Privacy Policy

App name: Misbehave (多人成行)
Effective date: 2026-05-13
Last updated: 2026-05-13

1. Introduction

This Privacy Policy explains how Misbehave ("the App") collects, uses, stores, and shares information when you use it. By installing or using the App, you agree to the practices described in this policy.

The App is intended for users aged 17 and older for in-person party games with partners or close friends, and is not directed at children under 13 (or under 16 where GDPR applies).

2. Information We Collect

The App is designed to be local-first and privacy-first. We only collect the relevant information when you choose to use features that require an internet connection (such as cloud sync, sign-in, or subscriptions).

2.1 Account information (only when you sign in)

• Email address (collected when you sign in with a one-time passcode, or OTP)
• Your X (Twitter) user ID, username, display name, and profile picture (collected when you choose to sign in with X; we only read your public profile, request no posting or other permissions, and do not store your X access token)

We do not collect phone numbers, real names, addresses, or contacts.

2.2 User-generated content (only when you upload)

• Custom board / deck configurations (JSON data) that you choose to upload to the cloud
• Content stored only on your device and not uploaded is never transmitted

2.3 Subscription and payment information

• In-app purchases are processed by your platform's app store billing system
• RevenueCat receives platform transaction receipts to determine subscription status and manage Pro benefits
• When you purchase on our website, payment is handled by a third-party payment provider; we only store the order number, amount, payment status, and the account you were signed in with when ordering, and never access your payment account or card details

2.4 Device and technical information

• Platform-assigned device identifiers (used for subscription management and abuse prevention, not for advertising)
• App version, OS version, and language/region (used for compatibility and diagnostics)
• Crash and error reports (containing no personally identifiable information)

2.5 Information stored only on your device

• Presets you haven't uploaded, game history, player nicknames, and settings

3. How We Use Information

1. To verify your identity and protect your account
2. To enable cloud sync and content uploads and downloads
3. To process and verify subscriptions and in-app purchases
4. To review uploaded content to keep the community safe
5. To diagnose crashes and improve the app
6. To comply with legal obligations

We do not sell or rent your personal information, do not use it for behavioral targeted advertising, and do not show third-party ads.

4. Third-Party Services

We use the following third-party services to support the online features you choose to use. Except for the purposes described below for these services, we do not transmit raw personal information about you to third parties.

• Supabase — accounts, authentication, and cloud preset storage
  https://supabase.com/privacy

• RevenueCat — subscription verification and Pro benefit management
  https://www.revenuecat.com/privacy

• App store in-app purchases (StoreKit / Play Billing) — processes subscription transactions
  https://www.apple.com/legal/privacy/
  https://policies.google.com/privacy

• X (Twitter) sign-in — used when you choose to sign in with X
  https://x.com/privacy

• Website payment provider — processes payments for purchases made on our website

• Firebase — infrastructure, distribution, and crash reporting
  https://firebase.google.com/support/privacy

5. Data Retention

• Account email and uploaded presets: kept while your account is active; deleted within 30 days after account deletion
• Subscription transaction records: kept as required by tax and audit regulations (typically 7 years)
• Crash logs: 90 days
• Local data: kept until you uninstall the app or clear it manually

6. Your Rights

You may have the right to access, correct, delete, export, or restrict the processing of your data, to withdraw consent, and to file a complaint.

You can use the in-app account deletion feature, or email us at support@duorenchengxing.com. We usually respond within 30 days.

7. Children's Privacy

The App is not directed at anyone under 17. If we learn that a child has mistakenly submitted personal information, we will delete it promptly.

8. International Data Transfers

Our servers and third-party services may process data outside your country (including in the United States and Singapore), protected by standard contractual clauses and our providers' security measures.

9. Security Measures

• Email sign-in uses one-time codes; no passwords are stored
• Sensitive data on your device is encrypted with secure storage
• Server-side policies such as RLS restrict data access
• Network requests use TLS 1.2 or higher

No system can guarantee 100% security, but we continuously maintain industry-standard security measures.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes through an in-app notice or by email.

11. Contact Us

Email: support@duorenchengxing.com