Punxo Privacy Policy
Effective date: 3 November 2026
Punxo (“Punxo”, “we”, “us”) is operated by Alexandru-Gabriel Birchi (“Alex Birchi”), an individual based in Craiova, Romania, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Contact: support@punxo.com. Our full postal address is available on request at that address.
This policy explains what personal data Punxo collects, why, who can see it, how long we keep it, and the rights you have. It covers the Punxo app and the punxo.com website.
1. What Punxo is (and isn’t)
Punxo is an entertainment game. You play short mini-games, and from your choices and timing we compute a playful personal “fingerprint” (trait scores and an archetype) that you can reveal, share, and compare (“Sync”) with people whose code you have. It also runs weekly picks and skill games with a scoreboard among your connections.
Punxo is not a psychological, clinical, diagnostic, or psychometric assessment, and its results are for entertainment only (see the Terms of Service). We do not use your results to infer your health, beliefs, or any other sensitive characteristic.
2. Data we collect
We collect only what the app needs to work. You give us most of it by playing; nothing is collected from other sources.
Your account
- Email address. Punxo has no passwords: you sign in with a one-time code we email you.
- Birth year. Only the year, never your full date of birth. It is used only to check that you meet the minimum age and whether a parent or guardian needs to agree (§11), and is never shown to anyone.
- Parent or guardian agreement. If you could be under 16, the date your parent or guardian’s agreement was confirmed in the app (§11).
- Display name (any name you choose, not necessarily your real one), shown to people who
have your code, and your identity code (shown as
XXXX-XXXX), a random code generated for you so others can add you. - Social profiles, if you add them: your Instagram, TikTok, or Snapchat username, shown only to people you are linked with.
- Your settings, such as whether new connection links are allowed.
What you do in the game
- Test answers. Your choice for each question and, for the reaction game, your reaction times. These are the raw inputs from which your trait scores and archetype are computed.
- Your Punxo: your trait scores and archetype. When you retake the test, your previous scores and archetype are kept as a private snapshot, visible only to you, and the previous answers are deleted.
- Weekly picks: the picks you publish each week, the predictions you make about other people’s picks, and the scores those predictions earn.
- Skill games (the scored mini-games that rotate each week): for each run, the game’s starting seed, the timing of your taps, and the resulting score, so the server can replay the run and check it; your best score for each week the game runs and your all-time record.
- Daily duels: who you are paired with each day, your best score that day, the result, and which duel notifications you have had; and the day you last opened the app, which decides who is paired with whom and pauses duel notifications while you are away.
- Connections: whose code you entered and when, mutual links, when you last looked at each connection (to show what is new), and the archetypes you have discovered through them.
- Scan notifications: when you choose to let someone you scanned know it’s you, who you told and when, and whether they have seen or dismissed it; the same for notifications others send you.
- Blocks: who you blocked and when, so the block holds and you can undo it.
- Notifications, if you allow them on a phone: that phone’s push token (an identifier its notification service issues to Punxo, so a notification can reach it) and its time zone, so weekly game notifications arrive in the evening where you are; and, for the “connections passed you” notification, who in your list was ahead of you in the week’s game when you last played or were last told, and how many of these notifications you have had that week.
Messages and technical data
- Emails you send us, such as a support question or a report about another person (the app’s “Report this person” opens an email to us with that person’s code). We receive your email address and whatever you write.
- Technical data handled by our infrastructure providers: IP address, device and request information, and server logs, used for security, abuse prevention, and keeping the service running. We also keep simple per-account counters to enforce rate limits.
- Crash reports: when the app crashes or hits an error it did not expect, it sends a report of what failed (the error, the code it happened in, the screens and requests just before it), with the app version and the device model and system version. Reports carry no name, email, or IP address, and are used only to fix bugs.
On your device. Your first test runs before you have an account: its answers, your birth year, and your display name stay on your device until you sign in, and nothing is sent to us before then except a request to download the current test. The app also keeps a copy of your recent data on the device so it opens quickly and works offline.
What we don’t collect. No contacts, photos, precise or approximate location (a phone’s time zone, if you allow notifications, is the only hint of where you are), microphone, or camera access, and no biometric data. Punxo contains no advertising and no third-party analytics or tracking, and the website sets no tracking cookies.
3. Why we use it, and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account, signing you in, and providing the game: scoring your test, Sync, connections, weekly picks, skill games, and scoreboards | Performance of our contract with you (the Terms), Art. 6(1)(b) |
| Sending the notifications you allow: a new link, someone revealing their scan to you, and the week’s game | Performance of our contract with you, Art. 6(1)(b). Your phone asks before any are sent, and you can turn each kind off in its settings at any time |
| Checking the minimum age, and recording a parent or guardian’s agreement for anyone who could be under 16 | Performance of the contract and our legal obligations, Art. 6(1)(b) and (c) |
| Security, preventing abuse and cheating (rate limits, replaying game runs, handling reports and blocks) | Our legitimate interest in a safe, fair service, Art. 6(1)(f) |
| Improving the game, for example seeing how each test question performs across all players | Our legitimate interest in improving Punxo, Art. 6(1)(f). Analysis is done on aggregated data, never to single you out |
| Answering your emails and requests | Performance of the contract, or our legitimate interest in helping you, Art. 6(1)(b) and (f) |
| Complying with the law and defending legal claims | Legal obligation and legitimate interest, Art. 6(1)(c) and (f) |
Where we rely on legitimate interests, you can object (§10). Your trait scores and archetype are produced automatically from your answers, but they are entertainment and have no legal or similarly significant effect on you, so no decision about you is made by automated means.
We do not sell your personal data, share it for advertising, or use it to profile you outside the game’s own features.
4. What other people can see
Only someone who has your identity code can find you in Punxo; there is no public directory or search. People who have added your code see:
- your display name, identity code, and archetype card, with any cosmetics you have put on it (what you have unlocked stays private);
- their Sync percentage with you and how close you are on each trait (computed on our servers; your trait scores themselves are never sent to them, though how close you are on a trait, set against their own score, tells them roughly where you sit on it);
- whether the two of you are linked, whether you have published this week’s picks (so they can predict them), your best score in this week’s game (on their scoreboard and your card), and a “New” marker when you have something new, such as a retake or new picks.
If you are linked (you have each added the other), each of you also sees the other’s score from predicting your weekly picks, any social profiles the other added (tapping one opens that app or website, where its own privacy policy applies), and on a day the two of you are paired in a daily duel, your best score that day, which tells them you played that day. People who predict your picks see only their own score, never your picks. Links are on by default; turn off “Allow connection links” in Settings to stop new ones forming, and removing or blocking someone ends a link.
The “scanned your Punxo” number is an anonymous count of people who currently keep you in their list. It never reveals who they are.
Revealing your scan. Scanning is silent unless you choose otherwise: right after you scan someone, you can tap Reveal your scan. That person then sees your display name and identity code in their inbox, so they can scan you back, and nothing else (not your card, your Sync, or your scores). You can do this at most once a week per person, and removing them takes a notification they have not answered back. Others can let you know in the same way; you can scan them back, dismiss it, or block them.
Notifications tell you only what the app already shows you: the name of someone who linked with you or revealed their scan to you, the week’s game, and the score of the person you are dueling that day. A notification that connections passed you in a game gives only how many, never who.
Nobody else ever sees your email, birth year, individual answers, trait scores (only how close you are on each, as above), past snapshots, the list of people you added, or your blocks (a person you block is never told). People cannot message you in Punxo.
Sharing your card. You can share an image of your card through your phone’s share sheet. The image is made on your device, and once you share it, where it goes is up to you and the service you share it to.
5. Who we share data with
We use service providers (“processors”) that handle data only on our instructions and under a data processing agreement:
- Supabase (Supabase Inc.): authentication, database, and server functions. Your account and game data are stored on its servers in London, United Kingdom.
- Resend (Plus Five Five, Inc., United States): delivers the sign-in code emails, so it receives your email address and the email it sends.
- Google (Google LLC, United States, through Firebase Hosting): hosts the punxo.com website, and so processes the IP address and request data of website visitors.
- Sentry (Functional Software, Inc., United States): receives the app’s crash reports, stored on its servers in the European Union (Germany).
- Expo (650 Industries, Inc., United States): builds the app and delivers its updates, so it receives the app’s update checks (IP address, app version, and platform). It also sends the app’s notifications, so it receives each phone’s push token and each notification’s text, which may include the display name of the person it is about.
- Google (through Firebase Cloud Messaging) on Android phones, and Apple (through the Apple Push Notification service) on iPhones, deliver those notifications to the phone, and so receive the same token and text.
- Our email provider, which hosts the punxo.com inbox that receives your emails.
Apple and Google distribute the app through their stores and process data about your download and device under their own privacy policies, as independent controllers; we receive only aggregated statistics and the crash reports their stores provide.
We may also disclose data when the law requires it, or where needed to enforce our Terms or to protect the rights, safety, and security of our users or others. If Punxo is transferred to a company (for example, one we set up to run it), your data moves with it under this policy, and we will tell you.
New features (such as in-app purchases) may add providers; we will update this policy before they start.
6. International transfers
Your data is stored in the United Kingdom, which the European Commission recognises as providing adequate protection. Some providers (such as Resend, Google, Sentry, and Expo) are based in the United States or may process data there; those transfers are protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission’s Standard Contractual Clauses.
7. How long we keep it
- Your account and game data: while your account exists.
- Unfinished sign-ups: if a sign-in code for a new email is never entered, the account started for it is deleted after 7 days.
- Previous test answers: deleted when you retake the test (only the private score snapshot stays, until you delete your account).
- Weekly picks and weekly game scores: deleted 12 weeks after the week they belong to ends, with the predictions and guesses about them. All-time game records stay while your account exists.
- Daily duels: each day’s duel (who you were paired with, your scores, the result, and the duel notifications) is deleted 12 weeks after that day. Your duel record (how many duels you won, lost, and tied, in all and against each person) stays while your account exists.
- Push tokens and time zones: until you log out on that phone, turn notifications off and the token stops working, or the phone is replaced by newer ones (we keep an account’s five most recently used phones). What the “passed you” notification remembers goes with the week’s game scores.
- Your emails to us: kept as long as needed to handle them, and deleted within 12 months of the matter being closed unless needed for a legal claim.
- Server logs and crash reports: kept by our providers for a short period, generally no longer than 90 days.
When you delete your account, your account and everything that belongs to it (profile, answers, scores, picks, game results, duels, connections, links, social profiles, scan notifications, blocks, and push tokens) are deleted from our database immediately. Copies in our provider’s backups are overwritten within 30 days.
8. Security
Data is encrypted in transit (HTTPS/TLS). Access rules in the database (row-level security) mean each account can reach only its own data, and only our servers can reach data meant for nobody else. No system is perfectly secure, but we work to protect your information, and if a breach puts your data at risk we will notify you and the authorities as the law requires.
9. Deleting your account
In the app, go to Settings → Delete account. This permanently deletes your account and all its data (§7). If you can’t open the app, email support@punxo.com from your account’s address and we will delete it for you. More at punxo.com/support.
10. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it;
- correct it (you can change your display name and social profiles in the app; we can fix anything else);
- delete it (§9);
- restrict its processing, or object to processing based on our legitimate interests;
- receive the data you gave us in a portable format (data portability).
To use any of these, email support@punxo.com from your account’s address. We answer within one month, and may need to confirm the request comes from you. Using your rights is free and never affects how you are treated in the game.
You also have the right to complain to a data protection authority. In Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), dataprotection.ro; you may also contact the authority in the country where you live or work. We would appreciate the chance to sort out any concern first.
If you live in a US state with a privacy law (such as California), you have similar rights to know, delete, and correct your data, which you can use the same way. We do not sell or share personal data as those laws define it.
11. Young people
Punxo is only for people aged 13 or older. The app asks for your birth year and does not let anyone younger create an account. We do not knowingly collect data from anyone under 13; if you believe someone under 13 is using Punxo, tell us at support@punxo.com and we will delete their account.
If you are 13 to 15, a parent or guardian must agree to the Terms and this policy before you play, and the app asks you to confirm they did; we keep the date of that confirmation. Punxo is built to be safe at this age, for everyone: nobody can find you without your code, nobody can message you in Punxo, social profiles you add are shown only to people you are linked with, it has no advertising or tracking, it never asks for your location, contacts, or photos, and your email and birth year are never shown to anyone. A parent or guardian can use the rights in §10 on their child’s behalf, including asking us to delete the account.
12. Changes to this policy
We may update this policy as Punxo changes. The current version is always at punxo.com/privacy with its effective date, and we will tell you in the app or by email before a significant change takes effect.
13. Contact
Questions or requests: support@punxo.com, Alex Birchi, Craiova, Romania.