Privacy Policy

This Privacy Policy explains how we collect and use your personal data when you use the Spades & Clubs: Cards Game app (the "App") and the website spades-clubs.com (together, the "Services"). It is written to meet the EU General Data Protection Regulation (GDPR) and Czech data-protection law.

1. Who is responsible for your data

The data controller for the Services is:
Vítek Bordovský
IČO: 24535249
Email: support@spades-clubs.com
Based in the Czech Republic.

For any question about this policy or your personal data, contact us at support@spades-clubs.com.

2. What we collect

We do not use advertising networks, we do not track you across other apps or websites, and we do not sell your personal data.

• Account. You sign in with Apple. We receive a unique Apple identifier and the email address Apple shares with us — your real address or an Apple private-relay address, as you choose. Apple may also offer your name; we do not keep it. You choose a display name.
• Your profile and statistics. Display name, friend code, rating (current and highest), games played, wins, losses and draws, streaks, longest game, experience points and level, the card back you chose, whether you are a Spades+ supporter and until when, and your settings stored with your account (house rules, display and notification choices, the table design, the friend you pinned as your #1 rival). We also keep technical fields: when your account was created and last changed, your progress through the introduction, the mode your QR code offers, and your account role.
• Matches. Who played, the mode and rules, every move, the result, rating and experience changes, timings, and the display names used at the time.
• Friends and private lists. Friend requests, friends and players you block. Private nicknames, colours, emoji and labels you give friends, the rule presets you save and the matches you pin — only you can see these.
• Messages in a match. The preset messages you can send from the in-game menu are delivered live to your opponent and are not stored on our servers.
• Ideas board, support and bug reports. Ideas you post (title, description, category and photos), the ideas you like, and your comments. Support messages and bug reports, with any photos you attach.
• Reports and moderation. If you report an idea, a comment or a player: what you reported, your reason, and a copy of the reported text or display name as it was at that moment. If your content is reported or removed: that copy, the reason, and which member of our team decided.
• Spades+ purchases. Payment is handled entirely by Apple; we never see your card or payment details. Our purchase provider RevenueCat receives your account identifier and your App Store purchase and subscription records, and tells us whether you are a supporter and until when.
• Usage analytics and crash reports — only if you allow them. On first launch we ask. If you are 15 or older and choose "Allow", the App sends PostHog: the screens and features you use; device and app details (device model, operating system, app version and build, language); crash and error reports; and a profile linked to your account identifier holding your display name, rating, total wins, games played, longest game and whether you are a supporter. If you choose "Don't allow", or are under 15, none of this is sent. We do not record your screen. We keep a record of each answer you give — allow or don't allow, which version of the question, and when — linked to your account, to show that we asked; it is deleted with your account.
• Remote settings. Whatever you choose above, the App asks PostHog which features and notices are switched on (for example a maintenance notice or early access for supporters). That request carries your account identifier, whether you are a supporter, and your IP address; PostHog does not record it as an analytics event.
• Push notification token. Only if you allow notifications on your device.
• Security data. When you create a match or open a support ticket, we check the request's IP address against a list of addresses blocked for abuse. Each time your profile or a support ticket is changed, we record the IP address, your account identifier and the time, to detect abuse; these records are deleted after 7 days. An IP address is kept longer only if it is blocked. We also count notifications sent per account, to stop notification spam.
• Bot training. Games against our most advanced bots produce a record of the moves played, used to improve how the bots play. It contains no account identifier.
• The website. spades-clubs.com sets no cookies and loads nothing from other companies' servers. Our host Vercel processes your IP address to deliver the pages.
• Kept only on your device. Your answer to the analytics question and your year of birth are never sent to us. The App also keeps your settings, open and offline matches, moves not yet sent, and copies of your friends list and profile on your device, and your sign-in session in the device's secure keychain.

Camera and photos. The App uses the camera only to scan QR codes; the image is not stored or sent. It reads your photo library only when you pick a photo to attach.

Playing offline. An account is required to use the App, and creating one needs an internet connection. Once you are signed in you can play against bots with no connection; that gameplay is kept on your device and saved to our servers the next time you connect.

We do not collect your location, your contacts, or audio from your microphone. We do not knowingly collect special categories of data (such as data revealing health, religion, or ethnic origin).

3. Why we use your data, and our legal bases

• To provide the Services — your account, matches, statistics, friends and private lists, the ideas board, support, and your Spades+ status. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To keep the Services safe — blocking abusive IP addresses, the 7-day security records, the automatic word filter, handling reports, removing content that breaks our rules, and blocking between players. Legal basis: our legitimate interest in a safe, working service (Art. 6(1)(f) GDPR), and our obligations as a hosting service under the EU Digital Services Act (Art. 6(1)(c) GDPR).
• Usage analytics and crash reports — to find bugs and see what to improve. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: Profile → Privacy → Share usage data.
• Remote settings — so maintenance notices and features reach the App. Legal basis: our legitimate interest in running the Services (Art. 6(1)(f) GDPR).
• Improving our bots — from move records that contain no account identifier. Legal basis: our legitimate interest in improving the App (Art. 6(1)(f) GDPR).
• Push notifications you have asked for. Legal basis: your consent, given in your device settings (Art. 6(1)(a) GDPR); withdraw it there at any time.
• To comply with the law — for example, answering valid requests from public authorities, or reporting a suspected crime that threatens someone's life or safety. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

4. Children

The App is not designed to profile children or to market to them. In the Czech Republic, the age of digital consent is 15. On first launch the App asks for your year of birth; the answer stays on your device. If you are under 15, usage analytics and crash reports stay off and you are not asked to allow them. If you are under 15, a parent or guardian must agree to our Terms of Use and this Privacy Policy on your behalf, and push notifications need their consent. If you believe a child under 15 has given us personal data without that consent, contact us and we will delete it.

5. Who sees your data and who processes it

• Other players. Your opponent in a match sees your display name, your card back, your moves and the preset messages you send. Any signed-in player can see your display name, card back and statistics (rating, games played, wins, losses and draws, streaks, longest game), whether you are a member of our support team, and whether you are a Spades+ supporter — not the dates — so that friends, leaderboards and matches work. Your settings, your friend code and the rest of your profile are visible only to you. Your ideas and comments are visible to all signed-in players with your display name, and so is which ideas you liked. Friends see your Spades+ badge and frame. Do not put anything private in your display name.
• Apple — for Sign in with Apple and App Store payments, as an independent controller.
• Supabase — our hosting provider: database, file storage and sign-in, on servers in Ireland (EU), as our processor.
• PostHog — usage analytics, crash reports and remote settings, in the United States, as our processor.
• Expo — delivers push notifications, in the United States, as our processor. Your push token and the notification text (which may include another player's display name) pass through Expo.
• RevenueCat — manages Spades+ purchases, in the United States, as our processor.
• Vercel — hosts the website spades-clubs.com, as our processor.
• Public authorities — only where the law requires it.

Each processor acts under a data-processing agreement with us.

6. Where your data is processed, and international transfers

Your account, gameplay and support data is stored in the European Union (Supabase, Ireland).

Some processing takes place in the United States: analytics, crash reports and remote settings (PostHog), push delivery (Expo), purchase management (RevenueCat), and support and service operations by Supabase and Vercel as US companies.

PostHog, Expo and Vercel are certified under the EU-U.S. Data Privacy Framework, so transfers to them rely on the European Commission's adequacy decision (Art. 45 GDPR). RevenueCat and Supabase are not; transfers to them rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which are part of their data-processing agreements. Email support@spades-clubs.com for a copy of these safeguards.

To keep your usage data out of the United States, choose "Don't allow" when asked, or turn off Profile → Privacy → Share usage data. Push notifications are optional.

7. How long we keep your data

• Your account — while it exists. When you delete it in the App, we revoke the App's Sign in with Apple authorisation and delete your profile, experience and level, friends and blocks, your private lists and the private nicknames other players gave you, rule presets, pins, push tokens and notification counters, support tickets and messages, bug reports, ideas, likes and comments, reports you made, your answers to the analytics question, the photos you attached, and your analytics profile and events at PostHog. Matches still in progress end, and your opponent wins.
• Completed match records — kept after you delete your account, so your former opponents' match history and experience stay complete: the moves and result and the display name you used at the time, no longer linked to any account. They are not used for anything else.
• Spades+ — deleting your account does not cancel your subscription: cancel it in your Apple ID settings first. RevenueCat keeps your purchase records, linked to your account identifier, for as long as we use its service.
• Reports and moderation records — deleted 12 months after the decision. Reports you made are deleted with your account; a record of your content being reported or removed keeps its copy until then, without your account.
• Usage analytics and crash reports — kept by PostHog for 1 year (log entries for 14 days), unless you delete your account first.
• Security records — deleted after 7 days, also after you delete your account. Blocked IP addresses — deleted 12 months after they were blocked.
• Bot-training records — contain no account identifier; kept for as long as they help improve the bots.
• On your device — until you uninstall the App.

8. How we protect your data

All communication between the App and our servers is encrypted in transit (HTTPS/WSS), and Supabase encrypts stored data. Your sign-in session is kept in your device's secure keychain, and because sign-in goes through Apple we never handle passwords. Photos you attach are stored privately and are reachable only through short-lived signed links, by you and by our support team.

9. Your rights

Under the GDPR you have the right to:

• Ask for access to the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased — Profile → Delete Account does it (see section 7).
• Restrict how we process your data.
• Receive your data in a portable format.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time — for analytics, Profile → Privacy → Share usage data; for push notifications, your device settings.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. The only automated decision in the Services is our word filter, which refuses a display name, idea or comment containing words or links we do not allow, before it is published.

To exercise any of these rights, email support@spades-clubs.com.

If you believe we have handled your personal data unlawfully, you can complain to the Czech data-protection authority: Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

10. Changes to this policy

We may update this Privacy Policy. If a change is material, we will tell you in the App. The date at the top shows the current version.