CheckMess · Your data in the game
CheckMess app privacy policy
Version dated 27 October 2026
1. Scope
This policy covers CheckMess on iOS and Android and its services: player accounts, online saves, multiplayer matches, friends, messaging, in-app purchases and support. Available features may vary by platform, version and the player's age.
Solo games and lessons are available without an account, with Play without an account. No account is then created: progress stays on your device, and only the technical information described in section 3 is processed when the game contacts our servers.
Browsing checkmess.com, its contact form and signing up for the launch announcement are covered by the separate “Website privacy” policy: checkmess.com/en/privacy/.
2. Controller and contact
The data controller is Equaviz OÜ, a company incorporated under Estonian law, registered under number 17542633, with its registered office at Harju maakond, Tallinn, Lasnamäe linnaosa, Lõõtsa tn 5, 11415, Estonia.
For any question or request about your data: support@checkmess.com. You may also write to the postal address above, marking your correspondence “CheckMess data protection”.
3. Data processed and how it is used
Account and sign-in
We process your email address, account identifier, username and the information needed for sign-in, account recovery and session security. Required information is identified when you enter it; without the data needed for an account, its associated online services cannot be provided.
If you choose to sign in with Google or Apple, that provider sends the information authorised for authentication. Google may, in particular, send a name and a reference to a profile photo, in addition to an email address and provider identifier. Apple may send a relay address when you hide your email. We do not receive your Google or Apple password. The name and photo from your sign-in provider are not automatically published in your game profile.
Profile, saves and matches
We store your game profile, the avatar you choose in the game, decks and their names, synchronised progress, completed tutorials, match results and histories, rating, inventory and mana wallet. This data is used to run the game, save progress, find opponents and assign results and rewards.
Your username, avatar and the game information provided for by the features you use may be visible to other players, notably in a match or leaderboard. Your sign-in email is not public profile information.
Some preferences and saves remain on your device, including certain settings and solo games. Not all local data is synchronised. Information used to keep you signed in is stored using the platform's protection mechanisms.
Friends and messaging
We store invitations, relationships between friend accounts and information needed for friendly duels. This list is created within CheckMess: we do not import your phone's address book. Your friends can see whether you are online: for this, we record the time of your last activity in the game.
We store message content, dates, senders, recipients and read markers to enable conversations and allow them to be viewed. Messages are intended for the participants concerned. This is not an end-to-end encrypted messaging service: people authorised to handle security, moderation or support may access information necessary for their intervention.
The game requires acceptance of the chat rules before the first message is sent, on iOS and Android. We record the account identifier, the version of the rules accepted and the acceptance date. Acceptance is recorded once per account for the relevant version of the rules; it is not blanket consent to data processing. Not accepting the rules prevents sending messages, but does not prevent online play.
A block is stored with the identifiers of the accounts concerned and its date. It persists after signing in again, removes the friendship and prevents direct messages, friend requests and duel invitations between those accounts. Unblocking a player does not automatically restore the friendship. A block also keeps both accounts apart in online matchmaking. A report has the same effect for 90 days.
A private report records the report and account identifiers, its date, its reason, the reported player's username, the optional comment and any choice to block the player. When it concerns a received message, a copy of only the selected message, its reference and date are also kept for review; the entire conversation is not copied into the report. Reports are not public: only authorised people may access and handle them.
Reported abuse is reviewed manually. We store the case status, decisions, their reason and date, the identity of the authorised person taking action and any chat or account restrictions. Depending on the review, that person may, in particular, hide a message from its participants, restrict chat or suspend an account. Reporting a player does not by itself trigger an automatic sanction; a block chosen by the player is a separate action. We do not promise automated content moderation, continuous monitoring or an immediate response. The separate retention periods for conversations, evidence and cases are set out in section 7. Avoid sending sensitive data, passwords or sign-in codes in chat or to support.
In-app purchases
Your platform's store processes the payment. We process product and transaction references, technical proof of purchase, purchase status and the beneficiary account. We keep records of mana movements and associated entitlements to deliver content, prevent duplicate grants, handle incidents and prevent fraud.
We do not receive your full payment card number or banking credentials. The store country and currency may be used to display and verify the local offer; they are not a measurement of your GPS location.
Technical operation and security
The game and its infrastructure process technical information necessary for communication and diagnostics: IP addresses during connections, sign-in events and errors, technical request or session references, game version, platform, technical device characteristics and operational measurements.
Purchase components may also process installation, device, session, country or transaction information necessary for their services. This information is used to provide purchases, ensure service compatibility and reliability, and prevent abuse.
We do not use players' data to display targeted advertising or build advertising profiles across apps. We do not sell their data. The graphics and 3D modelling tools used during development do not receive players' accounts, messages or matches in the normal operation of the game.
Support
When you contact support@checkmess.com, we receive your email address and the information you choose to send. Messages are hosted by IONOS and accessible to the person responsible for support at Equaviz OÜ. The support mailbox is not forwarded to another email service.
The game’s Contact support screen sends your message directly to support@checkmess.com: your reply address, the chosen topic and your message go through our game server, then our email delivery provider, to the support mailbox. The language, game version and platform are attached; if you are signed in, your account identifier is attached too. You may choose to add diagnostics, unticked by default and shown before sending: game version, platform, device model, display, performance and game state, with no email address or sign-in code. The Idea box works the same way; the email address is optional there. If direct sending is unavailable, the game offers to prepare an email that you send from your email app.
Creating an account or contacting support does not subscribe you to a marketing list.
4. Legal bases
Processing necessary for your account, the game features you request, saves and purchase delivery is based on the performance of the contract to provide the service.
Protecting the service, preventing fraud and abuse, handling incidents and certain support interventions are based on our legitimate interest in providing a reliable service and protecting players, while respecting their rights.
Retention of accounting documents and responses to certain requests from authorities are based on our legal obligations. Where consent is required, it is requested separately and may be withdrawn. Reading this policy does not constitute blanket consent to all processing.
5. Providers, components and recipients
Only authorised people at Equaviz OÜ and providers needed for their respective tasks have access to the relevant data. The main parties involved are:
| Party | Role and data concerned |
|---|---|
| Supabase | Authentication, databases and storage of accounts, profiles, friendships, messages and game data, as well as chat rule acceptances, blocks, reports, evidence and moderation data. |
| Render | Hosting of game server and purchase validation services; requests, data needed for matches, relay of support and idea box messages, operational logs. |
| Resend | Delivery of service emails (sign-in and verification) and of messages sent from the game’s support screen and idea box; recipient and reply-to addresses, content and delivery information. |
| IONOS | Hosting of support email; email addresses, messages, attachments and technical email data. |
| Apple and Google | Authentication when you choose their sign-in services; management of payments and transactions on their respective stores, depending on the features offered. |
| Unity | Provision of the engine and in-app purchase components; technical processing of purchases and diagnostics necessary for the services used. Unity does not host CheckMess accounts or messages. |
Providers acting on our behalf are subject to our instructions and the data protection obligations applicable to their services. We ensure that third parties to whom we transmit data provide protection at least equivalent to that described in this policy. Apple and Google also process certain data for their own services under their policies. Providers' access rights are limited to what the services concerned require.
When you open our website from the game, its host, Cloudflare, processes the browsing request under the website policy. The link does not automatically include your CheckMess account information.
We may disclose data to authorities when a legal obligation or legally founded request requires it, and to relevant professional advisers when necessary to defend our rights. These accesses are limited to relevant information.
6. International processing and safeguards
Our providers may process data in the European Economic Area and other countries, including the United States. A server being located in Europe does not rule out technical access or international processing necessary for the service.
Where a transfer subject to European rules is made to a country without an applicable adequacy decision, it is covered by the safeguards required by those rules, notably the European Commission's standard contractual clauses and, where necessary, supplementary measures. Applicable UK and Swiss safeguards are taken into account for the transfers concerned.
You can obtain information about processing locations and relevant safeguards, or request a copy, at support@checkmess.com. Providers' documents are available, in particular, at the following addresses:
- Supabase: supabase.com/legal/dpa
- Render: render.com/dpa
- Resend: resend.com/legal/dpa
- IONOS: www.ionos.fr/terms-gtc/
- Unity: unity.com/legal/privacy-policy
- Apple: www.apple.com/legal/privacy/
- Google: policies.google.com/privacy
7. Retention periods
| Category | Period and action on expiry |
|---|---|
| Account, profile, progress, decks, inventory and friendships | For the lifetime of the account. After 24 months without signing in, a 30-day deletion notice is given. Signing in again within that period cancels the inactivity procedure. Accounts that have purchased Mana are not deleted for inactivity. |
| Match histories and statistics linked to the account | For the lifetime of the account, then erased or irreversibly anonymised when it is deleted. Statistics retained in a genuinely anonymous form no longer allow the player to be identified. |
| Ordinary chat messages and read markers | Kept in the conversation history for the lifetime of the participating accounts, unless erased earlier. Actual deletion of either account removes the exchanged messages from the active database. Blocking a player or hiding a message does not erase its stored content. The report-specific periods below do not erase the original conversation. |
| Acceptance of chat rules | For the lifetime of the account, for the latest accepted version of the rules. |
| Blocks between players | Until the person who created the block removes it, or either account concerned is actually deleted. |
| Report copies and evidence | The copy of the selected message, its copied date, the copied username and the report's optional comment are erased after 90 days from the report's creation. |
| Report cases and moderation decision log | Each case is deleted after 365 days from its creation. Each decision log entry is deleted after 365 days from that entry's date, independently of when the case is closed. Evidence copies follow the shorter period described above. |
| Current state of chat or account restrictions | The latest state, its reason and date, and the authorised person responsible for the decision are stored for the lifetime of the account and updated when a decision changes. This state is separate from the decision log; the log's retention period does not automatically end a restriction. |
| Supporting accounting documents | 7 years from the end of the financial year in which they are recorded, in accordance with applicable Estonian obligations. Only necessary data is archived with restricted access; this does not justify keeping the entire account or its game history. |
| Technical logs retained under our control | No more than 30 days. Extracts necessary to analyse a security incident may be isolated until it is resolved, then for no more than 90 days after resolution, unless a legal obligation or documented dispute requires otherwise. |
| Support correspondence and diagnostics sent to support | While the request is handled, then 12 months after closure, unless a legal obligation or documented dispute requires otherwise. |
| Backups we create | Rotation over no more than 30 days. Erased data disappears by the end of this cycle at the latest; a restore reapplies deletions made since the backup. |
Expiry-based erasure of evidence copies, report cases and the decision log is performed by periodic server maintenance, at startup and then hourly. If the service is unavailable or an attempt fails, it is retried during a later run; erasure is not guaranteed to the exact second.
Actual account deletion removes its identifier links from report cases and the decision log, but does not immediately erase the material kept there to handle abuse. A message copy, username or comment may still contain personal data until it is erased according to the periods above. Removing those links does not therefore, on its own, amount to irreversible anonymisation. Your rights continue to apply as described in section 8.
Logs and backups managed directly by providers also follow their service cycles and their own obligations. Their retention periods may be shorter than our maximum periods. Information held by Apple or Google for their own services is governed by their respective policies.
Exceptional retention related to a dispute or legal obligation is limited to necessary data, with restricted access and reassessment when that need ends. Moving a match to a technical archive is not erasure.
8. Rights, export and deletion
Subject to applicable legal conditions, you have rights of access, rectification, erasure, restriction and portability. You may object to processing based on our legitimate interest and withdraw consent where it is the basis for processing. Withdrawal does not affect the lawfulness of processing already carried out.
To exercise your rights, email support@checkmess.com. We may request only the information necessary to verify your identity proportionately. We generally respond within one month; any extension permitted by law will be explained to you within that period.
The My profile → My data section lets you export certain game data. The file does not necessarily include data stored only on your device or all support correspondence. It does not limit your right to request a more complete copy.
You can delete your account directly in the game under My profile → Delete my account (or My profile → My data → Delete my account), after confirmation. Deletion is immediate. You may also email support@checkmess.com.
Deletion ends access to the account and leads to erasure or irreversible anonymisation of its associated data, except information that must be retained by law and the limited retention of reports and moderation material described in section 7. It covers profiles, social relationships, relevant messages, online saves and player references in histories and archives. Backup copies expire according to the cycle described above. Deletion takes effect immediately after confirmation in the game. Results of games already played and purchase receipts are kept, attached to an anonymous player, for opponents’ history and accounting obligations. Replays of those games, visible to your opponents, keep the username and avatar shown during the game. A request sent to support is processed within one month.
The confirmation screen explains the loss of access to progress and account items, including remaining mana. Deletion is not in itself a refund request; your statutory rights and the store's procedures remain applicable. It does not delete your Apple or Google account. Uninstalling the game does not automatically delete your CheckMess account.
You may contact the Andmekaitse Inspektsioon in Estonia, www.aki.ee/en, or the competent authority in your country, including the CNIL in France, www.cnil.fr. Where the law permits, an authorised representative may exercise your rights on your behalf.
9. Age, distribution and access to online services
For its Android launch on Google Play, CheckMess targets players aged 13 and over. This is the declared Android distribution audience, separate from the content age rating assigned by each store. This change does not alter the iOS rating. A distribution audience or store rating is neither verification of a player's age nor universal permission to access online services.
Online play remains available with an account. The Android launch flow does not include a general age or identity check, or a mode that automatically places minors offline. Acceptance of the chat rules is required to send messages, not to access online play, and does not verify age or parental authorisation.
We do not offer a supervised account with verified parental authorisation in this launch flow. It therefore does not collect a date of birth, a parent's contact address or proof of authorisation for that purpose. The legal conditions allowing a minor to use an online service or consent to certain processing depend on the country and the processing concerned; the Android target audience does not replace those conditions.
A player or their legal representative may contact support@checkmess.com about age, safety or exercising the rights described in section 8. An age-related report is reviewed manually and may lead an authorised person to restrict chat. It does not automatically trigger a sanction, an identity check or a parental authorisation procedure. As stated above, we do not use players' data for targeted advertising.
10. Security and changes
We implement appropriate measures to control access, protect communications and limit the data used. Administrative and support interventions are restricted to authorised people. No measure can, however, guarantee absolute security.
This policy may change as features or our obligations evolve. The version shown at the top of the page identifies the applicable text. Appropriate notice is given of any material change; fresh consent is requested where necessary.