Who Knows More?

Por ahora, esta página solo está en inglés.

Privacy policy

How Who Knows More? uses your data. Short version: we collect what the game needs to work, we count how the apps are used so we can improve them, and the free apps show ads through Unity LevelPlay, mostly from Meta Audience Network. Players under 18 never get ad-network ads, ads are personalised only if you allow it (on iPhone and iPad through Apple's tracking prompt), and buying No ads removes them. We never sell your data.

Última actualización: 6 November 2026

1. Who we are

Who Knows More? (the apps for iPhone, iPad and Android, and the website whoknowsmore.app) is made by SELLTICKETS Ltd, Ras Al Khaimah, UAE, licence no. 07011340, Office A, Innovation City Business Centre, RAK Bank ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates. We are the controller of your personal data. Contact for anything about privacy: [email protected].

This policy covers the apps and this website. The website sells nothing; question decks are bought only inside the apps, through the App Store or Google Play.

2. What we collect

  • Sign-in: when you sign in with Apple or Google, the account id they give us and, if they share it, your email address (Apple may give a private relay address). We never see your Apple or Google password.
  • Your profile: name, @handle, date of birth, gender, language, and your photo, drawn avatar or initials. Your date of birth is used to check you are 13 or older and to set privacy defaults; other players never see it.
  • Profile photo (optional): if you add one, the image you pick or take. The camera or photo library is used only when you choose to, and we remove location and other hidden details (EXIF) from the image.
  • Friends and settings: friends, friend requests, players you blocked, privacy, analytics and notification settings, your chosen skin.
  • Games: the games you play, the settings, your answers (including answers you type), timing, marks and scores. With each game we store your age band (for example 18–24), gender and language at the time, for statistics.
  • Reports you send about other players or content, and reports others send about you.
  • Purchases: when you buy a question deck, Apple or Google take the payment. We receive the store's receipt: the product, a transaction id, the date, and the store country and price. We never see your card or bank details.
  • Your device: an install id made by the app, platform, app version, system version, device model, language and, if you allow notifications, a push token.
  • Ads (apps, adults only): when ads are shown, Unity's and Meta's ad software collects data about your device; see section 6. If you finish a reward video, we store that you watched one in a game.
  • Usage analytics (apps): see section 5.
  • Crash reports (apps): when an app crashes, a report of what went wrong; see section 5.
  • Website visits: none by default. Only if you accept analytics cookies, the information in section 7.
  • Support emails: what you write to us and your email address.
  • Technical logs: our servers and Cloudflare see your IP address and basic request details when you connect. We use them only to run and protect the service and keep them for at most 30 days.

We do not collect your contacts, precise location, microphone, health, financial or browsing data. Advertising identifiers (the IDFA on iPhone and iPad, the advertising ID on Android) are used only by the ad software, only for adults, only when you allow it, and only as described in section 6; we don't build profiles of you for marketing ourselves.

3. Why we use it, and our legal basis

  • To run the game and your account — sign-in, rooms, turns, scores, friends, invites, skins (contract: needed to give you the service you asked for).
  • To unlock and restore decks you bought and keep the records tax law requires (contract and legal obligation).
  • To keep the community safe — the word filter, automatic checks of profile photos, reports, moderation and blocking (legitimate interest, and our duty under app store rules).
  • To check age — the apps are for people aged 13 and over (legal obligation and our terms).
  • To send notifications you allowed — game invites, friend requests, updates (consent; turn them off any time in Settings or your phone's settings).
  • To find and fix crashes — crash reports from the apps (legitimate interest: keeping the app working for everyone; see section 5).
  • To show ads that pay for the free apps — non-personalised ads on the legitimate interest of keeping the game free; personalised ads only with your consent: our consent question where the law asks for it (UK, EEA and Switzerland) and, on iPhone and iPad, Apple's tracking prompt; see section 6.
  • To give you a reward video's reward and stop it being claimed twice (contract).
  • To understand and improve the apps and website — counts of games, players, languages and popular decks, and which website pages help (your consent; see sections 5 and 7).
  • To answer you when you write to support (legitimate interest).

We don't make decisions about you that are based only on automated processing and have legal or similarly significant effects. The automatic photo check only decides whether a photo is shown; a person reviews disputes.

4. What other players see

Players in your games see your name, @handle, face (photo, avatar or initials) and your answers when they are revealed. Who can find you, send you friend requests, invite you and see your photo follows your privacy settings.

5. Analytics and crash reports in the apps (Google Analytics for Firebase, Firebase Crashlytics)

Only if you agree, the apps use Google Analytics for Firebase, a service of Google, to count how they are used. What is sent: app interactions (the app opening, signing up, finishing the how-to-play slides, creating a game with its kind and number of players, a game ending with its rounds, choosing a deck, adding a friend, sending a report), the app version, device type, operating system, language, the country and city worked out from your connection, and a random analytics id for the app install (a device/app-instance id that Google creates; it is not your account). We do not send a user id, your name, email, @handle, photo, answers, typed text or date of birth, and analytics never uses an advertising identifier.

  • Off until you agree: analytics is switched off when you install the app. After you set up your profile the app asks you once; nothing is collected unless you tap Allow. You can change it at any time in the app: Settings › Privacy › Share usage analytics.
  • Under 18: players aged 13 to 17 are never asked, and analytics stays off for them.
  • Settings we use: Google signals, ad personalisation and advertising features are switched off. The data is not used for advertising and not shared to track you. IP addresses are not stored by Google Analytics 4.
  • How long: analytics events are kept for 14 months, then deleted automatically.
  • Google processes this data for us under the Google Analytics and Firebase data processing terms. More: how Google uses data from apps and sites that use its services.

Crash reports (Firebase Crashlytics). Separately from analytics, the apps use Firebase Crashlytics, a service of Google, to tell us when an app crashes so we can fix it. It is on for everyone, including players aged 13 to 17, because it is needed to keep the app working; it is not analytics. A crash report holds the crash and diagnostic details (where in the app it went wrong, the stack trace), the device model, operating system, app version and a random app-instance id. It holds no name, email, @handle, answers or typed text, and it is not used for advertising. Our legal basis is legitimate interest: keeping the app working. Crash reports are kept for 90 days, then deleted automatically. You can object by writing to [email protected].

Google Analytics never uses an advertising identifier, and the ads in section 6 never get your analytics data.

Install measurement (Meta app events). When we run ads for Who Knows More? on Facebook and Instagram, we need to know whether those ads bring players who keep playing. For this, and only if you are 18 or over and tapped Allow on the same usage-data question (and only while we run such ads), the apps also send a few app events to Meta Platforms Ireland Ltd. (Meta Platforms, Inc. outside the EU, EEA, UK and Switzerland) through Meta's app events software: the app opening, signing up, finishing the how-to-play slides, your first game, sending an invite, and a purchase with its product, price and currency. With them go the app version, device type, operating system and language, and, on Android, the advertising ID where Android allows it; on iPhone and iPad the advertising identifier only if you tapped Allow on Apple's tracking prompt. We do not send your name, email, @handle, photo, answers, typed text or date of birth. Meta uses the events to tell us how many installs and purchases our ads brought, and may use them to improve the delivery of our ads, under Meta's privacy policy. Players aged 13 to 17 never send them. Turning off Share usage analytics in Settings › Privacy stops them.

  • iPhone and iPad: the app also tells Apple's SKAdNetwork how far a new install got (signed up, first game, invite sent, three games, a purchase). Apple passes this on to the ad network only as an anonymous count, delayed, so it carries nothing about you; it is never updated for players under 18.
  • Android: Google Play tells the app which link or ad campaign it was installed from (the install referrer). The app sends us only the campaign's source and name, with the usage data above (adults who allowed it), so we can compare what each campaign cost with how its players play. For an install from a Meta ad, the campaign and ad set names come from Meta encrypted; we decrypt them on our server and keep only those names.

6. Ads in the apps (Unity LevelPlay, Meta Audience Network)

The apps are free, and ads pay for them. Ads are loaded by Unity LevelPlay, the ad mediation service of Unity Technologies (formerly ironSource), and come from Meta Audience Network, a service of Meta, which bids for each ad inside LevelPlay. Older versions of the apps contain Google AdMob, which shows no ads for us.

  • Where ads appear: full-screen ads only at breaks (between turns, between rounds, at the end of a game) and banners only on calm screens (home, the lobby, the scoreboard, the game end). Never on a question or answer screen.
  • Players aged 13 to 17 never get ads from ad networks. They may see our own ads for Who Knows More? (house ads), which are pictures we host ourselves; no data about you is sent to anyone for them.
  • UK, EEA and Switzerland: before any ad is loaded, adults are asked once whether they allow personalised ads (Allow or Not now). Without a yes, ads are non-personalised. You can change your answer in the app's privacy settings.
  • iPhone and iPad: adults first answer our consent question (in the UK, EEA and Switzerland), then see Apple's App Tracking Transparency prompt. Only if you tap Allow does the ad software read the advertising identifier (IDFA) and show personalised ads; otherwise ads are non-personalised and the IDFA is not read. You can change this at any time in iOS Settings › Privacy & Security › Tracking. Players aged 13 to 17 are never asked.
  • Android: adults who allow it (in the UK, EEA and Switzerland, through the consent question) may get personalised ads, which use the Android advertising ID. Everyone else gets non-personalised ads. You can reset or delete your advertising ID at any time in Android Settings › Privacy › Ads (or Settings › Google › Ads).
  • What Unity's and Meta's ad software collects when it shows an ad: device identifiers (on Android, the advertising ID where allowed, and an app-set id), your approximate location worked out from your IP address, how you interact with ads (views and taps), and diagnostics and performance data (for example how fast an ad loaded). It does not get your name, email, @handle, photo, answers, date of birth or analytics data. Unity and Meta use this under their own policies: Unity's game player and app user privacy policy and Meta's Audience Network data policy.
  • Reward videos: some features let you choose to watch a short video ad for a reward. When you finish one, LevelPlay tells our server with our user id for you and an event id, so we can give the reward once. We store that you watched a reward video in a game (your user id, the room and the time). It is deleted with your account.
  • No ads: buying No ads in the app (a yearly subscription or a one-off lifetime purchase) removes ads for you and for everyone in the rooms you host.

7. Cookies and analytics on this website

By default this website sets no cookies and loads no analytics. If analytics is switched on for the site, a banner asks you first:

  • If you accept: we load Google Analytics 4, which sets the cookies _ga and _ga_<id> to tell visits apart. They last up to 13 months. We use them only to count visits, pages viewed, where visitors come from and which buttons (for example "Download on the App Store") are tapped. Google signals and advertising features are off, and IP addresses are not stored.
  • If you reject: nothing from Google is loaded and no analytics cookie is set.
  • Your choice is remembered in your browser's local storage (wkm.consent, not a cookie) for 6 months, then we ask again. You can change it at any time with Cookie settings at the bottom of every page.
  • Cloudflare, which protects the site, may set a strictly necessary security cookie (__cf_bm, 30 minutes) to tell people from bots. It is not used for analytics.

8. Teenagers (13 to 17) and children

If you are under 18, your account starts with the most private settings, in line with the UK Age Appropriate Design Code: you can't be found in search, only people you played with can send you friend requests, and your photo is shown only to friends. You can change these later. We don't use your data for nudges, profiling or advertising: you never get ads from ad networks, only our own house ads, which send no data. Usage analytics stays off for you. Crash reports (section 5) are still sent, because they keep the app working; they contain nothing about who you are.

The apps are not meant for children under 13. People under 13 cannot create an account: if a date of birth under 13 is entered, no account is kept. If we learn that we hold data of a child under 13, we delete it. Parents can write to [email protected].

9. Who processes data for us

We share data only with these service providers, who handle it on our instructions and must protect it at least as well as we do:

  • Amazon Web Services — servers, database, photo storage and backups in Frankfurt, Germany; Amazon Rekognition checks new profile photos for nudity, violence and hate symbols.
  • Cloudflare — network, delivery of images and skins, protection against attacks, and forwarding of support email.
  • Apple — Sign in with Apple, App Store purchases, and push notifications (Apple Push Notification service).
  • Google — Google sign-in, Google Play purchases, push notifications (Firebase Cloud Messaging), Google Analytics for Firebase, Firebase Crashlytics, and Google Analytics 4.
  • Unity — Unity LevelPlay, which loads the ads in the apps (adults only).
  • Meta — Meta app events, which measure installs from our own ads (adults who allowed usage data; section 5), and Meta Audience Network, which shows the ads through Unity LevelPlay (adults only). For ads, Unity and Meta also decide themselves how they use the data their ad software collects (section 6).
  • Microsoft — the mailbox where support emails arrive.

We may also share data if the law requires it, to protect people's safety, or with a buyer if the business is sold (you would be told first). We never sell or rent personal data.

10. Where data goes

Our game servers and database are in the EU (Frankfurt, Germany). SELLTICKETS Ltd is based in the United Arab Emirates, and some providers above may process data in other countries, including the United States. Where data leaves the UK or the EEA, it is protected by the European Commission's standard contractual clauses, the UK International Data Transfer Agreement or addendum, or an adequacy decision.

11. How long we keep it

  • Account data: until you delete your account.
  • When you delete your account, your name, @handle, date of birth, gender, photo, sign-in details, devices, friends and settings are erased at once. Game records stay without your name, so other players' scores and statistics remain correct; they can no longer be linked to you.
  • Purchase records: as long as tax and accounting law requires (up to 7 years), without your profile.
  • Reward video records: until you delete your account.
  • App analytics: 14 months. Crash reports: 90 days. Website analytics: 14 months; cookies at most 13 months.
  • Server logs: at most 30 days. Database backups: 30 days, then deleted.
  • Reports and moderation decisions: as long as needed to keep the service safe, at most 2 years.
  • Support emails: 2 years after the conversation ends.

12. Security

All connections are encrypted (HTTPS/TLS). Data is stored encrypted in AWS data centres. Only the people who run the service can reach it, through accounts protected by two-factor authentication, and every admin action is logged. Photos are served from unguessable addresses. No system is perfectly secure; if a breach puts you at risk, we tell you and the authorities as the law requires.

13. Your rights and choices

You can ask for a copy of your data, correct it, delete it, take it elsewhere, object to how we use it, ask us to limit it, and withdraw consent at any time (for example for analytics, personalised ads or notifications) without affecting what was done before. Much of this you can do in the app (Settings). Delete your account in the app (Settings › Account › Delete my account) or on the account deletion page. For anything else write to [email protected]; we answer within one month.

  • UK and EU: you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
  • California and other US states: we never sell personal information for money. Personalised ads from Meta Audience Network through Unity LevelPlay (on Android, and on iPhone and iPad after you tap Allow on Apple's tracking prompt) can count as sharing personal information (the advertising identifier, approximate location and ad interactions) for cross-context behavioural advertising, or as targeted advertising; so can the app events we send to Meta to measure our own ads (section 5, adults who allowed usage data, with the advertising identifier only where allowed). Turning off Share usage analytics stops those. Players under 18 never get network ads. To opt out: say no to personalised ads in the consent question where it is shown (in the US, the apps tell the ad software when personalised ads are off); on iPhone and iPad turn tracking off in Settings › Privacy & Security › Tracking; on Android delete or reset your advertising ID in settings (or turn on Opt out of Ads Personalisation on older Android versions); buy No ads; or email [email protected] and we will help you opt out. This website has no ads. We don't use sensitive data to infer things about you. You have the right to know, delete and correct, and we won't treat you differently for using these rights.
  • Türkiye: you can use your rights under the Personal Data Protection Law (KVKK, article 11) by writing to us.

14. Changes

If we change this policy in a way that matters, we tell you in the app before it applies and update the date above.