Service operated by: DigitalFreedom — a brand of DigitalFreedom Global LLC

Data controller (legal entity): DigitalFreedom Global LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States

Data protection: data-protection@digitalfreedom.co.za
Data protection request form: https://data-protection.digitalfreedom.co.za
General: hello@digitalfreedom.co.za

1. Introduction

This Privacy Policy explains how DigitalFreedom Global LLC (“we”, “us”) collects, uses, stores and protects personal data when you use the Snapshots iOS app and the website at snapshots-quiz.app (together, “the Services”). Wherever app and website differ, the section says so.

1.1 Global scope

Snapshots is distributed through the Apple App Store and is therefore available in every country and territory that store serves. This Policy applies globally, regardless of where you download, access or use the Services.

We apply the EU General Data Protection Regulation (GDPR) as a global floor: every user, in every country, gets at least the GDPR-level protection set out here. Where your local law is more protective, the more protective standard applies. Laws we align with include the GDPR and BDSG, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA/CPRA and the other US state privacy statutes, PIPEDA, the Australian Privacy Act 1988, the Brazilian LGPD, the Japanese APPI, the Korean PIPA, the Indian DPDP Act and POPIA.

2. Data controller

The controller under Art. 4(7) GDPR is:

DigitalFreedom Global LLC (trading as DigitalFreedom) 30 N Gould St, Ste N Sheridan, WY 82801 United States

For data protection inquiries use the request form at https://data-protection.digitalfreedom.co.za or write to data-protection@digitalfreedom.co.za. You may use either route — and any other channel you like; we act on your request however it arrives.

No Data Protection Officer is appointed: the Provider does not meet the threshold of Art. 37 GDPR / § 38 BDSG.

3. Data we collect

3.1 The app — what leaves your device

Snapshots works without an email address, without a password and without a social login. What the app sends to our backend is:

Data	Why	When
Player name you choose on first launch	It identifies your entry on the global leaderboard and must be unique	Once, when you create it; then with each score
Score records — final score, number of puzzles solved, timestamp	The leaderboard and your personal best	At the end of a session, or later when you are back online
Puzzle language code (e.g. `en`, `de`)	So the backend serves the puzzle set in the language you play	With each puzzle request
Technical request data — IP address, time, user agent, requested resource	Unavoidable in operating a server; used for delivery, security and defect analysis	With every request

That is the complete list. There is no email address, no password, no name of a real person unless you type one into the player-name field, no payment data, and no address book, calendar, photo, microphone, camera, location or health data.

3.2 The app — what stays on your device

Solved puzzles, downloaded puzzle images, your settings, your sound preference, your personal best and the local copy of your player record are stored on the device in a local database. They are not transmitted. Deleting the app deletes them.

3.3 The app — what is not in it

No third-party analytics SDK. Snapshots contains no Firebase Analytics, no Google Analytics for Firebase, no Amplitude, no Mixpanel.
No crash-reporting SDK. Crashes reach us only through Apple’s own aggregated reports, if you have enabled sharing with developers in iOS.
No advertising. No ad SDK, no ad is displayed, nothing is sold to an ad network.
No advertising identifier. IDFA is never read, and no App Tracking Transparency prompt is shown because there is nothing to ask for.
No push notifications from a server. Reminders are scheduled locally on your device by iOS; no push token is registered and none leaves the device.

3.4 The website

Data	Purpose	Legal basis
Server log data at the host (IP address, time, requested URL, user agent)	Delivering the pages, security, defect analysis	Art. 6(1)(f) GDPR — legitimate interest in operating the site
Google Analytics 4 with Consent Mode v2	Aggregated reach and content measurement	§ 25(1) TDDDG and Art. 6(1)(a) GDPR — your consent, for anything stored on or read from your device; before consent only cookieless aggregated pings on Art. 6(1)(f)
Your cookie choice	Not asking you again	Strictly necessary, § 25(2) no. 2 TDDDG
Your language and theme choice	Showing the site the way you left it	Strictly necessary, § 25(2) no. 2 TDDDG

The site is a static build hosted on GitHub Pages (GitHub, Inc.), whose servers write the access logs; we do not access them. Fonts are self-hosted from this domain — there is no Google Fonts request, no CDN, no embedded video and no social plugin. Details, including the concrete cookie names and durations, are in the cookie policy.

3.5 Support and legal correspondence

If you write to us — support, a data protection request, a vulnerability report — we process the content of your message, your email address and whatever you choose to include, in order to answer you. Legal basis: Art. 6(1)(b) and (f) GDPR, and Art. 6(1)(c) for requests we are legally required to handle.

4. Legal basis for processing

Legal basis	What it covers
Contract performance, Art. 6(1)(b) GDPR	Creating the player name, delivering puzzles, recording scores, running the leaderboard, unlocking the purchase
Legitimate interests, Art. 6(1)(f) GDPR	Server logs, abuse and fraud prevention, defect analysis, cookieless aggregated measurement before consent
Consent, Art. 6(1)(a) GDPR	Google Analytics on the website and everything else stored on or read from your device beyond the strictly necessary
Legal obligation, Art. 6(1)(c) GDPR	Tax and accounting records for purchases, handling of statutory requests

5. How we use your data

We use your data to provide and operate Snapshots, to show the leaderboard, to serve puzzles in your language, to verify and restore your purchase, to answer your messages, to keep the service secure, to find and fix defects, and to comply with legal obligations. We do not profile you, we do not build advertising audiences, and we do not use your data to train AI models.

6. Who receives your data

6.1 Processors

Processor	Role	Location
Civo Ltd.	Cloud infrastructure — Kubernetes cluster, managed PostgreSQL database, S3-compatible object storage for puzzle images	London, United Kingdom (`lon1`)
RevenueCat, Inc.	In-app purchase management: receipt validation and entitlement state, keyed to a pseudonymous app user ID	United States
Migadu-Mail GmbH	Email hosting for the contact and support addresses	Servers in France (EU); company established in Switzerland
Storj (Storj Labs Inc.)	Off-provider copy of our server backups, which include the helpdesk holding support correspondence (§ 3.5)	United States (company); encrypted pieces on storage nodes in the EU (EU-placed bucket); location of Storj’s hosted gateway not verified
Google Ireland Ltd.	Google Analytics 4 — website only, and only after your consent	EEA, with onward transfer to Google LLC in the United States
GitHub, Inc.	Hosting of this static website (GitHub Pages)	United States

OpenAI Ireland Ltd. generates the puzzle words and images before any player sees them, in a scheduled background job on our servers. No user data — no player name, no score, no message — is sent to OpenAI. OpenAI is therefore a supplier of content production, not a recipient of your personal data.

The list of processors may change; the current list is maintained in our sub-processor register and is available on request at data-protection@digitalfreedom.co.za.

6.2 Platform and distribution

Apple Distribution International Ltd. acts as an independent controller for App Store distribution, TestFlight and In-App Purchase. Apple is the seller of the purchase in the EU/EEA, the United Kingdom, Switzerland and Türkiye (commissionaire) and our agent elsewhere, in which case the seller is DigitalFreedom Global LLC. Apple never passes us your payment details, and we never see your card data. Apple’s own processing is governed by https://www.apple.com/legal/privacy/.

6.3 Legal requirements

We disclose data where we are required to by law, legal process or a lawful government request — and no further.

6.4 Business transfers

In a merger, acquisition or sale of assets your data may be transferred. You would be informed in advance, as stated in § 15.

6.5 No sale of personal data

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

7. International data transfers

Civo lon1 (London, United Kingdom) — covered by the European Commission’s adequacy decision for the UK under Art. 45 GDPR.
Migadu-Mail GmbH — mail is stored on servers in France (EU), so storage involves no transfer outside the EEA. Migadu is established in Switzerland; access by the Swiss company is covered by the adequacy decision for Switzerland under Art. 45 GDPR.
Storj (United States company; storage in the EU) — a nightly copy of our server backups, including the helpdesk with support correspondence, is uploaded through Storj’s hosted gateway, which encrypts it on Storj’s side with keys handed to Storj, so Storj can access the data in readable form there; the location of that gateway is not verified. The encrypted pieces are stored on storage nodes in the EU, because our bucket is placed in Storj’s EU region. As Storj is a US company with access to the data, this is a transfer to a third country. No data processing agreement and no Standard Contractual Clauses with Storj are in place at the date of this Policy, and we do not rely on an adequacy decision for it. A request to Storj for a data processing agreement, the EU Standard Contractual Clauses (Module Two) and the UK Addendum was prepared on 14 October 2026.
RevenueCat, Inc. (United States) — EU Standard Contractual Clauses under RevenueCat’s published DPA framework, plus encryption in transit and at rest and pseudonymous app user IDs. No payment-card data is involved: Apple processes the payment.
Google Ireland Ltd. / Google LLC (United States) — EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum and Google’s participation in the EU-US Data Privacy Framework.
GitHub, Inc. (United States) — Standard Contractual Clauses under the Microsoft/GitHub data protection terms.
Apple — independent controller; intra-group transfers under Apple’s own safeguards.

The controller itself is established outside the EEA. Processing carried out by us therefore takes place outside the EEA, and we apply the GDPR standard to it as the global baseline described in § 1.2. For transfers not covered by an adequacy decision, other than Storj (see above), we rely on Standard Contractual Clauses, apply Chapter V safeguards and assess the recipient country’s law before engaging a processor.

8. Retention

Data	Kept
Player name and its creation date	Until you ask us to delete it
Score records on the leaderboard	Until you ask us to delete them
Server logs	30 days, then deleted
Purchase and entitlement records (with RevenueCat and Apple)	For the life of the entitlement; tax-relevant records up to 10 years (statutory tax and accounting retention)
Support correspondence	3 years from closure
Records of data protection requests	6 years from closure, Art. 5(2) GDPR accountability
Google Analytics data	14 months

Deletion is a real deletion, not a flag. What we retain because the law requires it is restricted to that purpose — see the data deletion page.

8a. Health data

None. Snapshots reads no HealthKit data, writes none, and offers no health or fitness feature. Art. 9 GDPR is not engaged.

8b. Access to information on your device

Independently of data protection law, § 25(1) TDDDG and Art. 5(3) of Directive 2002/58/EC require your consent for storing information on your device or reading information already stored there — whether or not it is personal data.

What	Where	Basis
Local game database — player record, solved puzzles, images, settings	App	Strictly necessary, § 25(2) no. 2 TDDDG
Google Analytics cookies	Website	Consent, § 25(1) TDDDG
Cookie-choice, language and theme entries in local storage	Website	Strictly necessary, § 25(2) no. 2 TDDDG

No advertising identifier is read, on either surface.

9. Data security

TLS in transit; encryption at rest for database and object storage
Access control on the principle of least privilege; administrative access with multi-factor authentication
Documented incident response under our internal breach response plan (Art. 33/34 GDPR)
Coordinated vulnerability disclosure, published at the security page and machine-readable in /.well-known/security.txt

No system is completely secure and we do not claim absolute security.

9.1 Breach notification

Where a personal data breach is likely to result in a high risk to your rights and freedoms (Art. 34 GDPR), we notify affected users without undue delay. Because Snapshots holds no email address, a general communication on this website is the route by which we can reach you, and it will name the nature of the breach, the categories of records concerned, the likely consequences, the measures taken, and a contact for further information.

10. Your rights

Wherever you live, you can exercise at least: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent at any time and as easily as it was given (Art. 7(3)), and a complaint to a supervisory authority.

10.2 What your jurisdiction adds

Several jurisdictions grant rights beyond this floor, or attach different deadlines, appeal routes and named officers. § 17 is the single place where those are stated. Nothing in § 17 reduces the floor above.

10.3 How to exercise any of them

Write to data-protection@digitalfreedom.co.za or use the form at https://data-protection.digitalfreedom.co.za. Because Snapshots holds no email address, tell us the player name so we can find your records. We respond within one month (Art. 12(3) GDPR), or within the shorter period your jurisdiction prescribes.

11. Children’s privacy

Snapshots is a general-audience game and is not directed at children. The age at which a child can consent to data processing is set nationally between 13 and 16 (Art. 8(1) GDPR), so this Policy states no single number. We do not knowingly collect data from a child below the applicable age; if we learn that we have, we delete it promptly. If you are a parent or guardian and believe your child has entered a player name, write to data-protection@digitalfreedom.co.za and we will remove it.

12. Cookies and tracking

Described separately in the cookie policy, which covers the website. The app sets no cookies and contains none of the tags listed there.

13. Automated decisions and AI

13.1 Automated decision-making

We make no automated decisions producing legal effects concerning you or similarly significantly affecting you (Art. 22 GDPR). The leaderboard is a sorted list of scores, not a decision about a person.

13.2 AI in Snapshots

The puzzle words and the three hint images per puzzle are generated with artificial intelligence — OpenAI GPT-4o for the words and their translations, gpt-image-1-mini for the images — in a scheduled job on our servers, before the puzzle reaches any player. Two consequences:

Every image you see in Snapshots is AI-generated content, not a photograph of a real scene. This disclosure is made in the spirit of Art. 50 of the AI Act (Regulation (EU) 2024/1689), which governs transparency about synthetic content.
Nothing you do goes to OpenAI. Your player name, your scores, your answers and your messages are never transmitted to an AI provider, and none of your data is used to train a model.

13.3 Marketing

We send no marketing email and no marketing push notification. There is no newsletter and no mailing list.

14. Third-party links

The Services link to third-party sites — the App Store, the sub-processors’ own policies, standards bodies. We are not responsible for their privacy practices.

15. Changes to this policy

We may update this Policy. Material changes are announced through the Services and, where a change requires your consent under applicable law, we obtain that consent before the change applies to you — continued use alone is never treated as consent. The “Last updated” date at the top reflects the latest revision.

16. Contact

DigitalFreedom Global LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States

Data protection: data-protection@digitalfreedom.co.za · https://data-protection.digitalfreedom.co.za
General: hello@digitalfreedom.co.za
Support: https://support.apps.digitalfreedom.co.za

If you are in the EU/EEA you may also contact the supervisory authority of your country.

17. Regional provisions

What each jurisdiction adds to the baseline. § 10.1 states the floor that applies everywhere; nothing below reduces it. All requests: data-protection@digitalfreedom.co.za or https://data-protection.digitalfreedom.co.za.

17.1 European Union and EEA

Processing complies with the GDPR, which applies in Norway, Iceland and Liechtenstein through the EEA Agreement.
No lead supervisory authority applies. The Controller is not established in the Union, so the one-stop-shop under Art. 56 GDPR does not apply.
You may lodge a complaint with the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR) — in the EEA states, Datatilsynet (Norway), Persónuvernd (Iceland) or the Datenschutzstelle (Liechtenstein).
Data protection impact assessments are carried out where Art. 35 requires them.
On the age of digital consent, which Member States set between 13 and 16, see § 11.

17.2 United Kingdom

The UK GDPR and the Data Protection Act 2018 apply. The supervisory authority is the Information Commissioner’s Office (ICO), https://ico.org.uk.

17.3 Switzerland

The revised Federal Act on Data Protection (revFADP) applies to processing that has an effect in Switzerland, regardless of where the Controller sits. The GDPR baseline of this Policy covers its substance.
Right to information (Art. 25 revFADP): substantially the access right of Art. 15 GDPR; we answer within 30 days.
Breach notification (Art. 24 revFADP): owed to the FDPIC as soon as possible; our plan runs on the shorter of the applicable periods, so the 72-hour GDPR clock governs in practice.
Competent authority: the Federal Data Protection and Information Commissioner (FDPIC).

17.4 United States

The state-law common core. The comprehensive state statutes (Virginia, Colorado, Connecticut, Texas, Oregon and the wider family) grant substantially the rights in § 10.1 and add two things:

Appeal. If we deny your request you may appeal to us; our appeal response tells you how to complain to your State Attorney General. Exception: Utah, whose statute provides no appeal process.
Deadlines. We respond within 45 days, extendable once by a further 45 with notice. Exception: Iowa, where the statute allows 90 days plus a 45-day extension — in practice we apply the shorter period.

Biometrics (Illinois BIPA). No biometric identifier is collected. Snapshots uses neither Face ID nor Touch ID.

Consumer health data (Washington, Nevada). Snapshots processes no health data, so the My Health My Data Act and the Nevada equivalent are not engaged and no separate consumer-health-data policy is published.

“Do Not Sell or Share” link. Not required: nothing is sold, and nothing is shared for cross-context behavioural advertising. If that ever changes, the link becomes mandatory and will appear.

California — notice at collection (CCPA/CPRA)

Provided to California residents at or before the point of collection, as required by Cal. Civ. Code §§ 1798.100(a) and 1798.130(a)(5)(A). The full policy this notice belongs to is at https://snapshots-quiz.app/privacy/.

Category (CCPA § 1798.140(v))	What we collect	Purpose	Disclosed for a business purpose?	Sold or shared?
A. Identifiers	Player name; IP address; pseudonymous app user ID for the purchase	Leaderboard, delivery, security, entitlement	Yes — to the processors in § 6.1	No
B. Customer records	Purchase state (unlocked / not unlocked)	Restoring your purchase	Yes — RevenueCat, Apple	No
C. Protected classifications	None	—	—	—
D. Commercial information	The one-time in-app purchase	Service delivery	Yes — Apple, RevenueCat	No
E. Biometric information	None	—	—	—
F. Internet or network activity	Requests to our backend; website page views after consent	Delivery, security, aggregated measurement	Yes — Civo, Google (website only)	No
G. Geolocation	None. IP address is processed for delivery and security, not to locate you	—	—	No
H. Sensory information	None	—	—	—
I. Professional information	None	—	—	—
J. Education information	None	—	—	—
K. Inferences	None	—	—	—
L. Sensitive personal information	None	—	—	—

We have not sold or shared the personal information of California residents and do not intend to. Retention is as stated in § 8. Your rights — know, delete, correct, portability, non-discrimination — are exercised at data-protection@digitalfreedom.co.za; we verify requests proportionate to risk and respond within 45 days, extendable once by 45 with notice. An authorised agent is accepted with proof of authorisation.

Shine the Light (§ 1798.83): we disclose no personal information to third parties for their direct-marketing purposes; the annual answer is “none disclosed”. Global Privacy Control is honoured as a valid opt-out signal; because we neither sell nor share, it changes nothing in practice, but it is acknowledged. Complaints: California Privacy Protection Agency, 2101 Arena Boulevard, Sacramento, CA 95834, https://cppa.ca.gov/webapplications/complaint, or the California Attorney General.

17.5 Canada

Consent (PIPEDA Principle 3): express consent where information is sensitive or the purpose is not obvious; implied consent where it is obvious and not sensitive. Withdrawal at any time, subject to legal or contractual restrictions and reasonable notice.
Your rights: access and a copy, accuracy challenge and correction, withdrawal of consent, and complaint to the Office of the Privacy Commissioner of Canada, https://www.priv.gc.ca. We respond within 30 days (PIPEDA § 8(4)).
Quebec (Law 25): the person responsible for the protection of personal information is Marcel R. G. Berger, data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. A privacy impact assessment precedes any transfer of Quebec residents’ information outside Quebec; the destinations used are the UK and Switzerland (adequate) and the United States under Standard Contractual Clauses. You may request your data in a structured, commonly used technological format, and you are informed of any decision based exclusively on automated processing — we make none. A French version of this Policy is published at https://snapshots-quiz.app/fr/confidentialite/.
CASL: we send no commercial electronic messages at all.
Provincial laws (BC PIPA, Alberta PIPA) apply where more protective; complaints also to the OIPC BC and OIPC Alberta.

17.6 Australia and New Zealand

Australia: the Privacy Act 1988 and the Australian Privacy Principles apply to an overseas entity carrying on business in Australia. APP 12 sets a 30-day response period for access. APP 8 makes us accountable for an overseas recipient’s handling of your data — which is part of why every recipient is named in § 6. Complaints: Office of the Australian Information Commissioner (OAIC).
New Zealand: the Privacy Act 2020 applies to an overseas agency carrying on business in New Zealand. IPP 12 restricts disclosure outside New Zealand; access requests are answered within 20 working days. Complaints: Office of the Privacy Commissioner (NZ).

17.7 Brazil (LGPD)

Encarregado (Art. 41 LGPD): Marcel R. G. Berger, data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. This Policy is the publication of those contact details that ANPD Resolution CD/ANPD No. 18/2024 requires.
Legal bases (Art. 7): contract performance (V) for the game, the leaderboard and the purchase; legal obligation (II) for the retention duties binding the Controller; legitimate interest (IX) for security and defect analysis; consent (I) for website analytics.
Your Art. 18 rights: confirmation, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, deletion of consent-based data, information about sharing and about the consequences of refusing consent, and revocation of consent. We respond within 15 days (Art. 19 § 3).
Transfers (Art. 33): adequacy for the UK and Switzerland, contractual safeguards for the US legs.
Children (Art. 14): processing a child’s data under 12 requires specific and prominent parental consent; we operate no such mechanism and therefore do not knowingly process such data.
Incidents (Art. 48): the ANPD and affected data subjects are notified; our target is 72 hours. Complaints: https://www.gov.br/anpd. A Portuguese version of this Policy is published at https://snapshots-quiz.app/pt/privacidade/.

17.8 India (DPDP Act, 2023)

DigitalFreedom Global LLC is the Data Fiduciary and is not designated a Significant Data Fiduciary.
Consent (§ 6): free, specific, informed, unconditional and unambiguous, by clear affirmative action, and withdrawable as easily as given.
Your rights (§§ 11–14): access to what is processed and with whom it is shared; correction, completion and erasure; grievance redressal; and nomination of another person to exercise your rights in case of death or incapacity.
Grievance Officer (§ 8(10), IT Rules 2021): Marcel R. G. Berger, data-protection@digitalfreedom.co.za. Acknowledgement within 24 hours; resolution within 15 days, extended to 30 for complex grievances with an explanation. Escalation: the Data Protection Board of India, once constituted.
Children (§ 9): data of a person under 18 is processed only with verifiable parental consent; no tracking, behavioural monitoring or advertising is directed at children — none is directed at anyone.
Transfers (§ 16): permitted except to destinations notified as restricted; none of the destinations used is currently restricted.

17.9 Japan (APPI)

The APPI applies to a foreign operator that acquires personal information in connection with supplying services to persons in Japan; Snapshots is therefore covered.
Purpose specification: the purpose of use is specified as narrowly as possible and published here. A change of purpose is limited to what remains relevantly connected to the original purpose; anything larger requires fresh consent.
Provision to a third party in a foreign country: no user data is provided to a third party for its own purposes. The processors in § 6.1 act on our instructions; the countries concerned are the United Kingdom, Switzerland and the United States, and the safeguards are stated in § 7.
Publicly available matters (Art. 32): the operator’s name and address, the purposes of use, the procedure for disclosure requests and the complaint contact are in this Policy and the imprint. Representative: Marcel R. G. Berger.
Breach reporting: for reportable categories, a preliminary report to the Personal Information Protection Commission within roughly 3–5 days and a final report within 30 days (60 where wrongful access caused the breach).
No advertising email is sent, so the 特定電子メール法 regime is not engaged.

17.10 Korea (PIPA)

PIPA applies to a foreign operator processing personal information while offering services to data subjects in Korea; Snapshots is therefore covered.
Itemised, separated consent: where consent is the basis, it is obtained separately per item, with required and optional items distinguished, and refusing an optional item never blocks the service.
Cross-border transfer: the recipients, destination countries, items transferred and purposes are set out in §§ 6 and 7 of this Policy.
Under 14: processing a child’s data requires the legal representative’s consent. Snapshots is not directed at children; § 11 applies.
Response period: access, correction, deletion and suspension requests are acted on within 10 days, or you are told the reason and the schedule. That is shorter than the GDPR month, and the shorter period governs.
Breach: affected users are notified without delay; above the statutory scale the Personal Information Protection Commission is notified within 72 hours.

17.11 Türkiye (KVKK)

The KVKK (Law No. 6698) resembles the GDPR in concept but leans harder on explicit consent as the general basis; each activity is assessed against Turkish law separately.
Transfers abroad rest on the safeguards in § 7 and, where required, on your explicit consent given after disclosure of the transfer.
Response period: 30 days. You may complain to the Kişisel Verileri Koruma Kurumu after applying to us first — within 30 days of our response or 60 days of your application.

17.12 South Africa (POPIA)

POPIA § 3(1) applies to a responsible party domiciled in the Republic, or to processing by means located there. Neither is the case: the Controller is domiciled in Wyoming and processes on servers in London, with an off-provider backup copy of support correspondence on Storj storage nodes in the EU (§ 7). A .co.za domain name is a name, not a processing means, so the Act does not apply on the present facts. POPIA-style enquiries are nonetheless answered through the same channels and on the same clock as everywhere else — a service commitment, not an admission that the Act applies. Two points where POPIA would differ from the GDPR floor, stated rather than papered over: it treats everyone under 18 as a child, and § 22(1) requires breach notification without the GDPR’s high-risk threshold; our breach plan operates on the GDPR standard. The Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, https://inforegulator.org.za.

17.13 All other countries

Everywhere the App Store distributes and no section above applies: the GDPR baseline of this Policy is your floor (§ 1.2), any more protective mandatory local law prevails over it, and every request goes to data-protection@digitalfreedom.co.za or https://data-protection.digitalfreedom.co.za.

Privacy policy