Privacy Policy for Murlan

Effective Date: August 27, 2026 | App: Murlan (com.murlan.app)
Data Controller: Kevin Licenji — Milan, Italy | Email: support@murlangame.com

1. Data We Collect

Data Category	Purpose	Legal Basis (GDPR)	Retention
Email Address	Account verification, password reset, authentication	Performance of contract (Art. 6(1)(b))	Until account deletion
Username	In-game identification and profile display	Performance of contract	Until account deletion
Account ID (UUID)	Session management and anonymous telemetry	Legitimate interest (Art. 6(1)(f))	Until account deletion
Social Sign-In IDs	Authentication via Google / Apple Sign-In	Performance of contract	Until account deletion or unlinking
Room Codes & Match State	Room lifecycle and multiplayer synchronization	Performance of contract	Cleared within 24 hours of match completion
In-Game Chat Messages	Real-time messaging (in-memory buffer, max 100 msgs)	Performance of contract	Destroyed on room close; never stored to disk
Blocked Players List	Preventing unwanted communications	Legitimate interest	Until unblocked or account deletion
Crash Reports (Sentry)	Bug tracking and stability improvements	Legitimate interest	90 days in Sentry; no card or chat data

We do not collect: real names, phone numbers, GPS location, device contacts, payment details, or advertising identifiers (IDFA/GAID).

2. Third-Party Services & Sub-Processors

Apple Inc. (USA / EU): Authentication via Sign in with Apple.
Google LLC (USA): Authentication via Google Sign-In.
Oracle Cloud Infrastructure (Frankfurt, EU): Backend API server hosting and PostgreSQL database.
Resend, Inc. (USA): Transactional email delivery (operating under EU Standard Contractual Clauses).
Functional Software, Inc. / Sentry (USA): Crash reporting and diagnostics (operating under EU Standard Contractual Clauses).

We do not sell, rent, or trade your personal information with third parties for marketing or advertising purposes.

3. Sentry Data Scrubbing

All telemetry sent to Sentry passes through a client-side beforeSend sanitization hook. Crash reports never include player cards/hands, private chat messages, passwords, authentication tokens, or email addresses. Only an opaque account UUID is attached for crash grouping.

4. User Rights & Account Deletion

Under GDPR and applicable laws, you have the right to access, rectify, export, or erase your personal data.

In-App Deletion: You can permanently delete your account and all associated data inside the app via Settings → Account → Delete Account.
Manual Request: You can also email us at support@murlangame.com. Deletion requests are processed within 30 days.
You have the right to lodge a complaint with your local Data Protection Authority (in Italy: Garante per la protezione dei dati personali).

5. Children's Privacy

Murlan requires players to be at least 13 years of age. We do not knowingly collect personal information from children under 13. Contact support@murlangame.com to report underage accounts.

6. Changes to This Policy

Substantial modifications will be announced via an in-app notice at least 14 days prior to taking effect.