Privacy policy and terms

Squader — Terms of Use and Privacy Policy

Part I. Terms of Use

1. What we are agreeing on

Squader is an app for finding people to play with: listings, clans, teams, events, text and voice chat. By installing the app or creating an account you agree to this document. If you do not agree, do not use the service.

2. Your account

You sign up with a login and a password, or through Google. One person, one account; accounts may not be sold, transferred or lent.

An email address is optional, but the account is fuller with one. Without a confirmed address: first, a forgotten password cannot be recovered — there is nothing to get back into the account with; second, some abilities are limited — you may answer listings less often, your listing stays visible to others for a shorter time, and you cannot create clans. Once the email is confirmed these limits are lifted. You can add or change the address under Profile → Security; signing in through Google or Yandex fills it in automatically.

We send exactly two kinds of letter — a code to recover a password and a code to confirm a change of address. No newsletters, no news, no advertising. We never ask you to follow a link — our letters carry a code you type into the app yourself: a letter "from Squader" asking you to sign in through a link is not from us. The delivery service appends an unsubscribe link at the bottom; using it is a bad idea, as it would take password recovery with it.

If you have turned on sign-in codes (two-factor authentication), save your recovery codes: without them and without your authenticator app the account cannot be recovered, email or not.

Your login is fixed the moment the account gets a password and cannot be changed afterwards. Your nickname (display name) can be changed freely.

Age. The service may not be used by anyone under 14. Users aged 14 to 18 use it with the knowledge and consent of a parent or legal guardian.

You are responsible for everything done through your account. If you suspect somebody else got in, change your password — this ends every other session — and write to support.

3. What is not allowed

Inside the service it is forbidden to:

• insult, harass or threaten anyone, or incite hatred on any ground;
• post pornography, any sexualised material involving minors, or scenes of violence;
• call for terrorism or extremism, or promote drugs, suicide or weapons;
• publish somebody else's personal data without their consent — addresses, phone numbers, private messages, photographs;
• impersonate another person, an organisation, or the service's administration;
• send spam, advertising, bulk messages, or recruit for outside services;
• trade accounts, cheats or boosting services, or run any scheme that defrauds other users;
• interfere with the service in any way: guessing passwords, scraping, circumventing limits or bans, exploiting vulnerabilities;
• infringe anybody's copyright.

Separately: evading a ban — creating a new account to replace a blocked one — is itself a violation.

4. Your content

Everything you post — text, images, video, voice messages — remains yours. By posting it you give us the right to store it and show it to other users as far as running the service requires (delivering a message to its recipient, showing a picture to a clan, and so on). The licence grants nothing beyond that: we do not sell your content and do not show it outside the app.

You are responsible for having the right to post what you post.

5. What we do not verify

Age, gender, name, photographs and every other detail in a profile or a listing are what that person wrote about themselves. We do not check them and cannot check them. The one thing in the app that really is verified is the creator badge, and all it means is ownership of a YouTube channel.

When you answer a listing and arrange to play, keep in mind:

• the person may not be who they say they are — of any age and with any intent;
• never give anyone your passwords, confirmation codes, payment details, home address, or where you work or study;
• do not send money or hand over in-game valuables to somebody you know only from conversations here;
• everything you say in a voice channel and everything you show on your screen is heard and seen by everyone in that channel;
• if somebody threatens you, presses you for data, pressures you or talks you into something — stop the conversation, block them and file a report: moderation will see it.

This matters most for minors. If a child of yours uses the service, talk to them about the fact that conversations here are conversations with strangers.

6. Voice channels and screen sharing

Voice and screen sharing pass through our own server and are never recorded: neither the audio nor the picture is written to disk in any form. They are, however, seen and heard by everyone in the channel, including people who join later. When you share your screen, you are responsible for what is on it — conversations, passwords, other people's data.

Screen sharing is available to whoever is allowed to speak at that moment: a mute, a kick or a ban takes it away along with the right to talk.

7. YouTube channel verification

A creator may prove they own a YouTube channel. We check ownership (through Google sign-in, a code in the channel description, or an email sent from the channel) and read the subscriber count from YouTube's public API. The badge and the abilities attached to it rest on that check: if the subscriber count falls below the threshold the badge goes out automatically, and it comes back on its own once the channel is over the bar again.

The administration may withdraw a badge if the verification turns out to have been obtained in bad faith.

8. Moderation

Anyone can report a user, a message, a clan or any other material. The administration reviews reports and may hide or delete material, issue a warning, restrict particular actions, or block an account temporarily or permanently.

Inside a clan, roles and permissions granted by its owner apply: strikes, mutes, kicks and bans within a clan are the clan's decisions, not the service's.

If you disagree with a sanction, write to support from the app. If the account is fully blocked the app cannot be used at all, and an appeal can be sent to the operator's address shown on the About screen.

9. Events, giveaways, clans

An event is created and run by its author, who is also responsible for what they promised: the time, the line-up, any giveaway prizes. The service's administration is not the organiser of events and does not guarantee that they take place.

A clan belongs to whoever created it. If the owner deletes their account, the clan passes to another member; if there is nobody to pass it to, the clan is deleted.

10. Availability and changes

The service is provided "as is". We do our best to keep it running but do not guarantee uninterrupted operation, the survival of messages and files in the event of a failure, or compatibility with every device.

We may change how the service works, and we may change this document. A new version is published in the app, and the next time you sign in you will be asked to accept it. Continuing to use the service after that means you agree.

We may end access to an account for a serious or repeated breach of these rules, and we may shut the service down, announcing it in the app beforehand.

11. Governing law

This agreement is governed by the law of the Russian Federation. Disputes are resolved at the operator's place of registration unless the law requires otherwise.

---

Part II. Privacy Policy

1. General

This policy describes what data the Squader app collects, what for, and what happens to it. The data controller is the entity named in the app, on the About screen.

We do not sell personal data, do not pass it to advertisers, and do not use it for advertising profiles. The app contains no advertising trackers and no third-party analytics.

2. What data is processed

Account data. Login, password hash (the password itself is never stored), nickname, avatar. For Yandex or Google sign-in — the account identifier at that provider and the name it returned.

Email address — if you gave one (it is optional) or it came from Google or Yandex when you signed in through them. It is used only to recover a password and to confirm a change of the address itself; it is never used for anything else and never shown to anybody.

Profile data — all optional, filled in by you: first and last name, date of birth, gender, languages, time zone, list of games, the hours you are available to play.

Channel verification. The identifier, title and link of the YouTube channel, its subscriber count and the date it was verified. If you chose verification by email, the address you published in the channel description is processed as well — only to send the code there and to check that the address has not changed since.

Device data. Device fingerprint, platform, OS version, manufacturer, model, device name, app version, language and time zone, and the date of the last session. This is what lets us show you the list of your own sessions and deliver notifications to the right device.

The device fingerprint is an identifier issued by the phone's own operating system (ANDROID_ID on Android, identifierForVendor on iOS). It is unique to the pair "this app on this device", is useless to any other app, and reveals nothing about you outside the service. Besides the session list, it is used for two things: limiting how many accounts can be created from one device, and blocking a device used to evade a ban by making new accounts. Such a block applies to every account on that device. Registration also stores your IP address and this identifier - solely to count those two limits.

Push notification tokens — one per device.

Content. Messages, attachments, photographs, voice messages, round video notes, posts, comments, listings, events, favourite stickers.

Moderation data. Reports filed and received, blocks, strikes, notes about clan members.

Two-factor data, if you have turned it on: the secret used to generate codes and the hashes of your recovery codes.

Technical data. For choosing the sign-in method by country your IP address is processed in passing only — to determine your country from a local GeoLite2 database and offer the right sign-in method (Yandex or Google); for that it is not written to the database. The one place the IP address is stored is the registration stamp (see "Device data" above), solely to count the per-address account limit. Beyond that it may appear in web-server logs, which are kept for no longer than 30 days.

Voice conversations and screen shares are not recorded and are not stored in any form.

3. Why it is needed

• signing up, signing in and protecting the account — account data, device data, two-factor data;
• recovering a password and lifting account limits — the email address;
• running the service: listings, clans, teams, chats, events — your profile and what you post;
• notifications — push tokens, device data, language settings;
• moderation and safety — reports, blocks, server logs;
• choosing the sign-in method by country — your IP address, in passing;
• the creator badge and what comes with it — YouTube channel data.

The legal basis is performance of our contract with you (these Terms) together with your consent, given at registration and again with every new version of this document.

4. Who the data is shared with

The application servers, the voice server and the realtime server are hosted with hosting-vds.com; the database is hosted with sweb.ru. Voice, screen sharing and realtime messages travel through our own servers and are not passed to anyone else.

The third-party services genuinely involved:

• Google Firebase Cloud Messaging — the device's push token and the notification text, so a notification reaches an Android phone;
• Google — your account identifier and channel data, for Google sign-in and channel verification;
• Yandex ID — your account identifier and name, for Yandex sign-in;
• Cloud.ru, S3 object storage in region `ru-central-1` — uploaded files, to store attachments and avatars;
• Unisender Go (Unisender LLC, Russian Federation) — the recipient address and the text of the code email, so the letter reaches your mailbox. Sent only at the moment a letter goes out, and only for accounts that have an address.

The game catalogue is loaded from an external source, and game descriptions are translated by a machine-translation service — no user personal data is sent there.

Data may be disclosed to state authorities where the law requires it.

5. Retention and deletion

Data is kept for as long as the account exists.

You delete the account yourself: Profile → Delete account. Deletion is immediate and irreversible; there is no undo. What happens:

• deleted: the account, profile, listings, events, posts, reviews, reports you filed, subscriptions, block history, devices and notification tokens, two-factor data;
• your avatar is queued for deletion from file storage;
• messages in conversations stay with the people you were talking to, but stop being linked to your account — their author becomes unknown. Otherwise deleting one participant would destroy somebody else's conversation;
• files you uploaded that other people's content still refers to also remain, likewise unlinked from the account;
• clans you own pass to another member, or are deleted if there is nobody to pass them to.

Web-server logs are kept for no longer than 30 days.

6. Your rights

You may:

• see and correct your data — in your profile;
• delete your account and data — in your profile;
• withdraw consent — which amounts to deleting the account, since the service cannot work without processing this data;
• request information about how your data is processed — through in-app support or by writing to the operator's address from the About screen. We answer within 30 days.

7. How data is protected

Passwords are stored only as hashes. Traffic to the server runs over TLS. Access tokens are kept in the operating system's secure storage on the device. Changing your password ends every other session. Sign-in codes (TOTP) are available, with a limit on attempts. Access to production data is restricted to the service's administration.

No system is perfectly secure, and we cannot guarantee the safety of data against circumstances outside our control.

8. Children

The service is not intended for anyone under 14 and does not knowingly collect their data. If you are a parent and believe a child signed up against these rules, write to the operator and the account will be deleted.

9. Changes

A new version of this policy is published in the app. The next time you sign in you will be asked to accept it; previous versions remain available in the history.