PRIVACY POLICY & COOKIE DECLARATION
Last audited: November 2026 · TIRAZO Beta 1.0 (Android & Web) · Published by KAEL LABS
TIRAZO is engineered as an offline-first tactical football simulation. We do not use advertising trackers, marketing SDKs, or profiling cookies. Full guest gameplay (matches, drafts, auctions, XP, and progression) requires no account and transmits zero personal data. When you choose to authenticate via Google Sign-In or TIRAZO CLUB ID, Google Firebase Authentication securely manages your session credentials. In Beta 1.0, cloud synchronization is intentionally decoupled; all match simulation and career progression remain strictly local on your device.
YOUR PRIVACY & STORAGE CONTROLS
You can change or withdraw your consent at any time. When withdrawn, optional data is erased instantly from your browser.
LOCAL STORAGE & COOKIE AUDIT
Under GDPR Article 6(1)(b) and the ePrivacy Directive, all local storage technologies below are audited, transparently documented, and governed by your explicit consent.
1. ESSENTIAL STORAGE (STRICTLY NECESSARY · ALWAYS ACTIVE)
Required for gameplay execution, local career progression, and secure session management. Cannot be disabled.
| STORAGE KEY / NAME | MECHANISM | CATEGORY | PURPOSE | RETENTION |
|---|---|---|---|---|
| tirazo_storage_v1 (tirazo_save_v1) |
localStorage | Saves local manager nickname, career record (matches, wins, losses, goals), squad assignments, and XP progression. | Persistent on device until user clears application storage or browser cache. | |
| tirazo_account_hint (tirazo_cloud_active) |
localStorage | Lightweight session flag indicating an authenticated CLUB ID exists, enabling background token validation without delaying guest startup. | Until sign-out or account deletion. | |
| firebase:authUser:[apiKey]:[appName] | IndexedDB / localStorage | OAuth session tokens, user identifier (UID), and refreshed authentication state for Google Sign-In and CLUB ID users. | Persistent until user signs out, revokes Google permissions, or deletes account. | |
| tirazo_cookie_consent_v1 | localStorage | Stores the visitor's cookie and storage consent choice, consent version, and ISO timestamp. | Persistent until user resets preferences or clears browser storage. |
2. PREFERENCES STORAGE (OPTIONAL · REQUIRES CONSENT)
Used to remember custom UI choices, audio settings, and community feature votes. Disabled by default until you grant permission.
| STORAGE KEY / NAME | MECHANISM | CATEGORY | PURPOSE | RETENTION |
|---|---|---|---|---|
| tirazo_audio_v1 (tirazo_audio_prefs) |
localStorage | Preserves audio mixer levels (Master and SFX volume sliders) and mute state across visits. | Persistent until consent is rejected, withdrawn, or storage cleared. | |
| tirazo_soundtrack_v1 (tirazo_soundtrack_prefs) |
localStorage | Preserves soundtrack volume, mute status, and the currently active music track across sessions. | Persistent until consent is rejected, withdrawn, or storage cleared. | |
| tirazo_community_pref_v1 | localStorage | Remembers your roadmap voting selections (e.g. favorite country, league, and gameplay priorities). | Persistent until consent is rejected, withdrawn, or storage cleared. | |
| tirazo_beta_intro_seen_v1 | localStorage | Remembers that you have reviewed the Beta 1.0 onboarding briefing, preventing repetitive modal popups. | Persistent until consent is rejected, withdrawn, or storage cleared. |
3. ANALYTICS & MARKETING (NOT IMPLEMENTED · ZERO TRACKERS)
TIRAZO is completely tracker-free. We do not use advertising or analytics cookies.
| CATEGORY | STATUS | DETAILS |
|---|---|---|
| Analytics & Telemetry | Zero third-party analytics trackers (such as Google Analytics, PostHog, or Mixpanel). No telemetry is captured. | |
| Marketing & Advertising | Zero marketing trackers, advertising pixels, or data broker integrations. No personal data is ever commercialized. | |
| HTTP / Document Cookies | TIRAZO does not set or read any HTTP cookies or document.cookie entries across the entire website. |
DATA PROTECTION & PRIVACY DISCLOSURES
1. LEGAL BASIS FOR PROCESSING (GDPR ARTICLE 6)
KAEL LABS ("we", "us") publishes TIRAZO and processes minimal player data under GDPR Article 6(1)(b) (Performance of a Contract) to maintain saved manager progression, audio preferences, and authentication sessions requested by the user.
2. DATA WE NEVER COLLECT
TIRAZO does not track or collect:
- Precise GPS or coarse location coordinates
- Advertising IDs (Google GAID, IDFA)
- Contacts, call logs, SMS, or media gallery assets
- Biometric identifiers or browsing habits outside our game
- Payment card numbers or banking data (all supporter contributions are processed off-site via Ko-fi)
3. AUTHENTICATION & USER CREDENTIALS
When you opt into creating a TIRAZO CLUB ID or authenticate via Google Sign-In:
- Email & Password: Handled securely by Google Firebase Authentication. TIRAZO never has access to plaintext passwords. An email verification request is dispatched upon registration.
- Google Sign-In: On Android, authentication runs natively via Android Credential Manager. On Web, standard OAuth 2.0 pop-up flows are used. We receive your verified email, display name, and Firebase User ID (UID).
- Decoupled Cloud Sync Notice: In Beta 1.0, cloud match synchronization is decoupled and inactive. Your match scores, lineups, and career records remain strictly on your local device.
4. THIRD-PARTY DATA PROCESSORS
For optional sign-in, Google Cloud / Firebase Authentication (Google LLC) processes authentication information. If you follow a voluntary support link, you leave TIRAZO and visit Ko-fi; the creator's connected payment provider processes the contribution under its own terms and privacy notices. TIRAZO does not collect payment card numbers on this website. Account pages may load Firebase JavaScript from Google's hosted SDK. We do not sell personal information to data brokers or advertising networks.
5. USER RIGHTS & ACCOUNT DELETION
Depending on where you live, applicable privacy law may give you rights to access, correct, or erase personal information. TIRAZO also offers account deletion for authenticated users:
- In-App Deletion: On Android and Web, navigate to Settings > Account Deletion to permanently erase your authenticated account.
- Public Web Deletion Portal: If you uninstall the app, you can delete your account at any time via our public portal at /account/delete.
- Local Data Wipe: Clearing application cache/storage resets all local guest records.
- Email Requests: You may also request account erasure by emailing privacy@tirazo.app.
6. CONTACT US
For privacy inquiries or data-erasure requests, please contact KAEL LABS at support@tirazo.app or privacy@tirazo.app.
ASSET ATTRIBUTIONS & LICENSES
View Lucide Icons, CC BY 4.0, and CC0 Licenses
Lucide Icons and Contributors. Original TIRAZO player art, league environment illustrations, typographic club identities, and UI. Club and player reference metadata: openfootball/players and openfootball/clubs (CC0). Sourced 2017-18 affiliations from matchday squads: Wyscout / Pappalardo et al., CC BY 4.0 (DOI 10.1038/s41597-019-0247-7); historical season, not current. Unmapped clubs use fictional players.
ISC License Copyright (c) 2026 Lucide Icons and Contributors Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.