RetroReadyPrivacy policy
Last updated: 16 October 2026
This policy explains what happens to your information when you use the RetroReady app and the website retroready.app.
The short version
- Your photos and questions are sent to identify your game and answer you. They are not kept on our servers.
- Your scans are saved on your phone, not with us.
- The app needs no account. It gets a random install id, which is not linked to your name, email or phone number.
- We count how the app is used without knowing who you are. If you agree, and only then, we also record how you use the app (with every text and image hidden) to find what confuses people and what breaks.
- The website sets no cookies and runs no analytics.
- We do not sell your information, show ads, or track you across other apps or websites.
Who is responsible
The controller of your data is Francesco Noferi, Via Carlo Collodi 27, 50059 Vinci (FI), Italy ("we"). Partita IVA 07313090487. Write to support@retroready.app about anything in this policy. We have not appointed a data protection officer (the law does not require one for a service of this size).
What we process, why, and on what basis
Photos, notes and questions (app and website)
When you scan a game, the photos you take (up to three in the app, up to two on the website) and any note you add are sent to our server, which passes them on to answer you:
- Moderation: every request is first checked for harmful content by OpenAI's moderation service, or, when it is unavailable, by Llama Guard (a safety model run through OpenRouter).
- The answer: AI models from Google, DeepSeek and other providers, reached through OpenRouter, identify the game and write the answers.
The same happens with the questions you ask about a game in the app. Our server does not store photos, notes, questions or answers. The providers process them only to answer you, under their own terms (OpenRouter, OpenAI). The app and the website shrink photos and remove their location and camera data before sending them.
Basis: to provide the service you asked for (GDPR art. 6(1)(b)); moderation is our legitimate interest in keeping the service safe and lawful (art. 6(1)(f)). Some requests are refused automatically by moderation; this has no legal effect on you, a refused request is not charged, and you can write to us if you think a refusal was wrong.
You are not required to send anything, but without a photo there is nothing to identify.
What stays on your phone
Your scans, their photos, and your questions and answers are saved on your phone only. Deleting a scan or the app deletes them. On Android they are not included in device backups; on iPhone they are part of your own device backup, like other app data.
Your install (app)
On first launch the app gets a random install id from our server, so that it can count your free scans and what you bought. Our server keeps, per install: when it was created, the scans used, your plan and when it ends, and any extra scans we gave it by hand (for example after a support request). Basis: to provide the service (art. 6(1)(b)). Kept: as long as the install may use the app, because your purchases depend on it. Ask us and we delete it: the install record, and the purchase records that our server and RevenueCat hold for it (our hosting provider's database history, kept for restoring it, still holds the deleted record for up to 30 days). Apple and Google keep their own records of your purchases. After the deletion, anything bought on that install no longer works in the app until you restore your purchases there. Deleting it does not cancel a plan: cancel in your store account.
To keep the service fair and running, our server also keeps some counts for the current day (UTC) only:
- installs made from your network: your IP address (or the first half of an IPv6 address), and the wider block it belongs to (the first three numbers of an IPv4 address, or the first three groups of an IPv6 address);
- for each install in the app, or each network on the website: how many of its requests moderation refused, and how many scans were given back for free (for example when no game was found); on the website, also how many free scans were used.
These counts are deleted by the first request our server handles after the day ends at midnight UTC, normally within minutes. Our hosting provider keeps 30 days of history of that database so that it can restore it, so a deleted count can stay there for up to 30 days. Basis: our legitimate interest in preventing abuse (art. 6(1)(f)).
Request logs (app and website)
Our server runs on Cloudflare, which logs the requests the app and the website's free scan send to it (technical details of each request, which may include your IP address). The logs help us find errors and abuse, and are kept for 3 days (7 days on Cloudflare's paid plan). Basis: our legitimate interest in a secure, working service (art. 6(1)(f)).
Usage counts (everyone, app)
The app sends simple events to our server, such as "an onboarding step was shown", "the paywall was opened from the scan button" or "a scan found a game". Our server adds them up per day; it does not keep your install id, your IP address or the time of day with them, and nothing you typed or photographed is included. We keep these daily totals for 90 days. Basis: our legitimate interest in understanding and improving the app (art. 6(1)(f)). These counts are aggregate statistics made by us for this app only, which the Italian Data Protection Authority treats like technical tools that need no consent (its cookie guidelines of 10 June 2021, section 7.2); you can object at any time by writing to us.
Usage analytics and screen recordings (only if you agree, app)
On the privacy screen and in Settings you can choose to share how you use the app. If you do, the app sends the same events, with a random id, to PostHog (servers in the EU), together with recordings of the app's screens in which all text and images are hidden, and reports of errors and crashes (what failed in the app's code, the phone model and the app version). We use them to see where people get stuck and to fix bugs. Basis: your consent (art. 6(1)(a)), which you can withdraw at any time in Settings; nothing is sent while it is off. On the PostHog plan we use, events are kept for up to one year and screen recordings for one month. (PostHog privacy)
Purchases (app)
Subscriptions are sold by Apple (App Store) or Google (Google Play), who handle payment as the sellers; we never see your card details. RevenueCat processes the purchase records for us so that your plan works on your install, using your install id. RevenueCat also receives your install's group in our onboarding test (exp_onboarding_paywall: whether the plans were shown right after setup), so that we can compare purchases between the groups. Basis: to provide what you bought (art. 6(1)(b)) and our legal obligations (art. 6(1)(c)). (RevenueCat privacy)
The website
retroready.app is hosted by Cloudflare. It sets no cookies, stores nothing in your browser and runs no analytics. Cloudflare keeps technical request logs (which include your IP address) for a few days to keep the site running and safe. Basis: our legitimate interest in a secure website (art. 6(1)(f)).
The free scan page may use Cloudflare Turnstile to tell people from bots before a scan. Turnstile looks at technical signals from your browser for that purpose only, which is necessary for the security of the scan you asked for; Cloudflare also uses those signals to improve its bot detection, as an independent controller (Turnstile privacy addendum).
Support emails
If you write to us, we use your email and what you send to answer you. Emails to support@retroready.app are forwarded to our mailbox by Cloudflare. We keep them as long as needed to help you and for up to two years afterwards, in case you write again. Basis: our legitimate interest in answering you (art. 6(1)(f)).
Who receives your information
Only the service providers named above, each for its own task: Cloudflare (hosting of the server and the website, email forwarding), OpenRouter and the AI providers it routes to (answers), OpenAI (moderation), RevenueCat (purchase records), PostHog (only if you agreed), and Apple or Google (as the sellers of your purchases, under their own policies). We do not sell or share your information with anyone else, except when the law requires it.
Transfers outside the EU
Cloudflare, OpenRouter, OpenAI and RevenueCat are based in the United States, and the AI providers behind OpenRouter may process requests in other countries. Where data leaves the European Economic Area, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for companies certified under it) or on the Commission's Standard Contractual Clauses in each provider's data processing terms. PostHog stores the app's analytics in the EU (Frankfurt); some of its processing happens outside the EU, including in the United States, under the Data Privacy Framework and the Standard Contractual Clauses. Write to us for a copy of the relevant safeguards.
How long we keep it
| What | Where | Kept |
|---|---|---|
| Photos, notes, questions, answers | not on our servers | not kept |
| Your scans, photos, questions | your phone | until you delete them or the app |
| Install record (scans used, plan, extra scans) | our server | while the install may use the app, or until you ask us to delete it |
| Daily counts per network or install (installs, refused requests, scans given back, website scans) | our server | the current day (UTC), deleted by the first request after it; up to 30 days in our hosting provider's database history |
| Daily usage totals (no id) | our server | 90 days |
| Analytics (if you agreed) | PostHog, stored in the EU | up to one year |
| Masked screen recordings (if you agreed) | PostHog, stored in the EU | one month |
| Purchase records | our server, RevenueCat | while the install may use the app, or until you ask us to delete them |
| Purchase records | Apple, Google | as their terms and tax law require |
| Request logs of our server | Cloudflare | 3 days (7 on Cloudflare's paid plan) |
| Request logs of the website | Cloudflare | a few days |
| Support emails | our mailbox | up to two years after the conversation |
Your rights
You can ask us for access to the information we hold about you, and to correct, delete or restrict it, to object to processing based on our legitimate interests, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time (in the app: Settings) without affecting what was done before. Write to support@retroready.app; for anything about your install, include the install id shown in the app's Settings, since it is the only way we can find your data. We answer within one month.
You can also complain to a data protection authority: in Italy the Garante per la protezione dei dati personali, or the authority where you live or work.
Children
RetroReady is not meant for children under 14, and we do not knowingly collect their information. In Italy, children under 14 need a parent's consent to use AI services and to agree to data processing on their own.
Changes
We update this policy when the app or the website changes what it collects, and change the date at the top. If a change needs your consent, the app asks for it again.