Draft pending review. This text is not the final version yet.

Privacy policy

Last updated: 5 November 2026

In short

  • We don’t ask for your email, phone number or a password: your account is anonymous.
  • We keep only what the game needs: your profile, your tables, your cards and a record of your purchases. Never your card details.
  • The app’s data is stored in the European Union. Only purchase validation and the paywall go through the US.
  • We measure how the game is used with an anonymous ID. In the app, stats and session recordings only if you agree.
  • Tables are deleted 90 days after they end; your account, whenever you choose.
  • No ads and no selling data. This site uses no cookies.

Who is responsible

Data controller: [pending: name or company name, tax ID and address]. For anything about your data, write to hola@dealt.example.

What we keep

  • Account: a random ID the app creates the first time you open it, with the date you joined and the date you last used it. For your session we only keep a hash, never the token itself.
  • Profile: the name and colour you choose, and your language.
  • Notifications: your phone’s push token, to tell you what’s happening at your tables and that your Plus trial is about to end.
  • Tables: name, deck, time limit, players, hands, cards served and their answers, scoreboard and history. If you write your own cards, their text too.
  • Invites: each table’s four-character code.
  • Reports: if you report a card, its text, who wrote it and who reported it.
  • Purchases: the record of your Dealt Plus, that is, the product (yearly, monthly or lifetime), the start and expiry dates, the store (App Store or Google Play) and whether you’re in a trial. Never card details: Apple and Google handle those.
  • Game usage: events such as creating a table, joining, serving or doing a card, tied to your account’s anonymous ID, without your name or the text of any cards.
  • App stats and errors: the steps you take in the app (welcome, tutorial, invites) and session recordings with all text masked, only if you agree; and the technical details of crashes (for example, the phone model and the system and app versions), without the text of any cards.

What we don’t keep

We don’t ask for your email, phone number, contacts, location or photos. We don’t keep payment details either: Apple and Google take the payments, and all we get is which plan you have and its dates, never your card or your bank account. There are no ads and no cross-app tracking.

What we use it for, and the legal basis

  • Making the game work (dealing, serving, answering, notifying you and showing the recap): providing the service you ask for when you use the app, that is, the contract (Article 6(1)(b) GDPR).
  • Handling your purchases and your Plus (knowing whether you can create tables, restoring your purchase and warning you before your trial ends): also the contract (Article 6(1)(b)).
  • Game stats from our server, with your account’s anonymous ID, to learn what works and improve it: our legitimate interest (Article 6(1)(f)).
  • Finding and fixing the app’s errors: our legitimate interest (Article 6(1)(f)).
  • Reviewing reports and moderating content: our legitimate interest (Article 6(1)(f)).
  • Stats and session recordings inside the app: your consent (Article 6(1)(a)). We ask when you start, and you can withdraw it any time in Your profile. Withdrawing it changes nothing in the game.

Who sees what

Players at a table see your name, your colour, the cards you serve and receive, and your answers. Only you see your hand.

Where it’s stored and who helps us

The app’s data is stored with Cloudflare, under European Union jurisdiction. For the rest we work with these processors:

  • Cloudflare: hosts the app’s data and this website.
  • Expo, Apple and Google: deliver notifications (Apple on iPhone, Google on Android), and receive the token and the text of the notification. Apple and Google also take the payments.
  • RevenueCat (US): validates your purchases and subscriptions. It receives your account’s anonymous ID and your purchases.
  • Superwall (US): shows the subscription screen (the paywall). It receives your account’s anonymous ID, the paywalls you see and your purchases.
  • PostHog (EU): game stats and, if you agree, app stats and session recordings.
  • Sentry (EU region): the app’s error reports.

Transfers outside the EU

RevenueCat and Superwall are in the US, so that data leaves the European Union. [Pending: confirm the safeguards for those transfers and the final list of processors.]

How long

  • Tables, with their cards and history, are deleted 90 days after they end.
  • Your account and profile, until you delete your account.
  • The purchase record, until you delete your account. The purchase itself stays on your Apple ID or Google account, and you can restore it.
  • Push tokens, until they stop being valid or you delete your account.
  • Stats, recordings and error reports: [pending: confirm the retention period at PostHog and Sentry].

Your rights

You can access, correct, delete or take your data with you, or object to its use. You can withdraw your consent for stats and recordings in Your profile. Delete your account in the app (Profile › Delete account) or write to us. If you think we’re getting it wrong, you can complain to the Spanish Data Protection Agency (aepd.es) or your local authority.

This website

This site uses no cookies and no third-party analytics, and the fonts are served from here. Cloudflare, which hosts it, processes your IP address to serve and protect it. An invite code is read in your browser and never leaves it.

Changes

If we change this policy, we’ll say so here and in the app.