Version française

Privacy Policy - Spiky

Last updated: November 6, 2026

Spiky is a party game with several game modes, to play with friends or as a couple, published by Chouic SAS for iOS and Android. This policy explains what data the app collects, why, with which providers, for how long, and how to exercise your rights.

Our principle is simple: we only ask for what the app needs to work. Spiky can be played without an account, shows no ads, does not sell your data and does not track you across other companies' apps or websites.

This policy covers the Spiky app only. The chouic.com website has its own privacy policy (in French).

Data controller

• Chouic SAS
• 12 rue Racine, 44000 Nantes, France
• SIREN 813 825 395 · SIRET 813 825 395 00045 · RCS Nantes 813 825 395
• Contact about your personal data: our contact form (page in French)

What is stored on your device

The following is stored on your phone. It is not sent to our servers, except in the cases described further down:

• the player names you enter (attached to support requests, see "Support");
• your answers to the starting questionnaire (playing as a couple or with friends, who you are playing with, the vibe of the night) and your settings (language, sound, vibration, read aloud, etc.), whose changes are counted by analytics (see "Analytics");
• the number of challenges played, which is used to pick your notification topics and is attached to support requests (see "Notifications" and "Support");
• your privacy choice (see "Analytics").

Uninstalling the app erases all of it.

Analytics

To understand how Spiky is used and improve it, the app uses Google Analytics for Firebase. It receives:

• usage events: screens viewed, games played, answers to the starting questionnaire, settings changes;
• the app language, your test group (read aloud on or off by default) and whether notifications are allowed;
• technical information about your device and an app instance identifier.

The app does not collect your device's advertising identifier (that collection is turned off), shows no ads, does not track you across other companies' apps or websites, and does not attach any user ID to this data.

Analytics is active from the first launch.

If your device is set to a country of the European Union or the European Economic Area, a "Your privacy" window appears the first time you tap "LET'S GO!". You can tap "Accept", or "Customize my preferences" to opt out of analytics: collection stops immediately and stays off on later launches. Crash reports, support and purchases work whatever you choose.

You can change your mind at any time in "Settings", then "Manage my privacy preferences". Your choice is kept for 13 months, after which you are asked again.

Outside the European Union and the European Economic Area, this window is not shown. You can ask us to opt you out of analytics through our contact form.

Crash reports

If the app crashes, Firebase Crashlytics sends us a report: device model, operating system and app versions, and the state of the app at the time of the crash. For installations coming from the previous version of Spiky, the report also includes a random identifier specific to the installation, which does not directly identify you.

These reports are used to fix bugs and are necessary for the app to work. They are kept for 90 days.

Custom challenges and account

You can write your own challenges in "Custom challenges". They are stored on your device and backed up to Firebase Realtime Database, on servers located in Europe (europe-west1 region, Belgium). This backup is tied to an anonymous Firebase identifier, created the first time a challenge is saved.

Your custom challenges stay private: they are never published or shared with other players.

To get your challenges back on another device, you can sign in from "Settings", then "Sign in", with "Continue with Google" or "Continue with Apple". We then receive your email address (or the relay address provided by Apple if you choose to hide yours) and your account identifier. We do not ask for your age, gender or any other information.

Information emails

When you sign in with Google or Apple, your email address, your account identifier, the app language and your operating system (iOS or Android) are added to the Spiky contact list at Mailjet (Mailjet SAS, France), which sends our emails on our behalf. Chouic may use this list to send you information emails about Spiky.

You can unsubscribe at any time using the link in every email, or through our contact form. Deleting your account also deletes your Mailjet contact.

Your feedback on challenges

On each card you can tap "I like it" or "I don't like it", or "Skip the challenge" with an optional reason. This feedback is sent with the language, the pack and the challenge identifier, then stored as aggregated monthly counters with no identifier linked to you. These counters help us improve the content.

Notifications

To send you notifications, the app uses Firebase Cloud Messaging, which assigns a notification token to your device. The device is subscribed to topics based on the app language, the number of challenges played (fewer or more than 50), your status (free or subscriber) and your operating system (iOS or Android).

Permission to send notifications is requested by your operating system; you can withdraw it at any time in your phone's settings.

Subscriptions and purchases

Buying and paying for a subscription goes through the App Store or Google Play: Chouic never receives your payment details.

Purchasely (Purchasely SAS, France) displays the offers and manages your subscription status. It processes an anonymous Purchasely identifier (linked to the app's Firebase instance identifier), the app language, and your purchase and subscription history.

Support

Help, the FAQ and the chat with our support team ("Settings", then "Contact us") are provided by Helpshift (Helpshift, Inc., United States).

When you open them or write to us, Helpshift receives your messages, together with technical information attached automatically to help us handle your request: Firebase and Purchasely identifiers, notification token, number of challenges played, the player names you entered, whether you are signed in to an account, your subscription status, the app language and data about your device.

This information is kept for as long as needed to follow up on your request.

Unlock code

If our support team gives you an unlock code or link, the app sends it to Chouic's server (api.chouic.com) to activate it.

Transferring your old challenges to Truth or Dare

Custom challenges created in the previous version of Spiky can no longer be used in the new one. At your request (the "Open Truth or Dare" button), Spiky creates a transfer link valid for 7 days. Your old challenges are copied into your account in the Truth or Dare app, another Chouic app, then deleted from Spiky.

Chouic keeps a record of this transfer: the identifiers of both accounts, the date and the number of challenges transferred.

Reading challenges aloud

The "Read aloud" feature uses the speech synthesis built into your device (iOS or Android). Chouic receives no data when it is used.

Remote configuration

To adjust some app settings without publishing a new version, the app uses Firebase Remote Config, which processes the Firebase installation identifier. No personal data is involved.

Legal bases

Each processing activity relies on a legal basis provided by the GDPR:

• performance of the contract: running the app, backing up your custom challenges, managing your subscription, answering your support requests, activating an unlock code, transferring your old challenges;
• our legitimate interest: fixing bugs, improving the content thanks to your feedback, keeping you informed about Spiky by email and, outside the European Union and the European Economic Area, measuring the app's audience;
• your consent: analytics in the European Union and the European Economic Area, and notifications.

Providers and transfers outside the European Union

To work, Spiky relies on providers that act on our behalf and only access data as far as their service requires:

• Google (Firebase: analytics, crash reports, authentication, database hosted in Europe, server functions, notifications, remote configuration): Google privacy policy;
• Apple and Google, for account sign-in and for the stores (App Store, Google Play);
• Purchasely (subscriptions): Purchasely privacy policy;
• Helpshift (support): Helpshift privacy policy;
• Mailjet (information emails): Mailjet privacy policy.

Google and Helpshift may process data outside the European Union, in particular in the United States. These transfers are governed by the European Commission's standard contractual clauses and, where applicable, by the EU-US Data Privacy Framework.

We do not sell your data, do not pass it on to anyone for advertising purposes and do not build any advertising profile. Spiky does not use Apple's App Tracking Transparency prompt, because it does not track you.

Retention periods

• account, backed-up custom challenges and Mailjet contact: until you delete your account;
• analytics: 14 months at most;
• crash reports: 90 days;
• privacy choice: 13 months;
• transfer link to Truth or Dare: 7 days;
• support requests: as long as needed to follow up on them;
• data stored on your device: until you uninstall the app.

Delete your data

If you are signed in with Google or Apple: in "Settings", open "My account", tap "Delete my account" and confirm. Your account, the custom challenges backed up on our servers and your Mailjet contact are deleted, and your challenges are erased from the device. This cannot be undone.

If you have no Google or Apple account (anonymous backup), or for any other data (support requests, analytics, transfer record), send us your request through our contact form (page in French; you can write in English). To help us find your data, you can paste your installation identifiers: in "Settings", a long press on "Privacy Policy" copies them to the clipboard.

Data stored only on your device disappears when you uninstall the app.

Your rights

Under the General Data Protection Regulation (GDPR), you have the following rights over your personal data:

• right of access;
• right to rectification;
• right to erasure;
• right to object;
• right to restriction of processing;
• right to data portability;
• right to withdraw your consent at any time, where processing is based on it;
• right to lodge a complaint with the CNIL, the supervisory authority in France.

To exercise these rights, write to us through our contact form.

Changes to this policy

This policy may change, in particular to reflect changes in the app or in regulations. Any change will be published on this page, with the date at the top updated. We invite you to check it regularly.

Contact us

For any question about your personal data or about Spiky, use our contact form or write to Chouic SAS, 12 rue Racine, 44000 Nantes, France. In the app, "Settings" then "Contact us" opens our support.

The app's terms of use are available on the Spiky terms of use page.