Turup 29
Privacy Policy
Turup 29 is a virtual card-game application. This page describes what data the app collects, how it is used, and the choices you have. We collect only the minimum needed to run the game and to keep matches fair.
Data we collect
- Account data: display name, account identifier (guest UUID, or email / Google / Facebook login), optional avatar image, language preference, account creation date.
- Gameplay data: match results, ratings, coins, XP, profile level, room join/leave events, bidding and trick-play history for match replay when enabled, friend requests, tournament entries.
- Technical data: device type, app version, connection-quality signals for performance and reconnect, a per-device guest identifier used for fair-play cooldown.
- Ads & notifications data: a push notification token and your notification opt-in state (only if you enable notifications), and ad-interaction events (ad offer shown or tapped, ad started or completed, reward granted) used to run the rewarded-ads system fairly and prevent reward fraud.
Optional permissions
The following device permissions are optional and are only requested when you choose to use the feature that needs them. The app works fully without granting them, and you can decline or revoke them at any time in your device settings.
- Microphone — optional voice chat. If you start or join a Private-Play voice chat, we ask for microphone access so you can talk to the other players at your table. Voice is a live, encrypted (WebRTC) stream between players in the same private room. It travels directly between players or, when a direct connection is impossible, through an encrypted relay (TURN) that only forwards the encrypted stream and cannot listen to, decrypt, record, or store it — voice is never recorded, never stored, and never transcribed or analysed by us. Voice chat is off by default, available only on Private-Play tables you opt into, and never active for spectators or in tournament rooms.
- Camera / photos — optional avatar. If you choose to set a profile avatar, we ask for camera or photo access so you can take or pick a single picture. Only the image you explicitly select is uploaded, and only to store it as your avatar. We do not access your camera or photo library for any other purpose, and we do not collect it in the background.
What we do not collect
- No real-money payment data — Turup 29 is virtual play only.
- No precise or approximate location tracking.
- No microphone or camera access except the optional, user-initiated voice chat and avatar features described above (and no recording or storage of voice).
- No contacts, calendar, SMS, or health data.
- No browsing history outside the app.
- No list of other installed apps.
How we use data
- To run the game and keep matches fair.
- To maintain account state (display name, history, friends list when added).
- To diagnose crashes and improve quality.
- To improve game balance and bot behaviour in aggregate.
- To deliver the push notifications you opt into.
Sharing
We do not sell personal data. Match metadata (display name, score) is visible to other players in the same room as part of normal gameplay. Limited data is shared with the service providers listed below so they can perform their function.
Service providers we use
We use the following third-party services to operate Turup 29:
- Supabase — our backend platform. Stores your account profile, authentication record, gameplay history, friend requests, and tournament entries. All traffic is over HTTPS.
- Google Play Billing — processes optional in-app purchases (such as the ad-removal upgrade and coin packs). We never see your payment card, billing address, or Google account email; Google handles the transaction. We receive only the product identifier and an opaque purchase token, which we store as a one-way hash.
- Google AdMob — serves the rewarded video and post-match interstitial ads. AdMob may read your device's Advertising ID (AAID) to deliver and measure ads and to prevent fraud. You can reset or opt out of personalised advertising at any time in your device's Privacy settings.
- Google User Messaging Platform (UMP) — shows the consent prompt that lets you choose between personalised and non-personalised AdMob ads, where required (for example, in the European Economic Area and the United Kingdom).
- Sentry and PostHog — optional crash-diagnostic and product-usage analytics. These are currently disabled. If enabled in a future build, both are configured with personal-information stripping (no IP, email, phone, or display name), no session replay, and respect for the browser Do-Not-Track signal.
- Firebase Cloud Messaging (Google) — delivers the push notifications you opt into. It receives an opaque device push token; we store that token to send your notifications and remove it when you turn notifications off or delete your account.
- Cloudflare (voice relay) — when two players in a voice chat cannot connect directly, an encrypted TURN relay forwards the voice stream between them. The relay cannot decrypt, record, or store the audio.
Children and age requirements
Turup 29 is intended for a general audience and is not directed to children under 13 (or the higher minimum digital-consent age that applies where you live — for example 16 in parts of the European Economic Area). Because the app offers optional voice chat and social features, you must be at least 13, and old enough to consent to these terms in your country, to create an account or use the app.
We do not knowingly collect personal data from children below the applicable minimum age. If we learn that we have collected data from a child who does not meet the age requirement, we will delete that account and its associated data. Parents or guardians who believe their child has provided us with personal data can contact us using the details below to have it removed.
Your rights
You may request export or deletion of your account data at any time. See the Data Deletion Instructions page for how to request deletion. Where local law requires parental consent for a minor to use an online service, that consent must be obtained before the app is used.
Contact
For privacy questions or data requests, email support@shamrocks.games.