Privacy Policy

Gamify ("Gamify", "we", "us", or "our") provides a multi-tenant platform that helps organizations run youth programs — including Mobility programs and Grassroots Weekly programs — with gamification features such as points, leaderboards, peer voting, performance tasks, reflections, and evaluations.

This Privacy Policy explains what information we collect when you use the Gamify mobile app, web app, and related services (collectively, the "Service"), how we use it, who we share it with, and the rights you have over your information. It applies to Participants (PAX), Youth Workers (YW), and Organization Admins.

By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

Gamify is the operator of the platform and acts as the data controller of the platform infrastructure and the core user accounts that exist within it. Organizations that run programs on Gamify act as independent controllers (or, depending on context, joint controllers) for the program-specific data they collect from their own participants.

Our registered office and Data Protection Officer contact details are listed in the "Contact Us" section at the bottom of this page.

We collect the following categories of information:

Account information

• Name and surname
• Email address
• Display name
• Password (stored as a salted hash)

Profile information

• City and country
• Profile photo or avatar
• Gender
• Date of birth
• Optional OID (Organisation ID) when relevant

Participation data

• Programs and projects you join
• Your role in each project (PAX, YW, Admin)
• Computed scores (PP, FS, IQI) and leaderboard standing

Content you create

• Performance task submissions, including photos, videos, and documents
• Reflection answers
• Anonymous evaluation responses
• Anonymous peer votes
• Gossip Box messages (anonymous to other participants)

Technical data

• Device information (model, operating system, app version)
• IP address
• Access and error logs

We use information about you to:

• Enable you to participate in programs and projects;
• Compute and display gamification scores (PP, FS, IQI) and leaderboards;
• Generate reports for organizations and youth workers about program activity;
• Send notifications related to tasks, deadlines, evaluations, and program updates;
• Ensure fairness — for example, applying anti-gaming caps and detecting abuse;
• Maintain, secure, and improve the Service.

We do not sell your personal information, and we do not show third-party advertising inside the Service.

Where the GDPR applies, we rely on the following legal bases to process your personal data:

• Consent — for optional features (such as uploading a profile photo) and where required by law.
• Performance of a contract — to provide the Service and let you participate in the programs you join.
• Legitimate interest — to secure the platform, prevent abuse, and improve the Service in proportionate ways.
• Legal obligation — to comply with applicable laws (for example, responding to lawful requests from authorities).

We share your information only as needed to operate the Service:

• With your organization and its admins and youth workers, for program management and reporting;
• With other participants in your project, to the extent necessary for gamification features (e.g. your display name and avatar in a leaderboard);
• With infrastructure providers acting as processors — including Microsoft Azure Blob Storage for file hosting — under written data processing agreements;
• With authorities when required by law, court order, or to protect the rights and safety of users.

Anonymous evaluations, anonymous votes, and Gossip Box messages are designed so that other participants cannot see the author's identity.

We retain personal data for as long as your account is active and as long as needed to provide the Service. After a program ends, we may retain aggregated or anonymized data for reporting and product improvement.

When you delete your account, we delete or anonymize personal data within a reasonable period, except where we are required to retain it (for example, to comply with legal obligations or to resolve disputes).

Subject to applicable law (including the GDPR), you have the following rights:

• The right to access your personal data;
• The right to rectification of inaccurate data;
• The right to erasure ("right to be forgotten");
• The right to restrict processing;
• The right to data portability;
• The right to object to processing based on legitimate interest;
• The right to withdraw consent at any time, without affecting prior lawful processing.

To exercise any of these rights, email us at privacy@gamifyouthwork.org. You also have the right to lodge a complaint with your local data protection authority.

Many Gamify users are minors. The Service is intended for users aged 16 and above. Where local law requires a higher age of digital consent, users below that age need verifiable consent from a parent or legal guardian before using the Service.

We minimize the data we collect from minors to what is necessary for program participation. Features such as anonymous voting, anonymous evaluations, and the Gossip Box are designed to protect minors' identities from their peers.

If you believe a child has provided us with personal data without appropriate consent, contact us and we will take prompt action to remove it.

The Service uses a small number of strictly necessary cookies and local storage entries to keep you signed in and to remember your preferences. We do not use third-party advertising cookies and we do not run cross-site tracking pixels.

Where we use analytics to understand product usage, we configure it to minimize personal data and to respect Do Not Track signals where technically feasible.

The Service is primarily hosted in the European Union. Where personal data is transferred outside the European Economic Area (for example, to a processor located abroad), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We apply technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS/TLS), encryption of files at rest in Azure Blob Storage, hashed passwords, access controls, and routine review of our practices.

No system is completely secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Service or by email. Continued use of the Service after the changes take effect means you accept the revised Policy.

If you have questions about this Privacy Policy or want to exercise your rights, contact us:

• Email: privacy@gamifyouthwork.org

For data your organization controls (such as the projects you participate in, the evaluations they configure, and the reports they generate), you can also contact your organization's administrator directly. We will work with your organization to help resolve your request.