Privacy

What the app stores, and where

Everything below lives in the app's own storage on your phone, written through the platform's ordinary preferences store. None of it is uploaded, backed up to us, or readable by anyone but the app — and a device backup made by iOS or Android is between you and that platform, not us.

• spadecraft.field.v1Your level in the field, your current form, and your record.
• spadecraft.formtrail.v1Your form after each of your last thirty games, which the home screen draws as a chart. It stays on this phone, and is not sent even when you carry your progress.
• spadecraft.progress.v1How far up the room ladder you have climbed.
• spadecraft.settings.v1Your settings.
• spadecraft.lasthand.v1The last hand you finished, kept so the export outlives the review screen.
• spadecraft.savedgame.v1A game against the field you left before it finished: who you sat with, the seeds it was dealt from and every bid and card so far, so you can pick it up where you left it. Removed when the game finishes.
• spadecraft.history.v1Recent hands — the bids and what they cost — which the home screen is drawn from.
• spadecraft.learn.v1Which lessons and drills you have done.
• spadecraft.entitlement.v1Whether this device has the ad-free tier.
• spadecraft.account.v1If you signed in: which provider vouched for you, and the opaque id the server knows you by.
• spadecraft.session.v1If you signed in: the token this device presents, and when it stops working.
• spadecraft.sync.v1Whether you have turned off Carry my progress in settings. It only matters once you have signed in.
• spadecraft.results.v1Games you finished in the field and your account has not seen yet: the level you played, whether you won, and when. Kept so that a sign-in can bring your form up to date, and never more than the last sixty.

That is the whole list, and it is the whole of it: three files in the app write these keys, the ones that keep your progress, your sign-in and your account, and nothing else in the app touches storage at all.

What the app sends

Playing alone: nothing about your games. Every number the app shows you — your level, your form, the cost of a card you played — is computed on the device from what is stored on the device. The field, the review, the lessons, the drills and your hand records need no network at all, and the app works on a plane.

If the app crashes: it sends a crash report to Sentry, the service we use to find and fix bugs. A report says which error happened, where in the app's code, and the phone's model, system version and the app's version. It never includes your name, a handle, your account, your games, what was on the screen or anything you typed, and it is not used to follow you or to build a profile. Sentry is asked not to store the address the report came from. Nothing is sent when the app is working normally — there is no usage tracking, no record of what you tap and no ping when you open it.

The deal is generated on your phone too. The commitment, the second seed and the reveal all happen locally: there is no server to send a hand to, and a hand record you export is a file on your device until you choose to send it somewhere.

If you sign in: the app sends the signed proof your provider gives it, once, so the server can tell it is you. Signing in is optional and is for playing rated games against other people. Everything above keeps working exactly as it does without one.

What the server then keeps, by name, is this and nothing else:

• providerApple or Google — which one vouched for you.
• subjectThe opaque id that provider uses for you. It is not an email address and it is not shown to anybody.
• handleThe name you choose for other players to see at a rated table. Optional, and empty until you choose one — see the moderation rules.
• handle_changeEach name you have used and when it changed. It is what a report is checked against, since a name can be changed after one is filed. It goes when the account does.
• handle_reportEach time you report a name, or somebody reports yours: who reported it, whose it was, the name as it read then, which game, and what was decided. It goes when either account does.
• account_blockEach player you have blocked, and when. It is what keeps the two of you apart in the rated queue, and it goes when either account does.
• bannedWhether you have been barred from rated play.
• created_atWhen the account was made.
• sessionOne row per device you are signed in on: a one-way hash of the token that device holds, and when it expires. The token itself is never stored on the server.
• standingYour level on the field, and your points towards the next one.
• ratingYour form: the rating, how certain it is, how many games are behind it, and when you last played.
• rating_changeOne row per game your rating was updated by, which is what makes it auditable.
• ranked_handEach hand played at a ranked table: when, to which target, which game it was part of, and its deal in the fairness record's own format. It belongs to the four people who played it — see shared hands below.
• ranked_seatWhich account sat in which chair for that hand, and the bags that chair's side took.
• ranked_walkoutEach time you left a ranked game before it ended: which game, after how many hands, the score between the sides at that moment, and whether you sat back down in time. A walk-out is rated on where the game stood, and this is the record of it. It goes when the account does.
• field_recordWins and losses against each character on the field.
• partner_gameHow many games you have played beside each partner.
• lesson_readWhich lessons you have read to the end.
• drill_answerWhich drills you answered right first time.
• hand_noteYour last sixty hands — the bids and what they cost — which is what the home screen reads to tell you what keeps costing you. Removed on its own by the sync switch.
• entitlementWhether you have the ad-free tier, so a second phone gets it too. It can only ever be added to: nothing the app sends and no query here can take a one-time purchase away.

No email address is collected, asked for, or sent. Apple's private relay and Google's subject id both work without one, the app sends no mail, and a field that is never stored is a field that cannot leak and cannot be missed when you delete.

If you sign in, your progress is carried too, so that a new phone is not a fresh start: your level, your form, who you have beaten and how often, which lessons and drills you have done, and your last sixty hands. That is a switch — Settings → Account → Carry my progress — and it is named before you sign in, not afterwards.

Turning it off stops the sending and removes the hands already sent. Your level, your form and anything you have paid for stay, on this device and on the account: it is a narrower thing than deleting, and it is there so that somebody who wants the level carried but not the record of their own mistakes can have exactly that.

Nothing on this device is removed by any of it. Your progress was on your phone before there was an account and it is still yours.

If you play at a private table: the app sends our table server the name you type there, the table's code, and your bids and cards as you play them — which is how the other three see them. No account is involved, and signing in is not needed. The table is held in that server's memory while it is played. When the server is restarted — which happens whenever we release a change to it — the game in progress is written to its database so that it can carry on afterwards: the table's code, how its cards were dealt, and the bids and cards played so far. Never the names typed at it, and nothing that identifies the people playing. That record is removed as soon as the table is picked up again, and within about an hour if nobody comes back. The server's own log records a table only by its code and a seat only by its number — never by the name typed at it. When each hand ends, its deal is published to the four people at the table, so any of them can check that it was dealt fairly.

If you play ranked: the app sends the queue your session and the target you picked, and asks every two seconds whether a table has been found. At the table it sends your bids and cards as you play them, exactly as at a private table, and the other three see your handle and nothing else about you. The queue is held in the server's memory only, and forgets you within a minute of seating you or thirty seconds after the app stops asking.

What a ranked game leaves behind is the three ranked_ records above and the change to your rating: each hand's deal, so any of the four can check it was fair; which account sat where, and the bags each side took; and each walk-out. A game in progress when the server restarts is written down as a private table's is, together with which account holds which chair so it can still be rated — never a handle — and removed the same way.

Ads, on the free tier. The free tier is funded by ads from Google AdMob. To show one, AdMob is sent the phone's advertising identifier where the system allows it (on iPhone only if you have allowed tracking, which the app does not ask for), its IP address and the coarse location that implies, the phone's model, system version and language, the app's name and version, and whether an ad was shown, closed or tapped. Google uses that to choose the ad, to cap how often you see it, and to prevent fraud. Nothing about your games goes with it: not your level, your form, your hands, your mistakes or your account. In the EEA, the UK and Switzerland you are asked for consent first, and can change your answer.

An ad comes between games, every few hands when playing the characters, and at the end of a match with other people. Never between a hand and its review, and never more than one in five minutes. The paid tier removes ads completely, and on it the ad network is never started, so nothing is sent to it at all.

Permissions

The app asks for none. No camera, no microphone, no contacts, no location, no notifications. On Android the ad network adds the advertising-ID permission, which needs no prompt and which you can reset or delete in the system's settings; on iPhone the app never asks to track you.

Children

Playing alone, the app collects nothing about anybody of any age beyond the crash report above, which carries no name and no identifier, and what the ad network is sent to show an ad, also above. Ads are limited to content rated for general audiences. Signing in collects the two fields listed above and nothing more, it is optional, and it can be undone completely from inside the app.

Deleting what is stored

Reset progress, on the settings screen, throws away your level, your form, your record and your kept hands. It is the only destructive thing in the app that touches this device, and it asks first.

Delete account, on the same screen, removes everything the server holds under your account: the account row itself, every field listed above, and every session on every device you are signed in on. It takes effect immediately — there is no queue and no waiting period — and it needs no email to us and no form to fill in. It asks first, and the dialog names what goes.

Three things deliberately survive it, and this is the place to say so rather than leave you to find out:

• this deviceYour level, form, lessons, drills and hand records are not touched. They were on your phone before there was an account and they are still yours.
• what you paid forNot touched. A purchase belongs to your store account, not to ours, and deleting here is not a way to lose it.
• shared handsA rated hand four people played stays a record, because any of the four can check the deal was fair. Your account is unlinked from it, so no name and no id of yours remains on it.

Uninstalling the app removes everything stored on this device. It does not delete an account — use Delete account first if you want that gone too.

Your name, and other players

If you choose a handle, the other three people at a rated table see it and nothing else about you. It is the only thing you can type that anybody else ever reads at a rated table — there is no chat at a table, by design, and nothing else to type there.

A name typed when you join a private table is a different thing: it is not reserved, not moderated as a handle, and not kept after that table ends.

What is allowed, what gets a name taken down, and what happens to the account it belonged to is on the moderation page. The short version: a name that has to go is replaced, and your level, your form and anything you paid for are not touched by that.

Changes to this policy

The date at the top moves when the text does. A change that alters what the app collects or sends will be made here before the release that makes it true, rather than after.

Contact

Questions about any of this: support@spadecraft.app. The support page has the rest.