Smirk

by M3 Strategies Limited

Privacy Policy for Smirk

Last updated: 14 September 2026

1. Introduction

This Privacy Policy explains how M3 Strategies Limited (“Smirk”, “we”, “us”, or “our”) collects, uses, stores, and shares information when you use the Smirk mobile application (the “App”).

Smirk is a collection of party games for groups of friends. Depending on the version of the App, it may include a word game, a drawing game, a timing game, a colour-matching game, and a quiz. Every game can be played locally by passing one phone around the room, or online in a private room that friends join with a short code or invite link.

We designed the App to work without a sign-up form and to collect only the limited information required to run the games, provide online rooms, and process subscriptions.

For the purposes of applicable data-protection laws, the data controller is:

M3 Strategies Limited
Unit 82a James Carter Road
Mildenhall
Bury St. Edmunds
England
IP28 7DE
United Kingdom

Privacy contact email: admin@m3strategies.co.uk

2. Information We Collect

2.1 Account Information

You do not need to fill in a registration form to use Smirk. When you first open the App, it silently creates an anonymous account for you so that you can play online without signing up. In connection with that account, we process:

A randomly generated account identifier;
The display name you choose, which is shown to other players (up to 24 characters);
The character you pick to represent you;
A unique handle generated by our systems (for example “sam4821”), which other players can use to find you in the friends feature where that feature is available;
Authentication tokens and session information needed to keep your account secure and keep you signed in. These are stored in your device’s secure keychain;
The date your account was created and the date it was last used.

If the App offers you the option to upgrade your anonymous account with Sign in with Apple, and you choose to do so, we also receive the account identifier that Apple provides for you and, if you choose to share them, your name and email address (Apple may provide a private relay email address instead of your real one). Upgrading keeps your existing account, handle, friends, and purchases; it does not create a new one.

Authentication is provided through Supabase Auth. We do not ask for, or store, a password.

2.2 Local Games Played on One Phone

When you play a game by passing one phone around, the game runs entirely on that device. The player names typed in for a local game, the game options you chose last time, and simple local statistics are stored on the phone only so that your group does not have to set everything up again. They are not sent to our servers.

2.3 Online Rooms and Game Play

When you create or join an online room, we process the information needed to run the game for everyone in it, including:

The room code and invite link, and which players are in the room;
Your display name, character, and account identifier, so the other players can see who you are;
The game and settings chosen for the room;
Per-round game data such as the secret word or role dealt to you, drawing strokes you make in the drawing game, the answers you give in the quiz, the timings you record in the timing game, the colours you pick in the colour game, and the votes you cast;
Round results and scores.

Game moves are transmitted through our backend so that the other players in your room can see them. Room data is temporary: rooms expire a few hours after they are created, and the room and all of its round data are automatically deleted when the room ends or expires. We do not keep a history of the games you have played.

2.4 Drawings and Shared Images

In the drawing game, the finished picture is assembled on your device. If you choose to save it to your camera roll, the App asks for permission to add photos to your photo library at that moment; it never asks up front and never reads your existing photos. If you choose to share it, the image is handed to the app you pick through the standard iOS share sheet. We do not upload finished drawings or result cards to our servers.

In online drawing rounds, the individual strokes you draw are sent to our backend so that the other players in your room can watch the picture appear, and they are deleted with the room as described in Section 2.3.

2.5 Friends Information

Where the friends feature is available, the App lets you find other players by their handle and send, accept, or decline friend requests. To provide this feature, we process:

Handle searches you perform;
Friend requests you send and receive;
Accepted friend connections;
The display name, handle, and character of each friend, which are shown to each other in the App.

Your information is not made publicly available merely because you use the App. You may remove a friend at any time to stop appearing in each other’s friends lists.

2.6 Subscription and Purchase Information

Subscriptions are purchased through Apple’s App Store and managed on our behalf by RevenueCat. To know which features you have unlocked, we process:

Your account identifier, which is also used as your RevenueCat customer identifier;
The subscription you purchased, its start and expiry dates, whether it is in a free trial, and whether it is set to renew;
Apple transaction and subscription identifiers.

Payment is handled entirely by Apple. We never see or store your payment-card details.

We keep a copy of your current subscription status in our backend so that online rooms can be created against it.

2.7 Crash Reports and Usage Analytics

To keep the App working and understand how it is used, the App may send:

Crash and error reports to Sentry, including the type of device, operating-system version, App version, and the technical details of the error;
Product-usage events to PostHog, such as when a round is completed, when the subscription screen is shown, when a purchase is made, and when a result card is saved, together with basic device and App-version information.

These reports are associated with your account identifier so that we can investigate problems, not with your name or email address. We do not use advertising SDKs, and we do not use this information to build advertising profiles.

2.8 Clipboard

If the App detects that you have copied a room code, it may offer a paste button. It reads your clipboard only when you tap that button, never automatically on launch.

2.9 Limited Technical Information

When the App communicates with our backend, our service providers may process limited technical information needed to operate, secure, troubleshoot, and protect the service. This may include:

Internet Protocol address;
Request timestamps;
Basic network-request information;
Authentication events;
Error information;
Security-related logs.

3. Information We Do Not Collect

Smirk does not collect or store:

Your precise or approximate location;
Your contacts or address book;
Your existing photos or videos (the App only adds drawings you choose to save);
Camera or microphone content, because the App has no voice or video chat;
Your private messages, because the App has no in-game chat;
Your payment-card details;
Your advertising identifier for behavioural advertising;
A list of the apps installed on your device;
Health, fitness, or other special-category information.

If we introduce a new feature that requires additional information, we will update this Privacy Policy and provide any required notice or consent request before collecting that information.

4. How We Use Information

We use information only where needed to provide, secure, and maintain Smirk. This includes using information to:

Create and maintain your account without a sign-up form;
Show your display name and character to the other players in your room;
Run online rooms and deliver each player’s moves to the rest of the table;
Keep each player’s secret role or word hidden from the other players;
Provide the friends feature where available;
Process subscriptions, free trials, and Restore Purchases;
Decide whether a room can be created or a game can be started under the subscription that covers the table;
Diagnose crashes and fix bugs;
Understand which features are used so that we can improve the App;
Respond to support and privacy requests;
Detect, prevent, and investigate security issues or misuse;
Comply with legal obligations.

We do not sell your personal information, and we do not show third-party advertising in the App.

5. Legal Bases for Processing

Where the UK General Data Protection Regulation or similar laws apply, we rely on the following legal bases:

5.1 Performance of a Contract

We process your account information, room and game-play information, and subscription information because this is necessary to provide the service you choose to use.

5.2 Consent

We rely on your consent when the App asks for permission to add a drawing to your photo library, and when you choose to upgrade your account with Sign in with Apple. We also rely on your choice to send or accept a friend request before connecting you with another player.

Where applicable law requires consent for usage analytics, we rely on that consent. You may withdraw consent through your device settings, by removing a friend, by deleting your account, or by contacting us. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal.

5.3 Legitimate Interests

We process crash reports, usage analytics, and limited technical and security information where necessary for our legitimate interests in:

Keeping the App stable and fixing bugs;
Understanding how the App is used so that we can improve it;
Protecting accounts and preventing misuse;
Establishing, exercising, or defending legal claims.

5.4 Legal Obligations

We may process or retain limited information where necessary to comply with applicable laws, regulations, court orders, or valid requests from public authorities.

6. When We Share Information

We share information only in the limited circumstances described below.

6.1 With the Other Players in Your Room

Online play means sharing with your table. The other players in a room can see your display name, your character, and the moves you make in the game: your drawing strokes, your quiz answers, your timings, your colour picks, whether you have voted, and the round results. Your secret word or role is revealed to the other players only when the game rules reveal it. Room codes and invite links let anyone who has them join your room, so share them only with people you want to play with.

6.2 With Friends You Choose to Add

Where the friends feature is available, players you connect with can see your display name, handle, and character.

6.3 With Our Service Providers

We use the following service providers to run the App. Each processes information on our behalf and is bound by contractual obligations to protect it and use it only to provide its service to us:

Supabase, for backend infrastructure, the database, authentication, and real-time messaging between players in a room;
RevenueCat, for subscription management and entitlement checks;
Apple, for App Store payments and, where offered, Sign in with Apple;
Sentry, for crash and error reporting;
PostHog, for product-usage analytics.

6.4 For Legal Reasons

We may disclose information where reasonably necessary to:

Comply with a legal obligation;
Respond to a valid court order or lawful government request;
Protect the rights, safety, or property of our users, the public, or M3 Strategies Limited;
Investigate misuse, fraud, or security incidents;
Establish, exercise, or defend legal claims.

6.5 Business Transfers

If M3 Strategies Limited is involved in a merger, acquisition, restructuring, financing, insolvency process, or sale of assets, information may be transferred as part of that transaction. Where required, we will notify users before personal information becomes subject to a materially different privacy policy.

7. International Data Transfers

M3 Strategies Limited is based in the United Kingdom. Our service providers may process information in other countries, including the European Union and the United States. These countries may have data-protection laws that differ from those in your country.

Where required by applicable law, we use appropriate safeguards for international transfers, such as adequacy regulations, contractual protections, or other lawful transfer mechanisms.

8. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy. In general:

Your account, display name, character, and handle are retained while your account remains active;
Anonymous accounts that have not been used for 90 days and have no subscription, friends, or other saved data are deleted automatically;
Online rooms and all of their round data (including drawing strokes, answers, timings, colour picks, votes, and scores) expire a few hours after the room is created and are deleted automatically;
Friend requests and friend connections are retained until they are declined, removed, or your account is deleted;
Subscription records are retained for as long as needed to provide the subscription, handle Restore Purchases, and meet accounting and tax obligations;
Crash reports and usage analytics are retained for a limited period by the relevant service provider and then deleted or aggregated;
Security and technical logs may be retained for a limited period where necessary to operate, troubleshoot, or protect the App;
Information that must be retained for legal compliance or legal claims may be retained for the period required by law.

When you delete your account, we delete or anonymise the personal information associated with it unless we are legally required to retain particular information. Residual copies may remain temporarily in routine backup systems until those backups are overwritten or expire through the ordinary backup cycle.

9. Account Deletion

You may request deletion of your Smirk account from the profile section of the App, where available, or by contacting us at admin@m3strategies.co.uk.

Deleting your account removes your account, display name, handle, character, friend connections, and the copy of your subscription status held in our backend, subject to the limited legal and backup exceptions described in this Privacy Policy.

Deleting your account does not cancel an active subscription. Subscriptions are managed by Apple and must be cancelled in your device’s Settings under your Apple ID’s Subscriptions, otherwise they will continue to renew.

If you have not upgraded your anonymous account and you delete the App from your device, the account may no longer be recoverable, and it will be deleted automatically under the retention rules in Section 8.

10. Your Privacy Rights

Depending on where you live, you may have the right to:

Request access to the personal information we hold about you;
Request correction of inaccurate information;
Request deletion of your information;
Ask us to restrict certain processing;
Object to certain processing;
Request a portable copy of information you provided to us where applicable;
Withdraw consent at any time where processing is based on consent;
Lodge a complaint with a data-protection authority.

If you are based in the United Kingdom, you may lodge a complaint with the Information Commissioner’s Office.

To exercise your rights, contact us at admin@m3strategies.co.uk. We may need to take reasonable steps to verify your identity before responding to a request. Because most accounts are anonymous, we may ask you to make the request from within the App or to provide your handle so that we can locate your account.

11. United States Privacy Disclosures

Where applicable United States state privacy laws apply:

We do not sell personal information;
We do not share personal information for cross-context behavioural advertising;
We do not use sensitive information for purposes other than providing the features you request, securing the App, and complying with applicable law.

You may contact us at admin@m3strategies.co.uk to exercise any applicable privacy rights.

12. Children’s Privacy

Smirk is not intended for children under the age of 13.

We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that a child under 13 has created an account or provided personal information, contact us at admin@m3strategies.co.uk.

If we become aware that we have collected personal information from a child under 13 without an appropriate legal basis, we will take reasonable steps to delete it.

Additional protections may apply where local laws impose a higher age threshold or require parental consent.

13. Data Security

We use reasonable administrative, technical, and organisational safeguards designed to protect personal information. These include storing session tokens in your device’s secure keychain, restricting database access so that each player can only read their own secret role or word, and applying backend and authentication controls appropriate to the information processed.

However, no internet transmission or electronic-storage system can be guaranteed to be completely secure.

14. Third-Party Platforms and Services

Your use of Smirk may involve operating-system services and third-party services, including:

Apple device permissions, the App Store, and Sign in with Apple where offered;
Supabase backend, database, authentication, and real-time services;
RevenueCat subscription services;
Sentry crash reporting and PostHog analytics;
Any voice-chat, messaging, or social app that your group uses alongside the App, such as to talk during an online game or to share an invite link or a result card.

These services may process information under their own terms and privacy notices where they act independently of us. We do not control what happens to a room code, invite link, or drawing after you share it through another app.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we make changes, we will update the “Last updated” date at the top of the policy. Where required, we will provide additional notice in the App or request new consent before using information for a materially different purpose.

We encourage you to review this Privacy Policy periodically.

16. Contact Us

For questions, privacy requests, or account-deletion assistance, contact:

M3 Strategies Limited
Unit 82a James Carter Road
Mildenhall
Bury St. Edmunds
England
IP28 7DE
United Kingdom

Email: admin@m3strategies.co.uk