Privacy Policy for Sky Card Game

1. Who we are

Sky Card Game (the "app") is published by Cherry Pub LLP, registered office 71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ, company number OC431055 ("we", "us").

We are the controller of the personal data described here. Contact: app@greentomatomedia.com.

This policy covers the Sky Card Game apps for iOS and Android and the web version at skycardgame.cherrypub.app. It does not cover other websites, including gtmapp.com, or the App Store and Google Play, which have their own policies.

2. The short version

• You can play without an account. We give your device a random anonymous ID.
• Signing in with Apple or Google is optional. It unlocks your @tag, friends, table invites, game history and your profile on a new phone.
• There are no ads, no Facebook, no cross-app tracking. We never sell or rent your data.
• We measure how the game is played with Google Analytics, without your name, @tag or advertising ID. In the app you can turn it off at any time; on the website it only starts if you accept.
• Your nickname, avatar and moves are visible to the other players at your table. Your @tag, nickname and avatar are visible to players you connect with.
• You can delete your account in the app at any time: Me > Settings > Delete account.

3. What we collect and why

3.1 When you play (everyone, including web guests)

• Anonymous player ID. Firebase Authentication creates a random ID for your device so you can sit at a table and reconnect. It contains nothing about you.
• Nickname and avatar. You pick a nickname and one of our preset avatars and card decks. We check nicknames against a list of offensive words.
• Online tables. When you create or join a private table, the table is stored on our server: the table code, the nickname, avatar, deck and seat of each player, when each player was last active, the cards and moves of the game, and the preset emotes sent. Anyone who has the table code or invite link can see this table while it exists. Bots are computer players.
• Camera (optional). If you scan a table's QR code, the camera image is processed on your device only. Nothing is uploaded.
• Solo games run entirely on your device and are not uploaded. Finished solo games only count towards unlocking card decks.

3.2 When you sign in with Apple or Google (mobile only, optional)

• Sign-in data. We use Firebase Authentication and link your Apple or Google sign-in to your existing anonymous ID.
  • Apple: we request no name and no email. We receive only an Apple user identifier.
  • Google: Google gives Firebase your Google account ID, email address, name and profile-photo link. We store them in Firebase Authentication only to recognise you; we do not show them, contact you with them or use them for anything else.
• Profile. Your nickname, avatar, equipped deck and deck progress are saved to your account so they follow you to a new phone.
• @tag. You can claim a unique public @tag (3-16 letters, digits or underscores). Other signed-in players can look you up only by typing your exact @tag; there is no search or list of players.
• Friends. Your friends list, friend requests you sent and received, the players you blocked, and whether you accept friend requests. When you connect with someone, each of you keeps a copy of the other's @tag, nickname and avatar so your lists display quickly.
• Table invites. When you invite a friend, we store the invite (your @tag, nickname, avatar and the table code) in their account. Invites are hidden after one hour.
• Push notifications. If you allow notifications, we store your device's Firebase Cloud Messaging token to send you friend requests and table invites. The notification shows the sender's nickname and @tag (or the table code). You can turn notifications off in your phone's settings. Signing out removes the token from your account.
• Game history and statistics. For signed-in players, when an online game ends we save the result to your account: date, table code, rules, your score per round, your place, and the nickname, score and place of each player at that table. Your stats are calculated from this. Anonymous players and web guests have no history.

3.3 Sky Premium subscription (mobile only)

• Purchases are made and paid through the App Store or Google Play. We never see your card or bank details.
• We use Adapty to show the subscription offers and check whether your subscription is active. Adapty receives an Adapty device/profile ID, your purchase and subscription status and history from the store, which offers you viewed, basic device information (model, OS, app version, store country, language), and, when you are signed in, your Sky Card Game account ID so your subscription follows your account. Collection of the advertising IDs (IDFA, Android Advertising ID) is turned off.
• Your free game of the day is counted on your device.

3.4 Keeping the app working and secure

• Crash reports (Sentry). When the app crashes or hits an error, it sends a technical report: error and stack trace, app version, device model, OS version, language and a few sanitised steps leading up to the error. Reports carry no account ID, no nickname, no @tag and no table code (they are removed before sending). Screenshots, screen recordings and network capture are switched off.
• App integrity (Firebase App Check). To block fake clients, the app asks Google Play Integrity (Android), Apple App Attest / DeviceCheck (iOS) or Google reCAPTCHA Enterprise (web) to confirm the request comes from a genuine app. These services check your device or browser and give us a yes/no token; we do not store their signals.
• Text updates (GTM Content). On mobile the app downloads updated texts and translations from our own content server, GTM Content, hosted in New York, United States. The request contains no player ID. Like any web server, it logs the IP address and time of each request.
• Server logs. Like any online service, our hosting providers log technical data such as IP addresses when your device connects. We do not use them to identify you.

3.5 Usage statistics (Google Analytics for Firebase)

To understand how the game is played and make it better, the app and the website send usage statistics to Google Analytics for Firebase, run by Google as our processor.

• What is sent: in-game actions such as tutorial progress, games started and finished (solo or online, table size, duration, result), table joins, invitations shared, friend requests, paywall views and purchase outcomes; device and app information (device model, operating system, app version, language); your approximate country and city, which Google derives from your IP address without storing the address; a random app-instance identifier; and broad groups such as whether you are signed in, whether you have Premium, and how many games you have played.
• What is never sent: your name, nickname, @tag, email address, table codes or invite links, your account ID, or your advertising ID (IDFA, Android Advertising ID). Google signals and ad personalization are turned off, and the data is not used for advertising.
• Only in released versions. Test and development versions of the app send nothing.
• Your choice: in the app, statistics are on until you turn them off in Settings > Privacy > Share usage statistics; they stop at once on that device. On the website, nothing is measured until you choose Happy to on the notice at the bottom of the page; No thanks keeps it off. To change your answer on the website, clear the site's data in your browser and answer the notice again.
• Cookies on the website: only after you choose Happy to, Google Analytics stores the _ga and _ga_91RGLH1N5Z cookies for up to 13 months.
• Retention: event data is kept for 14 months, then deleted by Google.

3.6 Support and reports

If you contact support or report a player (Friends > a player > Report, which opens our support page at https://gtmapp.com/support/sky-card-game/ with the player's @tag copied for you), we receive what you write, your email address if you give it, and the @tag you report. We use it to answer you and to enforce our Terms.

3.7 What we do not do

We do not collect your phone number, contacts, photos, precise location, or advertising ID. We do not show ads, use advertising cookies, track you across other companies' apps or websites, or sell or share your personal data for advertising.

4. Data table

5. Who can see your data

• Players at your table: your nickname, avatar, deck, seat, moves and emotes. Anyone with the table code or link can open the table while it exists.
• Other signed-in players: your @tag, nickname and avatar if they look up your exact @tag, and when you send them a request, invite or are friends. They are never told that you blocked them.
• Service providers who process data on our behalf and under contract: Google (Firebase Authentication, Cloud Firestore, Realtime Database, Cloud Functions, Cloud Messaging, Hosting, App Check, Play Integrity, reCAPTCHA Enterprise), Apple (Sign in with Apple, push notifications, App Attest), Adapty (subscriptions), Sentry (crash reports), Google Analytics for Firebase (usage statistics). GTM Content (text updates) is our own server and is not shared with anyone.
• Apple and Google process your purchases as independent controllers under their own terms.
• Authorities when the law requires it, and a buyer of our business if the app is sold (you will be told).

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.

6. Where your data is stored

Game data, profiles, friends and history are stored by Google in the European Union (europe-west1, Belgium). Crash reports are stored in Germany. Some providers (Firebase Authentication, Cloud Messaging, Apple, Adapty) may process data in the United States or other countries, and our text-update server (GTM Content) is in the United States. When a provider receives data from the UK or EEA outside those areas, we rely on adequacy decisions (such as the EU-US Data Privacy Framework and its UK extension where the provider is certified) or Standard Contractual Clauses.

7. Legal bases (EU and UK users)

• Contract: to run the game, tables, accounts, friends, invites, history and your subscription.
• Legitimate interests: crash reports, usage statistics in the app (with the opt-out described in section 3.5), security and anti-abuse (App Check, name filter, reports, blocks), and keeping the service reliable. You can object (section 9).
• Consent: push notifications and the camera, which you allow through your phone's permission prompt and can withdraw in your phone's settings; usage statistics and their cookies on the website, which start only after Happy to.
• Legal obligation: tax and accounting records for purchases, and answering lawful requests.

8. Deleting your account and data

In the app: Me > Settings > Delete account, then confirm with Apple or Google. This immediately:

• deletes your @tag, withdraws the table invites you sent, and removes you from your friends' lists and pending requests;
• erases your profile (nickname, avatar, deck, deck progress, friends, requests, invites, blocks and notification tokens) and keeps only an empty marker of your account ID so friends' apps stay in sync;
• revokes Sign in with Apple, and deletes your sign-in account;
• then deletes your game history, your statistics and your subscription profile at Adapty automatically.

Without the app: use https://skycardgame.cherrypub.app/delete-account/ or email us from the Apple or Google address you signed in with, with your @tag if you remember it. We confirm within 30 days.

What remains:

• Sky Premium is billed by Apple or Google: deleting your account does not cancel your subscription. Cancel it in your App Store or Google Play settings. Apple and Google keep their own purchase records under their policies.
• A table you were seated at stays visible to its players until it expires (about a day at most).
• Your nickname stays in the game history of other signed-in players who played with you, until they delete their account. A block list that names you may keep your old @tag, nickname and avatar until the other player unblocks you.
• Crash reports expire on their own (up to 90 days) and never contain your name or @tag.
• Usage statistics are not linked to your account. Deleting your account resets the analytics identifier on that phone; past statistics expire after 14 months.
• Data stored on your phone is removed when you uninstall the app. Web guests can clear their browser data.

Players who never signed in have no account to delete: uninstalling the app (or clearing browser data) removes everything on the device that identifies them. Their random anonymous ID stays in Firebase Authentication but can no longer be linked to them, and anonymous tables expire on their own.

9. Your rights

Depending on where you live (for example the EU, UK, or US states such as California), you can ask us to: access your data or get a copy; correct it; delete it; restrict or object to processing based on legitimate interests; and withdraw consent at any time. We do not sell or "share" personal data for targeted advertising, and we do not use it for decisions with legal effects about you. We will not treat you differently for using your rights.

Most of this you can do yourself in the app (change nickname or @tag, remove friends, block, turn off requests, notifications or usage statistics, delete your account). For anything else, email app@greentomatomedia.com. We answer within one month (45 days under US state laws). We may ask you to prove the account is yours, for example by writing from your sign-in email or giving your @tag.

You can also complain to your data protection authority, for example the UK Information Commissioner's Office (ico.org.uk) or the authority in your EU country.

10. Children

Sky Card Game is meant for players aged 13 and over. If the age at which you can consent to data processing online is higher where you live (for example 16 in some EU countries), you need a parent's or guardian's permission to sign in, use friends features or buy a subscription. We do not knowingly collect personal data from children under 13. Players under 13 should only play solo or as a guest at a table with family, without signing in. If you think a child under 13 has given us personal data, contact us and we will delete it.

11. Security

All data travels over encrypted connections (HTTPS/TLS). Database rules let each player read only their own account; tables can only be opened with their code, and the player list cannot be browsed. Access to our consoles is limited to the people who run the game. No system is perfectly secure, and we will notify you and the authorities of a breach when the law requires it.

12. Changes to this policy

We will update this page when our practices change and change the date at the top. For important changes, we will also tell you in the app before they take effect.

13. Contact

Cherry Pub LLP, 71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ

Email: app@greentomatomedia.com

Support and reports: https://gtmapp.com/support/sky-card-game/