Privacy Policy
How CHANCE handles your information, photos and privacy requests.
01Who we are / Legal notice
CHANCE is operated by Hajiyev Davud, Volmerswerther Str. 35, 40221 Düsseldorf, Germany. In this Policy, “we”, “us” and “our” refer to this operator, who is responsible for the processing described below.
This Policy covers the CHANCE mobile app, the CHANCE website and our support service. For privacy questions or requests, contact chance@chance.stream.
02Account and gameplay information
We process your email address, account ID, username, date of birth and sign-in information to create and secure your account and check age eligibility. Your date of birth is not part of your public player profile.
We also process your profile picture and selected cosmetics; mission attempts, submitted photos, results, timing, progress and rewards; friend requests and connections; invitations; rankings; and event participation, viewing access and votes. We store settings such as language, time zone, notification preferences and quiet hours.
Our infrastructure processes IP addresses, connection and request metadata, timestamps, delivery status and operational errors to deliver the service, diagnose failures and prevent abuse. These technical records are separate from advertising or behavioural analytics.
03Photos and automated mission checks
When you submit a photo for a mission, CHANCE uploads it to private storage and checks it against the mission requirements. For automated photo checks, the image and the relevant requirements are sent to OpenAI. The verification request does not deliberately include your account email or date of birth, but anything visible in the photo is part of the image sent for checking.
The verifier is instructed to assess the mission rather than identify people. Its result can affect whether an attempt succeeds and whether an attempt is used. Ambiguous or technical results can be referred for review. Automated checks can be wrong; contact support@chance.stream if you want us to review a result.
Only submit photos you have the right to share. Avoid including private documents, other people’s personal information or unnecessary sensitive details.
We use a mission photo in CHANCE advertising only if you give separate, optional consent for that use. The consent request will identify the photo, intended channels and duration of use. Refusing or withdrawing this consent does not affect your access to gameplay. You can withdraw it at any time using the withdrawal option provided with the consent request, or by contacting chance@chance.stream. We will stop future promotional use and remove the photo from promotional placements under our control; withdrawal does not make earlier consent-based use unlawful. Copies independently made or shared by others may remain outside our control.
The verification request disables stored response history. This does not disable all provider retention: OpenAI describes default abuse-monitoring retention of up to 30 days, with exceptions for legal and safety needs. OpenAI does not use API data for model training by default. In the organization reviewed for CHANCE, optional sharing of feedback, evaluation and fine-tuning data, and API inputs and outputs is disabled.
04Live events and information other players can see
When you choose to broadcast in a live event, your camera and microphone content is transmitted through our live-streaming infrastructure to authorised viewers and administrators. Connection and session information is also processed to manage access and troubleshoot delivery.
Your username, avatar, equipped cosmetics, visible Supporter status, results and other information shown in player cards, rankings or event screens can be seen by other players according to the relevant feature. Private mission-photo submissions are not automatically published as a public gallery.
Do not broadcast anything you do not want viewers to see or hear. Viewers may be able to capture what is shown on their devices.
We do not routinely retain full recordings of live broadcasts. The planned moderation process may retain selected video or audio excerpts to investigate reported or suspected violations and review related appeals. Access to these excerpts is limited to people and service providers who need it for that purpose. These excerpts are not used in advertising under this moderation purpose.
05Purchases and support
Apple or Google processes purchases made through its store. CHANCE receives and verifies information such as product and transaction identifiers, purchase verification data, the linked CHANCE account, subscription status, renewal status and access expiry. CHANCE does not receive your full payment-card details through this purchase flow.
If you contact support, we process your email, message, attachments, report category, account or report identifiers and our replies. In-app reports are stored in our support system and their message details are delivered to our support mailbox through Resend. Attachment files submitted in the app remain available to authorised staff through the support interface.
06Device permissions, invitations and local storage
Camera, photo-library and microphone permissions support photo submissions, profile pictures, attachments and live broadcasting. You can manage these permissions in your device settings; denying a permission may prevent the related feature from working.
If you enable notifications, we process notification delivery identifiers, installation identifiers, platform information and your notification settings. Google Firebase Cloud Messaging and Apple’s notification services deliver notifications to supported devices.
If you select a contact to invite, CHANCE uses the system contact picker and messaging or sharing interface. The selected phone number is used on your device; CHANCE does not upload your address book to its servers for this invitation flow. The messaging service you choose processes the message under its own terms.
The app stores sign-in session information, settings and cached progress locally. The current website does not include advertising or analytics scripts or a payment checkout.
CHANCE does not include in-app advertising, advertising trackers, behavioural analytics or a separate crash-reporting service. We use only technical logs needed to operate and secure the service. Separately consented use of a mission photo in external CHANCE promotion, described above, does not enable advertising tracking in the app.
The public website is served from our Hostinger infrastructure. To deliver pages securely, the server processes your IP address, requested URL and technical connection information. We do not enable website access logs or use cookies for advertising or analytics. Infrastructure security and error diagnostics may still be processed to operate and protect the server.
07Why we use information
We use information for the following purposes and, where the GDPR applies, legal bases.
Providing your account, photo missions, friends, rankings, event access, purchased benefits and requested support relies on performance of our contract with you (Article 6(1)(b)). We need the information necessary for these features to provide them; without it, the relevant feature may be unavailable.
Protecting accounts, preventing fraud and abuse, investigating violations, resolving disputes and operating necessary technical diagnostics relies on our legitimate interests in a safe and reliable service (Article 6(1)(f)), balanced against your rights. You may object to processing based on legitimate interests.
Optional promotional use of mission photos relies on your separate consent (Article 6(1)(a)). You may refuse or withdraw it without losing gameplay access. We also obtain consent for other optional processing where required. Device permission alone is not blanket consent to every use of data.
Keeping records required by tax, accounting or other applicable law and complying with binding legal requests relies on legal obligations (Article 6(1)(c)).
08Service providers and other disclosures
Supabase provides account authentication, databases, file storage and server functions. It processes account, gameplay, social, purchase, support and technical records needed for those services.
OpenAI processes mission images and requirements for automated verification. Resend processes sign-in and support emails, addresses, message content, attachments sent by email and delivery information. In-app report attachments stay in our private storage rather than being attached to the forwarded report email.
Hostinger hosts our public website, administration and live-streaming infrastructure, which handles authorised support access, live audio/video and connection data. LiveKit and our event-text translation software run on this infrastructure; using this software does not by itself send content to LiveKit Cloud or a third-party translation API.
Google Firebase Cloud Messaging and Apple notification services process delivery identifiers and notification payloads. Apple and Google process store purchases and provide transaction information to CHANCE. They also have independent responsibilities under their own privacy notices.
Cloudflare provides DNS for the CHANCE domain. This does not mean that CHANCE mission photos are sent to Cloudflare for analysis. The current website has no account form, payment checkout, advertising trackers or behavioural analytics.
Service providers receive information needed for their tasks and may use their documented subprocessors. We may also disclose necessary information to comply with law, protect users or handle a legal claim. We do not sell personal information or share it for cross-service targeted advertising.
09International processing and security
The primary Supabase database, authentication service and storage are hosted in Ireland (eu-west-1). This is not a promise that all processing stays in the EEA: infrastructure metadata, support access, edge execution and content delivery may involve other countries.
Resend stores customer email data in the United States, even when a European sending region is selected. Google notification infrastructure is global. The OpenAI project reviewed for CHANCE has Global residency. OpenAI and hosting providers may process data outside your country; we do not represent the service as EU-only or as having zero data retention.
For transfers requiring safeguards under the GDPR, the relevant provider data-processing terms include European Commission Standard Contractual Clauses; adequacy decisions may also apply where their conditions are met. Provider terms and subprocessor disclosures describe these arrangements. You can request information or copies of relevant safeguards from chance@chance.stream, with confidential information redacted where necessary.
We use encrypted connections, access controls and restricted administrative access. These measures reduce risk but cannot guarantee absolute security.
10How long information is kept
We retain information only as needed for the purposes described in this Policy, subject to justified legal retention and specific disputes.
Mission photos are scheduled for deletion after 7 days for resolved submissions and after 30 days for pending or review submissions, measured from the latest recorded review or, if none, submission creation. Cleanup runs daily; deletion is not an instantaneous action at the exact cutoff. Unsubmitted uploads are scheduled for removal 7 days after the attempt is created. Mission-result records are separate from the image files. These periods govern CHANCE mission storage; service providers may have separate retention rules.
Our planned retention limits are up to 12 months after case closure for support records and attachments held by CHANCE, and up to 30 days for ordinary technical logs. These controls are being prepared for launch; complete enforcement has not yet been verified. A provider may erase its copy sooner; these limits do not promise a 12-month email archive. If particular material is needed for a specific legal obligation or dispute, we retain only the necessary records for that purpose and limit access.
Selected live video or audio excerpts are retained only as long as needed to investigate the relevant violation and resolve related appeals, unless a specific legal obligation or dispute requires longer retention. A copy used in promotion with separate consent follows the duration stated in that consent and the withdrawal process in this Policy; the ordinary mission-photo period does not describe promotional copies.
Under the planned account-deletion process, account, profile, gameplay and social records will be kept while the account remains active and during the 30-day recovery period following an account-deletion request. After that period, we will delete or irreversibly anonymise the associated personal information, except for records needed for a specific legal obligation or dispute. Existing shorter retention periods continue to apply during the recovery period; restoration does not recover photos or logs already deleted under those rules.
Purchase verification records are needed to manage access, restoration, refunds and disputes. Only records that actually qualify for mandatory accounting or tax retention are kept for those legal periods: under German rules, generally 8 years for accounting vouchers, 10 years for books and accounting records, and 6 years for relevant business correspondence, calculated from the end of the relevant calendar year. Applicable extensions may apply. These periods do not justify retaining unrelated photos or all gameplay data.
The notification cleanup rules remove device registrations after 30 days without an update or when their linked sign-in session no longer exists. The in-app notification list is limited to 200 entries and 90 days; delivery deduplication keys are removed after 180 days. These rules do not delete Firebase installation IDs by themselves. Firebase documents removal from live and backup systems within 180 days after a valid installation-deletion request.
Provider copies and backups may expire later than active CHANCE records. Resend publishes a standard 30-day email/log window and 7-day backup retention. Its Inboxes product separately describes thread deletion as moving a conversation to Trash and permanently deleting it 30 days later, unless restored. We do not treat the general email window as proof that an active Inbox thread is automatically deleted after 30 days. Backup expiry and complete removal across our providers are still being verified for launch. We cannot yet promise a fixed maximum period for all residual backup copies. Contact us for the retention applicable to a specific request.
For the public website, HTTP access logging is disabled. Shared infrastructure diagnostics use size-based rotation; this is not a guaranteed 30-day deletion schedule. The planned technical-log limit above remains a launch task for the application infrastructure.
11Your rights and account deletion
Depending on the law that applies, you may request access to your personal information, correction, erasure, restriction or portability, and object to certain processing. Where processing relies on consent, you may withdraw it. You may also complain to your competent data-protection authority.
Send privacy requests to chance@chance.stream, preferably from the email linked to your CHANCE account. We may ask for information reasonably necessary to verify the request. Do not send passwords or sign-in codes. We respond within the applicable legal time limits.
The current development build does not yet provide working in-app account deletion or automatic 30-day recovery. You can send a privacy or deletion request to chance@chance.stream or support@chance.stream now; we will verify the request and explain the actions and timing.
We plan to enable in-app deletion with a 30-day recovery period starting when a verified request is accepted. The following recovery rules describe that planned process. During that period you can cancel the deletion request and restore the account. If you do not cancel, we permanently delete the account and delete or irreversibly anonymise its associated personal information, subject to the limited exceptions described under retention. After final deletion, the account cannot be restored. The recovery option does not limit your statutory erasure rights: contact chance@chance.stream if you request erasure without waiting for this optional recovery period.
Deleting the app from your phone is not the same as deleting your account. Account deletion does not itself cancel a store subscription; manage renewal through the store used to subscribe.
12Age, changes and contact
CHANCE is intended for people aged 13 and older. A higher minimum age or parent or guardian authorisation may apply under the law where you live. Where we rely on consent and the law requires a parent or guardian to give it, the relevant processing must not start until that authorisation has been obtained and appropriately verified.
If you believe a child below the applicable age is using CHANCE, or that information was collected without required authorisation, contact chance@chance.stream. We will review the matter and take appropriate steps, including restricting access or deleting information where required.
We may update this Policy when our practices or legal requirements change. The effective date will identify the current version. We will provide additional notice of material changes where required. Privacy contact: chance@chance.stream. App support: support@chance.stream.
Operator and privacy enquiries:
chance@chance.stream ↗App and purchase support:
support@chance.stream ↗