Privacy Policy

dopa is operated by Azalea Cyber Development, a general partnership registered in Alberta, Canada. We are the organization responsible for the personal information described here.

Privacy questions, access requests, corrections, and complaints go to our privacy contact at privacy@dopasim.com, or by post at Calgary, Alberta, Canada. We answer within 30 days.

If you are in Quebec, this is the person designated as responsible for the protection of personal information under Law 25. If you are anywhere in Canada and you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, and Quebec residents can complain to the Commission d'accès à l'information.

dopa (dopasim.com) is a playground of calm, satisfying toys. This policy explains what we collect, why, and the choices you have. Our approach is simple: we collect as little as possible, we never sell your data, and we don't run third-party advertising or cross-site tracking.

Most of dopa runs entirely on your device and needs no account at all. Accounts, cloud sync, the leaderboard, and dopa+ are optional features that involve a little more data, described below.

• Account information. If you create an account, we store your email address, a display name, and a securely hashed password. If you sign in with Google, we receive basic Google profile information (your name, email address, and avatar).
• Guest play. If you start earning a score without an account, we automatically create a lightweight guest profile so your score can appear on the leaderboard and resume when you come back. A guest profile is just a randomly generated handle (for example “CalmOtter428”) and an internal placeholder identifier. We do not ask for or collect your name, email, or any personal details to play as a guest.
• Gameplay & progress. Your level, Drops, streaks, achievements, toys played, and preferences (such as theme and sound settings).
• Payment information (dopa+). Subscriptions are processed by Helcim. We never see or store your full card details. only a processor customer/subscription identifier and your subscription status.
• Technical data. Like most websites, our servers and providers process your IP address and basic device/browser information to keep the service secure, prevent abuse, apply rate limits, and run reliably.

We use essential, strictly-necessary first-party cookies and your browser's local storage. We do not use advertising cookies or cross-site trackers.

• Session cookie. A first-party, HTTP-only cookie keeps you signed in. This cookie is set when you sign in and also when you begin playing as a guest, so your guest profile persists if you close the tab and return. It is essential to how sign-in and the leaderboard work, and is not used for advertising.
• Local storage. We save your progress and preferences on your own device (in a key such as dopa.state.v1) so the app loads instantly and works offline. This information stays on your device unless you sign in, in which case it syncs to your account.
• Analytics. We use privacy-friendly, cookieless analytics (via Vercel) to understand aggregate usage. It does not profile you or follow you across other sites.

The leaderboard is public. Once you earn a score, your handle, level, and Drops total can appear on it. Guest profiles show a randomly assigned handle, never your real name or any personal information.

• You can turn the leaderboard off at any time from your account settings, and account holders can change their display name.
• When you create an account, your guest progress is merged into that account and the temporary guest profile is deleted.

• To provide, maintain, and improve dopa and sync your progress.
• To run the leaderboard and your standing on it.
• To process dopa+ subscriptions and send related receipts.
• To send essential account emails (verification and password resets). We do not send marketing email unless you opt in.
• To keep the service secure and prevent cheating, abuse, and fraud.
• To comply with our legal obligations.

We do not sell your personal information. We share data only with the providers that help us run dopa, and only so they can perform their service:

• Neon: database hosting (accounts & progress).
• Vercel: application hosting and cookieless analytics.
• Upstash: Redis for community counters and rate limiting.
• Helcim: payment processing for dopa+.
• Google: optional “Sign in with Google.”
• Resend: sending account emails.

We may also disclose information if required by law, or to protect the rights, safety, and security of dopa and its users.

• Account data is kept while your account is active and is deleted when you delete your account.
• Guest profiles that are never claimed and remain inactive may be automatically deleted after a period of inactivity.
• Information stored in your browser's local storage stays until you clear it, sign out, or your browser removes it.

You can:

• Access and update your profile from your account settings.
• Delete your account (and its data) from your account settings.
• Opt out of appearing on the leaderboard.
• Clear local data by signing out or clearing your browser storage.

Wherever you live, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. We do not sell personal information, and we never have.

Some places give you more. In Canada, under PIPEDA and Quebec's Law 25, you can ask for your information in a structured, commonly used technical format so you can take it elsewhere, and you can ask us to stop spreading information or to de-index it where the law allows. In the EEA and UK you can additionally object to or restrict certain processing and complain to your local supervisory authority. In California you can ask what we collect and ask us to delete it, and we will not discriminate against you for asking.

To exercise any of these, email privacy@dopasim.com. We reply within 30 days and we will not charge you for a reasonable request.

dopa is for everyone and is not directed to children specifically. The thing that protects children best here is structural: playing needs no account, so using dopa requires giving us nothing at all. Accounts, which are the only place we collect anything personal, are for people 13 and over (16 in the EEA).

We do not knowingly collect personal information from children, we run no advertising, and we build no behavioural profiles on anyone of any age.

If you are a parent or guardian and you believe a child has created an account or given us personal information, email privacy@dopasim.com and we will delete the account and its data. You do not need to prove anything first.

We protect your data with encryption in transit (HTTPS), hashed passwords, scoped HTTP-only cookies, and a strict content-security policy. No method of transmission or storage is ever 100% secure, but we work to protect your information and limit what we collect in the first place.

If a security breach happens and it creates a real risk of significant harm to you, we will tell you and the relevant regulators as quickly as we can, as Canadian law requires. We keep a record of breaches whether or not they meet that bar. We would rather tell you early and be wrong about the severity than tell you late.

We are based in Alberta, Canada, and several of our service providers store or process data in the United States and other countries. That means your information can be subject to the laws of those countries, including lawful access by their authorities.

Before using a provider outside Canada we assess whether your information will receive adequate protection, and we contract for it. We keep what we collect deliberately small so that there is little to expose wherever it sits. If you would like to know which provider handles which piece of data, the list is in the section above and we are happy to explain any of it.

We may update this policy from time to time. When we do, we'll revise the “Last updated” date above, and for material changes we'll provide a more prominent notice. Your continued use of dopa after an update means you accept the revised policy.