Privacy policy

This policy explains what data Izi Morocco collects when you sign up, build a game or play one, what we do with it, and how to ask us to delete it. Plain English first; the legal terms sit alongside it in our Terms of Use.

Who is the data controller?

Izi Morocco Web (“Izi Morocco”, “we”, “us”) is operated by the same legal entity behind the izi-morocco mobile app. Our contact email is on our contact page.

What we collect

• Account data. Email address, optional display name, hashed password (we never see the plaintext — Firebase Authentication handles it). Set when you sign up.
• Profile preferences. Role (organizer or player), subscription plan, UI language. Stored on your users/<your-id> document in Firestore.
• Game content. If you're an organizer: titles, descriptions, hero images, checkpoint coordinates, challenge questions and answers, media you upload.
• Gameplay data. If you're a player: the games you join, your score, which checkpoints you've unlocked, photos and videos you submit, and your team membership.
• Location. Only while you're actively playing a GPS checkpoint. Our servers never receive your coordinates: they are compared on your device against the checkpoint target. The map in the mobile app is provided by Mapbox, whose software collects location and usage data to run and improve the map; Mapbox declares this data as not linked to your identity.
• Diagnostics. When a crash happens we send the error stack to Sentry (Functional Software, Inc., USA) so we can fix it. No identifiers attached by default.

What we don't collect

We don't use advertising trackers, fingerprinting libraries, or marketing analytics (no Google Analytics, no Facebook Pixel). If we ever add an analytics product, we'll update the cookie policy first and ask for consent where the law requires it.

How we use it

• To run the service — show you your games, your score, the leaderboard.
• To keep things secure — Firestore Rules check on every read and write that you have permission for the data you're asking about.
• To send you a verification email at sign-up and a password-reset email on request.
• To troubleshoot crashes via Sentry, when they happen.

Who else sees it

Your data is stored on Google Cloud's Firebase platform (Ireland and the United States). They are our processor under the GDPR — they only handle the data on our instructions. Sentry sees error stack traces only when something crashes. Mapbox receives the map data described under Location above.

Other Izi Morocco users see what you choose to share with them: organizers see the player IDs and scores of people who join their games; players on the leaderboard see anonymized identifiers of other players.

How long we keep it

Game data stays as long as the organizer keeps the game. When a game is deleted, all its checkpoints, challenges, submissions and player sessions go with it. When you delete your account from /creator/account, your user document and Firebase Auth record are removed within 24 hours. Backups roll off within 30 days.

Your rights

Under GDPR, UK GDPR and many other regimes you can ask us to:

• Send you a copy of the data we hold about you (data portability).
• Correct anything that's wrong.
• Delete your account and associated data (right to erasure). In the mobile app you can do it yourself: Profile → Delete account.
• Stop using your data for a specific purpose (right to object).

Email aminebellahcen7@gmail.com from the address tied to your account. We'll reply within 30 days. If you don't like our answer, you can complain to your local data protection authority (in Morocco that's the CNDP; in the EU your national DPA).

International transfers

Firebase processes data in the US and the EU. Where applicable, Google Cloud uses the EU Standard Contractual Clauses to cover the transfer.

Changes to this policy

If we change anything that affects your rights, we'll bump the “Last updated” date above and put a banner on the home page for 30 days.