Privacy Policy

Last updated: 19 June 2026

May I Rummy ("the app", "we", "our") is a card game you can play in a browser or as an iOS or Android app. This page explains what personal information we collect, why, who we share it with, and the rights you have over your data.

1. Who we are

The app is operated by an individual developer based in New Jersey, United States. You can reach us at mayirummy@gmail.com for any privacy question.

2. What we collect

2.1 Account information (only when you sign in with Google)

• Display name — shown to other players in multiplayer games.
• Email address — used as a stable identifier and for support contact.
• Profile photo URL — shown as your avatar in the app.
• A Firebase user ID — an opaque random identifier that links you to your saved games.

We do not receive your Google password. Sign-in is handled entirely by Google.

2.2 Game data

• Single-player saves — a snapshot of your in-progress game (hand, discard pile, score). Stored in your private space in our database, readable only by you.
• Multiplayer room state — while a multiplayer game is active, the cards you hold and the moves you make are shared with the other players in the room (this is how the game works). When the room ends, this data is deleted.
• Audit log of host actions — if you are the host of a multiplayer room and remove a player, we record that action (who you are, who you removed, when) so the action is traceable in case of abuse complaints.

2.3 Local device storage

We store small pieces of information in your browser's local storage and IndexedDB so the app works:

• A sign-in session token (managed by Firebase Authentication).
• The 4-letter code of your last multiplayer room, so you can rejoin if you got disconnected.
• Your most recent game state, in case you close the tab.

All of this is wiped when you sign out.

2.4 What we do not collect

• No camera, microphone, location, contacts, calendar, health data, or any sensor.
• No payment information — the app is free and has no in-app purchases.
• No advertising identifiers (IDFA / GAID).
• No third-party analytics or marketing trackers.
• No cross-app tracking.

3. Why we collect it

• To let you sign in and identify your saved games across devices.
• To run multiplayer games — player names, hands, and moves need to be visible to the other players in the room while the game is in progress.
• To prevent abuse — Firebase App Check (using Google reCAPTCHA v3) checks that requests come from a real browser, not a bot. This is anonymous; no personal data is sent to reCAPTCHA.
• To improve reliability — standard server logs (e.g., HTTP request times, errors) help us debug crashes. These logs include your IP address and are kept for a short period by our hosting provider.

4. Who we share with

We do not sell your data. The third parties below process data on our behalf so the service can function:

• Google (Firebase) — authentication, database (Firestore), and bot-protection (App Check / reCAPTCHA). See Firebase privacy and Google privacy policy.
• Vercel — hosts the web app and serves the JavaScript and HTML to your browser. May log IP addresses, user-agent strings, and request times for security and reliability. See Vercel privacy.

We do not use any other third-party processors. No advertising networks, no analytics providers, no email marketing platforms.

5. How long we keep it

• Account and saved games — until you delete your account.
• Multiplayer room state — until the room is closed (typically minutes to hours).
• Audit logs — kept for as long as the relevant room exists, then deleted.
• Server logs — rolling 30 days at our hosting provider, then automatically deleted.

6. Your rights

You can:

• Access your data — everything we hold is visible to you when you sign in.
• Delete your account at any time from the app's Settings → Danger Zone → Delete My Account. This permanently removes your sign-in record and any saved games. (Audit-log entries from completed multiplayer rooms reference your old user ID as a bare string; that ID becomes orphaned once your account is deleted, and the entries themselves are removed when the room is closed.)
• Export your data — email us and we will provide a copy of what we hold (typically a small JSON file) within 30 days.
• Withdraw consent by signing out and not signing back in. The app works in single-player mode without an account.

If you are in the EU, UK, or California, you have additional rights under GDPR, UK-GDPR, or CCPA respectively (including the right to lodge a complaint with your data protection authority). Email us to exercise any of them.

7. Children and age requirements

The game itself is family-friendly and suitable for all ages — there is no violence, no chat between strangers, no gambling, and no in-app purchases.

• Single-player mode works for anyone of any age. It requires no account and we collect no personal information from you in single-player mode.
• Multiplayer mode requires signing in with a Google account. Google sets its own minimum age for Google accounts (13 in most countries, 16 in the European Union, others vary), so we cannot accept multiplayer sign-ins from anyone who Google itself would not allow to have an account.

Parents who want younger children to play should use single-player mode. If you believe a child has somehow signed in despite Google's age requirement, email us and we will delete the account.

8. International transfers

The data we collect is processed on Google's and Vercel's infrastructure, primarily in the United States. If you are accessing the app from outside the United States, your data is transferred to the United States for processing. Both providers offer standard contractual clauses for transfers from the EU.

9. Security

All traffic between your device and our servers is encrypted via HTTPS. Firebase Authentication tokens are managed by Google's SDK and stored in your browser's secure storage. Database access is governed by per-collection rules that prevent users from reading other users' private data.

We use Firebase App Check with reCAPTCHA v3 to make it harder for bots and abusive scripts to reach our backend. Dependencies are monitored weekly via Dependabot, and known CVEs in production code block our CI pipeline.

10. Changes to this policy

We may update this policy when we add features or change how we handle data. The "Last updated" date at the top will reflect any change. Material changes will be announced inside the app the next time you open it.

11. Contact

Questions, requests, or complaints? Email mayirummy@gmail.com. We aim to respond within 7 days.