Privacy

Privacy Policy

Effective 4 November 2026

Norppa is built to collect as little as possible. This policy explains exactly what we collect, why, who can see it, how long we keep it and how you can delete it. It covers the Norppa iPhone app and this website.

Who we are

Norppa is made by Verneri Marjala, an independent developer in Finland, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). “We” and “us” in this policy mean Verneri Marjala.

Contact: [email protected]
Postal address: Pakkahuoneenkatu 24 A 9, 90100 Oulu, Finland

What we collect

Norppa works mostly on your phone. Only the things needed for your account, your friends and the leaderboards are sent to our server:

Data	What it is	Who can see it
Account ID	A random ID created automatically the first time you open Norppa, plus a sign-in key stored on your phone. No email, phone number or password.	Only us
Display name	The name you type in (up to 20 characters). A nickname is fine. Names that break the rules are rejected.	Your friends and the members of your crews
Friend code	A random 6-character code we create for you.	Anyone you share it with
Streak	The day your current streak started and your best streak.	Your friends and crews see your current streak
Thinking events	Each time you finish “Think first”: which choice you made (figured it out yourself, thought first and then opened AI, or skipped), when, and the points it gave. Not what you typed.	Only us
Weekly points	Your points per week and how many times you chose each option.	Your friends and crews see your weekly points
Friends	Who you have added as a friend, and when.	You and that friend
Crews	The crews you create or join: crew name, crew code, members and when they joined.	Members of that crew
Reports	If you report a person or a crew name: what you reported, the reason you chose (offensive name, cheating or something else), the name at that moment, and when. The person you report never sees who reported them.	Only us
Blocks	The people you have blocked.	Only you. The person you block is not told.
Subscription	Whether you have a subscription or a free trial, which plan, and when it renews or ends. Apple handles the payment: we never see your card details.	Only us and RevenueCat
Technical data	When the app talks to our server, the server records technical details such as your IP address, the time and the request, to keep the service secure and working.	Only us and our server provider

We don't collect your real name, email, phone number, contacts, location, photos, advertising ID or browsing history.

What stays on your phone

These never leave your phone and we can't see them:

What you type in “Think first” (your question and your own answer). It isn't saved anywhere, not even on your phone, and disappears when you leave the screen.
Your lake, its water level, rain days and treasures, your answer to “How much do you use AI?”, and your settings.
Screen Time. Blocking uses Apple's Screen Time framework. When you choose which apps and websites to block, iOS gives Norppa only anonymous tokens: we can't see which apps you chose, how long you use them, or anything else you do on your phone. Screen Time data stays on your phone. We never use it for advertising or analytics, and we never sell or share it.
Notifications. If you allow them, tapping Open AI on the block screen sends you a notification that opens Norppa. The notification is created on your phone. We don't send notifications from a server and don't receive a notification token.

If you delete the app, this data is deleted with it.

Why we use it (and our legal basis)

Purpose	Data	Legal basis (GDPR)
Run your account, streak, friends, crews and leaderboards	Account ID, display name, friend code, streak, thinking events, weekly points, friends, crews	Contract: it is the service you asked for (Art. 6(1)(b))
Run your subscription and free trial	Account ID, subscription	Contract: it is the service you asked for (Art. 6(1)(b))
Keep leaderboards fair, e.g. limit how many points you can earn per day	Thinking events, weekly points	Legitimate interests: a fair game for everyone (Art. 6(1)(f))
Keep Norppa safe: reject offensive names, handle reports, let you block people	Display name, crew names, reports, blocks	Legitimate interests: a safe community for everyone (Art. 6(1)(f))
Keep the service secure and working, stop abuse	Technical data, account ID	Legitimate interests: security (Art. 6(1)(f))
Answer your messages	Your email and what you write to us	Legitimate interests: helping you (Art. 6(1)(f))
Meet legal obligations	Whatever the law requires	Legal obligation (Art. 6(1)(c))

We don't use your data for advertising, we don't build marketing profiles, and we don't make automated decisions that have legal or similarly significant effects on you.

Transfers outside the EU

Your account data is stored in the EU. Some service providers are based in the United States: RevenueCat stores subscription data there, Cloudflare may process website visits and emails there, and Supabase may access data to run and support its service. These transfers are protected by the EU–US Data Privacy Framework (where the provider is certified under it), the European Commission's Standard Contractual Clauses or another safeguard approved under the GDPR. You can ask us for a copy of the safeguards.

How long we keep it

Data	How long
Account, display name, friend code, streak, weekly points, friends, crew memberships	Until you delete your account. If you don't open Norppa for 24 months, we delete your account automatically.
Thinking events	35 days, then they are deleted automatically. Your weekly points stay.
Crews	Until the last member leaves. Then the crew is deleted.
Reports	Until we have handled them, and then 12 months, so that we can spot repeated abuse. Then they are deleted automatically.
Blocks	Until you unblock the person, or until either of you deletes your account.
Subscription	As long as your account exists. Apple keeps its own purchase records under Apple's privacy policy.
Technical data (server logs)	Up to 7 days
Backups	Up to 7 days
Messages you send us	24 months after the matter is closed

Delete your data

In the app: Settings → Delete account and data. This immediately deletes your account, display name, friend code, streak, thinking events, weekly points, friends, crew memberships and blocks from our server, and resets the app on your phone. Crews you created are deleted if nobody else is in them. Otherwise they stay without you. Reports you have made stay, without your account ID, until they are handled.

Deleting the app from your phone does not delete your account on our server. Because your account has no email or password, we can't find it unless you tell us your friend code. If you have already deleted the app, email us at [email protected] with your friend code (if you know it), and we will delete the account.

Other choices: you can turn off Norppa's Screen Time access in iPhone Settings → Screen Time, and remove a friend, block someone or leave a crew in the app at any time.

Your rights

Under the GDPR you have the right to:

get a copy of your personal data (access),
have it corrected (for example, email us and we'll change your display name),
have it deleted,
restrict or object to how we use it,
receive the data you gave us in a machine-readable format (portability).

Email [email protected] and include your friend code, so we can find your account. We'll answer within one month.

You also have the right to complain to a data protection authority. In Finland that is the Data Protection Ombudsman (tietosuoja.fi). You can also contact the authority in the EU country where you live.

Children

Children under 13 may use Norppa only with permission from a parent or guardian. Norppa collects as little as possible from everyone: no real name, email, phone number or location. If you are a parent or guardian and want your child's account deleted, contact us and we'll delete it.

Security

All traffic between the app and our server is encrypted (HTTPS). The database is locked by default: the app can only use checked functions that let you see your own data and the small part of your friends' data described above. There are no passwords to leak. No system is perfectly secure, but we do our best and will tell you without undue delay if a breach puts your data at risk.

This website

This website uses no cookies, no analytics and no trackers, and loads nothing from other companies (even the fonts are served from our own site). The site is hosted by Cloudflare, which processes technical details such as IP addresses to deliver the pages and protect against attacks. We don't keep visitor logs ourselves. Cloudflare's own privacy policy applies to what Cloudflare does.

Features that are coming

We will update this policy before any of these features is released, and tell you about the change in the app:

Sign in with Apple: an Apple user ID so that you can keep your account on a new phone.

Changes to this policy

If we change this policy, we update the date at the top. If the change is important, we tell you in the app before it takes effect. Earlier versions are available on request.

Contact

Questions about privacy: [email protected]
Verneri Marjala, Pakkahuoneenkatu 24 A 9, 90100 Oulu, Finland