Privacy policy

1Who we are

Rifilio (rifilio.com) is run by Nueltek Global Resources, Owerri, Imo State, Nigeria. We are the data controller for the personal data described here, under the Nigeria Data Protection Act 2023.

Questions about this policy or your data go to contact@nueltekglobalresources.com.

2What we collect

When you create an account

• Your email address, which signs you in with a one-time code. Other players never see it.
• If you continue with Google: your name, email address and Google profile picture address, which Google shares with your permission. We don't show the Google picture.
• The username, display name, colour and profile picture you choose.

When you play and talk

• Your games: the moves, clocks, results and who played whom.
• Your friends, friend requests, challenges and the people you block.
• Messages you send in a game, in a game's hall, and in chats with friends.
• Voice notes you record and send.
• For voice calls: when a call started and ended. Never what was said. See Voice calls and voice notes.
• Reports you make, and reports made about you.

Automatically

• When you sign in: your IP address and your browser's name and version, kept with your sign-in session. We use them to protect your account and to limit repeated sign-in attempts.
• Errors: when something breaks, we log what failed and where. Before anything is stored, we take out email addresses, ids, tokens and long numbers.
• Anonymous counts: how calls connect (direct or relayed, and how long it took), how voice notes play, and how games end. These counts carry no user ids, game ids or content.

On your device only

Your games against the computer opponents run in your browser and are saved there. They never reach our servers.

3What other people can see

• Signed-in players can see your username, display name, colour, profile picture, and your public games and their results.
• Games are public by default: any signed-in player can watch, and read the game's hall. A private game can only be watched by the people the players invite.
• Player chat in a game is seen only by the two players. A chat with a friend is seen only by the two of you.
• We don't read your messages. If someone reports a message or a voice note, our moderators see the reported content and enough around it to decide.
• People you have blocked can't watch your games or contact you.

4Voice calls and voice notes

Rifilio only uses your microphone after you press a button to call, answer or record, and your browser asks your permission first. Hanging up or finishing a note turns the microphone off.

• Calls connect the two players' devices directly when they can. On a direct connection, each device can see the other's IP address, as with any internet call. When a direct path isn't possible, the audio passes through a relay service (see Who helps us run it), encrypted so the relay can't listen. Nobody records calls: not us, and not the relays.
• Voice notes are stored on our servers so the other player can play them, and are deleted 30 days after they were sent.

5Why we use it

We use your data to:

• Run your account, your games, your chats and your calls. This is the service you asked for, so the legal basis is our agreement with you (the Terms).
• Keep Rifilio safe and working: stopping abuse and cheating, handling reports, limiting sign-in attempts, and fixing errors. The legal basis is our legitimate interest in a safe, working service.
• Email you sign-in codes, and, unless you turn them off, an email when a friend's challenge is waiting. Every challenge email has a link to stop them, and so does Settings.
• Meet our legal obligations, if a lawful authority requires it.

We don't sell or rent your data, we don't show ads, and we don't use your data to make automated decisions about you.

6Who helps us run it

These companies process data for us, only to provide their service, under their own data processing terms:

Some of these companies process data outside Nigeria, including in the European Union and the United States. For those transfers we rely on the safeguards in each company's data processing terms, as the Nigeria Data Protection Act allows.

7How long we keep it

When you delete your account

You can delete your account in Settings. You're signed out everywhere at once, and straight away we delete:

• your profile, picture and email address;
• your friends, friend requests and blocks;
• your chats with friends, both sides of them;
• your messages and voice notes in your games.

Your games and their results stay, showing “a deleted account” instead of your name. Messages you wrote in a game's hall disappear within 30 days, as everyone's do. A message or voice note someone has already reported stays with the report until our moderators close it. Our encrypted backups expire within 30 days.

8Cookies and storage on your device

We use one kind of cookie: the sign-in cookies that keep you signed in. They're needed for Rifilio to work, so there's nothing to accept. We use no advertising or tracking cookies, and no third-party analytics.

Your browser also stores a few things for convenience: whether you were signed in last time (so the right page shows first), your sound settings, and your unfinished game against a computer opponent. Clearing your browser's site data removes them.

9Your rights

Under the Nigeria Data Protection Act 2023, you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct data that is wrong;
• delete your account and your personal data (you can do this yourself in Settings);
• stop or limit some uses of your data, or object to them;
• give you your data in a format you can take elsewhere.

You can change your profile and email settings, and delete your account, yourself in Settings. For anything else, email contact@nueltekglobalresources.com from the address on your account, and we'll answer within 30 days.

If you think we've handled your data wrongly, please tell us first so we can put it right. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

10Age

You must be 16 or older to use Rifilio. We don't knowingly collect data from anyone younger. If you believe someone under 16 has an account, email contact@nueltekglobalresources.com and we'll remove it.

11Security

Connections to Rifilio are encrypted. Sign-in codes expire after 10 minutes, and we store them only in a scrambled (hashed) form. Access to our systems is limited to the people who run Rifilio, our logs never hold message text, audio or sign-in tokens, and backups are encrypted with a key kept offline. No system is perfectly secure, so if we ever learn of a breach that puts you at risk, we'll tell you and the Commission as the law requires.

12Changes to this policy

When we change this policy, we'll update the date at the top. If a change affects how we use your data in a significant way, we'll tell you on Rifilio or by email before it takes effect.

13Contact

Nueltek Global Resources, Owerri, Imo State, Nigeria. Email contact@nueltekglobalresources.com.