Privacy notice
Last updated 13 October 2026
D1FY Conversation Cards is run by D1FY Initiative, Kampala, Uganda (“we”). We are the data controller. Contact for anything in this notice: d1fyinitiative@gmail.com.
Short version: playing the cards alone collects nothing about you. Two optional features use your data, and each one asks first.
What stays on your device
Your progress, streaks, badges, sound setting and choices are saved in your browser storage on your own device. We cannot see them. We do not use advertising cookies, third-party trackers, session recording or third-party fonts. Clear them any time with Settings > Reset all progress or by clearing your browser data.
1. Optional visit counts (off until you say yes)
If you tap Yes, count me (or switch on Count my visit in Settings), we record:
- a random device ID and a random visit ID (not your name, not linked to you),
- device type (phone, tablet or desktop), time zone, browser language, and where you came from (for example a WhatsApp link),
- which decks you open and how many cards you play, with time stamps.
We use this only to understand how the cards reach people and to report on the programme. We never record your answers or your name. If your browser sends Do Not Track or Global Privacy Control, we treat it as a no. If you are under 18, ask a parent or guardian before saying yes. Change your mind at any time in Settings: counting stops and the device ID on your device is deleted.
Your device ID: none (counting is off)
2. Play together (18+ only)
Play together is for adults. Before it opens we ask you to confirm you are 18 or older and agree to what follows.
- We process the first name you type, the answers and emoji reactions you send, and whether you are online in the room.
- These are relayed live to the other players in your room through Supabase (a real-time service with servers outside Uganda). We do not write them to a database and we do not keep them. They exist while the room is open.
- Everyone in the room sees what you type. The host’s device holds the game. The end-of-game transcript is built on your device and is yours to download or discard.
- Your first name and 18+ confirmation are saved in your browser so you do not retype them. Remove them in Settings > Play together > Forget.
Please do not type sensitive details (your health information, other people’s names or contacts) into answers. Answers are visible to the other players.
Why we may use your data
Only with your consent: the visit counts (your tap) and Play together (the 18+ confirmation). You can withdraw consent at any time, and withdrawing is as easy as giving it. This follows the Uganda Data Protection and Privacy Act, 2019 and, for people in the EU/EEA and UK, the GDPR.
Who else handles data
| Provider | Role |
|---|---|
| Supabase | Receives visit counts (if you opted in) and relays Play together messages. Servers are outside Uganda. Like any internet service it sees your IP address to deliver the connection. We do not store IP addresses in our counts tables. |
| Netlify | Hosts the website files. Like any host it may log standard connection details (such as IP address) for security and delivery. |
Because the servers are outside Uganda, your data is transferred abroad. By opting in or confirming 18+ you consent to this. We rely on the providers’ data processing terms and security measures. We do not sell data and do not share it for advertising.
How long we keep it
Play together messages: not kept after the room closes. Visit counts: kept only as long as needed for programme reporting, then deleted. We delete counts linked to your device ID on request.
Your rights
You can ask us to tell you what we hold about you, correct it, delete it, stop using it, or hand it to you, and you can withdraw consent. Email d1fyinitiative@gmail.com (include your device ID from above if you opted in). We reply within 30 days.
You may complain to the Personal Data Protection Office at NITA-U in Uganda, or, if you are in the EU/EEA or UK, to your local data protection authority.
Children
Solo play collects nothing about anyone, so children can play the decks. Play together is for 18+ only. Visit counts for anyone under 18 need a parent or guardian’s agreement. If you think a child has used Play together or opted in without permission, tell us and we will delete the related data.
Security and changes
Connections are encrypted (HTTPS). Visit counts can only be sent to our database, not read back by the public. If we change this notice we update the date above and, for anything that needs new consent, we ask again.