Legal document

Privacy Policy

Applies to the audio game The Blind Mage (mobile app for iOS and Android) and to the newsletter available at unlockedspark.org.
Effective date: 11 July 2026 · Last updated: 8 September 2026 · Version 1.4

In short: the game works without an account and without sign-in, and your progress and settings (language, volume, accessibility options) stay on your device. To fix bugs and improve the game we use anonymous usage statistics and crash reports. If you choose to support us, we process the data needed to handle your donation. On our website you can also voluntarily subscribe to our newsletter by providing your e-mail address. We do not sell data, show ads, or profile players.

1. General information

This privacy policy explains how data is processed when you use the audio game “The Blind Mage” (the “Game” or the “App”), an accessible and fully audio-playable adventure built for blind and low-vision players. The Game is provided free of charge; it exists to serve a social mission, not to generate profit.

We handle privacy in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the GDPR) and applicable Polish data-protection law. This document sets out what data is processed, for what purpose, on what legal basis, who it may be shared with, and what rights you have.

2. Data controller and contact

The controller of personal data processed in connection with the Game is:

The foundation is responsible for the Game and for the processing described in this document. We have not appointed a Data Protection Officer (DPO), as it is not required. For all data-protection matters please use the e-mail address above. We normally reply within a few working days.

3. What data we process

3.1. Data we do not collect

Using the Game requires no account and no sign-in. We do not ask for your name, address, phone number, or any directly identifying information. Your in-game progress and settings (chosen language, volume, accessibility options, haptics settings) are stored locally on your device only and are not collected by us or sent to any server.

3.2. Usage analytics

To understand how players use the Game and to keep improving it, we use analytics tools (e.g. Google Analytics for Firebase / Unity Analytics). The data collected is anonymous or pseudonymous and includes, among others:

• in-game events (e.g. starting and finishing a chapter, session frequency and length);
• technical device information: model, operating system and version, language, approximate region/country (derived from your IP address, which we do not retain in full);
• installation/app identifiers generated by the analytics tools.

We do not link this data to your identity, and we do not use it for automated decision-making or profiling that affects your legal situation.

3.3. Crash reports and diagnostics

When the Game closes unexpectedly or hits an error, a crash report may be sent (e.g. via Firebase Crashlytics / Unity Cloud Diagnostics). It contains technical data that helps us diagnose the problem: the error type and stack trace, device model, OS version and Game version, and app state at the moment of the crash. These reports are used to fix defects, not to identify individuals.

3.4. Donation-related data

The Game is free. If you voluntarily choose to support the project with a donation, the payment is made by bank transfer to the foundation's account. That means the transfer brings us the data your bank passes to a beneficiary: the name of the sender, the account number, the amount, the currency, the date and the payment reference. We do not receive your card details or your banking credentials.

We process that data in order to accept and account for the donation (Art. 6(1)(b) GDPR) and to meet our accounting and tax obligations (Art. 6(1)(c) GDPR), which is why we keep it for the period the law requires, as a rule five years from the end of the financial year. We use no payment gateways or other intermediaries, so we pass the data to nobody beyond the bank holding the account and, to the extent the law requires, our accountants and the tax authorities.

3.5. Newsletter (website)

At unlockedspark.org you can voluntarily subscribe to a newsletter about the foundation's work by providing your e-mail address in the signup form. We use the address solely to send the newsletter and do not link it to any Game data. Every message includes a link that lets you unsubscribe immediately.

Subscriptions and delivery are handled by Brevo (Sendinblue SAS, France), which processes the data on our behalf and stores it on servers within the European Union.

3.6. Website statistics (cookies)

At unlockedspark.org we use Google Analytics 4 to understand how visitors use the site and to improve it. The tool runs only with your consent, given via the cookie banner. Until you grant it, no statistics cookies are stored on your device. The data collected (pages visited, device and browser type, approximate region, among others) is pseudonymous and is not used by us to identify individuals; Google Analytics retains it for a maximum of 14 months. You can withdraw or change your consent at any time via the “Cookie settings” link in the site footer.

4. Purposes and legal bases

We process data only for defined purposes and on specific legal bases under Article 6 GDPR:

• Providing and running the Game: necessary to perform an action at your request (Art. 6(1)(b) GDPR).
• Statistics and analytics: your consent where required (Art. 6(1)(a) GDPR), or our legitimate interest in measuring and improving the Game (Art. 6(1)(f) GDPR).
• Crash reports: legitimate interest in ensuring the App’s stability and security (Art. 6(1)(f) GDPR).
• Handling donations: performing and settling the donation (Art. 6(1)(b) GDPR) and complying with legal, including accounting and tax, obligations (Art. 6(1)(c) GDPR).
• Newsletter: your voluntary consent, given by subscribing to the newsletter (Art. 6(1)(a) GDPR); you can withdraw it at any time.
• Website statistics: your consent given via the cookie banner (Art. 6(1)(a) GDPR); you can withdraw it at any time.
• Responding to requests and enquiries: legitimate interest in communicating with users (Art. 6(1)(f) GDPR).

5. Data recipients and processors

We do not sell personal data and do not share it for marketing purposes. Data may be entrusted to trusted service providers who process it on our behalf under data-processing agreements, including:

• Google Ireland Ltd. / Google LLC: Google Play distribution, analytics and crash reports (Firebase), and website statistics (Google Analytics);
• Apple Inc. / Apple Distribution International: App Store distribution and App Store analytics;
• Unity Technologies: analytics and diagnostics services for the App (where used);
• the bank holding the foundation's account: processing transfers, donations included;
• Brevo (Sendinblue SAS, France): newsletter subscriptions and delivery; data stored on servers within the European Union;
• hosting provider: running the project website.

Data may also be disclosed to authorised authorities where required by law.

6. Transfers outside the European Economic Area (EEA)

Some of the providers above (e.g. Google, Apple, Unity) are based in or process data in the United States or other countries outside the EEA. In such cases, transfers rely on safeguards ensuring an adequate level of protection under the GDPR, in particular the Standard Contractual Clauses approved by the European Commission and, where applicable, the EU–U.S. Data Privacy Framework.

7. Retention periods

• Game settings and progress: remain on your device until you uninstall the Game or clear its data; we have no access to them.
• Analytics and crash reports: for a period set by the tool provider’s policies (typically up to several months), after which they are deleted or aggregated.
• Donation data: for the period required by accounting and tax law (as a rule, 5 years from the end of the year in which it was settled).
• Newsletter e-mail address: until you withdraw consent (unsubscribe) or the newsletter is discontinued.
• Correspondence: for as long as needed to handle the matter and to demonstrate its resolution.

8. Your rights

To the extent we process your personal data, you have the right to:

• access your data and obtain a copy;
• rectify (correct) your data;
• erase your data (“right to be forgotten”);
• restrict processing;
• object to processing based on legitimate interest;
• data portability;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, write to kontakt@unlockedspark.org. You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw (uodo.gov.pl).

9. Consent and opt-out

You can limit or disable analytics data collection at any time:

• in the Game’s settings (where such a toggle is provided), and
• in your device’s system settings, e.g. “Reset/Limit advertising ID” on Android, and “Tracking” / “Analytics” (App Tracking Transparency) on iOS.

The Game shows no ads and runs no personalised marketing.

You can unsubscribe from the newsletter at any time, via the unsubscribe link in the footer of every message, or by writing to kontakt@unlockedspark.org. Withdrawing consent does not affect the lawfulness of e-mails sent before the withdrawal.

You can change or withdraw your consent to website statistics (Google Analytics) at any time via the “Cookie settings” link in the footer of unlockedspark.org.

10. App permissions

As an audio-first game for blind players, the App uses a minimal set of permissions:

• Vibration / haptics: to convey information through touch (spatial orientation, interface cues). This is a local device feature and does not involve any data collection.
• Network access: solely to send statistics/crash reports and to process a donation if you make one.

The Game does not access your contacts, precise location (GPS), microphone, camera, or photos.

11. Children

The Game is not directed at children and we do not knowingly collect children’s personal data. If you believe a child has provided us with personal data, please contact us and we will delete it promptly. Under the GDPR and Polish law, information-society services offered directly to children require a guardian’s consent for users under 16.

12. Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, or destruction, including encrypted connections (TLS) and the principle of data minimisation: we process only what is genuinely necessary. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. Changes to this policy

We may update this policy from time to time, for example due to changes in the Game, the tools we use, or the law. The current version will always be available at this address, with its effective date. We will communicate material changes appropriately (e.g. within the Game or on the project website).

14. Where to get the game and how to reach us

The Game is currently distributed as a demo through testing programmes: on Android via Google Play and on iOS via TestFlight. We post current information on where to get the Game at unlockedspark.org/en/projects.

For privacy and data-protection matters, write to: kontakt@unlockedspark.org.