TibiaTrackerPrivacy policy
This privacy policy describes what data the TibiaTracker app processes and why. TibiaTracker is an unofficial, fan-made app and is not affiliated with CipSoft GmbH, the creator of Tibia, in any way.
1. Data controller
The data controller is Sanveware sp. z o.o. You can contact us about data protection at the address given at the bottom of this page.
We process data to provide the app services you use — your account, sync, notifications, linking characters and channels (Art. 6(1)(b) GDPR) — and in our legitimate interest: handling issue reports, keeping the service secure and running, and preventing abuse (Art. 6(1)(f) GDPR). Links to your streaming channels on character details are shown based on your consent, given in the channel settings (Art. 6(1)(a) GDPR) — you can withdraw it at any time by turning that option off.
2. Account and sign-in
An account is optional — the character tracker and Market watchlist work without signing in. Sign-in uses Google (Google Sign-In) or Apple (Sign in with Apple) and is handled by Supabase; we store the account's email address (with Apple this may be an anonymous relay address if you choose Hide My Email) and account ID, as well as the name — and, with Google, a link to the profile picture — that Google or Apple passes to us at sign-in (with Apple, the name only if you agree to share it). The app doesn't display or use the name or picture. An account is required for features such as saving your issue report history and Pro features. You can delete your account at any time in Settings → Account → Delete account, which permanently removes all data linked to it.
3. Tracked characters, worlds and watchlist
Your list of tracked characters, favourite worlds and watched items is saved locally on your device, and if you're signed in, also on our server (Supabase), so it stays available after switching devices. Character data — level, vocation, guild, online status, highscores positions, and markers such as “traded” or a recent transfer from another world — is fetched from public third-party APIs: TibiaData (api.tibiadata.com), tibiamarket.top (api.tibiamarket.top) and the public Tibia wiki. This is data publicly visible in the game, not personal data.
For characters that our users track, our server additionally keeps two things: the character's current world together with the date it last changed (so the tracker doesn't silently stop working after a world transfer), and a rolling 90-day window of that character's highscores positions — rank, level and experience — used to draw the progress chart. Older entries are deleted. This is public game data, but the list of which characters are being tracked is not, so these tables are not publicly readable: they only ever answer a query for a character name you already asked about.
If you link a character to your account (Settings → Account → My characters), we keep that link: the character's name and world, the one-time verification code, the dates of verification and of the link ending (if it does) together with the reason, and the character's level history collected while the link exists. If the account's character list on tibia.com is not hidden, verification also links the other characters on that list the same way — including ones previously linked to another TibiaTracker account (its owner then gets a notification that doesn't name your account). Every few hours we fetch the linked character from TibiaData to detect a trade, a world transfer or a name change. Every minute we also check its world's public online list and record when it logs in, logs out and levels up — this is used to calculate play time, visible only to you. These records are kept for 31 days. The only thing visible publicly is that a character has a verified owner — not which account it is linked to. If you link a Twitch or Kick channel, we keep its ID, name and avatar from that platform — no access token: the token from signing in is revoked right away. Every 2 minutes we check the platform's public API to see whether you are live. A "Streamer" badge is then shown publicly next to all your verified characters, and while you are live, the channel and stream too (so it shows that these characters belong to the same person). Links to your channels on character details are shown only if you turn that on in the channel settings. For linked channels we record what they streamed and for how long (game, title, start and end of the stream) — visible only to the app administrator. The official TibiaTracker account on Twitch and Kick may follow linked channels; we read the list of channels that account follows from Twitch. The "Tibia live" list shows public Twitch and Kick data about streams in the Tibia category.
4. Devices and notifications
If you enable push notifications, we store your device's FCM (Firebase Cloud Messaging) token and platform (Android/iOS) so we can notify you when a tracked character logs in, logs out, levels up, or dies, or its owner starts a stream (if you turn that on), or when your character's link to your account ends (a trade or verification by another account), and so we can deliver a reply to an issue report you filed. For signed-in accounts we also store basic device information (model, manufacturer, a unique device identifier, operating system version and app version) — used only to recognize your devices on the session list in Settings -> Account, and never shared with anyone but you.
Every notification we send (its content, target device and delivery status) goes into a queue on our server, from which failed deliveries are retried. The notification history in the app shows events from the last 3 days.
The owner of a linked character also receives, on the same channel, a "Your week in Tibia" notification on Monday after server save, with the levels gained in the past week. It can be turned off on the summary screen.
The app's administrator additionally receives technical alerts on the same channel when one of the app's own data imports fails. Those alerts carry no user data — only the name of the import, its status and the error message from our own server.
5. Issue reports
An issue report includes a title, description, category, and technical details (app version, platform, OS version, device model, language, theme) that help us diagnose the reported problem. If you're signed in, the report is linked to your account; if not, you can provide a contact email — without it we have no way to reply to an anonymous report.
6. Who we share data with
We don't sell your data. We use external providers necessary for the app to work: Supabase (database, sign-in, account data storage; servers in Ireland) and Firebase Cloud Messaging (delivering push notifications). Sign-in is also handled by Google and Apple, and channel linking by Twitch and Kick: when you sign in on the platform, they give us the channel's ID, name and avatar, and we use their public APIs to check who is live. Character and price data is fetched from the public TibiaData and tibiamarket.top APIs, but we don't send them anything beyond standard network requests. The app contains no analytics, advertising, or crash-reporting SDKs.
Some of these providers (Google and Firebase, Apple, Twitch, Kick) also process data outside the European Economic Area. This happens under the mechanisms provided for in the GDPR — European Commission adequacy decisions (e.g. the EU–US Data Privacy Framework) or standard contractual clauses.
Only the app administrator (Sanveware) has access to account data on our server, to the extent needed to handle reports, keep the service running and prevent abuse — for example, they can see an account's email address together with its tracked and linked characters, linked channels and devices.
7. Retention period
We keep account data and data linked to it (tracked characters, linked characters with their level history and link history, linked Twitch and Kick channels, watchlist, device tokens, sessions) for as long as the account exists. Deleting your account removes this data; your issue report history remains but loses its link to the account (it becomes anonymous). Data stored only locally on your device disappears when you uninstall the app.
The per-character data described in section 3 follows its own schedule, because it is keyed by character rather than by account: highscores history is kept for a rolling 90 days and trimmed automatically, and the record of a character's world is kept while that character is tracked by anyone.
Some data has a shorter, fixed retention period: tracked characters' events (logins, logouts, level-ups, deaths), from which notifications and their history are built — 7 days, or 31 days for characters linked to an account; the queue of sent notifications — 7 days; the record of linked channels' streams — 30 days (also after the channel is unlinked or the account is deleted).
8. Your rights
You have the right to access your data, to have it corrected, deleted, restricted and ported, and to object to processing based on our legitimate interest. You can withdraw consent (e.g. to showing links to your channels) at any time — without affecting the lawfulness of processing before the withdrawal. To exercise these rights or ask a question about your data, write to us at the address below. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (uodo.gov.pl).
9. Changes to this policy
We may update this privacy policy from time to time, e.g. alongside new app features. We'll announce significant changes in the app's changelog. The last-updated date is shown at the top of this page.
Contact
Sanveware sp. z o.o. · contact@tibiatracker.app