Opti — Privacy Policy
Last updated: 15 October 2026 · Effective: at App Store and Google Play launch
This policy explains how Nlongvity ("we", "us"), a sole proprietorship registered in Norway, processes personal data when you use Opti, a creature-collection game for iOS and Android. We are the data controller. We comply with the EU General Data Protection Regulation (GDPR) as incorporated into Norwegian law by the Personal Data Act of 15 June 2018. Our supervisory authority is the Norwegian Data Protection Authority (Datatilsynet).
Opti is a game. It does not collect health, location, contacts, financial account, biometric, voice or advertising data, it shows no ads, and it does not track you across other companies' apps or websites.
1. Who we are
Nlongvity (sole proprietorship), Norway
Privacy questions: privacy@nlongvity.com · Support: support@nlongvity.com
2. What we collect, why, and on what legal basis
| Data | What exactly | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| Account | Email address, password (stored only as a salted hash by our auth provider), sign-in timestamps. If you use Sign in with Apple or Google: the account identifier and the email address that provider shares (Apple may give a private relay address). | Create and secure your account, sign you in on any device, send account emails (confirmation, password reset). | Art. 6(1)(b) contract | Until your account is deleted |
| Age confirmation | That you confirmed you are 18 or older, and when. | Opti is for adults only. | Art. 6(1)(c) legal obligation / 6(1)(b) | Until account deletion |
| Profile | Display name (2 to 24 characters), home biome, onboarding progress. | Run the game. Your display name is visible to other players on your profile, showcase and in player search. | Art. 6(1)(b) | Until account deletion |
| Game data | Your creatures (species, serial number, genome, size, mutation, bond level, names you give them, favourites, memories), echo seeds, incubations, expeditions, breeding history, codex progress, wishlist, showcase, friend connections, world-first records. | This is the game. Creatures, serials and world-firsts are generated on our servers so they are fair and unique. Showcased creatures and their names are visible to other players. | Art. 6(1)(b) | Until account deletion |
| Purchases | Product purchased, store transaction identifier, platform, time, Echo Shard balance and its history. We never receive your card or bank details; Apple or Google process the payment. | Deliver what you bought, prevent duplicate or fraudulent grants, handle refunds. | Art. 6(1)(b); 6(1)(c) where accounting law applies | Until account deletion, except where law requires us to keep transaction records longer |
| Crash reports (if enabled) | Error type, stack trace, device model, OS and app version, your random account ID, and a random installation identifier the crash reporter creates for this install (on crashes in the app's native code). No email, name, advertising ID or game content. | Find and fix crashes. | Art. 6(1)(f) legitimate interest | Up to 90 days |
| Usage analytics (if enabled) | Named in-app events (for example "hatch completed"), app version, and your random account ID. No email, no names, no free text, no advertising ID, no session replay. | Understand which parts of the game work and improve them. | Art. 6(1)(f) legitimate interest | Up to 12 months |
| Reports | When you report a player or a name: the reason, your optional note, who or what you reported, the reported name as it was at that moment, and the time. | Moderation and player safety. | Art. 6(1)(f) | Kept as a moderation record; no longer linked to you after your account is deleted |
| Technical logs | IP address and request metadata recorded by our hosting provider when the app talks to our servers. | Security and abuse prevention. | Art. 6(1)(f) | A short period set by the provider, typically days |
Photos. When you choose to save a creature share card, Opti asks for permission to add an image to your photo library. Opti never reads, uploads or scans your photos.
Children. Opti is for people aged 18 and over. Email sign-up requires confirming you are 18 or older before an account is created. If you sign in with Apple or Google and then tell us at the age check that you are under 18, you are signed out and your account is permanently erased within one hour. If you believe a minor has an account, write to privacy@nlongvity.com and we will delete it.
3. What other players can see
Only signed-in players can see anything; nothing is visible to people who are not signed in.
- Your profile: your display name and how many world firsts you have earned. Your home biome, join date and collection counts stay private.
- Your showcase: for each creature you choose to showcase, its portrait and appearance, species, serial number, the name you gave it, generation, home biome, hatch date, its visible personality and any honours (such as being a world first). Breeding history, bond, favourites and hidden traits stay private.
- World firsts: the public discoveries feed shows each world first and links it to the discoverer's profile.
You are not findable in player search until you choose a display name, and you are hidden from everyone while your account is scheduled for deletion. If you block a player, neither of you can see the other. Other players never see your email address, purchases, balance or anything else in your account.
4. Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, server functions | EU (Ireland, AWS eu-west-1) |
| Resend, Inc. | Sending account emails | EU (Ireland) |
| Apple Inc. | iOS distribution, Sign in with Apple, in-app purchases | Per Apple's privacy policy |
| Google LLC | Android distribution, Sign in with Google, in-app purchases | Per Google's privacy policy |
| Functional Software, Inc. (Sentry) | Crash reporting, if enabled | EU data region |
| PostHog Inc. | Product analytics, if enabled | EU (Frankfurt) |
We have data processing agreements with each processor. Where data leaves the EEA we rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
We do not sell personal data and we do not share it for advertising.
5. Your rights
You can request access to, correction of, deletion of, or a portable copy of your personal data; you can object to processing based on legitimate interest and restrict processing. Write to privacy@nlongvity.com from the email address on your account. We answer within 30 days. You can also complain to Datatilsynet (Postboks 458 Sentrum, 0105 Oslo, postkasse@datatilsynet.no).
You can change your display name and creature names in the app at any time.
6. Deleting your account
In the app: World tab → Settings → Delete my account. Deletion is scheduled immediately and becomes permanent after a 7-day grace period, during which you can cancel by signing in again and choosing "Keep my account". After that, your account, profile, creatures and all game, purchase and wallet records are permanently erased. Full details: https://nlongvity.com/opti/delete-account
Unused Echo Shards are lost when the account is deleted.
7. Security
Data is encrypted in transit (TLS) and at rest. Access to your data in our database is restricted by row-level security so each account can read only its own private data. Game outcomes and purchases are validated on our servers, never trusted from the device.
8. Changes
If we change this policy materially we will tell you in the app before the change takes effect.
9. Contact
privacy@nlongvity.com · Nlongvity (sole proprietorship), Norway