Privacy Policy
Last updated: 31 October 2026
This Privacy Policy explains what information fidra collects, why, and what choices you have. It covers fidra.tech, every creator feed at play.fidra.tech/@handle, and our creator programme (together, the "Service").
We built fidra to collect as little as possible. Playing needs no sign-up, and we never ask for your name or phone number. We only ask for an email address if you choose to save your progress.
1. Who we are
The controller of your personal data is Tomsons Group, Tbilisi, Georgia.
Contact for privacy questions: g.jgerenaia@tomsons.co
We have not appointed a Data Protection Officer or an EU representative. Please send any privacy question to the address above.
2. What we collect
2.1 Visitors (people who use the feed)
| What | Details |
|---|---|
| Random device ID | A random identifier created in your browser the first time you visit and kept in your browser's local storage. It is not linked to your name, email or account. It lets us count returning visitors (for example "came back after 7 days"). |
| Random session and presence IDs | Short-lived random identifiers for a browsing session, used to count unique visits and the "people playing now" number without counting the same tab twice. |
| Usage events | What happens in the feed: which cards were shown and for how long, demo rounds started, demo bets and results (in demo coins only), clips created or shared, taps on "Play for real" links, responsible-gambling limits set or reached, experiment variant shown, the language and display settings used, and the creator feed you were on (by handle). |
| Country | Your approximate country (for example "DE"), worked out by our hosting provider from your connection. We use it for country blocks on casino links and for country-level statistics. We do not store your IP address in our usage or click records. |
| Click records | When you tap a "Play for real" link: time, creator handle, link ID, game card and country. No IP address and no name. |
| Feedback you choose to send | Free text (up to 500 characters) you type into the feedback card. Please do not include personal details. |
Unless you choose to save your progress (section 2.5), we do not collect from visitors: names, email addresses, phone numbers, payment details, precise location, or contacts. We do not create advertising profiles and we do not sell personal data.
2.2 Creators (people who join our creator programme)
| What | Details |
|---|---|
| Account and contact data | Email address, public handle, display name, channel links, and messages you send us. |
| Payout details | The details you give us to be paid, for example bank details or a crypto wallet address, plus tax or identity information where the law requires it. |
| Programme data | Your feed settings, partner links, traffic and conversion statistics for your feed, revenue-share calculations and payment history. |
2.3 Prospective creators we contact
If we contact you about joining the creator programme, we may hold your business contact details that you have made public (for example the business email on your channel), your channel name and links, and a record of our messages and your replies, including any request not to be contacted again.
2.4 Conversion data from casinos ("postbacks")
Casinos and their affiliate programmes send us technical notifications ("postbacks") when traffic from fidra leads to a registration, deposit or other event. These contain our tracking parameters (such as the game card and source), the event type, date, amounts used to calculate commission, and the programme's own reference numbers. We do not ask for, and casinos do not send us, players' names, emails or other identifying details. We cannot link a postback back to a specific visitor's device ID.
2.5 Saving your progress (optional player account)
| What | Details |
|---|---|
| Account ID | When you play your first round, the app creates an account with a random ID, so your demo coins, best scores, badges, level (XP) and the days you played can be saved. It has no name or email. |
| Email address | Only if you choose "Save" and enter it, to send you a one-time login code. |
| Passkey | Only if you create one: your device keeps the private key; we store the public key and a device label. |
| Telegram data | Only if you open fidra inside Telegram: your Telegram user ID, first name and language, sent to us by Telegram to sign you in. |
| Leaderboard nickname | The generated or edited nickname you play the Daily Cup and the weekly tournament under, and your scores. Nicknames and scores are shown publicly on the leaderboard. We store only a hashed version of your random device ID with them. |
You can delete your account at any time in the app ("Delete account"); this deletes the account row and everything linked to it.
3. Why we use it, and our legal bases
Where the EU or UK GDPR, or the Law of Georgia on Personal Data Protection, applies, we rely on the following legal bases:
| Purpose | Data | Legal basis |
|---|---|---|
| Running the feed and games, remembering your settings, enforcing your responsible-gambling limits | Data stored on your device (see section 7) | Necessary to provide the service you asked for; our legitimate interest in providing a working service |
| Age confirmation and country blocks on casino links | Age confirmation flag; country | Legal obligation where applicable, and our legitimate interest in protecting minors and complying with local rules |
| Measuring and improving the Service (usage statistics, retention, experiments, bug fixing) | Device/session IDs, usage events, country, feedback | Our legitimate interest in understanding how the Service is used and making it work better |
| Counting clicks and conversions to pay commissions and creators | Click records, postbacks, creator programme data | Performance of our contract with creators; our legitimate interest in accurate commission accounting |
| Running the creator programme and paying creators | Creator account, payout and programme data | Performance of contract; legal obligation (accounting, tax, anti-money-laundering where applicable) |
| Contacting prospective creators | Public business contact details | Legitimate interest in business-to-business outreach (you can object at any time) |
| Preventing fraud and abuse (fake traffic, bots) | Usage events, click records, postbacks | Legitimate interest |
| Complying with law and defending legal claims | Any of the above, as needed | Legal obligation; legitimate interest |
| Saving your progress (player account), leaderboards | Account data (section 2.5) | Necessary to provide the feature you asked for |
Where we rely on legitimate interest, you can object (see section 6).
4. Who we share it with
We use the following service providers ("processors") who process data on our behalf, under contract:
| Provider | Service | Data involved | Location |
|---|---|---|---|
| Vercel Inc. | Website hosting, serverless functions, country detection | All Service traffic; your IP address is processed by Vercel to deliver the site and detect your country, and may appear in Vercel's technical logs | USA and EU (global edge network) |
| Vercel Blob (Vercel Inc.) | File and data storage | Usage events, click records, uploaded creator clips and avatars | USA |
| Neon (Databricks, Inc.) | Database | Player accounts, creator and programme data, outreach records, leaderboards | USA |
| Telegram | Our Telegram bot and Mini App | Telegram user ID, first name and language when you use fidra in Telegram | Telegram's own infrastructure |
| Sentry (Functional Software, Inc.) | Error reports | Technical error details (error message, page, browser type) | USA |
| Resend | Sending email | Login codes, creator and prospective-creator email addresses and message content | USA |
| Payment provider (to be named here before the first creator payout) | Paying creators | Payout details | — |
We also share limited data with:
- Casinos and affiliate programmes — when you tap "Play for real", the link sends non-identifying tracking parameters (the game card and "fidra" as the source) so the commission can be attributed. Once you are on the casino site, the casino's own privacy policy applies.
- Creators — a creator can see aggregated statistics for their own feed (views, plays, clicks, conversions, by day and country). Creators do not see device IDs or any visitor's identity.
- Authorities and advisers — where the law requires, or to establish or defend legal claims.
- A buyer or successor — if our business or the Service is sold or reorganised.
5. How long we keep it
| Data | Kept for |
|---|---|
| Data stored on your device | Until you clear your browser's site data |
| Player account data | Until you delete your account |
| Usage events and feedback | 24 months, then deleted or fully aggregated |
| Click records and postbacks | As long as needed for commission accounting and disputes, and at most 6 years |
| Creator account and programme data | While you are a creator, then 6 years after the relationship ends for accounting, tax and legal claims |
| Prospective-creator contact data | 12 months from last contact, except a "do not contact" record, which we keep so we respect it |
| Hosting provider logs | According to Vercel's own retention policy |
6. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data;
- restrict or object to our use of your data, including at any time to direct marketing;
- data portability (receive your data in a common format);
- withdraw consent, where we rely on consent, without affecting earlier use;
- complain to a data protection authority — in Georgia, the State Audit Office (Personal Data Protection); in the EU/EEA, the authority in your country; in the UK, the ICO.
Email g.jgerenaia@tomsons.co to use these rights. If you have not saved your progress with an email, Telegram or passkey, we can only find your data if you give us your random device ID. You can delete a saved account yourself in the app ("Delete account"). You can also delete everything stored on your device yourself by clearing site data for fidra.tech in your browser.
We will reply within one month (this can be extended where the law allows).
7. Cookies and local storage
fidra does not use advertising cookies or third-party tracking cookies. Instead, the app saves small pieces of data in your browser's local storage and session storage. These include:
| Purpose | Examples |
|---|---|
| Needed to run the Service | Your 18+ confirmation; your demo coin balance and game state; your responsible-gambling limits; sound and language settings; your last position in the feed; liked and followed cards; clips you created; your provably-fair "client seed"; daily puzzle progress; a short-term cache of the creator feed settings |
| Measurement | Your random device ID; a random presence ID; a temporary buffer of usage events waiting to be sent; your experiment variant |
Casino sites you reach through "Play for real" links set their own cookies under their own policies.
8. International transfers
We are based in Georgia and our providers may process data in the United States, the EU and other countries. Where data protection law requires it, we protect transfers with appropriate safeguards, such as the EU Standard Contractual Clauses or a provider's certification under the EU–US Data Privacy Framework. You can ask us for more information.
9. Children
The Service is for adults only (18+). We do not knowingly collect data from anyone under 18. If you believe a child has used the Service and sent us information (for example in feedback), contact us and we will delete it.
10. Security
We use reasonable technical and organisational measures to protect data, including encrypted connections (HTTPS), a private storage area for creator and programme data, and restricted administrative access. No system is perfectly secure.
11. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated checks (for example country blocks and bot filtering) only decide whether a link is shown or a click is counted.
12. Changes
We may update this policy. We will post the new version here with a new "Last updated" date and, for significant changes affecting creators, let creators know by email.
13. Contact
Tomsons Group, Tbilisi, Georgia — g.jgerenaia@tomsons.co