Privacy policy

Free beta, by invitation

Retoverso is in a free beta that you can only join with an invitation code. During the beta there are no payments of any kind: we do not ask for or keep payment details, and no payment provider is involved.

Blockware is the data controller. Privacy contact: privacidad@retoverso.com.

Beta families are founders: they get the Premium benefits at no cost and with no end date, and these will be kept when paid plans arrive.

There is no chat between children during the beta.

If you ask for an invitation from the home page, we only keep your email to send it to you, and we delete it within 180 days at most.

These texts are provisional: our legal adviser is reviewing them and they may change before Retoverso opens to everyone. We will email you about any important change.

Who is responsible

Retoverso is a service by Blockware [company name, tax ID and address pending], the controller of the data described here. Privacy contact: privacidad@retoverso.com.

Adult accounts only

Accounts always belong to an adult who declares to be the mother, father or legal guardian. Children do not sign up or have credentials: they play from a profile inside their family account. Under-14s cannot consent to the processing of their data under Spanish law, so the adult decides and controls everything.

What data we process

• About the adult: email, name (optional), language, time zone, when the terms were accepted, the Parents’ area PIN (stored as a hash, never in clear) and open sessions (date, IP address and browser).
• About the child, the minimum: a nickname, the character chosen as avatar, an optional age range and the sound setting. We never ask for their real name, email, photo, date of birth or school.
• While playing: each game’s questions, answers, right answers, points, stars, badges, streak and which questions were already seen.
• For security: a log of sensitive actions (such as changing the PIN or deleting the account) with a pseudonymised IP, and counters to limit attempts.

Why, and on what basis

• To provide the service you ask for: account, profiles, games, progress and Parents’ area (performance of the contract, art. 6.1.b GDPR).
• To protect the service and its users: security log and attempt limits (legitimate interest and security duty, arts. 6.1.f and 32 GDPR).
• To email you sign-in links and security notices (performance of the contract).
• We don’t use data for advertising, we don’t sell it and we don’t build commercial profiles. If we ever measure app usage, it will only be with your consent and never on the child’s screens.

Who we share it with

Only with providers that help us run the service, under data processing agreements and with data in the European Union: server hosting [provider pending], backups (a daily, encrypted backup of the whole server in the same provider’s object storage, in Strasbourg, France) and email delivery (Resend, EU region). If you choose “Sign in with Google”, Google receives your email (transfer covered by the EU-US Data Privacy Framework). The full list of providers is available on request at privacidad@retoverso.com and will be published in the Trust Centre.

How long

• For as long as the account or profile exists. If you delete a profile or the account, it is deleted immediately.
• Sign-in links: 15 minutes, single use. Sessions: 30 days.
• Backups: database copies, 7 days; full-server backups, 30 days. So something you delete can remain in backups for up to 30 days, where nobody uses it. If we ever restore a backup, we delete closed accounts again before reopening the service.
• Security log: [12 months, to be confirmed]; when the account is deleted it loses anything that identifies you.

Your rights

You can access, rectify, erase, port, object to and restrict processing (arts. 15 to 22 GDPR). From the Parents’ area you can download all account data as JSON, edit profiles and delete the whole account without writing to anyone. For anything else, write to privacidad@retoverso.com: we reply within one month. If you are not satisfied, you can complain to the Spanish Data Protection Agency (aepd.es).

On your device

We only use strictly necessary technical cookies and keep the game in progress on the device so it can be finished offline. Details are in the cookie policy.

Security

Encrypted connections, PIN and links stored as hashes, a log of sensitive actions, verified daily backups, and data access restricted to the essential technical team.

Changes

If we change anything important we will tell you by email and in the app before it applies, and ask you to accept it again when needed.