Privacy notice

1. Who is responsible for your data

Controller: Oleksandr Tarasiuk, Founder of Real Life Game. For any question or request about your data, write to the official email address privacy@becovia.com.

2. What RLG is, and what it is not

RLG is a game for action in real life. You choose an intention and note how you feel; RLG suggests one small step a day, and you record the result. RLG does not diagnose anything, does not assess your health and does not provide treatment. It does not replace a doctor, therapist, lawyer, financial adviser or spiritual mentor. Only take actions that are safe for you, and stop if a task is not right for you. We run the pilot as a closed pilot: we invite participants personally. You must be 18 or older to take part (section 15).

3. What data we process

• Account and sign-in: your email address; your sign-in method (Google, or a one-time code sent by email); when your account was created and when you last signed in; an internal player number.
• Profile: display name; avatar, if you add one; language; timezone; your intention and direction in your own words; difficulty and focus. Optional: birth year, usual wake and sleep times, activity level, preferences and constraints in your own words. Your Four pillars of life scores and Daily Base items.
• Check-ins and diagnostics: your ratings of energy, clarity and calm (1 to 5), available time, focus and an optional note; your ratings of the eight Wheel of Life areas, your written answers and the result.
• Missions, activities and reflections: missions you received, replaced, skipped or completed, and your ratings afterwards; activities you log; tools you complete; reflections; XP and level. Some missions are written for you by the pilot operator.
• Photos: your avatar and any proof photos you choose to attach to missions (section 7).
• Invitations: your invite code and invitation details (section 8).
• Feedback: ratings and messages you send us.
• Activity history: records of what happened in the app, for example "check-in saved" or "mission completed". Some entries contain your own text or values.
• Consent record: your confirmation that you are 18 or older and take part voluntarily, with its date.
• Technical logs: server error messages.
• Early participants only: data from the earlier version of RLG that ran inside ChatGPT, and from the pilot's route spreadsheets, was imported into your RLG history.

We no longer collect weight or the number of meals. If these values were entered earlier, they are kept until you delete your account or ask us to delete them. We do not collect location tracking, contacts, advertising identifiers or data from fitness devices. The app contains no advertising or analytics trackers. Some of this data can reveal things about your wellbeing and health: your energy, clarity and calm ratings, your "Health and energy" rating, and anything you write in notes and reflections. Only write what you are comfortable sharing. Cookies: the sign-in system stores the cookies it needs to keep you signed in. If you open an invite link, a cookie named rlg_referral stores the invite code for up to 30 days and is deleted when you sign in.

4. Why we use your data

• to run the game: save your progress and history and choose your daily mission;
• so the operator can support the pilot: assign a mission, read feedback and help if something does not work;
• to understand how the pilot is going, for example by counting completed missions;
• to make invitations work;
• to keep the service secure and fix errors;
• to keep a record of your age confirmation and consent.

We do not sell your data, use it for advertising or publish it. There are no public rankings or feeds. Legal bases: We process your data on the basis of the consent you give when you start. For wellbeing self-ratings and notes that may concern your health, we rely on your explicit consent. You can withdraw your consent at any time (section 14).

5. How your mission is chosen

Your daily mission is chosen by fixed rules, with no artificial intelligence. The rules use today's check-in (energy, clarity, calm, available time and focus), your chosen difficulty and focus, your activity level, your Four pillars of life scores, your stage on the journey, the share of recent missions you completed and how you rated them. The rules also use the template of your immediately previous completed mission to avoid offering the same step again and choose another step within the same pillar. Skipped missions are not used for this. Your intention is inserted into the mission text. Wake and sleep times, preferences, constraints and birth year are stored but do not currently influence which mission you get. The Navigator picks (suggested tools) are also chosen by fixed rules, directly on your device. They use your chosen focus and difficulty, today's energy, your lowest Four pillars of life score, the tools you completed recently, and whether words from your intention or from the note in today's check-in match a tool's topic words. The result of this matching is not saved separately; your intention and note themselves are stored as described above. Apart from this matching, RLG's rules do not analyse what you write and do not draw hidden conclusions about your health, mental state, beliefs, relationships or finances. You can replace or skip any mission.

6. Self-assessments

Check-in ratings, the Four pillars of life and the Wheel of Life are your own self-assessments. RLG shows them as your ratings, not as a medical, psychological or financial assessment. Each Wheel of Life you complete is kept as its own record, and manual changes to your Four pillars of life are recorded with the values before and after.

7. Photos

Avatar. Since 12 September 2026, your avatar is re-saved on your device before upload, which removes hidden information such as location and camera data. Avatars added in the earlier version of RLG inside ChatGPT are stored as they were uploaded. Proof photos. Since October 1, 2026, a proof photo is resized and re-saved on your device before upload, which removes embedded location and camera data; the server removes such data again before storing the photo. Photos uploaded before that date are stored as they were uploaded and may contain such data: where and when the photo was taken and with which device. You can ask us to delete them. The picture itself can still show places and people. In the app, only you can open your proof photos.

8. Invitations

If you share your invite link, anyone who opens it sees only your display name. Your email address is never used as a display name. The person who invited you sees only how many people joined through their link and how many are active, not who. If you join through an invitation, we store that you were invited, when, and an internal reference to the person who invited you.

9. Who can see your data

• You.
• Other players: no. The only exception is your display name on an invite page, if you share your link.
• The pilot operator (Oleksandr Tarasiuk (Alex Tarian), Founder of REAL LIFE GAME). The operator dashboard gives access to the records of all participants: email, display name, profile, check-ins and notes, diagnostics, missions, activities, reflections and feedback. Every opening of the dashboard and of a participant's card is logged with the date and type of access, without content. The operator can only assign or replace your mission for today. The operator cannot open your proof photos in the app.
• Administrators of our providers' consoles (Oleksandr Tarasiuk) can technically access stored data, including photos. The RLG log does not record such access.
• Copies outside the app: the operator keeps some pilot records in Google Drive: route spreadsheets of early participants and working notes of the pilot.
• Artificial intelligence: the RLG app does not send your data to any artificial intelligence service. The operator uses AI assistants (OpenAI ChatGPT/Codex; Anthropic Claude) for project coordination, pilot operations and participant support. Depending on the concrete task, an AI assistant may process participant-level information available to the operator, including names, email addresses, messages, notes and other pilot records. Only information relevant to the task should be used. In the past, the following were also used for this: OpenAI ChatGPT/Codex, Anthropic Claude.

10. Services with access to data

The following services are used to operate RLG and handle data requests. Local database backups are described separately in section 11.

• Supabase — database, sign-in, avatar storage and server functions. Location: EU (Ireland).
• OpenAI (ChatGPT Sites) — hosting of the RLG web app, which handles every request. Location is not fixed: ChatGPT Sites does not offer a choice of storage region.
• Cloudflare (R2, D1) — storage of mission confirmation photos and the archive of the earlier RLG version. Location: through ChatGPT Sites; region not fixed.
• Google — Google sign-in, if you choose it; Google Drive for the operator’s materials and copies outside the app. Location: Google’s global infrastructure.
• Resend — sending one-time sign-in codes and replies to data requests. Location: United States for one-time codes; the region for processing replies is not fixed.
• Google (Gmail) — mailbox for receiving data requests and sending replies. Location: Google’s global infrastructure.
• ImprovMX — forwarding emails sent to privacy@becovia.com. Region not fixed.
• OpenAI ChatGPT/Codex; Anthropic Claude — the operator’s AI assistants (section 9). No fixed region; processing location may depend on the specific service and its settings.

11. Database backups on the computer and an external storage device

Account and game data are kept for as long as your account exists and are deleted as described in section 12. The operator access log is kept for 12 months. Records of your data requests are kept for 24 months. We delete or anonymise the operator’s working copies outside the app no later than 3 months after the pilot's final report. We will clear personal data from the archive of the earlier RLG version by 31 December 2026.

A daily task has been configured for 23:30 Paris time: exporting the database using pg_dump, encrypting it with age and storing the encrypted package on the founder’s computer. The founder holds the decryption key. Weekly transfer of an encrypted archive to an external storage device is part of the procedure as a manual action by the founder; this action is not automated.

The copy contains the contents of the database tables being exported, including the account and game data stored in them. Supabase Storage files, including avatar files, as well as mission confirmation photos and other files in separate storage systems, are not included in this dump. Links or file metadata in the database do not replace copies of the files themselves.

The script is configured for automatic rotation retaining the 14 most recent successful backup sets — the encrypted package and its receipt. Older sets are deleted by the script during rotation. This limits the number of sets; it is not a promise to delete data after 14 days: missed backups and delayed execution may extend actual retention. Deletion of the oldest real set upon reaching 15 copies has not yet been observed.

The founder undertakes to ensure that only the founder has access to the local backups and the decryption key. Weekly archives on the external storage device are intended to be kept for no longer than 8 weeks from the creation of each weekly archive; the founder manually deletes older archives during the next rotation. Weekly transfer and rotation on the external storage device are not automated and have not yet been confirmed. Delays in manual rotation may extend actual retention.

On request, we delete account and game data from the live RLG app. Previously created backups are not changed by this: the data they contain remains until the relevant copies are actually deleted — during automatic rotation of daily sets or manual rotation of weekly archives.

The first encrypted backup of the production database was created on 20 October 2026. Configuring a daily task does not confirm regular execution: adherence to the daily procedure and restoration of a real copy have not yet been confirmed.

Records from the earlier version of RLG that ran inside ChatGPT are kept in a read-only archive.

12. Deletion requests and previously created copies

Your profile has a "Delete account and data" button. It immediately removes from the current RLG database your profile, check-ins, diagnostics, missions, activities, reflections, activity history and consent record, as well as your avatar, and it tries to delete your proof photos. In-app deletion is currently incomplete:

• your sign-in record at our sign-in provider (email address and sign-in method) is not removed automatically;
• some older proof photos may not be deleted automatically, and a failed photo deletion is not retried;
• the button does not remove records of the earlier RLG version in the archive, or copies outside the app;
• if someone joined through your link, their records keep an internal number that no longer points to anything.

To request deletion of account and game data from the live RLG app, write to privacy@becovia.com. Sign-in data — email and sign-in method — is deleted manually in a separate step. Older mission confirmation photos, the archive of the earlier RLG version, and the operator’s materials and copies outside the app require separate checks; the account deletion button does not itself remove them. Ideally, write before pressing the button so it is easier to locate the records linked to your account. We will tell you what was deleted, what remains and why. Deletion from the live app does not mean simultaneous deletion from previously created local backups and weekly archives: the data in them remains until the relevant copies are actually deleted during the automatic rotation of daily sets or manual rotation of weekly archives described in section 11.

13. A copy of your data

There is no download button in the app. If you ask at privacy@becovia.com, we prepare a copy by hand: a machine-readable file (JSON) with your records, and your photos separately. We check the copy before sending it, and we send it only to your account email address. If something cannot be included, we tell you what and why.

14. Your rights

Under the conditions of data protection law, you can ask for:

• access to your data and a copy of it (section 13);
• correction. You can change most profile fields in your profile. Past check-ins, reflections and completed missions cannot be edited in the app: you can ask us to correct or delete such a record;
• deletion of your account or of specific data (section 12);
• restriction of processing, and objection to processing;
• your data in a machine-readable format;
• withdrawal of consent, where processing is based on consent. This does not affect processing before the withdrawal. There is no separate switch in the app: you can delete your account or write to us.

You also have the right to complain to a supervisory authority (section 18). How to make a request: write to privacy@becovia.com. To protect your data, we confirm the request comes from you by sending a code to your account email address. We send data only to that address. We reply without undue delay and within one month at the latest. For complex requests this can be extended by up to two more months; if so, we tell you within the first month.

15. Adults only

The pilot is for people aged 18 or older only. At the start you confirm that you are 18 or older. If you give a birth year, it must also show that you are 18 or older. We do not check documents; we rely on your confirmation. There is no version of RLG for minors.

16. Security

Each participant's data is kept separate on the server: other players' requests cannot read or change it. RLG does not store passwords: you sign in with Google or a one-time code sent by email. Connections to RLG are protected by HTTPS.

17. Changes to this notice

If this notice changes, we update the version and date and let you know.

18. Complaints

If you are unhappy with how we handle your data, please write to us first at privacy@becovia.com. You also have the right to complain to a data protection supervisory authority in the EU country where you live or work, or where you believe the problem happened.