This section is accurate as of the current build and should be kept in step with the database schema.
| Data | When | Why |
|---|---|---|
| Anonymous player id | The moment you start playing, including as a guest | To attach your coins, streak and progress to you |
| Email address | Only if you create an account | Sign-in, password reset, account recovery |
| Display name | Only if you create an account | Shown to other players at the table |
| Date of birth | Only if you create an account | Age eligibility, and applying the right regional rules |
| Consent timestamp | When you accept these documents | Record that consent was given, and when |
| Waitlist email | Only if you enter it on the landing page | To tell you when the game opens |
| Coins, items and rewards | As you play, claim rewards or buy from the Shop | To keep your balance and collection across your devices |
| Match records | When an online match finishes | Your career statistics and match history |
We do not handle payment details. We do not ask for your real name, your contacts, your location, or access to any file on your device. We do not sell your data.
Your account, coins, items and match history are held in our database, and the game server writes them as you play — so they follow you from one device to another. Some things stay on the device instead and are never sent to us: your theme, sound and music choices, your remembered game setup, and the progress of a practice game played offline.
Playing as a guest still creates an account for you — an anonymous one with no email attached. It is stored exactly like any other, which is what lets your progress survive when you later sign up.
The game is free, and advertising is part of how it pays for itself. We show ads through Playgama, an advertising service for web games that works with a number of ad partners, Google among them: a display banner on the lobby, and rewarded videos you choose to watch in exchange for coins. We never show an advert during a hand of cards, and a rewarded video is only ever started by you.
When an advert is shown, Playgama and the ad partner that serves it receive your IP address, information about your browser and device, and the page the advert appeared on, and may read or set cookies or similar identifiers on your device. That data goes to them, not to us — we receive only aggregate reporting, and we cannot identify you from it. Playgama's handling is described in its privacy policy; where Google serves the advert, what Google does with it is described in its own policy for partner sites and its advertising privacy disclosures.
If you are in the EEA, the UK or Switzerland, a consent dialog appears before any advertising identifier is set, and personalised advertising runs only on a consent you have actually given — we do not treat silence, or the absence of a dialog, as a yes. You can change or withdraw that choice at any time from Settings › Ad privacy, which reopens the same dialog. Withdrawing is as easy as consenting, and costs you nothing in the game: the rewarded videos still pay the same coins.
If you have never been shown an advert, nothing above has happened on your device yet. Premium removes advertising entirely, and the rewarded coin slots keep paying without the video.
We keep this list short on purpose. Each of these holds data because the game cannot work without it, and each is bound by its own privacy terms.
| Who | What for | What they get |
|---|---|---|
| Supabase | Database and sign-in | Your account, coins, items and match history |
| Vercel | Serving the website | Standard web request logs, including your IP address |
| Render | The game server that runs online matches | Your player id and the moves you make at a table |
| Playgama | Advertising: the lobby banner and rewarded videos | See Advertising above |
| Sign in with Google, and advertising | Your email and name if you sign in with Google; see Advertising above | |
| Cloudflare | Checking that sign-ins come from a person, not a script | Your IP address and a browser challenge |
| Resend | Sending confirmation and password-reset email | Your email address and the message sent to it |
| PostHog | Understanding how the game is used | Events tied to your player id — never your email |
| Sentry | Catching errors and crashes | Technical details of the error and the device it happened on |
You can see and correct your details on the Profile screen. You can delete your account outright from Profile › Delete account — that removes your profile, coins, ledger, items and match history, and cannot be undone. Guests can delete too. You can withdraw advertising consent from Settings › Ad privacy.
Depending on where you live you may also have the right to a copy of your data, to object to some processing, or to complain to your local data protection authority. To ask for any of these, write to us at the address below.
Accounts are not available to anyone under 13. If we learn that an account belongs to someone under that age, it will be removed.
The data controller for everything described above is Corvix Systems LLC, a limited liability company registered in Wyoming, United States.
Registered office: Sheridan, WY 82801, USA
Operations: Izmir Town, Lahore, Pakistan
For anything about your data — a copy of it, a correction, deletion, or a question about advertising consent — write to hello@rewhistify.com, or info@corvixsystems.com.