Privacy Policy

1. Introduction

KeySeek (the "App") is a Catholic educational quiz game, part of the Jubilee33 (JB33) experience, operated by Marian Devotional Movement Trust ("The MDM", theMDM.org). The MDM is the data controller responsible for the personal information described in this Privacy Policy. This policy explains how we collect, use, share, and protect your personal information when you use the App.

2. Information We Collect

We collect the following information when you create an account and use the App:

• Account Information: Name, email address, and password (stored securely using industry-standard hashing).
• Profile Information: Gender, birthday, country, state/province, and city (optional, provided at your discretion).
• Gameplay Data: Quiz scores, round progress, badges earned, Ask Mary credits, and leaderboard rankings.
• Technical & Security Data: IP address and device/browser user-agent, collected automatically when you play a round or submit a Vault entry. We use these to keep the game fair (anti-cheat), prevent abuse and fraud, and protect the integrity of your session and the leaderboard.
• Device Information: Device model name (e.g. "iPhone 15"), used only to label your active sessions. This is not a unique device identifier.
• Language Preference: Your selected display language.

3. How We Use Your Information

• To create and manage your account.
• To provide gameplay functionality, including quiz sessions, scoring, and progress tracking.
• To display leaderboard rankings to all users.
• To keep the game fair and secure (anti-cheat and fraud prevention).
• To personalize your experience (language, avatar, profile display).
• To improve the App and fix issues.

4. Legal Basis for Processing (EEA/UK Users)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Performance of a contract — to create and run your account, save your progress, and show the leaderboard (name, email, password, gameplay data).
• Legitimate interests — to keep the game fair and secure (IP address, user-agent, anti-cheat) and to operate and improve the service, balanced against your rights and freedoms.
• Consent — for the optional profile data you choose to provide (date of birth, gender, location). You may withdraw consent at any time by removing that data or deleting your account.

5. Data Sharing and Service Providers

We never sell or rent your personal data. We share it only with the service providers ("processors") that make the App work, and only as needed:

• Sign-in providers — Google, Facebook, and Apple, when you choose to sign in with them (they return your name and email to create your account). Apple's "Hide My Email" is supported.
• Email delivery — our email/SMTP provider, to send password-reset codes and account-related emails.
• Hosting — our cloud/hosting provider, which stores the data on our behalf.

These providers act under contract and may not use your data for their own purposes. Your leaderboard display name and scores are visible to other App users. We do not use any third-party analytics or advertising services. We may also disclose data where required by law.

6. International Data Transfers

Our servers and some of our processors are located in the United States. If you access KeySeek from the EEA or the UK, your personal data may be transferred to and processed in a country outside your own. Where required, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses, to protect your data.

7. Data Storage and Security

• Your data is stored on secure servers.
• Authentication tokens are stored on your device using platform-native secure storage (iOS Keychain / Android Keystore).
• Passwords are hashed and never stored in plain text.
• All communication between the App and our servers uses HTTPS encryption.

8. Data Retention and Account Deletion

• Account and gameplay data (name, email, profile, scores) and the technical/security data tied to your sessions (IP address, user-agent) are kept for as long as your account is active.
• When you delete your account, your personal data is permanently removed, and audit-log entries linked to you are anonymized immediately.
• Anonymized audit logs may be retained for up to 90 days for security and fraud prevention, then deleted.

You may request permanent deletion of your account and all associated data at any time via our self-service page: keyseek/delete-account, or by emailing info@themdm.org from the address associated with your account.

9. Children's Privacy

KeySeek is intended for users aged 13 and older. During registration we ask you to confirm you are at least 13. We do not knowingly collect personal information from children under 13 (or under the minimum digital-consent age in your country, which is up to 16 in parts of the EEA). If you believe a child has provided us with personal data, please contact info@themdm.org and we will delete it.

10. Your Rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion ("erasure") of your account and data.
• Request a copy of your data in a portable, machine-readable format (data portability).
• Restrict or object to certain processing of your data.
• Withdraw consent at any time by removing optional data or deleting your account.
• Lodge a complaint with your local data protection authority (for EEA/UK users).

To exercise any of these rights, contact us at info@themdm.org.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App. Continued use of the App after changes constitutes acceptance of the updated policy.

12. Data Controller and Contact

The data controller for your personal information is Marian Devotional Movement Trust ("The MDM", theMDM.org). If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

info@themdm.org