RoleMatch is a text roleplay app where players write short stories together. This policy explains what personal data we process, why, for how long, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is:
DNAGroup SRL (brand DNAFactory)
Via dei Mille 40, 80121 Napoli (NA), Italy
VAT IT08925651211
Share capital €11,600 fully paid
Email: [email protected]
For any privacy request write to [email protected].
2. What we collect
| Category | Data | Source |
|---|---|---|
| Account | Username, email address, password (stored only as a one-way hash), acceptance date of the Terms | You, at sign-up |
| Preferences | Favourite genres, intensity ceiling, excluded content tags, writing style, group size, your confirmation of being 18 or older, age verification status, whether you have turned on “Receive sensitive content” | You, during onboarding and in settings |
| Stories and messages | Premises, roles, backstories, in-character and out-of-character messages, keep/delete votes, narrator event responses, story ambience choices | You and the other players |
| Saved characters | Names, identities, traits, backstories, portrait colours | You |
| Social | Friends, friend requests, whether you can be found by username, last time you were active (shown to friends as "online" or "last seen") | You and the app |
| Uploads | Audio files and images you upload into a story, photos you send in a chat, and the result of the automated safety check on each image (for example, whether it is sensitive content) | You |
| Safety | Reports you file or receive, blocks, moderation decisions, account suspensions, Join skips (to detect abuse) | You, other players, our systems and moderators |
| Subscription | Plan, trial and renewal dates, store transaction reference. We never receive your card details: payments are handled by Apple or Google. | The App Store / Google Play |
| Technical | An authentication token for your device, IP address, request logs, app version, crash information | Your device |
We do not collect your precise location, contacts, photos library (beyond a file you choose to upload), microphone or camera. We use your device's advertising identifier (IDFA on iOS, Android Advertising ID) only for ads, only if you are a free user and only with your consent (see section 5).
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating and running your account, matchmaking, live and kept stories, friends, saved characters, ambience | Performance of our contract with you (art. 6.1.b) |
| Respecting your content limits (intensity ceiling, excluded tags, blocks) | Performance of the contract (art. 6.1.b) |
| Moderating messages and uploads, handling reports, preventing abuse and fraud, keeping the service secure | Our legitimate interest in a safe service and our obligations under the Digital Services Act (art. 6.1.f and 6.1.c) |
| Checking you are an adult before unlocking adult intensity levels | Legal obligation and legitimate interest in protecting minors (art. 6.1.c and 6.1.f) |
| Managing RoleMatch+ subscriptions | Performance of the contract (art. 6.1.b) |
| Keeping accounting and tax records of purchases | Legal obligation (art. 6.1.c) |
| Answering support requests | Performance of the contract and legitimate interest (art. 6.1.b and 6.1.f) |
| Aggregate, non-identifying statistics to improve the app | Legitimate interest (art. 6.1.f) |
| Showing ads to free users (personalised ads only with your consent; otherwise non-personalised ads) | Consent for personalised ads and for reading the advertising identifier (art. 6.1.a and art. 122 of the Italian Privacy Code); legitimate interest in funding the free service for non-personalised ads (art. 6.1.f) |
Stories can touch on sensitive themes because they are fiction. We do not ask for, and do not want, real information about your health, sexuality, beliefs or other special categories of data. Please keep real personal details out of your stories.
4. Artificial intelligence
RoleMatch uses AI models provided by OpenAI to write narrator events and story recaps, to play AI characters when not enough players are around, to suggest premises and roles, and to moderate messages and images. For these features the relevant story text or image is sent to OpenAI, which acts as our processor. Data sent through the OpenAI API is not used to train its models, and OpenAI may keep it for up to 30 days only to monitor for abuse before deleting it.
- AI players and AI-written content are always labelled in the app.
- Every image you upload or send in a chat (photos, covers, backgrounds, avatars, character photos, stickers) is sent to OpenAI's moderation service for an automated safety check before anyone else sees it. The check classifies the image, for example as nudity, sexual content or graphic violence; the result decides whether the image can be shared and whether it is shown blurred as sensitive content (see the Content Policy). As with all data sent to OpenAI, it is not used to train OpenAI's models and is kept by OpenAI for no more than 30 days, only to monitor for abuse.
- Automated moderation can hide a message or reject an image. It does not by itself suspend your account: suspensions are decided by a person. You can contest any moderation decision by writing to us (see section 10).
5. Advertising
The free version of RoleMatch shows a few native ads (while you wait for players, in the Stories list, under the chat header and at the end of a scene). Ads are served by Google AdMob. RoleMatch+ subscribers never see ads, and no ad data is collected for them.
- Consent first. In the European Economic Area, the United Kingdom and Switzerland we ask for your consent through Google's consent message before any ad is requested. On iOS, the system also asks whether RoleMatch may track you (App Tracking Transparency).
- Personalised or not. If you consent, Google may use your device's advertising identifier (IDFA or Android Advertising ID), your IP address and information about the ads you see to show ads based on your interests and to measure them. If you refuse, you only see non-personalised ads, chosen from coarse information such as the app and your approximate location (country or region). Even then, and only where your choices in Google's consent message allow it, Google may use limited device information to cap how often an ad is shown, produce aggregated reports and prevent fraud; it is never used to profile you.
- Who is responsible. Google Ireland Limited acts as an independent controller for the personal data it processes for advertising, under its own Privacy Policy and How Google uses information from sites or apps that use its services. Some data may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework.
- Change your mind at any time in the app under Account → Privacy choices, or in your device settings (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Google → Ads).
- Story content and messages are never shared with advertisers.
6. Who we share data with
- Other players in your stories see your username, your character and your messages. A seat's backstory is visible only to the player in that seat. Friends see your online status.
- Processors acting on our instructions under a data processing agreement: our hosting and storage provider, OpenAI (AI features and moderation), and our email provider.
- Apple and Google for subscriptions, under their own privacy policies.
- Google (AdMob), only for free users, to show and measure ads as described in section 5.
- Authorities when required by law, or to protect the safety of a person, in particular a child.
We never sell or rent personal data.
7. International transfers
Some processors, such as OpenAI, are located in the United States. Transfers are covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses with additional safeguards.
8. How long we keep data
| Data | Retention |
|---|---|
| Account, preferences, saved characters, friends | Until you delete your account |
| Live scenes that nobody kept | Deleted for everyone when the scene ends or is skipped |
| Kept stories and their messages | As long as at least two players keep the story. If you delete your account, your messages stay in stories other players kept, detached from your account. |
| Uploads | Until the story is deleted or the upload is removed |
| Reports, moderation decisions and suspensions | Up to 24 months after the decision, to handle appeals and repeat abuse |
| Server logs | Up to 30 days |
| Purchase records | 10 years, as required by Italian tax law |
9. Security
Data is encrypted in transit (HTTPS), passwords are hashed, access to production systems is restricted and logged, and moderator actions are recorded in an audit log.
10. Your rights
You can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw any consent you gave. You can delete your account at any time in the app (Account → Delete account) and hide yourself from username search (Account → Findable by username). We answer within one month. You also have the right to lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali.
11. Age
RoleMatch is only for people aged 18 or older: minors must not use it, and we do not knowingly process data of minors. If we learn that an account belongs to a minor, we close it and delete its data. As an extra safeguard, adult content and sensitive photos also require the in-app 18+ declaration; this does not make RoleMatch available to minors. Report suspected underage users in the app or through the Child Safety Standards page.
12. On your device
The app stores your authentication token in the secure keychain/keystore and a small cache of app settings. The website uses only the cookies described in the Cookie Policy.
13. Changes
We will announce material changes in the app before they take effect. The date at the top shows the latest version.