Privacy Policy

Who I am

Cuarenta is made by Raymon de Looff, an independent developer in the Netherlands. In this policy, "I", "me" and "my" mean Raymon de Looff. I decide what happens to the data described here, which makes me the controller under the EU's General Data Protection Regulation (GDPR).

For anything about your privacy, email me at privacy@cuarenta.app. I read every message myself and reply within one month at the latest, usually much sooner.

What I collect, and why

For each part of the app, here is what is collected, why, the legal basis for it, how long it is kept, and who handles it for me. You never have to give any of this: you can play against the computer without any of the optional parts below.

Ads (iPhone and iPad)

The free game shows a full-screen ad between games, at most after every second game. Ads are shown by Google AdMob. There are no ads on Mac or Apple Vision Pro, and none at all once you have Cuarenta Plus.

• What: your device's advertising identifier (IDFA), but only if you allow tracking when iOS asks; your IP address, from which Google works out your approximate location; your device type and system version; and which ads you see and tap.
• Why: to show ads, count them, prevent fraud, and pay for the free game.
• Legal basis: your consent (GDPR article 6(1)(a)) for personalised ads, and for storing or reading identifiers on your device where the law asks for consent. Where you live in the EU, the UK or Switzerland, a consent form from Google appears when you first open the app. If you say no, you still see ads, but they are not chosen using your data.
• Kept: by Google, under its own retention rules (see how Google retains data).
• Who handles it: Google, as an independent controller. Read how Google uses information from apps that use its services and Google's privacy policy.

Usage statistics

The app counts how it is used, so I can see which parts of the game people play and improve them. It counts things like: a game started, finished or left, against how many computer players and at what level, the score; a screen shown; the tutorial started or finished; an online table hosted or joined; an ad shown; the Cuarenta Plus page shown, and a purchase made, with its plan and price. It also notes your experience level from the welcome screen, roughly how many games you have played, whether iCloud sync is on, and which Cuarenta Plus plan you have. It never sends your name, your cards or anything you type.

These counts go to two services:

• TelemetryDeck (all devices). It receives the counts with your device type, system version, app version and country, under a random ID that is scrambled on your device before it is sent. TelemetryDeck doesn't store IP addresses and can't tell who you are. Legal basis: my legitimate interest in understanding how the game is played (GDPR article 6(1)(f)), which barely touches your privacy.
• Google Analytics for Firebase (iPhone and iPad). It receives the same counts with an app instance ID made on your device, your device type, system version and approximate location (from your IP address). It is linked to the ads, so I can see ad income and Cuarenta Plus income side by side. It never reads your advertising identifier (IDFA). Legal basis: where you live in the EU, the UK or Switzerland, it uses identifiers only if you agree in the ad consent form (GDPR article 6(1)(a)); until then, and if you say no, it sends only counts with no identifier attached, on the basis of my legitimate interest (article 6(1)(f)).

• Kept: Google Analytics keeps the data for 14 months. TelemetryDeck keeps it for as long as I need it to see how the game is played over time.
• Who handles it: TelemetryDeck GmbH (Augsburg, Germany) processes the data for me and keeps it in the EU. Google processes the analytics data for me, and as an independent controller where it is used for ads.

Crash reports

When the app crashes, freezes or runs into an error, it sends a report to Sentry, so I can find and fix the problem. It also notes when each session starts and ends, so I can see how often the app runs without crashing.

• What: technical details of the problem; the app version; your device model, system version, language, time zone and state (such as free memory and battery level); a random ID for your installation of the app; and a short log of what the app did just before. That log can include the address of the game server, with the code of an online table you were at. It never includes your name, your Game Center details or anything you typed. Sentry is set not to store IP addresses.
• Why: to keep the app working. Legal basis: my legitimate interest in finding and fixing bugs (GDPR article 6(1)(f)).
• Kept: 90 days at most, then Sentry deletes it.
• Who handles it: Functional Software, Inc. (Sentry), in the United States, for me.

Playing online

When you host or join an online table, the app talks to the Cuarenta game server, which passes the game between the players' devices.

• What: the name you chose (any name or nickname, up to 20 characters) and your experience level; a random player ID made on your device; the table's settings; every card played; the app version; and your IP address, which every internet connection needs.
• Who sees it: everyone at your table sees your name and whether you are connected and ready. Only people with the table's code or link can join, and the code stops working once the first game begins.
• Why: to run the online game you asked to play. Legal basis: providing the service you asked for (GDPR article 6(1)(b)). You need a name to play online; without one, you can still play against the computer.
• Kept: a table and everything in it is deleted an hour after its last game began, or straight away when the host ends the table. The server's technical logs, which can include your IP address, are deleted after 7 days.
• Who handles it: Cloudflare, Inc. runs the server for me, in data centres worldwide.

Saved games and statistics in iCloud

If you are signed in to iCloud, your saved games, statistics and game settings sync between your devices through your own private iCloud storage. For an online game, that includes the names of the players at your table. This data is stored by Apple in your account, and I can't read it. You can turn syncing off in the app's Settings, under iCloud.

Game Center

If you are signed in to Game Center, the app reports your number of games won to the Cuarenta leaderboard and your progress on achievements, and shows your Game Center photo on your own device. Apple runs Game Center under its own privacy terms; who can see your scores depends on your Game Center settings.

Cuarenta Plus purchases

Apple handles every purchase. I never see your name, your Apple Account or your payment details. The app only checks with Apple whether you have Cuarenta Plus, and Apple sends me sales reports that don't identify you. The usage statistics above record each purchase made in the app, with its plan and price.

On your device

The app keeps your profile (your name and experience level), your random player ID, your settings and a few counters (such as games since the last ad) on your device. They are sent only as described above, and are removed when you delete the app.

This website

cuarenta.app sets no cookies and uses no analytics or trackers, and its fonts come from this site, not from Google. Cloudflare delivers the site and, like any web host, processes your IP address to do so and to keep the site safe, for me, on the basis of my legitimate interest (GDPR article 6(1)(f)). Its logs are deleted after 7 days.

Emails to me

If you email me, I use your email address and what you write only to answer you. I keep the conversation for as long as it takes to help you, and delete it within a year after that.

Who else receives data

I don't sell your data, and I share it only with the services that help me run Cuarenta:

TelemetryDeck, Sentry and Cloudflare, and Google for usage statistics, process data only on my instructions, under data processing agreements that require them to protect it at least as well as this policy does. Google (for ads) and Apple decide for themselves how they use the data they receive, under their own privacy policies.

I may also share data if the law requires it, for example to answer a valid court order, or to protect the safety of players or the service.

Data outside Europe

Google, Sentry and Cloudflare are based in the United States, so data they handle can be processed there. Each of them is certified under the EU-U.S. Data Privacy Framework (with its UK and Swiss extensions), which the European Commission has found gives adequate protection. Their contracts with me also include the European Commission's Standard Contractual Clauses, as an extra safeguard. TelemetryDeck keeps its data in the EU.

Your choices

• Ad choices. Where the law gives you a choice, you can change or withdraw your consent at any time in the app, under Settings → Ads → Privacy Choices. Withdrawing consent doesn't affect what happened before.
• Tracking. You can stop the app from using your advertising identifier at any time in your device's Settings → Privacy & Security → Tracking.
• No ads at all. With Cuarenta Plus, the app shows no ads and doesn't start Google's ad service.
• iCloud. Turn syncing off in the app's Settings, under iCloud.
• Game Center. Sign out of Game Center in your device's settings.
• Online play. If you don't host or join an online table, nothing is sent to the game server.
• Crash reports and statistics. These can't be turned off in the app, but you can object to them by emailing me (see "Your rights").

Deleting your data

• Deleting the app removes everything it kept on your device.
• To delete your synced games and statistics, delete Cuarenta's data from your iCloud storage, in your device's iCloud settings under Manage Storage.
• Online tables delete themselves, as described above.
• Crash reports and usage statistics are deleted after the periods given above.
• You can always ask me to delete data sooner by emailing privacy@cuarenta.app. Because Cuarenta has no accounts, most of what I receive can't be traced to you, so I may not be able to find your data. Tell me what you're asking about and I'll do what I can.

Your rights

Under the GDPR you have the right to:

• know what data I have about you, and get a copy (access);
• have it corrected (rectification);
• have it deleted (erasure);
• have its use limited (restriction);
• receive it in a common format, to take elsewhere (portability);
• object to uses based on my legitimate interest, such as crash reports and statistics (objection);
• withdraw your consent at any time, without affecting what happened before.

Email privacy@cuarenta.app to use any of these rights. I answer within one month. I may ask for details that help me find your data, and I never charge for a request unless it is clearly unfounded or excessive.

The app makes no automated decisions about you with legal or similarly significant effects. If you agree, Google uses your data to choose which ads to show you.

If you think I've handled your data wrongly, please tell me first, so I can put it right. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

If you live in the United States

Several US states, such as California, give you extra rights. In the terms of those laws, Cuarenta collects these categories of personal information, all from your device and only for the purposes described above:

• Identifiers: the advertising identifier (with your permission), app instance and random IDs, and IP address.
• Commercial information: the Cuarenta Plus plans bought in the app, and their prices.
• Internet or other electronic network activity: how you use the app, ads seen and tapped, and crash reports.
• Geolocation data: your approximate location, worked out from your IP address.

It collects no sensitive personal information. It discloses these categories for business purposes to the services listed under "Who else receives data".

I don't sell personal information for money. But letting Google use your data to show you personalised ads can count as "selling" or "sharing" for targeted advertising under some state laws. You can opt out of that at any time: in the app under Settings → Ads → Privacy Choices, where your state's law applies, or by turning off tracking in your device's Settings → Privacy & Security → Tracking.

You have the right to know what personal information I hold about you, to have it corrected or deleted, and to opt out of its sale or sharing. You or an agent you authorise can use these rights by emailing privacy@cuarenta.app. I'll need to check the request is really yours. If I refuse a request, you can appeal by replying to my answer. I'll never treat you differently for using your rights.

Do Not Track: the app doesn't track you across other companies' apps or websites unless you allow it in iOS, and this website doesn't track you at all, so a browser's Do Not Track signal changes nothing here.

Children

Cuarenta is a card game for a general audience, not made for children under 13, and I don't knowingly collect personal information from them. If you are under 16 and live in the EU, ask a parent or guardian before agreeing to personalised ads. If you think a child under 13 has given me personal information, email privacy@cuarenta.app and I will delete it.

Keeping data safe

Everything the app and this website send travels encrypted (HTTPS and secure WebSockets). The app collects as little as it can, with no accounts or passwords to steal. Only I can get into the services listed here, and each of them protects the data it holds with its own security measures. No system is perfectly safe, but if something ever goes wrong with your data, I will tell you and the authorities as the law requires.

Changes to this policy

When the app starts handling data differently, I update this policy and the date at the top. For important changes, I also say so in the app's update notes before they take effect. Earlier versions are available on request.

• 14 October 2026: first version.

Contact

Raymon de Looff, the Netherlands. Email: privacy@cuarenta.app.