One safe.
Just enough data.

THE SAFE works without an email, a password or a visible account. So that the safe is the same for everyone and each person gets one guess a day, the app creates an anonymous technical identifier.

Controller and contact

The controller is Gonzalo Figueroa Gonzalez, individual publisher of The Stupid App. To exercise your rights of access, rectification, erasure, objection or restriction, write to support@thestupidapp.com.

What we store on the server

• The anonymous identifier and an automatic alias (for example PLAYER 7F3A) that can’t be changed and contains nothing about you.
• Your guesses: the combination, the safe and the day (UTC). They’re needed to enforce one guess a day and to make sure no combination is tried twice.
• If you open a safe: that it was you (your alias is shown) and, if you choose to sign it, the name you type. Signatures are reviewed before they appear.
• Aggregated counts of repeated combinations and technical counters that limit abuse.
• If you turn on “Safe alerts”: the device’s notification token and language.
• Minimal usage events to know whether the app works: first open, first guess, coming back another day, sharing, seeing an opened safe, starting and finishing a purchase, and turning on alerts. We don’t use third-party analytics.

What stays on your device

Preferences (sound, alerts, finish, frame), the latest safe information so it can be shown offline, your personal stats, and the daily reminder, which is a local notification scheduled on the phone itself.

Basis, purpose and retention

We process this data to provide the game you ask for by using the app. Guesses and safes are kept while the game exists because they make up each safe’s public history (without data that identifies you). Events and technical counters are kept only as long as their purpose requires.

Providers and location

Supabase hosts the database and anonymous authentication in its European London region (United Kingdom). If you turn on safe alerts, they’re delivered through Expo’s push notification service (United States) and Apple Push Notification service or Google’s Firebase Cloud Messaging. Cloudflare serves this website. Each provider processes the data its service needs under its own policies.

Ads

If you don’t support the app, at most one full-screen ad a day may appear, and only after a wrong guess. Never while you type a code or when a safe opens. Ads are served by Google AdMob. Before requesting ads we check your choices with Google UMP, and you can change them from Settings. We request non-personalised ads, we don’t ask for permission to track you across apps, and the app doesn’t use the Android advertising ID. Google’s SDK may process IP address, derived approximate location, technical identifiers and diagnostics to serve and measure ads and prevent fraud (Google’s policy). We don’t send your alias or guesses to AdMob.

Purchases

“Support THE SAFE” is a one-time purchase that removes ads and unlocks cosmetic extras; tips are optional and unlock nothing. No purchase gives guesses, hints or advantages. Apple or Google handle payment: we never receive card details. The app stores on the device whether you’re a supporter, and you can restore it with the same store account.

Control and deletion

In Settings, “Delete my data” deletes the anonymous identifier, alias, alert tokens and local data. Your past guesses and usage events are unlinked from you so tried combinations keep counting for everyone; if you opened a safe, the archive will show “anonymous”. More on the deletion page.

Children

The app doesn’t ask for age or personal data and is meant for a general audience. Signatures are reviewed before they’re published.

Last updated: 5 October 2026.