Cards4Players privacy policy
Last updated: 1 November 2026
This policy explains what data the Cards4Players game ("the game", "the app") processes, why, for how long, and what your rights are. If anything is unclear, write to us (see "Contact").
Who is responsible for your data
The controller is Tiago Filipe Pinto de Sousa. Contact: suporte@cards4players.com.
Summary
- You need an account to play. You sign in with your email (we send you a code) or with your Google or Apple account. We do not ask for your real name or phone number.
- Other players only see the nickname you choose. You can delete your account in the app, in Settings → Delete account.
- Cards and game state only exist while you are playing.
- Reports you make or receive are kept for a while, for review.
- (planned) The app shows Google ads (AdMob). Personalised ads are only shown if you consent.
- We do not sell your data.
What data we process and why
Data that stays on your phone
The app keeps the following in your phone's secure storage:
- your account session (a secret code that proves to the server it is you);
- a copy of your account data (nickname and email), so you can play against bots without internet;
- your settings (language, sounds, four-colour deck);
- the list of players you blocked (their nickname and public identifier).
This data does not leave your phone, except as described below. Uninstalling the app or signing out deletes it from your phone (the account stays on the server until you delete it).
Your account
To play you must sign in to an account. On the game server we keep:
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Your email, if you sign in with email (or the one Google or Apple give us, if they confirm it) | To send you the sign-in code and recognise you when you return | Performance of the service you asked for (Art. 6(1)(b)) |
| Your Google or Apple identifier, if you sign in that way | To recognise you when you return | Performance of the service (Art. 6(1)(b)) |
| Your nickname | To show it to other players | Performance of the service (Art. 6(1)(b)) |
| Open sessions (stored hashed) and when they were last used | To keep you signed in | Performance of the service (Art. 6(1)(b)) |
| The sign-in code (stored hashed, for 10 minutes) | To confirm the email is yours | Performance of the service (Art. 6(1)(b)) |
To send the code we use an email service (Brevo), which receives your email address and the message.
Data sent to the game server when you play online
When you create or join a room, or browse public rooms, the app sends to the game server:
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Your account session | To recognise you across connections (rejoining a game, one room per person, removals, room creation limit) | Performance of the service you asked for (Art. 6(1)(b)) |
| Players you blocked (public identifiers) | So you are not placed in the same room | Performance of the service (Art. 6(1)(b)) |
| Your moves (bets, cards played) | To play the game | Performance of the service (Art. 6(1)(b)) |
| App version | To tell you when you need to update | Legitimate interest in keeping the game working (Art. 6(1)(f)) |
The server never shows your email, your session or the internal account identifier to anyone. In rooms and in the public room list, other players only see:
- your nickname;
- a public identifier, derived from the account identifier in a way that cannot be reversed.
The state of rooms and games (who is in the room, cards, bets) is kept only in the server's memory. It disappears when the room closes.
The game server does not log your IP address. The hosting provider (see "Who we share data with") may process IP addresses to route connections and protect its network.
Stats, friends and groups
When an online game ends, we store on the server, linked to your account: the place you finished in, how many rounds you played and made, the tricks you won and the title you received. We use this to show your stats, achievements, daily challenges (and the coins you earn from them) and rivalries with other players.
| Data | Who sees it | Legal basis (GDPR) |
|---|---|---|
| Online game results, achievements, challenges and coins | You. Your friends see your stats and your rivalry with them | Performance of the service (art. 6(1)(b)) |
| Friend code, friend requests and friend list | Anyone with your code can send you a request; only you accept | Performance of the service (art. 6(1)(b)) |
| Friend groups (name, members) and the group table | The group members | Performance of the service (art. 6(1)(b)) |
| Invites to a room | The invited friend. Kept only in server memory, up to 5 min | Performance of the service (art. 6(1)(b)) |
Reports
When you report a player, we keep:
- the date;
- the room code;
- the reason;
- the nickname and public identifier of both the reporter and the reported player.
This lets us review abusive behaviour and, if needed, block access for those responsible. The legal basis is our legitimate interest in keeping the game safe and respectful (Art. 6(1)(f)).
Ads (planned)
The game is free and funded by Google AdMob ads. To show ads, Google's SDK may collect:
- your device's advertising identifier;
- your IP address and the approximate location derived from it;
- device and system information;
- data about your interaction with ads.
- In the European Economic Area and the United Kingdom, the app shows a Google consent message before the first ad. You can accept or refuse personalised ads. If you refuse, you may still see non-personalised or limited ads. You can change your choice at any time in Settings → [privacy option name].
- On iPhone, the app asks for permission to track your activity (App Tracking Transparency). If you refuse, Google does not receive your device's advertising identifier.
Legal basis: your consent (Art. 6(1)(a)), for personalised ads and for storing or reading information on your device.
Google processes this data under its own policy: How Google uses information from sites or apps that use our services.
Error reports
To fix crashes, when the app hits an unexpected error it sends a report to our own server (it does not go to any outside service). A report includes:
- the error message and where in the code it happened;
- the system (Android, iPhone or browser) and the app version;
- the screen you were on;
- your account, if you are signed in.
It does not include your email, your nickname, your cards or your phone model. The server's own errors are stored the same way. Legal basis: legitimate interest in keeping the game working (Art. 6(1)(f)).
Who we share data with
Only with providers we need to run the game, bound by contracts to protect the data:
| Who | Why | Where |
|---|---|---|
| OVH (OVHcloud) | Hosting the game server (and the accounts database) | Canada (Beauharnois). The European Commission recognises Canada as providing an adequate level of protection (adequacy decision) |
| Brevo (Sendinblue SAS) | Sending the sign-in code | European Union (France) |
| Google and Apple (if you sign in with them) | Confirming your identity. We only receive an identifier and, if they confirm it, your email | Under Google's and Apple's own policies |
| Google (AdMob) (planned) | Ads | Transfers to the US may occur, under the EU-US Data Privacy Framework and standard contractual clauses |
| Apple and Google (stores) | Distributing the app. The stores process data under their own policies | — |
Other players see your nickname, moves, lives and public identifier.
We may disclose data when the law requires it (for example, at the request of a court).
How long we keep data
| Data | Period |
|---|---|
| Room and game state | Until the room closes (server memory only) |
| Rooms created, for the hourly limit | 1 hour, server memory only |
| Reports | 12 months after they are made. Longer only if needed for a specific proceeding |
| Error reports | 90 days |
| Account (email, Google/Apple identifier, nickname) | Until you delete the account. |
| Results, achievements, challenges, coins, friends | Until you delete the account (or remove the friend, or leave the group) |
| Room invites | Up to 5 minutes, server memory only |
| Sessions | Until you sign out or delete the account |
| Sign-in code | 10 minutes, or until used |
| Data on your phone | Until you uninstall the app or sign out |
Minimum age
The game is not intended for children under 13. It is not gambling: there is no money, no prizes and nothing to buy. If you know that a child below this age has sent us data, write to us and we will delete it.
Your rights
Under the GDPR you have the right to:
- access your data;
- rectify it;
- erase it;
- restrict or object to processing;
- data portability;
- withdraw consent at any time, without affecting what was done before.
To delete your account and all its data, use Settings → Delete account in the app. To exercise any other right, write to suporte@cards4players.com from your account's email address (or tell us your public identifier, shown in Settings).
We reply within one month.
You may also complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or to the authority in your country.
Security
- Connections to the server are encrypted (HTTPS/WSS).
- The session is kept in the phone's secure storage (Keychain on iPhone, Keystore on Android). On the server, sessions and sign-in codes are only stored hashed, and your email is never shown to other players.
- The server does not keep games after rooms close.
Changes to this policy
If we change this policy, we update the date at the top. For important changes, we tell you in the app.
Contact
Tiago Filipe Pinto de Sousa: suporte@cards4players.com