Privacy Policy of the “Ferajna” service

Effective from: 12.11.2026

In short

• You don’t have an account with us. You only give a nickname, which doesn’t have to be your name.
• We don’t collect your email, phone number, age or precise location.
• We don’t use cookies. We count visits without storing anything on your device and without storing your IP address (point 3).
• The room with nicknames and the course of the game is stored on servers in the EU (Frankfurt) and deleted after 60 days of inactivity. The host can delete it earlier.
• Your browser remembers who you are in the room, so you don’t have to join again.

1. Who is the data controller

1. The controller of personal data in the “Ferajna” service (https://ferajna.app), including the “Not a word!” (“Ani słowa!”) game (https://ferajna.app/en/ani-slowa; the former address https://ani-slowa.pl redirects to Ferajna), is „CONNECT FINANCE” spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office in Józefosław, ul. Słoneczny Sad 35F, 05-509 Józefosław, entered in the register of entrepreneurs of the Krajowy Rejestr Sądowy (National Court Register) by the Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy KRS (District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register), under KRS number 0000258915, NIP (tax ID) 1231085681, REGON (statistical number) 140598530, share capital PLN 450,000.00.
2. Contact for personal data matters: by post to „CONNECT FINANCE” Sp. z o.o., ul. Słoneczny Sad 35F, 05-509 Józefosław.
3. The company has not appointed a data protection officer.
4. The rules for using the service are set out in the Ferajna terms of use.

“GDPR” (in Polish: “RODO”) means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of personal data.

2. What data we process

2.1. Data in the room (on the server)

When you create or join a room, we store the room’s state on the server:

• your nickname (up to 20 characters),
• a random player ID assigned by the server and a hash (sha256) of the access token. Only your browser knows the token itself; it cannot be recreated from its hash,
• the course of the game: your team or role, points, moves in the game, the game history in this room, who the host is, and the room settings,
• in “Not a word!”: the selected card level (“Kid”, “Medium” or “Advanced”),
• in some games: answers typed or selected in the game, votes and consents (e.g. consent to tasks involving another person in “Truth or Dare”). Other players see secret answers and votes only after they are revealed, and in anonymous modes only in aggregate form (e.g. “3 of 5”),
• in 18+ games: the fact that you have confirmed you are an adult in this room.

We delete some answers before the room disappears:

• in “Do You Know Me?”, the text of the typed answer and guess is deleted when the pair moves on to the next question or the game ends. Only the result remains (correct or not),
• in “Never in My Life”, we delete individual answers as soon as they are revealed. Only the number of admissions remains (e.g. “3 of 5”).

Please don’t enter your first and last name, or information about your health, sex life or beliefs, in your nickname or answers. The game doesn’t require it.

2.2. Technical data

• Your IP address and basic request data (e.g. page address, time, browser type) are technically processed by our hosting provider (Vercel), because the page cannot be displayed without them. Vercel’s firewall uses the IP address to limit the number of requests from a single address and to protect the service against abuse.
• Your browser also connects to a Supabase server to learn about changes in the room as they happen. No game data flows through this connection, only a “something has changed” signal, but Supabase can technically see the IP address.
• We don’t store IP addresses in our database and we don’t link them to nicknames.
• The page language comes from its address (e.g. /en/ for English). The browser sends it to the server with requests in the room so that cards are shown in that language. We don’t store it in the game data; it only goes into the visit statistics (point 3). The suggestion of another language version checks the languages set in your browser only on your device.
• Technical logs of our providers are kept for the period set by each provider’s rules.

2.3. Data on your device

We describe it in point 8.

2.4. Correspondence

If you write to us (complaint, content report, question), we process your contact details (e.g. email address) and the content of your message.

3. Visit statistics

The service counts visits without cookies and without storing anything on your device.

1. When a page is displayed, the browser sends the server the address of that page and the address of the page from which you came to the service. The server stores the page address without the room code and only the domain of the previous page (e.g. google.com).
2. When a room is created, when someone joins a room and when a game starts, the server stores: the type of event, the game, the page language, the room code, the number of players, whether the player is returning to the room, and the game settings (e.g. the selected deck, the number of rounds). We don’t store nicknames.
3. To each event we add:
   • the device type (phone, tablet or computer),
   • the operating system (e.g. iOS, Android, Windows),
   • the country, which our hosting provider (Vercel) determines from the IP address,
   • a daily identifier: an irreversible hash (SHA-256) of the date, the IP address, the browser description (User-Agent header) and a secret salt.
4. The identifier changes every day, and we don’t store the IP address. That’s why this data cannot be used to establish anyone’s identity or to track a person from one day to the next. It only lets us count how many different devices used the service on a given day.
5. Purpose: knowing which games and language versions are used and when the service is under the most load, and improving the games. Legal basis: the controller’s legitimate interest (Art. 6(1)(f) GDPR).
6. Browsers with “Do Not Track” turned on don’t send information about page visits. Room events (creating, joining, starting a game) are stored by the server while handling the game, so they are counted in that case too.
7. We keep this data for 13 months, after which it is deleted automatically. Only the controller views the summaries, in a password-protected panel. The data is kept with the same providers as the rest of the data (Vercel, Supabase; points 5 and 6).
8. In practice, this data doesn’t allow anyone to be identified, so we usually cannot tell which events relate to you (Art. 11 GDPR). If you still want to exercise your rights (e.g. to object), write to us. Contact: by post to „CONNECT FINANCE” Sp. z o.o., ul. Słoneczny Sad 35F, 05-509 Józefosław.

4. Why we process data and on what legal basis

Giving a nickname is voluntary, but you can’t play without one. We don’t make decisions based solely on automated processing that would have legal effects on you, and we don’t profile players.

5. Who has access to the data

1. Other players in the same room see your nickname, the course of the game and (once revealed) your answers, according to the rules of each game. Anyone who knows the room code can join the room.
2. Processors acting on our behalf (Art. 28 GDPR):
   • Vercel Inc. (USA): hosting of the pages and server, content delivery network, firewall. Server functions run in the Frankfurt region, but network traffic may pass through Vercel servers in other countries.
   • Supabase Inc. (USA): database in the Frankfurt region (EU) and the service that notifies about changes in the room.
3. We share data with public authorities only when the law requires it.
4. We don’t sell data and we don’t share it with advertisers.

6. Transfers of data outside the European Economic Area

1. Vercel and Supabase are US companies. Room data is stored in the EU (Frankfurt), but the providers or their subcontractors may access it from the USA (e.g. for technical support), and network traffic (including the IP address) may be handled outside the EEA.
2. Such transfers take place with the safeguards provided for in the GDPR, i.e. on the basis of:
   • the European Commission’s decision of 10 July 2023 finding an adequate level of protection under the EU-US Data Privacy Framework (Art. 45 GDPR), for providers certified under this framework, or
   • standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).
3. You can get information about the safeguards used, and a copy of them, on request. Contact: by post to „CONNECT FINANCE” Sp. z o.o., ul. Słoneczny Sad 35F, 05-509 Józefosław.

7. How long we keep data

8. What we store on your device (browser storage)

The service doesn’t use cookies. We use browser storage: localStorage, where data stays until it is deleted, and in one case sessionStorage, where data disappears when the tab is closed. We store there:

1. Under the Electronic Communications Law of 12 July 2024 (ustawa z 12 lipca 2024 r. – Prawo komunikacji elektronicznej), storing information on a user’s device requires consent, unless it is necessary to provide a service the user has requested. All the entries above serve only to run the game you ask for, or to remember choices you have made yourself. That’s why we don’t ask for consent, but we inform you about them.
2. Data from browser storage is not sent to us automatically. Only the ID and token (to confirm who you are in the room) and your actions in the game reach the server.
3. You can delete it at any time in your browser settings (delete site data). You will then lose automatic access to your rooms; you can get back to them by entering the code and the same nickname.
4. Visit statistics (point 3) don’t store anything on your device. If in the future we add tools that store information on your device and are not essential, we will ask for your consent first and update this policy.

9. Children

1. Ferajna’s family games, including “Not a word!”, are also designed for playing together with children.
2. People aged 13 or older may use the service on their own; people aged 13–17 with the knowledge of a parent or guardian. Children under 13 play only with an adult who creates the room and is present during the game.
3. We don’t ask children for any data other than a nickname, and we don’t ask about age. We ask parents to make sure children don’t use their first and last name in their nickname.
4. A parent or guardian can exercise the rights described in point 10 on the child’s behalf.
5. 18+ games and decks are intended only for adults and require confirmation of being an adult.

10. Your rights

You have the right to:

• access your data and get a copy of it (Art. 15 GDPR),
• have your data rectified (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR), e.g. by leaving the room or asking us to delete the room,
• restrict processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR), to the extent that we process your data on the basis of a contract,
• object to processing based on legitimate interest (Art. 21 GDPR),
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl) or with the data protection authority of the EU country where you live or work, if you believe we are breaking the law (Art. 77 GDPR).

To exercise your rights, write to us and give the room code and your nickname. Contact: by post to „CONNECT FINANCE” Sp. z o.o., ul. Słoneczny Sad 35F, 05-509 Józefosław.

We don’t know your name or email, so the room code and nickname are the only way we can find your data. We may ask for additional confirmation, e.g. information known only to a player from that room, so that we don’t disclose data to an outsider. If we are unable to identify you, we will let you know (Art. 11 GDPR). We reply within one month (Art. 12(3) GDPR).

11. Security

• Connections to the service are encrypted (HTTPS).
• Only the server has access to the database. Browsers have no direct access to it.
• The server stores only a hash of the access token, not the token itself.
• Each player receives from the server only what they are allowed to see at a given moment of the game (e.g. guessers don’t see the word).
• The server sends 18+ content only to players who have confirmed they are adults.
• The visit statistics panel is password-protected.

12. Changes to the policy

We will announce changes on the home page of the service. The current version is always available at https://ferajna.app/en/prywatnosc, with the effective date at the top. The rules for using the service are set out in the terms of use.

This privacy policy is an English translation of the Polish original. It is also available in German, Ukrainian and Spanish. In case of any discrepancy, the Polish version prevails.