Privacy Policy — PlayCards
Last updated : 21 September 2026
PlayCards is a multiplayer card game for phones. It works without a mandatory account. The free version shows a few ads (never during a game); any purchase removes them for good. This page describes the data that passes through our providers so the game can work, and what you can do about it.
Who is responsible
The publisher of PlayCards, AATMD (Mathys Thévenot) ("we"). Contact: aatmdmt@gmail.com.
What the app does not do
- No mandatory account: the whole game plays without one. The optional account (see below) asks only for an e-mail address, never a password or a phone number.
- No sale of your data, ever, to anyone.
- No ads during a game or in the lobby: only between two finished games.
- No access to your contacts, your location or your microphone.
Advertising
The free version is paid for by advertising, served by Google AdMob. In practice:
- At most one short ad after a finished game — never during a hand, never in the lobby, never before your second game of the session.
- Videos you choose to watch in exchange for something (coins, doubling the daily chest).
- Any purchase removes them all, for good: the Table Pass, the all-games bundle or "Uninterrupted games". And a guest at a table whose host has paid never sees one.
To serve those ads, AdMob receives your advertising identifier and technical data about the device. In the European Economic Area, the United Kingdom and Switzerland, a consent screen (Google UMP) asks for your agreement before any personalised advertising, and you can refuse or change it at any time from Profile › Help & info › Ad privacy choices. On iPhone the app also asks for tracking permission (App Tracking Transparency); if you refuse, the ads stay but are not personalised. Google's own privacy policy is at policies.google.com.
The camera and your photos
The app asks for camera access to scan a table's QR code and to photograph your own cards when you build a deck; it asks for photo access if you would rather pick a picture you already have. Nothing is sent anywhere: the image stays on your device, unless you submit that deck to the shared catalogue (in which case it goes to Supabase, the "Card images" row below). You may refuse: only those features stop working.
Data that passes through, and why
| Data | Why | Where | How long |
|---|---|---|---|
| Nickname (chosen by you, editable) | Identify you at the table | Photon (current game), Supabase (if you submit a game) | The session for Photon; as long as the submitted game exists for Supabase |
| IP address | Required to establish the network connection of a game | Photon | The connection; Photon's technical logs per their policy |
| Transient game data (cards played, bets, reactions, table state) | Let the other players at your table play | Photon | The duration of the game; nothing is stored afterwards |
| Device identifier (an anonymous identifier the system generates for this app; not your serial number or advertising ID) | Cap game submissions at 5 per day, avoid duplicate reports, count usage | Supabase | With the row that carries it: at most 12 months for events, plays, reports and feedback; as long as a submitted game exists |
| Submitted games and decks (game name, description, rules, deck cards, author nickname, language, app version) | Publish your game in the shared catalogue after review | Supabase | Until removed by you or by us |
| Card images (of a submitted deck, when your version has this feature) | Show the deck to other players | Supabase (storage) | Same |
| Reports (targeted game, reason) | Moderate community content | Supabase | At most 12 months |
| Optional e-mail address (the "e-mail" field of the "Report a problem" form or of a game submission; never required) | Answer you, tell you when your game is published | Supabase | At most 12 months for feedback; as long as the submitted game exists; erased everywhere with the optional account when it is the same address |
| "Report a problem" feedback (message, category, app version, phone model, game on the table, last lines of the log) | Fix the problems reported | Supabase | At most 12 months |
| Usage events (table created, joined, finished, game chosen, purchase succeeded or failed; never the content of a game) | Learn which games are played and improve the app | Supabase | At most 12 months |
| Anonymous purchase identifier and receipts | Unlock paid games and restore them on a new device | RevenueCat (and Apple / Google, who process the payment) | Per Apple, Google and RevenueCat policies |
Progression data (level, coins, collection, language) stays on your device; it is sent nowhere, unless you create the optional account described below.
The optional account
Since version 1.1 you can, from your profile, attach your progression to an e-mail address so it follows you to another phone. This is never required to play.
- Signing in: you type your address, receive a six-digit code by e-mail and type it in. There is no password, no social login, and the address is used for nothing but sending that code.
- What is stored (Supabase, European Union): your e-mail address, an account identifier, your nickname and avatar, your level, experience points, coins, day streaks, the cosmetics you unlocked and equipped, your language, and your game history (game, number of players, won or lost, duration, score, date — never the content of a game). While signed in, usage events also carry your account identifier, to tell your devices apart.
- How long: as long as the account exists.
- Deletion: Profile → Account → "Delete my account" immediately erases the account, the e-mail address (including where the same address was left in a feedback report or a game submission), the cloud save and the online history. What is on your phone stays; uninstalling the app erases it. "Sign out" only removes the account from the device.
- Legal basis: your consent, given when you sign in and withdrawn by deleting the account.
Our providers
- Photon Engine (Exit Games GmbH, Germany): real-time game servers, EU region. www.photonengine.com/privacy
- Supabase (Supabase Inc.): database for the community catalogue, reports and usage statistics. supabase.com/privacy
- RevenueCat (RevenueCat Inc.): in-app purchase management. Receives an anonymous identifier and the purchase receipts forwarded by Apple or Google, never your name. www.revenuecat.com/privacy
- Apple and Google process payments under their own terms.
These providers act on our behalf. Some are established outside the European Union; transfers rely on the European Commission's standard contractual clauses.
Legal basis
Performance of the service you request (playing online, submitting a game, buying a game) and our legitimate interest in keeping a working app and a safe catalogue (moderation, minimal usage statistics).
Your rights
You can request access to, correction or deletion of the data linked to your device or to a game you submitted by writing to the address above (aatmdmt@gmail.com). Include the nickname you used and, if possible, the name of the submitted game. Deleting the app erases all local data. EU residents may also lodge a complaint with their data protection authority.
Children
PlayCards knowingly collects no data that identifies a person, child or adult. Community content is reviewed by hand before publication; any game can be reported from the catalogue.
Reporting a problem or an idea
The profile has a "Report a problem / an idea" form. When you send one we receive what you typed, the category you picked, and — so that a human can act on it — the app version, the phone model and platform, the anonymous device identifier, the name of the game on the table and the last 40 lines of the app's own log (technical messages such as "deal started"; never your cards, your messages or anyone's name). The e-mail field is optional; fill it in only if you want an answer. Reports are stored on Supabase with the rest of the community data, read by hand, and deleted 12 months after sending at the latest. To have one deleted earlier, write to the address above with the approximate date of the report.
Changes
Any change to this policy is published at this address with its date.