Chalke Cards — Privacy Policy

Information we collect

You can play without an account: guests play straight away, against bots or online. An account is optional; it keeps your stats and lets you play online under one username on all your devices. The app handles the following:

• Game data on your device. Your settings, your coins and the card backs and felts you own, and a bot game in progress are stored on your device only — we keep no copy of them.
• Your account (optional). To make an account you choose a username, give an email address and set a password. Your username is shown to other players. Your email address is used only to send you codes: one to confirm it when you sign up, and one if you ask to reset your password. It is never shown to other players, and we send no other email. Your email address and password are held by Amazon Cognito, the sign-in service of Amazon Web Services, not in our own database. Your password passes through our server on its way to Cognito when you sign up or sign in; we never store or log it. Usernames are 3 to 16 letters, numbers or underscores, are screened for offensive language, and can be changed once every 30 days (the first change is free).
• Stats. The app keeps stats for each game, split into online games and games against bots: games played, wins, losses, streaks, bests and a few figures for each game (such as melds laid in Rummy or blackjacks in Blackjack). For online games against other signed-in players it also keeps your head-to-head record (games, wins and losses) against each of them. Your stats are shown only to you; your username appears in the head-to-head lists of the signed-in players you have played. A guest's stats are kept under this install's random player id, and move to your account if you sign up or sign in on that device.
• Online play. The app creates a random player id for this install (or this browser) and uses it with our game service. Signed in, you sit at online tables under your username; as a guest, under the name you choose in Settings, marked as a guest. Guest names are screened for offensive language too. Our servers keep the tables you sit at (the names at the table, the cards played, the scores, whose turn it is) so a game can continue if you reconnect. On iPhone and Android the app may ask the operating system to confirm it is a genuine copy of the app (App Attest or Play Integrity) before our game service gives it a player id; that check sends no personal information. The app does not send push notifications.
• Your devices. When you sign in, we record each device (install or browser) linked to your account: whether it is an iPhone, Android or web device, when it was linked and when it was last used. Each gets its own credential, so signing out or deleting your account cuts off every device. Your sign-in session is kept in your device's secure storage (in a browser, in the site's local storage).
• Purchases. Coin packs and Remove Ads are bought through the App Store or Google Play, which handle payment; we never see your payment details. The app keeps a record on your device of what was bought.
• Advertising data (iPhone, iPad and Android only). The app shows ads served by Google AdMob. AdMob may collect device identifiers (such as the advertising identifier, where you have allowed tracking), ad-interaction data, your IP address (from which a coarse location may be estimated) and diagnostic data to serve and measure ads. See Google's Privacy Policy and How Google uses advertising data. The web version shows no ads.

Your account

Your account lives in the app's Profile: tap your name on the home screen. From there you can make an account or sign in, change your username or password, sign out, or delete your account.

• Forgot your password? Choose “Forgot password?” on the sign-in screen and we will email a code to the address on your account.
• Codes come from no-reply@cards.chalkecustoms.com.au and only last a short while. If one doesn’t arrive, check your spam folder, then ask for another.
• Signing out signs you out on all your devices. Your account and stats are kept, and you play as a guest until you sign in again. Changing your password signs out your other devices.
• Deleting your account is in Profile > Delete account, and asks for your password. It can’t be undone.

Email

Account emails (the codes to confirm your address and to reset your password) are sent by Amazon Simple Email Service (SES) from no-reply@cards.chalkecustoms.com.au. If one bounces or is reported as spam, we are told, with the address it was sent to, so we can keep our email working. We send no newsletters or marketing.

Server logs and security

Our servers run on Amazon Web Services in Sydney, Australia. To keep the service running and secure:

• Request logs. For each request to our game service we log what was asked for, when, how it went and the IP address it came from. Our servers also log errors and diagnostics, which do not include your email address or password. Both are kept for 14 days, then deleted.
• Rate limits. To stop abuse, such as guessing passwords or sending floods of emails, we count recent requests by IP address, by player id, by username and by a one-way hash (SHA-256) of your email address — never the address itself. These counters are used for nothing else and expire within about a day, after which they are deleted automatically.
• Audit trail. AWS CloudTrail records administrative activity in our AWS account, including calls to the sign-in service such as creating or deleting an account. It is kept for 90 days.

App Tracking Transparency

On iPhone and iPad the app asks your permission before tracking. If you choose “Ask App Not to Track”, your advertising identifier is not shared with AdMob and you see non-personalised ads. You can change this at any time in Settings > Privacy & Security > Tracking.

Advertising and consent

Where consent is required (such as the EEA and the UK), the app shows a consent form from Google's User Messaging Platform before any ad is requested. You can decline personalised ads and still play. Ads appear only in the lobbies and occasionally between hands against bots; never during a hand, and never at an online table. Remove Ads turns them off for good.

Service providers

We use these companies to run the app:

• Amazon Web Services hosts our game service, accounts (Amazon Cognito) and email (Amazon SES).
• Google AdMob serves the ads on iPhone, iPad and Android.
• Apple (the App Store and App Attest) and Google (Google Play and Play Integrity) distribute the app, handle purchases and confirm genuine copies of it.

Children

The app is not directed at children and does not knowingly collect personal information from children.

Data retention and your rights

• Games. A game with no real players left in it is closed and removed from our servers within about an hour. A finished game is deleted about an hour after its last player leaves (so the table can deal a rematch until then), and never kept longer than 7 days.
• Your account is kept until you delete it. Deleting it in the app removes your email address and password from Cognito, your username, your stats, your head-to-head records (including your rows in other players' lists), your linked devices and their credentials, and your online seats. Tables you played at may show your username until they are deleted (within 7 days). Your username is then held for 30 days, so nobody else can take it and pose as you, before anyone may claim it; when you change your username, your old one is held the same way. Our database backups, kept for 35 days, may hold a copy until they roll over.
• Unfinished sign-ups. If you start making an account but never enter the code, the unconfirmed sign-up is deleted automatically about 24 hours after the last code was sent.
• Guests. Your player id, display name and stats are kept while you play. To have them deleted, email us your display name and we will remove them.
• Elsewhere. Data handled by Google (AdMob), Apple and Google Play is held under their own policies. You can reset your advertising identifier in your device's settings, and remove all local game data — your coins, card backs, felts and settings — by deleting the app (or clearing the site's data in your browser). Deleting the app does not delete your account.

Changes to this policy

If we change how the app handles data, we will update this page and the "Last updated" date above.

Contact

Questions about this policy can be sent to hello@chalkecustoms.com.au.