CheckMess · Your data in the game
CheckMess app privacy policy
Version dated 26 September 2026
1. Scope
This policy covers CheckMess on iOS and Android and its services: player accounts, online saves, multiplayer matches, friends, messaging, in-app purchases and support. Available features may vary by platform, version and the player's age.
Browsing checkmess.com, its contact form and signing up for the launch announcement are covered by the separate “Website privacy” policy: checkmess.com/en/privacy/.
2. Controller and contact
The data controller is Equaviz OÜ, a company incorporated under Estonian law, registered under number 17542633, with its registered office at Harju maakond, Tallinn, Lasnamäe linnaosa, Lõõtsa tn 5, 11415, Estonia.
For any question or request about your data: [email protected]. You may also write to the postal address above, marking your correspondence “CheckMess data protection”.
3. Data processed and how it is used
Account and sign-in
We process your email address, account identifier, username and the information needed for sign-in, account recovery and session security. Required information is identified when you enter it; without the data needed for an account, its associated online services cannot be provided.
If you choose to sign in with Google or Apple, that provider sends the information authorised for authentication. Google may, in particular, send a name and a reference to a profile photo, in addition to an email address and provider identifier. Apple may send a relay address when you hide your email. We do not receive your Google or Apple password. The name and photo from your sign-in provider are not automatically published in your game profile.
Profile, saves and matches
We store your game profile, the avatar you choose in the game, decks and their names, synchronised progress, completed tutorials, match results and histories, rating, inventory and mana wallet. This data is used to run the game, save progress, find opponents and assign results and rewards.
Your username, avatar and the game information provided for by the features you use may be visible to other players, notably in a match or leaderboard. Your sign-in email is not public profile information.
Some preferences and saves remain on your device, including certain settings and solo games. Not all local data is synchronised. Information used to keep you signed in is stored using the platform's protection mechanisms.
Friends and messaging
We store invitations, relationships between friend accounts and information needed for friendly duels. This list is created within CheckMess: we do not import your phone's address book.
We store message content, dates, senders and recipients to enable conversations and allow them to be viewed. Messages are intended for the participants concerned. This is not an end-to-end encrypted messaging service: people authorised to handle security, moderation or support may access information necessary for their intervention.
Blocking and reporting help protect players. A report may lead to the retention of information needed to investigate it. Avoid sending sensitive data, passwords or sign-in codes in chat or to support.
In-app purchases
Your platform's store processes the payment. We process product and transaction references, technical proof of purchase, purchase status and the beneficiary account. We keep records of mana movements and associated entitlements to deliver content, prevent duplicate grants, handle incidents and prevent fraud.
We do not receive your full payment card number or banking credentials. The store country and currency may be used to display and verify the local offer; they are not a measurement of your GPS location.
Technical operation and security
The game and its infrastructure process technical information necessary for communication and diagnostics: IP addresses during connections, sign-in events and errors, technical request or session references, game version, platform, technical device characteristics and operational measurements.
Purchase components may also process installation, device, session, country or transaction information necessary for their services. This information is used to provide purchases, ensure service compatibility and reliability, and prevent abuse.
We do not use players' data to display targeted advertising or build advertising profiles across apps. We do not sell their data. The graphics and 3D modelling tools used during development do not receive players' accounts, messages or matches in the normal operation of the game.
Support
When you contact [email protected], we receive your email address and the information you choose to send. Messages are hosted by IONOS and accessible to the person responsible for support at Equaviz OÜ. The support mailbox is not forwarded to another email service.
Preparing an email from within the game does not send it automatically: you send it from your email app. You may choose to add diagnostics including, in particular, the game version, platform, device model, display, performance and game state. When sent by email, these diagnostics are associated with your support request, even if they do not themselves contain your account identifier.
Creating an account or contacting support does not subscribe you to a marketing list.
4. Legal bases
Processing necessary for your account, the game features you request, saves and purchase delivery is based on the performance of the contract to provide the service.
Protecting the service, preventing fraud and abuse, handling incidents and certain support interventions are based on our legitimate interest in providing a reliable service and protecting players, while respecting their rights.
Retention of accounting documents and responses to certain requests from authorities are based on our legal obligations. Where consent is required, it is requested separately and may be withdrawn. Reading this policy does not constitute blanket consent to all processing.
5. Providers, components and recipients
Only authorised people at Equaviz OÜ and providers needed for their respective tasks have access to the relevant data. The main parties involved are:
| Party | Role and data concerned |
|---|---|
| Supabase | Authentication, databases and storage of accounts, profiles, friendships, messages and game data. |
| Render | Hosting of game server and purchase validation services; requests, data needed for matches and operational logs. |
| Resend | Delivery of service emails, including sign-in and verification emails; recipient address, content and delivery information. |
| IONOS | Hosting of support email; email addresses, messages, attachments and technical email data. |
| Apple and Google | Authentication when you choose their sign-in services; management of payments and transactions on their respective stores, depending on the features offered. |
| Unity | Provision of the engine and in-app purchase components; technical processing of purchases and diagnostics necessary for the services used. Unity does not host CheckMess accounts or messages. |
Providers acting on our behalf are subject to our instructions and the data protection obligations applicable to their services. We ensure that third parties to whom we transmit data provide protection at least equivalent to that described in this policy. Apple and Google also process certain data for their own services under their policies. Providers' access rights are limited to what the services concerned require.
When you open our website from the game, its host, Cloudflare, processes the browsing request under the website policy. The link does not automatically include your CheckMess account information.
We may disclose data to authorities when a legal obligation or legally founded request requires it, and to relevant professional advisers when necessary to defend our rights. These accesses are limited to relevant information.
6. International processing and safeguards
Our providers may process data in the European Economic Area and other countries, including the United States. A server being located in Europe does not rule out technical access or international processing necessary for the service.
Where a transfer subject to European rules is made to a country without an applicable adequacy decision, it is covered by the safeguards required by those rules, notably the European Commission's standard contractual clauses and, where necessary, supplementary measures. Applicable UK and Swiss safeguards are taken into account for the transfers concerned.
You can obtain information about processing locations and relevant safeguards, or request a copy, at [email protected]. Providers' documents are available, in particular, at the following addresses:
- Supabase: supabase.com/legal/dpa
- Render: render.com/dpa
- Resend: resend.com/legal/dpa
- IONOS: www.ionos.fr/terms-gtc/
- Unity: unity.com/legal/privacy-policy
- Apple: www.apple.com/legal/privacy/
- Google: policies.google.com/privacy
7. Retention periods
| Category | Period and action on expiry |
|---|---|
| Account, profile, progress, decks, inventory and friendships | For the lifetime of the account. After 24 months without signing in, a 30-day deletion notice is given. Signing in again within that period cancels the inactivity procedure. |
| Match histories and statistics linked to the account | For the lifetime of the account, then erased or irreversibly anonymised when it is deleted. Statistics retained in a genuinely anonymous form no longer allow the player to be identified. |
| Ordinary chat messages | 12 months from sending, or earlier as part of account deletion. Information needed for a report follows the separate period below. |
| Reports and moderation material | Until closure, then 12 months, unless a justified need arises from a dispute or legal obligation. |
| Supporting accounting documents | 7 years from the end of the financial year in which they are recorded, in accordance with applicable Estonian obligations. Only necessary data is archived with restricted access; this does not justify keeping the entire account or its game history. |
| Technical logs retained under our control | No more than 30 days. Extracts necessary to analyse a security incident may be isolated until it is resolved, then for no more than 90 days after resolution, unless a legal obligation or documented dispute requires otherwise. |
| Support correspondence and diagnostics sent to support | While the request is handled, then 12 months after closure, unless a legal obligation or documented dispute requires otherwise. |
| Backups we create | Rotation over no more than 30 days. Erased data disappears by the end of this cycle at the latest; a restore reapplies deletions made since the backup. |
| Minimum parental authorisation information and evidence | While that authorisation is necessary, then deleted with the account or when no longer needed, subject to a justified obligation to retain evidence. Identity documents that may be used for verification are not stored in the player's profile. |
Logs and backups managed directly by providers also follow their service cycles and their own obligations. Their retention periods may be shorter than our maximum periods. Information held by Apple or Google for their own services is governed by their respective policies.
Exceptional retention related to a dispute or legal obligation is limited to necessary data, with restricted access and reassessment when that need ends. Moving a match to a technical archive is not erasure.
8. Rights, export and deletion
Subject to applicable legal conditions, you have rights of access, rectification, erasure, restriction and portability. You may object to processing based on our legitimate interest and withdraw consent where it is the basis for processing. Withdrawal does not affect the lawfulness of processing already carried out.
To exercise your rights, email [email protected]. We may request only the information necessary to verify your identity proportionately. We generally respond within one month; any extension permitted by law will be explained to you within that period.
The My account → My data section lets you export certain game data. The file does not necessarily include data stored only on your device or all support correspondence. It does not limit your right to request a more complete copy.
You can request deletion of your account directly in the game under My account → My data → Delete my account, with confirmation and, where necessary, identity verification. You may also email [email protected].
Deletion ends access to the account and leads to erasure or irreversible anonymisation of its associated data, except information that must be retained by law. It covers profiles, social relationships, relevant messages, online saves and player references in histories and archives. Backup copies expire according to the cycle described above. The request is processed within one month, subject to a legally justified and notified extension.
The confirmation screen explains the loss of access to progress and account items, including remaining mana. Deletion is not in itself a refund request; your statutory rights and the store's procedures remain applicable. It does not delete your Apple or Google account. Uninstalling the game does not automatically delete your CheckMess account.
You may contact the Andmekaitse Inspektsioon in Estonia, www.aki.ee/en, or the competent authority in your country, including the CNIL in France, www.cnil.fr. Where the law permits, an authorised representative may exercise your rights on your behalf.
9. Children and supervised accounts
CheckMess is aimed at players aged 9 and over. A store's content age rating does not replace online service access requirements or personal data protections.
For players aged 9 to 15, a supervised account and verified parental authorisation are required before online services are activated. The process explains to the parent what data is collected, its uses and recipients, and how to exercise their rights. The child's agreement is also obtained where required by law. Children under 9 cannot create a CheckMess account.
Verification uses only the information necessary to establish age and authorisation: an age band or information to establish it, the parent's contact address and minimal proof of authorisation. No targeted advertising is enabled for children. Interactions with other players and purchases are subject to the protections and parental controls of the process provided.
The parent may view information about the supervised account, withdraw authorisation and request erasure by contacting [email protected] or using the account management tools. Without verifiable authorisation where it is required, the services concerned are not activated, and information collected solely for an unsuccessful authorisation request is deleted after no more than 30 days.
10. Security and changes
We implement appropriate measures to control access, protect communications and limit the data used. Administrative and support interventions are restricted to authorised people. No measure can, however, guarantee absolute security.
This policy may change as features or our obligations evolve. The version shown at the top of the page identifies the applicable text. Appropriate notice is given of any material change; fresh consent is requested where necessary.