept to resolve the request. Send only necessary information: device model, app version and steps that reproduce the problem. Do not send passwords, card details, game answers or unnecessary sensitive information. The app’s support pages have no contact form; your email application handles sending.
7. Why we may use this data
For Impostor + access administration and requested support, we rely on performing a contract or steps you request before it (GDPR Article 6(1)(b)). Website security and operation, general correspondence and defending rights rely on the legitimate interests in those purposes (Article 6(1)(f)). Rights requests and mandatory accounting or tax records rely on legal obligations (Article 6(1)(c)).
These grounds concern the company’s own processing. Local Network permission is not GDPR consent and does not replace special conditions for sensitive data. We use no profiling or automated decisions with legal or similarly significant effects.
8. Providers and transfers
Game data is received by the session’s devices, except for the Host name advertised on the network. Vercel hosts the website; Apple handles the App Store and purchases. Email involves the sender’s and recipient’s mail providers.
Vercel’s published DPA covers processor handling on Pro and Enterprise and includes international-transfer clauses. Apple’s Privacy Policy describes international processing and Standard Contractual Clauses for EEA transfers. These published frameworks do not establish our exact account arrangements or promise EU-only storage. Account-specific roles, recipients and applicable safeguards still require review.
We disclose to authorities or professional advisers only data needed for a legal obligation or defending a right.
9. How long data is kept
Game data stays in memory until the session is released when you return Home or the app terminates, without a guarantee of immediate overwriting. Disconnection does not erase accepted contributions. We do not control screenshots kept by other participants. Language and appearance preferences remain saved independently on the device between launches, until you change them or the app’s data is removed.
Vercel Pro with Observability Plus is enabled. Vercel documents 30-day retention for observability data and runtime logs. No drains are configured. Other provider records and recovery copies have separate retention.
Routine support messages, attachments and necessary call notes are deleted 90 days after the request is resolved. The period starts at resolution, not the last message. Records needed for legal obligations or disputes have separately justified retention. The routine deletion process includes emptying Trash and deleting downloaded attachments and exports. Support mail is not forwarded. Only the owner accesses the receiving devices; mail and downloaded support files are not included in local or device backups.
There is no verified deletion deadline for all provider backups. Mailbox deletion does not prove those copies are erased. Records necessary for a legal obligation or dispute require a separate justification and period; the routine-message period does not automatically apply to them.
10. Your rights
Subject to the law, you have rights of access, correction, erasure, restriction, portability and objection, including to legitimate-interest processing. Withdraw consent if it is the basis of processing; the operations in section 7 do not rely on consent.
Write to support@dorobantimedia.com. Requests are normally free. We respond without undue delay, within one month; for complex or numerous requests, we may add two months, giving reasons in the first month. We verify identity only when necessary.
We handle requests for data we control or can access; we have no server from which to retrieve local sessions. You may complain directly to ANSPDCP without contacting us first, and seek a judicial remedy.