Pandora's Box
Privacy Policy
Last updated July 2026
Thank you for choosing to be part of our community!
WE HOPE YOU TAKE SOME TIME TO READ THROUGH IT CAREFULLY, AS IT IS IMPORTANT.
This Privacy Policy describes how SmallStack ApS (collectively, “we,” “us,” or “our”) collects, uses, stores, transfers, and discloses personal information from our Users in connection with our Website and/or Application Pandora's Box located at https://smallstack.dk/pandoras (collectively referred to as “Service”). One way to protect your privacy is to learn how it will be used before you give it out. We attach great importance to your privacy rights and truthfully explain why and how we process your information. «Personal Data» means personal data that relates to you as an identified or identifiable individual.
Where applicable, you must provide us with the relevant Personal Data to be able to use our Services completely. You should not use the Services if you disagree with this Policy, our Terms of Use, and any other agreement that governs your use. BY USING THE SERVICE, YOU PROMISE US THAT (I) YOU HAVE READ, UNDERSTAND AND AGREE TO THIS PRIVACY POLICY, AND (II) YOU ARE OVER 16 YEARS OF AGE (OR HAVE HAD YOUR PARENT OR GUARDIAN READ AND AGREE TO THIS PRIVACY POLICY FOR YOU). You must not use the Service if you disagree or cannot make this promise. In this case, you must (a) contact us and request deletion of your data; and (b) leave the Service and not access or use it.
We may update this Privacy Policy from time to time, so please be sure to check regularly. We will notify you of any material changes by posting the new Privacy Policy on the primary access points to the Services or as otherwise required by applicable law.
If any questions still need to be answered, please contact us at simon@smallstack.dk.
Questions and answers you write
Pandora's Box lets players write their own questions and dares. Where you save or share one, we store it against your account so it is available in your games.
Please do not put personal details about yourself or anyone else into a question. We may review, remove or restrict content that is reported to us or that breaks our Terms of Service, and we may keep a record of a removal in order to enforce it. Content you submit is not sold and is not shared with advertising partners.
Table of Contents
- Categories of personal data, purposes of the processing, and legal bases
- Cookies
- Third parties processing Personal data
- Term of storage of your personal information
- Rights about personal data
- Age limitations
- CCPA rights
- Miscellaneous
- Contact information
1. Categories of personal data, purposes of the processing, and legal bases
When the User uses our Services, we can collect, use, receive, process, transfer, and share some of the User's Personal Data for different legitimate purposes. Below are explanations regarding what Personal Data we may collect or process, why we may collect this data, and the legal bases relied on in each case.
| Category | Personal Data |
|---|---|
| User-provided information | |
| Contact Data – when the User registers for the Service | Email; Name/Surname/Nickname; password or passcode; last 4 digits of the card number; comment. |
| Location Data – we do not collect the User's precise location | Location and movement information collected through your IP address, WiFi, Bluetooth and GPS, Time zone coordinates available through your device. |
| Quiz Data – during the onboarding questionnaire | Answers to questions about the purpose of using the Services. We do not collect, store, share, or transfer this quiz data or use this data for identification, marketing, or advertising purposes. |
| Automatically collected information | |
| Device Info – technical data | Device type and model, country code, city, language code, operating system and version number, hardware type, connection type, network service provider, device motion parameters and carrier. |
| Identity Data – identify a device or product | IP Address; ID for advertisers (IDFA); Google Advertising ID; Firebase ID and other similar unique identifiers. |
| Usage Data (Events) | Length of sessions; number of sessions; push notification token; clicks on ads; the type of ads and the page from which such ads were displayed; downloads and installations. |
| Diagnostic information | Logs, error reports, events, and the type, number, date, and page relating to this information. |
| Cookies and Other Tracking Technologies | Cookies, web beacons, embedded scripts, location-identifying technologies, fingerprinting, device recognition technologies, in-app tracking methods, and other tracking technologies. |
We collect personal data to ensure the Service is provided, analyze your behavior during the usage of our Service, add new features to our Service, and provide our third-party service providers with information crucial to their services.
Providing Service includes enabling you to use the Service seamlessly and preventing or addressing Service errors or technical issues. We use hosting and backend services to host personal data and enable our platform to operate. We use payment processing providers to allow purchases and process your payments. We will not store or collect your payment card details ourselves. This information will be provided directly to our third-party payment processors.
| Purposes | Personal Data | Legal Basis |
|---|---|---|
| To provide the Services according to our policies with you (e.g., onboarding, personalization). | Contact Data; Quiz Data; Location Data; Usage Data | Contract |
| Research and development: understand user behavior and trends, detect technical issues, improve and optimize our Service. | Automatically collected information | Legitimate interest |
| To diagnose and fix issues with the Service. | Usage Data | Legitimate interest |
| To help the User choose a subscription plan, provide services, and customize the User experience. | Quiz Data | Contract |
| To communicate with you and provide support. | Contact Data | Contract |
| To track the performance of marketing campaigns and optimize Service features. | User ID, in-app activity data, advertising ID, IP address, location | Legitimate interest |
| Alternative registration (e.g., via Apple, Google). | First/last name, Apple ID/Google ID, profile picture/URL, city-level location | Contract |
| Billing, account management, and administrative purposes. | Contact Data; payment and billing information | Contract |
| To send you marketing communications. | Contact Data | Consent |
| To personalize ads. | Automatically collected information, Location data | Consent |
| To prevent fraud or harm and ensure security of our network and services. | Automatically collected information | Legitimate interest |
| Legal obligations (e.g., prevention, detection, or investigation of a crime). | Contact Data | Legal obligation |
| To fulfill contractual obligations with third parties (e.g., analytics, payment processing). | Automatically collected information; Contact Data | Legitimate interest |
2. Cookies
We may send one or more small data files called “cookies” to User's computer to uniquely identify User's browser, help the User log in faster, and enhance User's navigation through the website. Cookies may convey anonymous information about how Users browse the Services to us so we can provide you with a more personalized experience, but do not collect personal information about you. We may use different types of cookies:
- Essential Cookies – to provide you with Services available through our Site and to enable you to use some of its features.
- Functionality Cookies – to remember your login details and changes you make, helping us make the Service personally oriented.
- Analytics Cookies – to collect information about traffic to our Site and how users use our Site (this information does not include personally identifiable information; the data collected is aggregated and anonymous).
- Social Media Cookies – used when you share information using a social media sharing button.
We may use web and mobile analytics and advertising services and technologies (such as Google Analytics, Firebase, etc.) to assist in collecting certain information about the devices or computers you use to access the Service. For further information about cookies, including how to see the cookies set on your device and manage and delete them, visit www.allaboutcookies.org and www.youronlinechoices.com.
3. Third parties processing Personal data
We may share your information with third-party companies to perform certain services, including but not limited to hosting services, payment processing, analytics, and customer service, and to assist us in our marketing efforts. We share your Personal Data with certain third parties as part of our operation of the Service. This data sharing enables us to provide you with the Service optimally. We hereby undertake not to disclose or transfer the User's Personal data to any third parties, except Processors mentioned in this paragraph, without receipt of individual consent of the User.
| Processor | Purpose |
|---|---|
| Ad Partners | |
| Meta (Facebook/Instagram) | Advertising service. Our Services measure conversions using visitor action pixels from Facebook. Personal Data collected: Cookies, unique device identifiers for advertising (Google Advertiser ID or IDFA), and Usage Data. |
| TikTok | Advertising service. Campaign performance tracking, user behavior analysis, conversion optimization, and audience insights. |
| Analytics | |
| RevenueCat | Subscription and purchase analytics: purchase behavior and patterns, subscription status and renewals, revenue attribution, cohort analysis. |
| Other Partners | |
| Apple, Inc. | To collect and process payments for subscriptions to the App. Personal Data collected: Payment and banking information and Usage Data. |
| Google Inc. | To collect and process payments for subscriptions to the App. Analytics services. Personal Data collected: Cookies, unique device identifiers, and Usage Data. |
| OpenAI, L.L.C. | AI-generated content provider. For the analysis of events and acceleration of information processing. |
| Competent Authorities | To comply with a legal obligation, process, or request. If we are bound to disclose your Personal data by a judicial order or governmental or regulatory authority, we will comply. |
We may display third-party products, services, and offers in the Service. If you click an offer and are redirected to a partner's website/app, or if you later complete an action with that partner, we (and our partners and service providers) may use tracking and attribution technologies to (i) measure performance, (ii) attribute conversions to the App, (iii) prevent fraud, and (iv) support billing/commission settlement in affiliate programs. We do not receive your payment card details from partners.
4. Term of storage of Personal data. Security measures.
We retain all Personal Data for as long as you use the Services and 24 months after you stop. If you do not use the Services for 24 continuous months, we erase Personal Data from our database and request the same erasure from any third party to whom your Personal Data may have been transferred. We may erase Personal Data earlier if we no longer need to process such data.
Personal data may be processed by automated and non-automated means and stored at our premises and on our service provider's servers. We have implemented industry-standard security measures, which include encryption to protect your personal information. Our measures include pseudonymization and tokenization; encryption; protection of data integrity, etc. However, transmissions over the Internet are never 100% secure, and you should not provide personal data to avoid risk.
5. Rights about personal data
We attach great importance to user privacy and would like to explain your data protection rights.
- (i) The withdrawal right. If we process your data based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Withdrawal is made by notifying us via email at simon@smallstack.dk with the topic «Consent withdrawal».
- (ii) The right to be informed. The right to know what Personal Data we hold and how and why we handle your Personal Data. You can ask us for a copy of your Personal Data.
- (iii) The right to opt-out of direct or target interest advertising on mobile applications by checking the privacy settings on your device settings menu. Please note that even if you opt out, you will still receive advertising but not direct or target interest advertising.
- (iv) The right to request an update or correction (rectify) to any of your Personal Data that is out of date, incomplete or incorrect (according to Article 16 of the GDPR).
- (v) The right to delete your Personal data (Right to be forgotten). You have the right to request that we delete certain of your Personal data. There are situations where we are unable to delete your data, for example, when it is still necessary to process the data, our interest in using the data overrides your interest in deletion, we have a legal obligation to keep the data, or we require the data to establish, exercise or defend legal claims.
- (vi) The right to object. You have the right to object to our processing of your personal data under certain conditions, such as when we process it on the basis of legitimate interest or for interest-based advertising.
- (vii) The right to restrict the processing of your personal data under the conditions set out in Article 18 of the GDPR or any other applicable laws.
- (viii) The right to portability of your personal data. In some circumstances, you may request that the data you provided to us be provided so that you can transfer this to another data controller. If you wish to receive personal data in a machine-readable format, you can send a respective request to simon@smallstack.dk.
- (ix) The right to complain to a data protection authority about our collection and use of your personal information. Please see https://edpb.europa.eu/about-edpb/board/members_en for contact details.
- (x) The right to request access to the personal information we collect from you, change it or delete it. You have the right to ask for copies of your personal data. We will respond to your request within 30 business days. The User is empowered to request one copy of the personal data free of charge. Please send an email to simon@smallstack.dk.
If you are based in the EEA, you have the right to complain to the supervisory authority. We would love for you to contact us directly so that we can address your concerns. Nevertheless, you can complain to a competent data protection supervisory authority, in particular in the EU Member State where you reside, work, or where the alleged infringement has occurred.
6. Age limitations
The Service is intended for adults and has a minimum “Age Limit” in each country or region. In general, you must be 16 years of age or older to use the Service, or your age requires parental consent to process your personal data.
Following the Federal Children's Online Privacy Protection Act of 1998 (“COPPA”), we will never knowingly solicit, nor will we accept, personally identifiable information from users of the Service known to be under 13 years of age. If you believe we have information from or about anyone under thirteen (13) years of age, please notify us by email at simon@smallstack.dk. Please include “COPPA Concern” in your message's subject line. We will make significant efforts to delete the personal data.
7. CCPA rights
Here is additional information about how we collect, use, disclose and otherwise process the personal data of individual residents of the State of California within the scope of the California Consumer Privacy Act of 2018 (“CCPA”). We adopted this paragraph to comply with CCPA, and any terms defined in the CCPA have the same meaning when used in this notice.
| Category | Examples | Collected | We Sell |
|---|---|---|---|
| A. Identifiers | Real name, alias, unique personal identifier, online identifier, IP address, email address, account name. | YES | NO |
| B. Personal information (Cal. Civ. Code § 1798.80(e)) | Name, address, telephone number, financial information, etc. | NO | NO |
| C. Protected classification characteristics | Race, gender, religion, sexual orientation, etc. | NO | NO |
| D. Commercial information | Records of products or services purchased, obtained, or considered. | YES | NO |
| E. Biometric information | Genetic, physiological, behavioral characteristics. | NO | NO |
| F. Internet or similar network activity | Browsing history, search history, interaction with a website or application. | YES | NO |
| G. Geolocation data | Physical location or movements. | NO | NO |
| H. Sensory data | Audio, electronic, visual information. | NO | NO |
| I. Professional information | Current or past job history. | NO | NO |
| J. Education information | Education records directly related to a student. | NO | NO |
| K. Inferences drawn from other personal information | Profile reflecting preferences, characteristics, behavior, and aptitudes. | YES | NO |
As a California resident, you have the following rights:
- You can request information about how we have collected and used your personal information during the past 12 months.
- You can request a copy of the personal information that we have collected about you during the past 12 months.
- You can ask us to delete personal information we have collected from you.
- You have the right to be Free from Discrimination. We may not discriminate against you because you have exercised your rights.
- You have the right to opt out of the sale of Personal Information. We do not sell to third parties, and within the last 12 months have not sold, any of your personal information.
Right to Delete
You have the right to request that we delete the information we have collected from you. There are several exceptions, including when the information is necessary for us or a third party to:
- Complete your transaction or provide you a good or service
- Perform a contract between us and you
- Protect your security and prosecute those responsible for breaching it
- Fix our system in the case of a bug
- Comply with a legal obligation
- Make other internal and lawful uses of the information compatible with the context in which you provided it
Right to Opt-out
You have the right to “opt-out,” or direct us to stop “selling” or otherwise sharing your information with third parties in exchange for monetary or other valuable consideration. To submit an opt-out request, please configure the Privacy Settings in any of our apps or by checking your device privacy settings.
Exercising Your California Privacy Rights
To request access to or deletion of your personal information, to opt-out, or to exercise any other rights under California law, please write us an email to simon@smallstack.dk.
8. Miscellaneous
Conditions of the present Privacy Policy may be unilaterally changed by us if required under the applicable laws or in other relevant cases with obligatory notification of the Users. The new version of the Privacy Policy enters into force and is subject to observance by the User after the User has expressly agreed to its applicability. If the User does not agree to the relevance of the new version of the Privacy Policy, the User will discontinue the usage of the Service and will not be allowed to use its account without the provision of unambiguous consent to the applicability of the new version of the Privacy Policy.
9. Contact information
DATA CONTROLLER
Company: SmallStack ApS
Location: Denmark
Email: simon@smallstack.dk