Privacy Policy — TRAMA

Last updated: July 8, 2026 · Version: 1.1

1. Who we are (Data Controller)

The owner of the TRAMA application (“TRAMA”, “we”) is responsible for the processing of the personal data collected through the Service.

This Policy explains what data we process, for what purpose, on what legal basis, who we share it with, and what rights you have. It is complemented by the Terms and Conditions.

Processing is governed by Uruguay’s Personal Data Protection Act (Law No. 18.331) and its implementing Decree No. 414/009, under the oversight of the Regulatory and Data Protection Control Unit (URCDP / AGESIC). Where applicable, we also observe the LGPD (Law 13.709, Brazil) and the GDPR (EU).

2. What data we collect

a) Data you give us when creating or using an account

  • Email and password (the password is stored hashed and encrypted, never in plain text).
  • Profile name and language (locale).
  • If you sign in with Google: your Google identifier, email, name, and, if available, profile picture (avatar).

Playing the daily edition does not require an account: login is optional and is only used to sync your progress and to take part in rankings.

b) Optional demographic data (for rankings)

  • Country and year of birth. These are optional; they are used only for country and age-bracket rankings. You may choose not to provide them, or delete them.

c) Activity and progress data

  • Games completed per day, streaks, statistics, solving times, scores, medals, and ranking positions.
  • Groups you create or join, and your membership in them.

d) Technical, security, and advertising data

  • Session and refresh tokens (the refresh token is stored hashed).
  • A record of your acceptance of these terms (version and date).
  • Advertising (Google AdMob): the app displays ads served by Google AdMob, which processes the device’s advertising identifier and usage data to serve and measure ads (see sections 5 and 10).

We do not intentionally collect special categories of data (health, religion, etc.). Please do not provide them through free-text fields (e.g. a group name).

3. Purposes of processing

We process your data to:

  1. Provide the Service: create and authenticate your account, sync your progress across devices.
  2. Rankings and groups: calculate and display rankings; manage groups and invitations.
  3. Security: prevent fraud, cheating, and unauthorized access; validate scores server-side.
  4. Support and improvement: handle inquiries and improve the quality of the Service.
  5. Advertising and monetization: show Google AdMob ads that keep the Service free, and manage premium features/purchases if any.
  6. Legal compliance: respond to requests from competent authorities.

Under Law 18.331 (and, where applicable, the LGPD/GDPR), we process data on the basis of:

  • Your consent — free, prior, express, and informed — to create the account, for the optional demographic data, for showing your name and score in rankings, and for personalized advertising. You may withdraw it at any time (without retroactive effect).
  • Performance of the relationship we have with you when you use the Service (providing the requested features).
  • Our legitimate interest in maintaining the security and integrity of the Service and preventing fraud, weighed against your rights.
  • Compliance with legal obligations.

5. Who we share data with

5.1. With other users: if you take part in rankings or groups, your profile name, score, medals, and position are visible to other users within the same scope (global, country, age bracket, or group). Your email and password are never shared.

5.2. With providers (data processors) who provide us services under our instructions and a duty of confidentiality, including: hosting and infrastructure providers (servers and database), Google (Google Sign-In/OAuth when you choose that option; and Google AdMob for advertising, which processes the device’s advertising identifier).

5.3. Under legal obligation: in response to valid requests from competent judicial or administrative authorities.

5.4. Reorganization: in the event the Service is transferred, the data may be transferred to the successor, subject to the obligations of this Policy.

We do not sell your personal data.

6. International transfers

Some providers may host or process data outside Uruguay. When this occurs, we will adopt appropriate safeguards in line with Law 18.331 and URCDP regulations (e.g. transfers to countries with an adequate level of protection or through contractual clauses). Uruguay is recognized by the EU as a country with an adequate level of data protection.

7. Data retention

We keep your data while your account is active and for the period necessary to fulfill the purposes described and applicable legal obligations. If you delete your account, we will erase or anonymize your personal data within a reasonable period, except for data we must retain for legal, security, or dispute-resolution reasons. Progress data stored locally on your device is removed when you uninstall the app or clear its data.

8. Security

We apply reasonable technical and organizational measures: hashed (bcrypt) passwords, signed session tokens (JWT), hashed refresh tokens, per-user access control, and encrypted transport. No system is 100% secure; we cannot guarantee absolute security, but we work to protect your data and to notify incidents in line with applicable regulations.

9. Your rights

Under Law 18.331 (and the LGPD/GDPR where applicable), you may exercise the rights to:

  • Access your data.
  • Rectify inaccurate or incomplete data.
  • Erasure / deletion (“right to be forgotten”).
  • Update and inclusion.
  • Object and withdraw consent.
  • Portability (where the LGPD/GDPR applies).

Some of these rights can be managed from within the app itself (editing your profile, demographic data, leaving groups, deleting your account). For the rest, you can write to us through the contact channel published on TRAMA’s listing on the App Store or Google Play. We will respond within the legal timeframes (in Uruguay, generally 5 business days for access requests).

If you believe your rights were not addressed, you may file a complaint with the URCDP (Regulatory and Data Protection Control Unit — AGESIC), the supervisory authority in Uruguay.

10. Cookies, SDKs, and identifiers

The app uses local device storage to function (e.g. to save your progress and preferences). The app integrates the Google AdMob SDK to show advertising, which uses the device’s advertising identifier. Before showing personalized ads we request consent and display the controls required by regulations and the platforms (Apple’s ATT and Google’s UMP); without consent, ads shown are non-personalized.

11. Minors

The Service is intended for people 13 years of age or older. Minors under 18 require the consent and supervision of a parent or legal guardian. We do not knowingly collect data from children under 13; if we become aware of this, we will delete the account and the associated data.

12. Changes to this Policy

We may update this Policy. We will publish the current version with its date and, in the event of material changes, we will make reasonable efforts to notify you. Continued use of the Service constitutes acceptance of the current version.

13. Contact

For privacy inquiries or to exercise your rights, you can write to us through the contact channel published on TRAMA’s listing on the App Store or Google Play. Supervisory authority: URCDP — Regulatory and Data Protection Control Unit (AGESIC), Uruguay.