Privacy Policy

dopa (dopasim.com) is a playground of calm, satisfying toys. This policy explains what we collect, why, and the choices you have. Our approach is simple: we collect as little as possible, we never sell your data, and we don't run third-party advertising or cross-site tracking.

Most of dopa runs entirely on your device and needs no account at all. Accounts, cloud sync, the leaderboard, and dopa+ are optional features that involve a little more data, described below.

• Account information. If you create an account, we store your email address, a display name, and a securely hashed password. If you sign in with Google, we receive basic Google profile information (your name, email address, and avatar).
• Guest play. If you start earning a score without an account, we automatically create a lightweight guest profile so your score can appear on the leaderboard and resume when you come back. A guest profile is just a randomly generated handle (for example “CalmOtter428”) and an internal placeholder identifier — we do not ask for or collect your name, email, or any personal details to play as a guest.
• Gameplay & progress. Your level, Drops, streaks, achievements, toys played, and preferences (such as theme and sound settings).
• Payment information (dopa+). Subscriptions are processed by Stripe. We never see or store your full card details — only a Stripe customer/subscription identifier and your subscription status.
• Technical data. Like most websites, our servers and providers process your IP address and basic device/browser information to keep the service secure, prevent abuse, apply rate limits, and run reliably.

We use essential, strictly-necessary first-party cookies and your browser's local storage. We do not use advertising cookies or cross-site trackers.

• Session cookie. A first-party, HTTP-only cookie keeps you signed in. This cookie is set when you sign in and also when you begin playing as a guest, so your guest profile persists if you close the tab and return. It is essential to how sign-in and the leaderboard work, and is not used for advertising.
• Local storage. We save your progress and preferences on your own device (in keys such as dopa.state.v1 and dopa.anonId) so the app loads instantly and works offline. This information stays on your device unless you sign in, in which case it syncs to your account.
• Analytics. We use privacy-friendly, cookieless analytics (via Vercel) to understand aggregate usage. It does not profile you or follow you across other sites.

The leaderboard is public. Once you earn a score, your handle, level, and Drops total can appear on it. Guest profiles show a randomly assigned handle — never your real name or any personal information.

• You can turn the leaderboard off at any time from your account settings, and account holders can change their display name.
• When you create an account, your guest progress is merged into that account and the temporary guest profile is deleted.

• To provide, maintain, and improve dopa and sync your progress.
• To run the leaderboard and your standing on it.
• To process dopa+ subscriptions and send related receipts.
• To send essential account emails (verification and password resets). We do not send marketing email unless you opt in.
• To keep the service secure and prevent cheating, abuse, and fraud.
• To comply with our legal obligations.

We do not sell your personal information. We share data only with the providers that help us run dopa, and only so they can perform their service:

• Neon— database hosting (accounts & progress).
• Vercel — application hosting and cookieless analytics.
• Upstash — Redis for community counters and rate limiting.
• Stripe — payment processing for dopa+.
• Google— optional “Sign in with Google.”
• Resend — sending account emails.

We may also disclose information if required by law, or to protect the rights, safety, and security of dopa and its users.

• Account data is kept while your account is active and is deleted when you delete your account.
• Guest profiles that are never claimed and remain inactive may be automatically deleted after a period of inactivity.
• Information stored in your browser's local storage stays until you clear it, sign out, or your browser removes it.

You can:

• Access and update your profile from your account settings.
• Delete your account (and its data) from your account settings.
• Opt out of appearing on the leaderboard.
• Clear local data by signing out or clearing your browser storage.

Depending on where you live (for example the EEA, UK, or California), you may have additional rights to access, correct, delete, or port your personal information, and to object to certain processing. We honor these rights and we do not sell personal information. To make a request, email support@dopasim.com.

dopa is not directed to children under 13 (or under 16 in the EEA), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

We protect your data with encryption in transit (HTTPS), hashed passwords, scoped HTTP-only cookies, and a strict content-security policy. No method of transmission or storage is ever 100% secure, but we work to protect your information and limit what we collect in the first place.

dopa and our service providers may process and store your information in the United States and other countries. By using dopa, you understand your information may be transferred to facilities outside your home country.

We may update this policy from time to time. When we do, we'll revise the “Last updated” date above, and for material changes we'll provide a more prominent notice. Your continued use of dopa after an update means you accept the revised policy.