Privacy Policy

Table Online · Effective 11 May 2026 · Last updated 2 October 2026

This Privacy Policy explains how TAGONSOFT SRL ("we", "us", "Tagonsoft", or the "Company"), the controller of your personal data, processes information when you use the Table Online mobile or web application, related backend services, and the website at play.table-online.ro (together, the "Service").

This Policy is issued under Regulation (EU) 2016/679 (the GDPR) and Romanian Law no. 190/2018, as well as Regulation (EU) 2018/1725, the ePrivacy Directive (2002/58/EC) as transposed in Romania, and applicable consumer-protection law.

1. Identity and contact details of the controller

Controller

TAGONSOFT SRL

Registered office

Str. Clopotari 6, Cod 700706, Iași, Romania

Trade Registry no.

J2013000605225

Tax ID (CUI)

RO31439694

General contact

support@table-online.ro

Privacy contact

privacy@table-online.ro

Data Protection Officer

Not appointed — Article 37 GDPR does not require one for our scale

If you are in the EU/EEA, you can lodge a complaint with your national supervisory authority. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — https://www.dataprotection.ro.

2. Summary of what we collect (TL;DR)

We try to collect as little as possible.

• You can play fully anonymously with only a device identifier — no email, username, or password required.
• If you sign in with Apple, Google, or Facebook, we receive your email, display name, and a stable provider user ID.
• On iOS and Android, we link your Game Center or Google Play Games account to your game account — without your email or name — so that reinstalling the app or moving to a new phone brings your progress back. This happens automatically once your account has progress; logging out stops it on that device.
• Optional information you may choose to provide: a username and a profile picture. Alongside these we store account-tied artefacts such as your friends list, chat messages, in-game purchase records, and gameplay history.
• We use Firebase (Google) for analytics, crash reporting, and push notifications. If you do not consent to analytics, the mobile app still sends Google usage events, but without any device or user identifier, so they can only be counted in aggregate (§12).
• On mobile, we show rewarded video ads through Google AdMob.
• Our servers are in the European Union (Hetzner, Germany). Backups are stored on Cloudflare R2.
• If you arrive through a friend's invite link, we use AppsFlyer to recognise which invite brought you, so it can be credited — and the player who invited you sees that you accepted.
• To measure our own advertising campaigns on TikTok, the mobile app tells TikTok when it is installed and opened, and when you finish the tutorial or make a purchase. In the EU/EEA/UK this happens only if you allow ads on the consent form (§12).
• You can delete your account at any time from inside the app (Settings → Profile → Delete account).

3. Categories of personal data we process

3.1 Data you provide

3.2 Data collected automatically

3.3 Data we generate about you

• Your gameplay statistics (wins, losses, ELO, badges, daily login streaks).
• Power-up balances and transaction logs.
• Friend connections and friend requests.
• Block list and reports you have filed or that have been filed against you.
• Moderation history (warnings, temporary or permanent bans, with reason).
• Your part in the invite programme: if you accepted an invite, which account invited you, when, the platform you redeemed on, whether the code reached the app through the link or you typed it, and what the programme promised at that moment; if you sent one, the accounts that accepted it and whether each has been rewarded.

3.4 What we do not collect

• We do not ask for your real name, date of birth, address, phone number, or payment-card details.
• We do not collect precise location (no GPS).
• We do not access your contacts, microphone, calendar, or files outside what you select.
• We do not sell your personal data.
• We do not offer real-money gambling. All in-app purchases are for virtual cosmetic items and power-ups.

4. Purposes and legal bases (Art. 6 GDPR)

You have the right to object to any processing based on legitimate interest (see §9).

5. Third parties and recipients

We do not sell your personal data. We share it only with the processors and partners listed below, each under a written agreement (DPA / Standard Contractual Clauses where required).

5.1 Processors (acting on our instructions)

5.2 Other recipients

• Other players: your username, profile picture, friend code, online status, and game and chat history are visible to opponents and friends, as you would expect from a multiplayer game.
• The player whose invite link you used: your username, profile picture and whether the invite has been rewarded appear in their list of invites. This happens whether or not you know them — an invite link can be forwarded by anyone. They are not shown your email, how much you play, or anything else about your account.
• TikTok (TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited): if you allow ads (§12), the advertising measurement data described in §3.2. For collecting and transmitting this data and for measuring our campaigns, TikTok and we are joint controllers (Art. 26 GDPR) under TikTok's jurisdiction-specific terms; TikTok then uses the data as an independent controller to optimise and personalise ads and for safety and security, as described in its privacy policy. You can exercise your rights (§9) with us or with TikTok.
• Public leaderboards: your username and ranking statistics may be displayed publicly.
• Law-enforcement or regulators: only when we are legally compelled.
• Buyers in case of corporate transactions: if the Service is acquired, your data may transfer subject to the same protections.

6. International transfers

Our primary processing takes place in the European Union (Germany). Some processors (Google, Cloudflare, Apple, Meta) are subsidiaries of US companies and may transfer data to the United States or other countries. Where transfers occur outside the EEA:

• We rely on the European Commission's Standard Contractual Clauses (Decision 2021/914/EU); and/or
• We rely on the EU-US Data Privacy Framework for Google LLC, Cloudflare, Inc., Meta Platforms, Inc., and Apple Inc., to the extent they are certified; and
• For AppsFlyer Ltd. (Israel) we rely on the European Commission's adequacy decision for Israel (Decision 2011/61/EU, reconfirmed on 15 January 2024), with onward transfers governed by the safeguards in AppsFlyer's Data Processing Addendum; and
• For TikTok, transfers outside the EEA are governed by the safeguards in TikTok's terms, which incorporate the European Commission's Standard Contractual Clauses, and are described in its privacy policy.

You can request a copy of the transfer safeguards by emailing us.

7. Retention periods

We keep personal data only as long as we need it for the purposes set out above.

When you delete your account (§9), most data is deleted within 30 days. Some data (game records visible to other players, chat messages already received) is anonymised rather than deleted, so the experience of other players is not disrupted. Backups are overwritten on the schedule above.

8. Children

The Service is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided personal data, please contact privacy@table-online.ro and we will delete it.

The Service is rated PEGI 3 / 12+ depending on store and includes social features (chat) and in-app purchases — parents should supervise use accordingly.

9. Your rights under the GDPR

You have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectification of inaccurate data (Art. 16);
• Erasure ("right to be forgotten") (Art. 17);
• Restriction of processing (Art. 18);
• Data portability — receive your data in a machine-readable format (Art. 20);
• Object to processing based on legitimate interest, including profiling (Art. 21);
• Withdraw consent at any time, for processing based on consent (Art. 7(3));
• Not be subject to solely automated decisions with legal effects (Art. 22) — we do not make any such decisions;
• Lodge a complaint with a supervisory authority (in Romania: ANSPDCP).

How to exercise your rights

• Inside the app: Settings → Profile gives you direct access to delete your account, change your username, replace or remove your profile picture, link/unlink social accounts, and adjust notification preferences. Logging out stops the automatic Game Center / Google Play Games sign-in on that device; you can also sign out of Game Center or Google Play Games in your device settings.
• By email: send a request to privacy@table-online.ro from the email address linked to your account, or include your friend code so we can identify you. We will respond within one month (extendable by two further months for complex requests, Art. 12(3) GDPR).

We do not charge for these requests, except where they are manifestly unfounded or excessive (Art. 12(5) GDPR).

10. Security

We implement appropriate technical and organisational measures (Art. 32 GDPR), including:

• Encryption in transit (TLS 1.2+) for all client-server traffic.
• Encryption at rest:
• sensitive credentials (admin password hashes) stored using bcrypt;
• all object-storage data (profile pictures, product images, database backups) stored in Cloudflare R2 EU-jurisdiction buckets with server-side AES-256 encryption;
• the PostgreSQL data directory on the VPS is held on the host filesystem.
• Storage of authentication keys in iOS Keychain / Android EncryptedSharedPreferences on the device.
• IP-address masking in application logs.
• Network isolation: PostgreSQL bound to localhost only, with firewall protection.
• Scoped credentials with least-privilege access for object storage and backups (separate R2 API tokens for user-content and for database-backup buckets).
• Daily PostgreSQL backups uploaded to a dedicated EU-resident R2 bucket; tiered retention (30 days daily, 90 days weekly, 365 days monthly) enforced by R2 lifecycle rules.
• Regular dependency updates and code review.

No system is completely secure. If we suffer a personal-data breach with risk to your rights, we will notify the supervisory authority within 72 hours (Art. 33 GDPR) and, where the risk is high, we will notify you directly (Art. 34 GDPR).

11. Cookies and similar technologies

The mobile app does not use cookies. The web app at play.table-online.ro uses only:

• Strictly necessary local storage (your authentication token, your device ID, your language preference). These are exempt from consent under Article 5(3) of the ePrivacy Directive.
• Optional analytics and advertising — only loaded after you accept on the consent banner.

A separate Cookie Notice is available at play.table-online.ro/cookies.

12. Advertising and consent

We show rewarded video ads on iOS and Android. We do not show ads on the web.

• For users in the EU/EEA/UK, we use Google's User Messaging Platform (UMP) to obtain consent before serving personalised ads. If you do not consent, we either show non-personalised ads (still using the AdMob SDK but without behavioural profiling) or no ads at all.
• On iOS 14.5+, we follow Apple's App Tracking Transparency: we will not request your IDFA without showing the ATT prompt and obtaining your permission.
• You can change your ad preferences at any time in Settings → Privacy → Ad preferences.
• The same consent form sets the four Google Consent Mode signals for Firebase Analytics: analytics storage, ad storage, ad user data and ad personalisation. Until you answer, all four are denied. While analytics storage is denied, the mobile app still sends usage events to Google — for example app opens, games played and purchases — but without any device or user identifier, so they cannot be linked to you or your device; Google uses them for aggregate reporting and statistical modelling of our analytics and of our own ad campaigns. While ad storage and ad user data are denied, no advertising identifier is collected and your data is not used for advertising. Once you consent, events are linked to a pseudonymous app-instance ID and your user ID, so that we can understand how the app is used over time. The web app sends no analytics at all until you accept (§11).
• The same consent form also governs install attribution: we obtain your consent for AppsFlyer there, and your answers are read from the form's standard storage by its SDK. Where consent is required — in the EU/EEA/UK — we do not start the AppsFlyer SDK until you allow it, so no attribution takes place and an invite link you tapped is not recognised; the app offers you a field to type the invite code by hand instead. Outside those regions no consent form is shown and attribution runs on the basis described in §4. Allowing it starts the SDK and the collection described in §3.2. Withdrawing consent in Settings → Privacy stops it again; withdrawal takes effect from that moment and does not affect processing already carried out, which you can address through your rights in §9.
• The same form also governs advertising measurement for our TikTok campaigns. The TikTok SDK runs only while ad storage is allowed: in the EU/EEA/UK that means you allowed ads on the form; outside those regions no form is shown and it runs on the basis described in §4. On iOS, TikTok receives the IDFA only if you also allowed tracking in Apple's prompt. Withdrawing consent in Settings → Privacy switches the SDK off from that moment; withdrawal does not affect processing already carried out.

13. Automated decision-making

We do not make decisions affecting you that are based solely on automated processing (Art. 22 GDPR). All bans and moderation actions are reviewed and applied by a human administrator.

14. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top will reflect the most recent change. If we make material changes, we will notify you in-app and, where we have your email, by email.

15. Contact

Questions, requests, or complaints:

• Privacy email: privacy@table-online.ro
• General support: support@table-online.ro
• Postal address: TAGONSOFT SRL, Str. Clopotari 6, Cod 700706, Iași, Romania

You also have the right to contact your local data-protection authority (in Romania: ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, https://www.dataprotection.ro).