Security policy

Encryption in transit

Traffic between the app and Supabase, the AI server function and Google's advertising services uses HTTPS/TLS. The app does not allow unencrypted HTTP traffic.

Encryption at rest

Supabase encrypts the database storage. Game saves stay in the app's private storage on your device.

Access control

Row Level Security (RLS) is enabled on every Supabase table, so the public key can do only what the rules allow, such as adding analytics events and reading shared content. The service-role key is never shipped in the app.

Secrets management

The OpenAI API key is a server-side secret of the Supabase Edge Function and is not embedded in the app.

Abuse prevention

The AI function limits the number of requests per client and forwards only the current message and up to six recent messages.

Least privilege

Administrator rights are limited to two developers. Supabase, Google Play Console, AdMob and OpenAI use two-step verification.

Dependencies and releases

We update SDKs and libraries regularly and review security advisories before each release. The app is signed with Play App Signing.

AI assistant safeguards

• Before first use, players are told that their messages are sent to OpenAI and are warned not to share personal information.
• Players can report offensive or harmful AI replies from the chat screen.
• Conversations are not stored in our database, our server logs do not store message text, and we do not use conversations to train our own models.

Personal data breaches

If we discover a personal data breach, we contain it, assess the risk and, where required, notify the data protection authority within 72 hours. Where the risk to affected players is high, we inform them without undue delay (GDPR Articles 33–34). We keep an internal record of incidents.

Reporting a security issue

If you find a security issue, send the details to contact@arojentarinat.com. Please give us a reasonable time to fix the problem before publishing it. We acknowledge reports within 5 working days, and we will not take action against research carried out in good faith.