Privacy Policy

This Privacy Policy explains how Zivo IT B.V., trading as DeAppFabriek, collects, uses, stores and protects personal information when you use The Button: Just Press.

We respect your privacy and aim to collect only the information necessary to operate and improve the game.

This policy applies to The Button: Just Press, including its public release and TestFlight testing.

The Button: Just Press is developed under the DeAppFabriek trading name. The data controller is:

We may process the following information:

Account Information

Information required to create, authenticate and maintain your account, such as account identifiers and authentication information.

Username

The username you choose when registering.

Game Activity

Your personal press count, server-verified presses and worldwide counter contributions.

Game Progress

ButtonCoins balances, inventory, achievements, equipped items and in-game purchases.

Moderation Information

Reports about inappropriate usernames, moderation decisions and information necessary to prevent abuse.

Presence Identifiers

While the app is connected, Supabase Realtime Presence uses your stable pseudonymous account identifier as its channel key and in its presence payload. Other connected clients receive that identifier to deduplicate online players. The app displays only the Players Online count; this is not a new random identifier for each visit.

Technical Information

Limited technical information needed for security, authentication, troubleshooting and abuse prevention. This may include IP addresses, device information and technical logs where processed by our service providers.

We use personal information to:

• Create and manage accounts.
• Authenticate users.
• Operate the game.
• Maintain personal and worldwide counters.
• Display leaderboard rankings.
• Manage ButtonCoins and inventory.
• Save achievements and progress.
• Prevent fraud and abuse.
• Moderate usernames.
• Respond to support requests.
• Maintain the security and reliability of the service.

We do not sell personal information.

Under the GDPR, we process personal data where necessary on the following bases:

Performance of a Contract

To provide the game, account functionality and associated services.

Legitimate Interests

To maintain security, prevent abuse, moderate usernames and improve service reliability.

Legal Obligations

Where processing or retention is required by applicable law.

Consent

Where legally required for optional processing activities.

You may contact us for information about the legal basis that applies to your data.

The game includes a public leaderboard. Your username and server-verified press count may be visible to other players.

The leaderboard interface displays your chosen username and accepted score. Authentication credentials are not displayed. Presence separately shares a pseudonymous account identifier with connected clients, as explained above.

Please choose a username that does not reveal personal information. Players can report and hide inappropriate usernames.

The app uses the following services:

Supabase

Authentication, database hosting and application backend services.

Microsoft 365 Support

If you email support@deappfabriek.nl, we process your sender address, message and any attachments in a dedicated Microsoft 365 mailbox. Access is restricted to the two designated support operators. Please do not send passwords or unnecessary sensitive information.

Apple

App distribution, TestFlight and StoreKit integration. When you use TestFlight, Apple collects testing information, including usage and crash information, and makes testing information and feedback available to the developer under its TestFlight terms. This testing channel is separate from the public App Store release.

Google AdMob

The Google Mobile Ads and User Messaging Platform SDKs are bundled. Production ad loading and rewarded advertisements are disabled in version 2.0 (2). Disabled ad loading alone does not establish that a bundled SDK processes no technical data; its privacy disclosures and actual operation must be assessed before advertising is enabled.

These providers may process technical information according to their own privacy policies and applicable contractual arrangements.

In version 2.0 (2):

• Production advertisements are disabled.
• Rewarded advertisements are disabled.
• Real-money purchases are disabled.
• No cash prize or physical golden-button prize is offered.

The app includes ButtonCoins and cosmetic items. When advertising or real-money purchases become available, this Privacy Policy will be updated to describe the additional processing.

We aim to keep personal information no longer than necessary. Our intended retention periods are:

Active Account Data

Account information, usernames, game progress, inventory and balances are retained while the account remains active.

Deleted Accounts

After a confirmed successful account-deletion request, the account and associated owned data are removed from active application systems in a single server transaction. Limited deletion-reconciliation receipts can remain for 30 days. Aggregate worldwide press totals remain.

Moderation Reports

Moderation reports may be automatically cleaned up 90 days after the moment a report is submitted. Open reports and reports subject to an active investigation hold are excluded for as long as further retention is necessary.

Automated Database Cleanup

Our database runs a daily automated cleanup procedure for data covered by our retention policy. We cannot guarantee that every automated run always completes successfully.

Support Requests

Resolved support messages are automatically deleted one year after resolution. Separate provider-backup retention and applicable legal preservation requirements may apply.

Backups

The current Supabase Free project does not include managed scheduled project backups. Restricted local operational backups are retained separately. Our local target is 30 days; cleanup is manual and protected originals require separate review. We do not promise automatic deletion of every backup after 30 days. Contact us for details.

Security Logs

Authentication sessions retain IP addresses and user-agent information for operation and security. The current Supabase Free plan provides a one-day API/database log-access window according to its published plan. This is not a guarantee that all provider-internal records are erased after one day, and it does not shorten the separate retention of authentication-session records. Contact us for details.

Legal Exceptions

Certain information may be retained longer where necessary to comply with legal obligations, resolve disputes or prevent serious abuse.

You can request account deletion directly in the app via Profile → Settings → Delete Account. After confirmation:

• Type DELETE and confirm the request in the app.
• The server validates the current session and removes the account and associated owned data atomically when deletion succeeds.
• The profile and public username are removed; authentication sessions are revoked.
• Local account data is cleared only after server confirmation. A failed request must not be treated as successful deletion.
• Existing aggregate worldwide totals are retained; they are not a personal account profile.
• Limited deletion receipts remain for up to 30 days; protected legal or financial cases may require support instead of automatic deletion.

A successful request deletes active account data directly rather than merely scheduling it. Residual information may temporarily remain in backups until those backups expire, as described under Data Retention, and information may be retained where legally required.

You can also contact support@deappfabriek.nl for assistance with account deletion.

We use appropriate technical and organisational measures to protect personal information, including:

• Secure authentication.
• Access controls.
• Database-level security policies.
• Restricted administrative access.
• Server-side validation.
• Protection against unauthorized transactions.
• Security monitoring.

No internet service can guarantee absolute security.

Some third-party providers may process information outside the European Economic Area. Where international transfers occur, we rely on applicable legal safeguards, such as adequacy decisions or Standard Contractual Clauses where appropriate.

Under the GDPR, eligible users have rights including:

• Access to personal information.
• Correction of inaccurate information.
• Erasure of personal information.
• Restriction of processing.
• Objection to certain processing.
• Data portability where applicable.
• Withdrawal of consent where processing relies on consent.

To exercise these rights, contact support@deappfabriek.nl. You may also submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

The Button: Just Press is intended exclusively for users aged 18 and older. The app is not intended for children, and users must be at least 18 years old to use the service.

If we become aware that an account belongs to someone under 18, we may restrict access and delete associated personal information where appropriate.

We may update this Privacy Policy when our services, technology or legal obligations change. Material changes will be communicated where required.

Last updated: October 27, 2026.

For privacy questions, account deletion requests or support:

Support: https://deappfabriek.nl/the-button/support