Privacy Policy

DodoNest ("we", "our", or "us") operates the DodoNest website at https://dodonest.app and the DodoNest iOS application (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding your information.

By using the Service you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account and Identity Information

When you create an account or sign in using a third-party identity provider (Apple, Google, or email/password), we receive and store:

• Email address — used to identify your account and, if you opt in, to receive service notifications.
• Display name — the name shown to other members of your tribe. Populated from your identity provider but editable by you at any time.

We do not receive your social account passwords. We do not collect or store profile photos from third-party providers.

1.2 Profile Information You Provide

You may optionally provide:

• ARK username — your in-game character name, visible to tribe members.

1.3 Game and Tribe Data You Create

The Service is built to store in-game information on your behalf. This includes, but is not limited to:

• Tribe memberships, server records, and tribe settings
• Base locations and generator fuel records
• Dinosaur records (names, statistics, mutations, breeding pairs)
• Task assignments and duty rotations
• Boss run schedules, seat assignments, and kill logs
• Character statistics and boss kill history
• Marketplace listings and trade records
• Tribe announcements and activity logs

All of this data is content you enter and control. Tribe leaders may see data entered by all members of their tribe.

1.4 Push Notification Token

If you grant permission for push notifications on iOS, we collect the Apple Push Notification service (APNs) device token associated with your device. This token is used solely to deliver notifications you have opted into. It is stored in our database linked to your account and is deleted when you remove notification permission, sign out, or delete your account.

1.5 Authentication Session Data

We use Supabase for authentication. Supabase issues and manages JSON Web Tokens (JWTs) for your session. Session tokens are stored in your browser's local storage or, in isolated flows such as account linking, in session storage. These tokens are invalidated when you sign out or delete your account.

1.6 Information We Do Not Collect

• We do not collect your precise location.
• We do not collect your contacts, camera, or microphone data.
• We do not track your activity across third-party apps or websites.
• We do not use advertising identifiers (IDFA/GAID).

2. How We Use Your Information

We use the information we collect to:

• Provide the Service — authenticate you, display your tribe data, and enable collaboration with tribe members.
• Deliver push notifications — send tribe alerts, boss run reminders, and other in-app notifications you have opted into.
• Maintain security — detect and prevent abuse, enforce our Terms of Service, and protect the integrity of user accounts.
• Improve the Service — understand aggregate usage patterns to fix bugs and prioritize features. We do not sell or share individual-level data for this purpose.

We do not use your information for advertising, profiling, or any purpose beyond operating the Service.

3. Sharing and Disclosure

3.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to any third party.

3.2 Service Providers

We share data with the following sub-processors that help us operate the Service. Each is bound by data processing agreements and handles data only as directed by us:

• Supabase, Inc. — Provides our database infrastructure and authentication services. Your account data and all tribe content is stored on Supabase's servers (hosted on AWS in the United States). Supabase Privacy Policy.
• Apple Inc. — Used for Sign in with Apple authentication and to deliver push notifications via APNs. Apple Privacy Policy.
• Google LLC — Used for Sign in with Google authentication on the web platform. Google Privacy Policy.

3.3 Within Your Tribe

Information you enter in the Service is shared with other members of your tribe as necessary to provide the Service (e.g., your display name, ARK username, and any content you create is visible to tribe members). Public player profiles are visible to any signed-in user.

3.4 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our legal rights, prevent fraud, or protect the safety of users.

3.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via the email address on your account before your data is transferred and becomes subject to a different privacy policy.

4. Data Retention

We retain your personal information for as long as your account is active. When you delete your account, we permanently delete all personal data associated with it — including your profile, all tribe content you created, and your push notification token — within 30 days. Data held in database backups may persist for up to an additional 30 days before being purged from backup cycles.

You can delete your account at any time from your profile settings on the web or from the Settings screen in the iOS app.

5. Your Rights

5.1 Rights for All Users

• Access and correction. You may view and update your profile information at any time from your account settings.
• Deletion. You may delete your account and all associated data at any time from Settings → Delete Account.
• Push notifications. You may revoke push notification permission at any time from your device's Settings app (iOS) or from the Notifications section in the app.

5.2 Rights Under GDPR (EEA and UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") — request deletion of your personal data where we no longer have a legal basis to retain it.
• Right to restriction of processing — request that we restrict how we use your data in certain circumstances.
• Right to data portability — request a machine-readable copy of your personal data to transfer to another service.
• Right to object — object to processing of your personal data where we rely on legitimate interests as our legal basis.
• Right to lodge a complaint — you have the right to lodge a complaint with your local data protection authority.

Our legal basis for processing your personal data is the performance of the contract between you and us (providing the Service) and, for analytics purposes, our legitimate interests in improving the Service.

5.3 Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to know — the categories and specific pieces of personal information we collect, use, disclose, and sell (we do not sell).
• Right to delete — request deletion of personal information we have collected about you.
• Right to opt out of sale — we do not sell personal information, so this right does not apply.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at support@dodonest.app. We will respond within 45 days.

6. Children's Privacy

The Service is not directed to children under 13 years of age (or under 16 in the EEA). We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at support@dodonest.app and we will delete that information promptly.

ARK: Survival Ascended is rated M (Mature, 17+) by the ESRB and PEGI 18. DodoNest is intended for players of ARK: Survival Ascended and is therefore designed for users aged 17 and older.

7. Security

We implement reasonable technical and organizational measures to protect your information, including:

• All data in transit is encrypted via TLS/HTTPS.
• Data at rest is encrypted by our database provider (Supabase/AWS).
• Authentication tokens are short-lived JWTs; we revoke all sessions on account deletion.
• Row-level security policies ensure users can only access data belonging to their own tribe.
• Account merges and deletions are performed server-side using privileged service-role credentials that are never exposed to the client.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

8. Third-Party Links

The Service displays news items fetched from the Steam API for ARK: Survival Ascended. These articles link to Steam and other external websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where required by law, notify you by email or via an in-app notice. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or have a privacy concern, please contact us: