Privacy Policy.

Introduction

Canastette is a canasta game, coach and scorer for iPhone, iPad and Android, made by Judedon Ltd ("we", "our" or "us"). This policy explains what personal data Canastette collects, why, where it's kept, for how long, and what your rights are.

In short: you can play, learn and keep score without giving us anything. Every install starts with an anonymous account that has no name and no email address. We use first names only. We never ask for your contacts or your location. Our usage stats are off until you switch them on. We show no ads, we don't track you across other companies' apps or websites, and we never sell your data.

Data we collect

Your account

The first time you open Canastette it signs you in anonymously and invisibly, through Firebase Authentication. That gives your phone or tablet an account ID and nothing else. You can stay that way for good: games against the computer players, lessons, Today's deal and the scorer never need more.

An account with a way in is needed only for a few things: starting or joining a group, hosting a friends' table, and getting your purchase and your groups back on a new device. You can use Apple, Google, or a sign-in code we email you. We receive your email address and, if Apple or Google share it, your name. With Apple you can hide your address behind a private relay address, and Canastette never shows it. For the emailed code we keep a scrambled (hashed) copy of the code and your address held encrypted, with a 15-minute expiry, and they are removed automatically once the code is used or has expired. We also keep short-lived counters that limit how many codes can be requested; they hold scrambled forms of the address and the network, not readable ones. We don't ask for a password, and Canastette never sets one.

Names

Canastette uses first names only. The name you give at a table, in a group, on a score sheet or on the room board is whatever you type, up to a short limit, and we ask you to use a first name or a nickname. Names that look like an email address or a phone number are refused.

Only on your device

Your games against the computer players, your record, your score sheets until you share one, your rules cards until you share one, your lesson progress, today's deal results until you share them with a group, your settings and your card size stay on your device. They don't go to our servers. "Export my data" on the You tab makes a file of them for you. If you delete the app they go with it.

Live scoreboards and passing the pen

If you share a score sheet's live scoreboard, our server keeps what the page shows: the sheet's name, the teams' names, the players' first names, the scores, the minimums and the hands so far. Anyone with its link or QR code can see it, with no app and no sign-in. It is deleted 30 days after its last update, and you can stop sharing sooner. If you hand the pen to another phone, the sheet travels with a six-digit code that works for 10 minutes and is then deleted.

Shared rules cards

If you share a rules card by link, the card's settings, its name, its history of changes and your first name are stored with it, and anyone with the link can read it. Nobody can list or search for cards. It stays until you stop sharing it or delete your account. People who saved a copy keep their copy.

Groups and the club night

A group is private and joined with an invite. We keep the group's name, its members' first names and when they joined, who hosts and co-hosts, the next game's day and time as the host set them, and the group's rules card with who last changed it. Answers to "Who's in?" (in, maybe or out, with a first name) are kept for each game. A guest who answers from the web page with no app is not a member: we keep the first name she types, her answer, and a scrambled form of a secret her browser stores so she can change her answer from the same browser. Games and their answers are deleted 60 days after the game. An invite code lasts a week.

When the host runs a night, we keep the night: who is playing, the tables and partners, each table's score for each round, the host's changes, and, if the group turns on settling up, the amounts it works out. These stay with the group so it can show standings, a season and the weekly recap, until the group is deleted. If you play Today's deal, your first name, your points, your canastas and whether you went out are shared with your own groups' members only, and deleted 60 days later.

The room board. The host's phone can publish a small picture of the night for the room's iPad or TV: the title, the round and its clock, each table's players' first names and score, and the standings. Anyone with its unguessable link can see it, with no app and no sign-in. It is deleted a day after the night's last change.

Settling up is off unless a group turns it on. It works out, from the scores, who owes whom at the group's own rate, and shows the sums. Canastette never takes, holds, sends or asks for money.

Friends' tables

When you host or join a friends' table, our server keeps the table so everyone sees the same game: the host's first name, the first names of the people seated, the seats (a person or a computer player in each), the rules card the host chose, the moves and cards played in the open, the totals, the last few preset reactions, and an invite code. A name with three or more digits, an at sign or a web address is refused, so a phone number or an email address can't be put on a table. Each person's own hand is held where only that person can read it: not the host, not their partner, and not the computer players, who never see a hidden card. The order of the deal, the stock and the pile stay on our server and never reach a player's phone until a hand is finished. At a teaching table the host turns on "Show all hands" when setting it up, everyone at the table is told, and everyone seated can see every hand. When a hand ends we keep it whole (every card dealt and every move, with no names) as a replay for the people seated, so you can watch it again with every hand shown. Hosting a table needs the full game, so our server reads your purchase record when you create one; joining never does.

At a live table your phone tells our server when the table is on your screen, and about once a minute while the table is waiting for you, so that a computer player can keep your seat warm if you drop out. That holds only a time and a yes or no. If you leave a table, or delete your account, your seat opens or a computer player takes it, and your first name leaves the table.

How long. A table played live is kept for two days after its last move. A table played at your own pace is kept for four weeks after its last move. When a table ends (the host ends it, or the last person leaves), its hands and the server's copy are deleted at once, and its last screen, with first names and totals, goes within an hour. A replay is kept for the same time as a table of its kind (two days live, four weeks at your own pace), counted from the end of that hand. An invite code works for 12 hours at a live table and 7 days at a table played at your own pace; it stops working once every seat is taken, when the table ends, or when the host takes someone out and makes a new one. Automatic deletion can take up to a further day. To stop abuse we count how many tables an account creates and how many codes are tried, per account and per network; a network is kept as a scrambled value, never its address, and these counters are deleted within a day.

Over FaceTime. On iPhone and iPad you can start a friends' table from a FaceTime call. FaceTime then carries a pointer to the table to the people on the call: the table's name, its invite code and its link. No cards, moves or other table data go over FaceTime, and we never learn who was on the call. The call itself is between you and Apple.

Notifications

A reminder for a group's game is set on your own device and never touches our servers. Notifications from our server are off until you choose them: the app asks only at a calm moment (when you set up a friends' table) or when you tap Turn on notifications on the You tab, and your phone asks you too. If you do, we store, with your account ID, your device's push token (a code the push service gives your device), its type (iPhone or Android) and when it was last refreshed, so we can tell you it's your turn or your deal at a friends' table, that the host nudged you, or that a seat opened in a group's game. We also store your choices of which of those you want. A message names only a first name (the host's, or a group's name and a weekday) and never a card, a hand, a score or a full name. Messages travel through Expo's push service and Apple's or Google's notification service.

A token expires about 90 days after the app last refreshed it (the app refreshes it when you open it and it is over 30 days old). It is removed at once when the push service reports it's no longer valid, when you sign out or someone else signs in on that phone, when you turn notifications off in your phone's settings (the next time the app opens), and when you delete your account. Short-lived counters, each lasting from a few minutes to a day, stop the same message being sent twice. You can turn notifications off in your device's settings or in the app.

Purchases

The full game is a one-time purchase through the Apple App Store or Google Play. We never see your card or payment details. RevenueCat checks the purchase with the store, and our server asks RevenueCat to confirm it before opening the full game, so a purchase can't be faked on a phone. RevenueCat knows you only by your account ID. We keep a small record linked to that ID: whether the full game is on, since when, which store and the store's purchase ids, whether it came through Family Sharing, whether it was refunded, and when we last checked. Our server asks RevenueCat when you buy or restore, when you sign in, once a day for a buyer when you open the app, and before you host a table; someone who has never bought causes no call. The count of practice games you have started, for the two free ones, is kept on your device only and never reaches our servers.

Usage stats

Only if you switch on "Share usage stats" on the You tab (it's off until you do), the app tells PostHog which screens you open and what you do, such as starting or finishing a game, with your account ID, your device model, operating system, language and app version. Your IP address is not stored, and no location is worked out from it. Screens are recorded by name, never with the IDs of your tables or groups. These stats hold counts and choices. They never include a name, an email address, what you type, a card or a hand. Switch it off and the app stops sending at once.

Crash and error reports

Crash reports go to Sentry whether or not you share usage stats, because they're how we find and fix faults for everyone. A report holds your account ID, your device model, operating system and app version, what went wrong and where, and the screens and buttons you used just before, by their names in our code and never the words on your screen (we strip emails, links and one-time codes, and take no screenshots). It also records each session, so we can count how many end without a crash, and timings for about one in ten actions. It never holds your name, email address, a card or a hand.

Support reports

If you use Report a problem or Suggest a feature, we receive what you wrote, the topic, and some context to help us find the cause: the app version and build, your device, operating system and language, your account ID, whether you've bought the full game, the rules card in use, the deal number of the hand you were in, and the ID of the last crash report. The rules card is described by its shape (the game, the preset and what was changed), never by its name. You can add a reply address: your account's address is filled in for you if you have one (not a private relay address), and you can change it. If you clear it, the studio still sees your account's email address, if it has one, so we can reply; the acknowledgement goes only to an address you typed or left in the box. The report is saved on our servers first and then goes to the studio's inbox in Studio HQ and to our support mailbox. If you are offline, a report waits on your device until it can be sent, including after a restart.

What we never collect

• Your contacts. Canastette never asks for them and never uploads them.
• Your location, precise or approximate, from your device.
• Advertising IDs. There are no ads.
• Photos, your camera or your microphone.
• Card or payment details. The stores handle those.

How we use your information

We use it to run your account; keep friends' tables fair and working; show the live scoreboards, rules cards, groups and nights you share; send the turn reminders you've allowed; open and restore the full game; find and fix crashes; understand which features are used, if you've said yes; and answer your support messages.

Under UK and EU data protection law, we rely on: our contract with you (your account, groups, friends' tables, live scoreboards and your purchase); our legitimate interest in keeping the app working and safe (crash reports, limits that stop abuse); and your consent (usage stats and notifications, either of which you can withdraw at any time).

We don't show ads, we don't sell your data, and we don't use it to track you across other companies' apps or websites.

Where your data is kept

Your account, groups, nights, friends' tables, live scoreboards, shared rules cards, notification devices and purchase record are stored in Google Firebase (Firebase Authentication and Cloud Firestore) in the United States (the nam5 multi-region), and our server code runs in Google Cloud's us-central1 region. Usage stats (PostHog) and crash reports (Sentry) are stored in the European Union. Support reports are also held in Studio HQ, our own inbox, hosted in the European Union (Ireland). Sign-in codes and the emails about your reports and your account are sent through Resend. When data moves outside the UK or the EU, these providers protect it with the safeguards the law requires (such as standard contractual clauses). We use appropriate security measures against unauthorized access, change, disclosure or destruction of your data.

Third-party services

Each has its own privacy policy:

• Firebase and Google Cloud (Google): sign-in, database and server code
• Sign in with Apple and Google Sign-In: if you choose them
• Resend: sign-in code, report and account emails
• Expo, the Apple Push Notification service and Firebase Cloud Messaging: delivering notifications you have turned on
• Apple FaceTime, on iPhone and iPad, only if you start a table from a call
• RevenueCat, the Apple App Store and Google Play: purchases
• Apple's App Attest and DeviceCheck and Google's Play Integrity: they tell our server a request comes from the real app on a real device (Apple and Google produce the proof; it carries nothing we hold about you)
• PostHog (EU): usage stats, only if you switch them on
• Sentry (EU): crash and error reports

How long we keep it

• Account: until you delete it.
• Sign-in codes: 15 minutes, or until used.
• Live scoreboards: 30 days after their last update. Pen codes: 10 minutes.
• Shared rules cards: until you stop sharing them or delete your account.
• Groups: until the group is deleted or you leave. Games and their answers: 60 days after the game. Group invite codes: a week. Today's deal lines in a group: 60 days. A night's record stays with the group.
• Room boards: a day after the night's last change.
• Friends' tables: two days after the last move at a live table, four weeks after the last move at a table played at your own pace, and within an hour of its end. Replays of finished hands: two days or four weeks after the hand, as for the table. Invite codes: 12 hours (live) or 7 days (your own pace).
• Notification devices (push tokens): until the push service rejects them, until you sign out or delete your account, or about 90 days after their last refresh. Your notification choices: until you delete your account.
• Counters that limit abuse (tables created, codes tried, messages sent): a day or less.
• Purchase record: our copy until you delete your account. Apple or Google, as the seller, and RevenueCat keep the purchase itself, linked only to your account ID.
• Support reports, and the count of how many you sent in the last hour: until you delete your account. The copy in our support inbox is kept as long as we need it to help you; ask us and we'll delete it.
• Usage stats and crash reports: for a limited time set by PostHog and Sentry, then deleted.

Deleting your account

You can delete your account at any time in the app (the You tab → Privacy and your data → Delete account). If your account has an email address or a way in, we ask you to sign in again first, so a borrowed phone can't delete it. You can also follow the steps on our delete account page, or email support@judedon.com from the email address on your account.

What deleting removes. Your sign-in, and any sign-in code still waiting for your address; the live scoreboards, pen codes and rules cards you shared; our record of your purchase; the devices registered for notifications and your notification choices; the reports you sent from the app; your answers in every group's games; and your place in every group and at every friends' table. You leave your groups: a host hands the group to a co-host or the longest-standing member first, and if you are its only member the group, its games, its invite code and its rules card are deleted with you. You leave your tables as if you had tapped Leave: a computer player takes your seat in a game, the hosting passes to another player, and your first name leaves the table. If you used Apple, we revoke the token we hold for it. We email you to confirm.

What stays, and for how long. Your first name stays on nights your group has already played, so its totals still add up (if you were the only member, the group and its nights are deleted with your account). Today's deal lines you shared with a group are deleted 60 days after you played. A room board you published ends a day after the night's last change. A table that had already ended shows your first name on its last screen for up to an hour. Short-lived counters go within a day. Crash and usage records in Sentry and PostHog carry your old random account ID and expire on their schedules. The copy of a report in our support inbox is kept as long as we need it to help you; ask us and we'll delete it. Apple or Google and RevenueCat keep the purchase itself, linked only to an account ID that no longer has a name or address. Deleting your account doesn't touch your purchase: it stays with your store account, and Restore purchases brings it back on a new account. Everything on your device goes when you delete the app.

Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, receive a copy, and restrict or object to how we use it. To use any of these rights, email support@judedon.com. If you're in the UK, you can also complain to the Information Commissioner's Office (ico.org.uk); in the EU, to your local data protection authority; in California, you can ask us what we hold and to delete it, and we won't treat you differently for asking.

Children

Canastette is not made for children, and we don't knowingly collect personal data from anyone under 13 (or under the age your country sets for consent). The game has no violence, no chat and nothing for sale to play with, so the app stores are expected to rate it for all ages (4+ on the App Store, Everyone on Google Play); that is a content rating, not an invitation to children. If you believe a child has given us data, email us and we'll delete it.

Independence

Independent. Not affiliated with any canasta league, publisher or app.

Changes to this policy

We may update this policy. We'll post the new version on this page and change the "Last updated" date; if a change is important, we'll tell you in the app.

Contact us

• Email: support@judedon.com
• Website: www.judedon.com