Sortivara
What we do with your data
Version 2026-10-19 · Last updated: October 23, 2026
The most important thing first. The camera image is not recorded, not stored and never leaves your phone. Ever. Of everything the camera sees, the game only uses where the moving point is, and that is worked out inside the device itself.
And you can play without an account. Without an account you give us neither your email nor your name: your progress is saved against a number the app makes up.
The camera
Sortivara watches the movement of your hand with the front camera to recognize the spell you draw in the air. That work is done by your phone, not by our server: the image is not transmitted anywhere, it is not stored on disk even for an instant, and it is not shared with anyone.
To follow your hand we use MediaPipe, a model by Google that ships inside the app and runs on your device: nothing is downloaded while you play and nothing is sent to Google.
You can refuse the permission and keep playing: the whole game works by drawing with your finger on the screen.
Who is responsible for your data
LEVANTNET CONSULTING S.A.S., trading as Levant, with registered address at Av. Manuel Córdova Galarza, km 11, Ecuador. Phone +593 98 183 0764. Email: soporte@levantapps.com.
Data protection officer: write to soporte@levantapps.com with "For the data protection officer" in the subject.
What we keep, what for, and on what basis
What isn't marked "with an account" is also kept if you play without one. The last column is the legal basis: the service means we need it to give you what you ask for when you play or create the account; security, our legitimate interest in protecting the service and its users; your consent, that you agreed to it and can withdraw it; the law, that we are required to keep it.
| Data | What for | Basis |
|---|---|---|
| Email address (with an account) | Signing in to your account, confirming it and recovering your password. | The service |
| Name (with an account) | Optional. Only to greet you and for the diploma. If you leave it out, nothing happens. | The service |
| Year of birth (with an account) | Checking that you meet the minimum age to have an account. We keep the year, not the date. | The service and the law |
| Your progress | Which spells you have cast, how many times and when, so you can continue on another device. | The service |
| Your diplomas | When you complete a level that gives a diploma: which one, when, what the paper says and the code in its QR, so that anyone who scans it can check that it is genuine. That check shows your first name, if you put a name in your account (see below). | The service |
| A device identifier | Generated by the app itself. It is not your phone's serial number nor anything that identifies you outside of here. | The service |
| The device name | "iPhone", "Chrome on Windows": worked out from what your browser says, so you can recognise your open sessions under Account. | The service and security |
| Your theme and language | Whether you prefer day or night, and which language you use the app in, so it looks the same on all your devices and emails reach you in your language. | The service |
| Network address (IP) | The one from your last connection and the one of each open session, to protect the service — to see where sign-ins come from and cut off abusive ones — and so you can see your devices under Account. A closed session's address is deleted after 30 days; without an account, the one from your last visit after 90 days without using the app. All of it is deleted with the account. | Security |
| What you accepted (with an account) | Which version of the terms of use and of this policy you accepted — each one separately —, the date and time, from which address and with which device, and when you asked for or stopped the news. It is what lets us show that you gave your consent. Kept while you have the account. | The law |
| The age band (without an account) | Whether the player is under 13, 13 to 15, or 16 or over, from the year they tell us the first time. We don't keep the year. | The law (treating each age as it should be) |
| An adult's authorisation (under 16, without an account) | That an adult who looks after the player authorised them to play, with the date, time, network address, device and language. Deleted with the game record. | The law and the adult's consent |
| Whether you want news (with an account) | Whether you ticked the box when creating the account, and when. Unticked, we write to you only when necessary. | Your consent |
| Your purchases | If you buy the full game (with or without an account), the store (App Store or Google Play) sends us an identifier of the purchase and what you bought, and tells us if it is refunded. We never see your card or your payment details: those stay with the store. | The service and the law |
| What you ask us about your data | Your request, your email and our reply, as proof that we handled it. | The law |
Almost everything comes from you while playing. The only thing that reaches us from others is what Apple and Google confirm to us about your purchases.
What is needed and what isn't. The email and the year of birth are needed to have an account; without them you can play without an account. If the email is wrong you won't be able to confirm the account or recover the password. If the year isn't true and you are under the age, we will delete the account. The name is optional.
Without an account, your progress is saved against the device identifier, with no email and no name: nothing that says who you are. If you never cast a spell, that record deletes itself the next day; and if you stop using the app for two years (with nothing bought), it is deleted with its progress.
What your device keeps
The app doesn't use cookies. The app and the game in a browser keep on your device (in its local storage) only what is essential for them to work: your session, your progress, the device identifier, the language and theme you choose, a copy of the spell catalogue to go faster and, in the browser, what you decided about the website's cookies. What is strictly necessary doesn't need your permission. If you clear the app's or the browser's data, all of that is removed from the device.
Cookies on the website (Google Analytics)
Only on the website and only if you accept. On sortivara.levantapps.com — the home page, the game when you open it in a browser, and these pages — we use Google Analytics to know how many people visit us, which pages they open and where they come from (for example, from a search engine or from the store listing). Inside the app there is no Google Analytics or any other analytics, ever.
- Until you press "Accept", nothing from Google is loaded: not its code, not a cookie, not a request. If you press "Reject", or don't answer, the website works exactly the same.
- What it measures: the pages you open (without whatever follows "?" or "#" in the address, and without the code of a shared spell or a diploma), which site you come from, your type of device and browser, the language and the approximate country or city. It doesn't measure what you do inside the game or anything about your account, and it doesn't know who you are.
- The cookies:
_gaand_ga_…, from this site, which tell one browser from another with a random number. They last 13 months at most. - No advertising: we don't use Google's advertising features, its signals for ads, or ad personalization.
- Your IP address: Google Analytics only uses it to work out the approximate country or city and does not store it.
- Who: Google LLC (and Google Ireland Ltd. in Europe) does it for us, as a provider and processor, with its servers in the United States and other countries. That transfer relies on your consent. Visit data is kept in Google Analytics for 14 months at most.
- Minors: if, in the game, whoever uses the browser said they are under 16, nothing is measured in that browser.
- Changing your mind: at any time, from "Cookies" at the bottom of the home page and of these pages, or in the game from Account → About. When you withdraw your consent, measuring stops at once and Google's cookies for this site are deleted. Your choice is remembered for 13 months; after that, or if we change what is measured, we ask you again.
Automated decisions
We don't build profiles or take automated decisions that significantly affect you. Two things are automatic: the game decides whether your movement matches the spell, and a filter rejects offensive words in the name. If you think it got it wrong, write to us and a person will look at it.
Who at Sortivara sees your data
Only the people who run the game, and only to run it: answering your requests, stopping abuse. Every time someone in the panel looks at or changes a person's data, it is recorded, with the date, and reviewed by whoever is responsible for the data. That record is kept for one year.
The server also keeps technical logs for 14 days to fix problems. Your email does not appear in full in them.
Who helps us, and where your data is
Nobody else sees your data for their own purposes.
- SmarterASP.NET keeps the server, the database and the mailbox we write to you from on our behalf. It acts as a processor: it only keeps the data for us and cannot use it for anything else. Its servers are in the United States: since your data leaves Ecuador to be stored there, that transfer relies on it being necessary to provide the service you ask for (art. 60.4 of Ecuador's Organic Law on Personal Data Protection) and on the contract with the provider.
- Apple and Google, only if you buy: they charge, with your store account, and confirm the purchase to us. They do so under their own privacy policies, as controllers of their part.
- Google, with Google Analytics, only on the website and only if you accept (see Cookies on the website).
What we don't do
- There is no advertising, personalized or of any kind.
- We don't sell or hand over your data to anyone.
- Inside the app there are no analytics or trackers. On the website, only Google Analytics, and only if you accept.
- We don't ask for your location, your contacts, your photos or your microphone.
- We don't train models with your data.
For parents and guardians
The first time the game is opened without an account, we ask for the year of birth. If the player is under 16, an adult who looks after them has to authorise it before anything reaches our server; that authorisation is recorded with the date, time, network address and device, as proof. We don't keep the year: only the age band (under 13, 13 to 15, 16 or over), whether the authorisation was needed and whether it was given.
Children under 13. From them we keep only what is essential for the game to work and be safe — the identifier the app makes up, the progress and the network address, which is deleted after 90 days —, what US law (COPPA) calls "support for internal operations": we don't use it for anything else or to contact anyone. They can't have an account, share spells, or receive emails. Whoever looks after them can ask us to see or delete what there is, and withdraw their authorisation, by writing to soporte@levantapps.com.
Children play Sortivara too. Without an account, the server keeps only the progress, the identifier the app makes up and the network address of the last visit — no email, no name, no age —, and never the camera image. That deletes itself: a record without spells the next day, the address after 90 days without using the app and everything else after two years. If you look after a minor and want us to delete it sooner, write to soporte@levantapps.com and we'll tell you how to do it from their device. And if you'd rather they didn't use the camera, the whole game is played with a finger.
Age
We use a single number: 16. Having an account and sharing spells require 16; below that you play without an account with an adult's authorisation. It is a number that covers the rules of every place where the game can be downloaded: in Ecuador — where the publisher is based — you can consent from 15, in Europe each country sets between 13 and 16, and in the United States the law protects children under 13 (which is why we keep even less from them, as explained above).
That doesn't close the game to anyone. A minor's purchases are controlled by the store with its own family tools (Apple's "Ask to Buy", Google Play's parental controls). If we find out that an account belongs to someone under the age, we delete it.
When you share a spell or download the diploma
The link of a shared spell may show your first name and nothing else — never your surname or your email — and only if you tick that box. Every time you share you are asked again: that decision is not kept from the previous time.
The diploma carries the name you put in your account and a QR code. The page that QR leads to says whether the diploma is genuine and shows the same as the paper, with only your first name — never your surname or your email. If your account has no name, none is shown.
Both pages have an unpredictable address and ask search engines not to index them, so only someone with the link or the paper gets there.
Emails
We write to you to confirm the account, to change the email and to recover the password. And only if you ticked the box when creating the account, the occasional Sortivara news: rarely, and each one carries a link to stop receiving them. It can also be turned off from your account, under "News by email". If you didn't tick it, there are no newsletters or promotions.
For how long
As long as you have the account. You can delete it yourself at any time from the app, under Account → Delete my account: everything of yours — email, name, progress and diplomas — is deleted at once and you are signed out on all your devices. If you don't have the app at hand, ask for it at sortivara.levantapps.com/borrar-cuenta.
- If you create an account and don't confirm the email within 7 days, the email, name, year and password are forgotten; if you were playing on that device, your progress stays there.
- Your purchases are not deleted: they stay with nothing that says who you are — what was bought, in which store, when, and its transaction number — as an accounting and audit record, for 7 years. If you restore the purchase in a new account with the same Apple or Google account, it is yours again.
- What you ask us about your data (and what we reply) is kept for 3 years, as proof that we handled it; after that it is left without email and without text.
Your rights
You have the right to access your data, to rectify and update it, to erase it, to object to its processing, to ask us to suspend its processing, to take it with you (portability) and not to be subject to solely automated decisions. And you can withdraw your consent whenever you want, as easily as you gave it, without affecting what was done before.
- Two things you do yourself, without waiting for anyone, under Account: Download my data gives you a file (JSON, machine-readable) with everything we keep about your account, and Delete my account deletes it at once. News is turned off with its switch or with the link in each email.
- For everything else, the app has a form under Account → About, or write to soporte@levantapps.com. It is free, and we reply within 10 working days of receiving your request (if we need you to clarify something, we ask only once).
- If we don't answer or you disagree, you can complain to Ecuador's Superintendencia de Protección de Datos Personales (spdp.gob.ec). If you live in the European Union, also to your country's data protection authority.
If this changes
If we change something important we will say so inside the app before it starts to apply, and with an account we will ask you to accept it again to continue. The version and date above say which one is in force.