Privacy policy — “Beautiful Lies — Polygraph Test”
Version 0.1 — draft, requires legal review / not legal advice. Date: 8 November 2026. Applies to the Android phone app, the Wear OS watch app (package ro.dragoscatalin.poligraf), the website poligraf.dragoscatalin.ro and the related API. The Romanian version prevails in case of discrepancy.
This policy explains, under Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Romanian Law 190/2018, what data we process, why, on which legal basis, who receives it, how long we keep it and what your rights are.
In short
- Physiological signals (heart rate, inter-beat intervals, PPG waveform, motion, skin temperature, electrodermal activity) are data concerning health. We read them only after the person wearing the watch gives explicit consent on their own watch, for each session.
- By default these signals stay on your phone. They do not reach the server and we cannot see them.
- Your account, purchases and entitlements (Party Pass, Research Lab) are kept on servers in the European Union (Google Cloud, Warsaw).
- AI features, the game room, encrypted replays and the research export are optional, each with its own consent.
- No ads, no advertising trackers, no sale of data.
1. Controller
The controller is Dragoș Cătălin, Romania.
[OPERATOR: denumire, CUI, adresă — de completat de proprietar]
Contact for any data question or request: privacy@dragoscatalin.ro.
We have not appointed a data protection officer (DPO): health data is processed on your device, not on our servers, and our core activity does not involve large-scale processing of special categories of data on the server (GDPR art. 37). This assessment is reviewed periodically, together with the data protection impact assessment (DPIA).
2. What we process, why, and on which legal basis
2.1 Physiological signals during play (on the device)
| Data | Depending on the watch and game mode, only the channels shown on the watch consent screen: heart rate (bpm), inter-beat intervals (IBI), PPG pulse waveform (green, infrared, red), accelerometer and gyroscope (to detect movement), skin temperature, electrodermal activity (EDA, compatible models only, e.g. Galaxy Watch8). Without a watch: heart rate and intervals from a Bluetooth chest strap (Heart Rate profile) or pulse estimated from the phone camera (light reflected by a fingertip); camera frames are analysed in memory, frame by frame, and are never saved. Computed on the phone: baseline, reaction index 0–100, level (calm / elevated / high / inconclusive) and signal quality. |
|---|---|
| From whom | The person wearing the watch or strap, or placing a finger on the camera (“measured player”). |
| Purpose | Running the game: comparing the reaction to each question with the player's own calm baseline. |
| Legal basis | Explicit consent — GDPR art. 9(2)(a) and art. 6(1)(a), asked on the watch, from the person wearing it, for every session (on the phone for strap and camera). Without consent the watch does not start recording; declining or dismissing the consent screen counts as “no”. The player can stop the session at any time with the “Stop” button on the watch. |
| Where | The watch sends readings straight to the paired phone through Google Play services on the device (Wear Data Layer). Calculations run on the phone, with fixed human-written rules (no machine-learning models). |
| Retention | For the session, in the phone's memory. Kept afterwards only if “Save this game in the history on this phone” is ticked (2.2). The watch does not keep signals once the phone acknowledges them. |
2.2 Game history (on the device, optional)
| Data | Session title and date, game mode, sensor type, player nicknames you type, questions, declared answer (truth/lie), votes, reaction index and level, session report and compressed raw signals. |
|---|---|
| Purpose | Letting you review past games. |
| Legal basis | Separate explicit consent (GDPR art. 9(2)(a) and art. 6(1)(a)). |
| Where | Only in the app's local database on the phone, excluded from cloud backup and device-to-device transfer. |
| Retention | Until you delete it (Settings → Delete data, or from History) or uninstall the app. On the free tier only the latest 3 sessions are kept; older ones are deleted automatically. |
2.3 Consent records (on the device)
| Data | Player name, consent type (watch sensors, game data, history, AI), granted or refused, time, source (watch/phone). The watch keeps the accepted session id and time for at most 10 minutes. |
|---|---|
| Purpose | Being able to show that consent existed before recording. |
| Legal basis | Legal obligation — GDPR art. 6(1)(c) with art. 7(1). |
| Retention | On the phone until “Delete data” or uninstall. On the watch, replaced by the next session or cleared on refusal. |
2.4 Account
| Data | Email address, display name, Google account identifier (if you sign in with Google), password stored only as a hash (if you use email and password), sign-in sessions (token, expiry, app/browser user agent). We do not store IP addresses in sessions. |
|---|---|
| Purpose | Buying and restoring entitlements (Party Pass, Research Lab), creating game rooms, AI features. Playing without an account stays free. |
| Legal basis | Performance of a contract — GDPR art. 6(1)(b). |
| Retention | While the account is active. Sessions expire after 60 days of inactivity. When you delete the account (in the app), the account, sessions, entitlements, replays and AI counters are erased immediately; purchase records remain unlinked from you (see 2.5 and account deletion). |
2.5 Purchases and entitlements
| Data | Product bought, Google Play purchase token, order id, purchase or subscription state, expiry (Lab), test-purchase flag, the verification response from Google Play, a pseudonymised account id (SHA-256 hash of the account id, sent to Google Play to link the purchase to the account) and, optionally, the Google Play Integrity verdict (recognised app, licence, device integrity). Google Play notifications about state changes (renewal, cancellation, refund). |
|---|---|
| Purpose | Granting, restoring and revoking entitlements; preventing purchase fraud. |
| Legal basis | Performance of a contract — art. 6(1)(b); for Play Integrity checks, legitimate interest — art. 6(1)(f) (fraud and abuse prevention). |
| Payment | Payment is processed by Google Play, the merchant of record. We never receive card details. |
| Retention | Entitlements: while the account is active; erased with the account. The purchase record (product, Google Play order id, state, dates) stays after account deletion unlinked from your account (the account id and the Google Play response are erased), for as long as accounting and tax law require. Google Play state notifications: 90 days. Google keeps its own transaction records under its policy. |
2.6 AI features (optional)
| Data sent | Question generation (requires Party Pass): language, spice level, number of questions, the theme you type (no names or personal data) and blocked topics. Funny recap: question texts, reaction level and index, the group's guess and the declared answer. No names, raw signals, email or device identifiers are sent. |
|---|---|
| Purpose | Generating new questions and an end-of-round recap. Returned texts are labelled “AI-generated”. |
| Legal basis | Separate explicit consent — GDPR art. 9(2)(a) and art. 6(1)(a) (the reaction index is derived from health data). |
| How | The request goes through our server (which checks the account and the 30 requests/day limit) to the codai AI gateway (hosted in the EU). We do not store the request content and it is not used to train models. We keep only a daily counter (account, day, count) for the limit. |
| Reporting | Any AI-generated text can be reported from the app (reason: offensive, inaccurate, personal data, other, plus an optional note). The report holds the reported text, reason, note, date and the account (only to prevent abuse). |
| Retention | Content: only for the duration of the request. Daily counter: 35 days. Reports: 180 days. |
2.7 End-to-end encrypted replays (optional)
| What it is | A link like poligraf.dragoscatalin.ro/en/replay?id=…#k=…, created on request from the phone, that lets someone else review a session in the browser (charts, questions, reactions). Your history is never copied to the server automatically. |
|---|---|
| Data | A file encrypted on the phone with AES-256-GCM containing the session's questions, signals and report. The server stores only: the ciphertext, its size, the uploading account, a hash of the delete code, creation and expiry time. |
| Key | Generated on the phone and placed only in the part of the link after “#”. Browsers never send that part to the server, so we cannot decrypt the replay. Anyone with the full link can view it — share it only with people you choose. |
| Legal basis | Separate explicit consent for each replay — GDPR art. 9(2)(a) and art. 6(1)(a). The measured player must agree to the upload. |
| Retention | Until you delete it or at most 30 days, then deleted automatically. |
2.8 Browser game room (optional, Party Pass)
| Data | Room code, host account, hash of the host token, expiry. In server memory, only while the room is open: the measured player's name and the players' nicknames/scores (entered by the host), the question text, votes, reaction level and index at reveal, end-of-game awards, the measured player's current heart rate (one value per second) and signal quality, the names spectators type in the browser and their votes. |
|---|---|
| Purpose | Spectators (on a phone, TV or OBS overlay) follow the round and vote. |
| Legal basis | For the live heart rate and reaction index: the measured player's separate explicit consent (consent 5 below) — GDPR art. 9(2)(a); without it the room works without heart rate. For names, votes and scores: performance of the requested feature — art. 6(1)(b). |
| Recipients | Anyone with the room code or link (up to 200 spectators). |
| Retention | In-memory data: at most 6 hours (room lifetime), lost when the room closes or the server restarts. The spectator name is also kept in their browser (localStorage) so they do not retype it. Room metadata (code, host, expiry) is deleted after the room expires (at most 6 hours), at the next daily clean-up. |
2.9 Research export (Research Lab, optional)
The CSV export (and research formats) creates a file on your phone, where you choose, with raw signals and reactions. The export does not pass through our servers. After export the file is under your control (and that of the app you save or share it with); ask the measured player before sharing it. Legal basis: explicit consent — GDPR art. 9(2)(a). From Settings you can also export all local data as JSON (portability).
2.10 Anonymous usage statistics
| When | Only if you turn on “Anonymous statistics” in Settings (off by default). Works without an account; you can stop it at any time. |
|---|---|
| Data | Per day: game mode, sensor type, number of sessions and questions, share of inconclusive answers, total duration. No user id, no device id. |
| Purpose | Understanding which modes and sensors work, to improve the game. |
| Legal basis | Legitimate interest — GDPR art. 6(1)(f). The request IP is used only in memory, for at most one hour, to limit abuse (60 requests/hour), and is not stored. Aggregates are anonymous. |
| Retention | Anonymous aggregates: indefinitely. |
2.11 Technical logs and security
| Data | Server logs: time, route, status, duration, request id; Google Cloud Run request logs include IP address and user agent. Tokens, cookies, purchase and integrity tokens are redacted. If error monitoring (Sentry) is enabled: technical error details without user data, IP, cookies, headers, request bodies, query parameters or AI content. |
|---|---|
| Purpose | Operating, securing and debugging the service. |
| Legal basis | Legitimate interest — GDPR art. 6(1)(f). |
| Retention | Google Cloud logs: 30 days. Sentry errors (if enabled): up to 90 days. |
2.12 Website
The website uses no tracking cookies or technologies and shows no ads. The browser keeps locally only your chosen theme and, in the game room, your spectator name (localStorage); the language may be kept in a technical locale cookie. These are strictly necessary for the function you request (Romanian Law 506/2004 art. 4(5)). Replays are decrypted only in your browser.
2.13 Correspondence
If you write to us, we process your email address and message to answer and to show that we handled requests about your rights. Legal basis: art. 6(1)(c) (GDPR requests) and art. 6(1)(f) (other messages). Retention: 3 years after the request is closed.
3. Separate consents
Each consent is asked separately, is never pre-ticked and can be withdrawn at any time without affecting the lawfulness of processing before withdrawal:
- Watch sensors — on the watch, from the person wearing it, for every session (required to play with the watch). Withdraw: the “Stop” button on the watch or declining the next request.
- Measuring heart rate for this game — on the phone, from the measured player (required for sensor modes). Withdraw: stop the session.
- Saving to the history on this phone — optional. Withdraw: Settings (stop saving) + “Delete data”.
- AI text features — optional. Withdraw: Settings.
- Showing heart rate and reaction in the game room — optional, from the measured player. Withdraw: close the room.
- Uploading an encrypted replay — optional, for each replay. Withdraw: delete the replay.
- Research export — optional, before each export.
The exact consent texts are shown in the app, on each consent screen, and you can request them at privacy@dragoscatalin.ro.
4. Recipients
We do not sell or rent data. Data reaches only:
| Recipient | Role | What it receives |
|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd., Ireland) — Cloud Run, Cloud SQL, Cloud Logging, Secret Manager, region europe-central2 (Warsaw) | Processor (art. 28) | Account data, purchases, encrypted replays, room metadata and transient room content, anonymous statistics, logs |
| Google Play (Google Ireland Ltd. / Google Commerce Ltd.) | Independent controller for payment and Google Play services | Payment and billing data (directly from you), pseudonymised account id, purchase and integrity verification |
| Google Play services on the device (Wear Data Layer, Sign in with Google / Credential Manager, Play Integrity) | Platform provider | Transport of watch → phone readings; Google sign-in; integrity verdict |
| codai (AI gateway, codai.ro, EU-hosted) and its EU model providers | Processor | Only the AI requests described in 2.6 |
| Sentry (Functional Software, Inc.), only if enabled | Processor | Technical server error details, no user data |
| Samsung (Samsung Health Sensor SDK, on compatible Galaxy watches) | Software component on the watch | The SDK runs on the watch; the app does not send readings to Samsung |
| Room spectators, people you send a replay link or an export to | Recipients you choose | What you choose to share |
| Public authorities | When the law requires | Only legally required data |
5. Transfers outside the EEA
Our servers and database are in the EU. Some providers (Google, Sentry) belong to US groups and may access data for support or security. Such transfers rely on the EU-U.S. Data Privacy Framework adequacy decision (Decision (EU) 2023/1795) for certified companies and on the Commission's standard contractual clauses (Decision (EU) 2021/914). You can request a copy of the safeguards at privacy@dragoscatalin.ro.
6. Retention (summary)
| Data | Retention |
|---|---|
| Signals during play | In memory only, for the session |
| History on the phone | Until you delete it; free tier: latest 3 sessions |
| Consent records (phone) | Until “Delete data” or uninstall |
| Account, sessions, entitlements | While the account is active; erased immediately in the app, within 30 days on an email request |
| Purchase records | Unlinked from the account after deletion, kept as long as accounting and tax law require |
| Sign-in sessions | 60 days after last use |
| Google Play state notifications | 90 days |
| Daily AI counter | 35 days; AI request content is not stored |
| Reports about AI text | 180 days |
| Encrypted replays | Until you delete them, at most 30 days |
| Game rooms | In memory at most 6 hours; metadata deleted after expiry |
| Anonymous aggregate statistics | Indefinitely (anonymous) |
| Server logs / errors | 30 days / 90 days |
| Correspondence about rights | 3 years after the request is closed |
7. Your rights
You have the right of access (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), portability (art. 20), objection to processing based on legitimate interest (art. 21) and to withdraw consent at any time (art. 7(3)).
- Data on your phone is only with you: you see it in the app, export it (Settings → Export data, JSON) and delete it (Settings → Delete data). We have no access to it, so we can neither provide nor erase it.
- Account data: write from your account address to privacy@dragoscatalin.ro. We answer within one month (extendable by two further months for complex requests, with notice to you).
- Account deletion: in the app (Account → Delete account), with immediate effect, or by email to the address above, in which case we erase the account and related data within 30 days. The steps are on the account deletion page. Deleting the account does not cancel a Google Play subscription: cancel it in Google Play first.
You may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, sector 1, 010336 Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro, or with the authority of the member state where you live, and you may go to court.
8. Automated decisions
The reaction index is computed automatically, on the phone, with fixed rules (baseline, z-scores, quality gate). The result is shown only to the players, as part of the game, and has no legal or similarly significant effect on you (GDPR art. 22). We make no decision about you based on it and build no profiles. The result does not say whether anyone is lying.
9. Do you have to give us data?
There is no legal obligation. Without sensor consent you cannot play the sensor modes (the reaction-time mode remains). Without an account you cannot buy, use the game room or the AI features.
10. Adults only
The app is exclusively for people aged 18 or over; age is confirmed on first launch. We do not knowingly process data of minors. If you learn that a minor used the app, write to us and we will delete the account data.
11. Security
- All connections to the server and website use TLS.
- Replays are encrypted on the phone (AES-256-GCM); the key never reaches the server.
- The local database and sign-in token are in the app's private storage and excluded from backup.
- The watch records only for the session accepted by the wearer, within at most 10 minutes of consent.
- On the server: secrets in Secret Manager, least-privilege access, passwords stored only as hashes, no IP in sessions, token redaction in logs, rate limiting.
- In case of a personal data breach we notify ANSPDCP within 72 hours, and you without undue delay if the risk is high (GDPR arts 33–34).
12. Changes
We will announce any significant change in the app and on the website before it takes effect. If a change needs new consent, we will ask again. Previous versions are available on request.
Want to delete your account? See how to delete your account