セキュリティポリシー

We collect as little data as we can and protect what we hold. This policy describes the main measures we use. It supplements the Privacy Policy.

◆Encryption in transit: traffic between the app and Supabase, the AI server function and Google's ad services uses HTTPS/TLS. The app does not allow cleartext HTTP.

◆Encryption at rest: Supabase encrypts its database storage at rest. Game saves stay in the app's private storage on your device.

◆Access control: Row Level Security (RLS) is enabled on every Supabase table, so the public key can only do what the policies allow, such as adding analytics events and reading shared content. The service-role key is never shipped in the app.

◆Secrets management: the OpenAI API key is held as a server-side secret of the Supabase Edge Function and is never embedded in the app.

◆Abuse protection: the AI function applies rate limits per client and forwards only the current message and up to six recent ones.

◆Least privilege: admin access is limited to the two developers, with two-factor authentication on Supabase, Google Play Console, AdMob and OpenAI.

◆Dependencies and releases: we keep SDKs and libraries up to date and review security advisories before each release. The app is signed with Play App Signing.

◆Before first use, players are told that messages are sent to OpenAI and are warned not to share personal data.

◆Players can report offensive or harmful AI replies from the chat screen.

◆Chats are not saved in our database, our server logs do not record message text, and we do not use chats to train our own models.

If we discover a personal data breach we will contain it, assess the risk, and, where required, notify the Finnish Data Protection Ombudsman within 72 hours and inform affected players without undue delay when the risk to them is high (GDPR Art. 33–34). We keep an internal record of incidents.

If you find a security issue, please email contact@arojentarinat.com with details. Please give us reasonable time to fix it before disclosing it publicly. We will acknowledge reports within 5 working days and will not take action against good-faith research.