How Darezo handles your information.

1. Summary

Darezo is a party game that works offline. There are no accounts and no in-app purchases. It is free, with a few ads from Google AdMob that are never personalised and never shown during a game. We do not sell your data. Usage stats and crash reports (Google Firebase) are off until you turn them on, and you can switch them off again in Settings. A few optional online features use our own server, and you can switch those off in Settings too.

2. Who we are

Darezo is made and run by QuantumPlug Technologies LLP, India ("we", "us"). We decide how the data described here is used (we are the data controller, or "data fiduciary" under Indian law). Our Darezo server runs at darezo-api.kernellylabs.com and is hosted for us by Hostinger. Contact and Grievance Officer: apps@quantumplugtech.com.

3. Age

Darezo is for players 13 and over. Spicy mode is for adults (18+) only. Spicy cards appear only after confirming that every player is 18 or older; the confirmation expires after a few hours and you can reset it at any time in Settings. If you are under 18, use Darezo with the permission of a parent or guardian, and do not turn on usage stats or online rooms unless they agree. We do not knowingly collect personal data from children under 13; if we learn that we have, we delete it.

4. Data on your device

Player names, saved player groups, your own cards, favourite and hidden cards, game settings, a game in progress, sound/vibration/text settings, your "everyone is 18+" confirmation, and your streak, stats, trophies and game history are saved only on your device. They are never sent to us or to other players, except the name you enter for an online room (see "Online rooms"). If Android backup is turned on for your Google account, Android may include this on-device data in your encrypted device backup, so it can be restored on a new phone. That backup is stored by Google in your Google account; we cannot see it. You can turn it off in your phone's backup settings.

5. Usage analytics (Google Analytics for Firebase)

Usage analytics is off by default. The app asks on first launch, and only if you turn on "Share usage stats" (Settings › Privacy) does it send pseudonymous usage events to Google Analytics for Firebase, a service provided by Google: which screens are opened; which game types, groups (such as Friends or Family), spice levels and card languages are played; how many players and cards a game has; which buttons are used (for example "Different card" or "Skip turn"); whether a game is finished or shared; and which settings are changed. Firebase also records the app version, device model, operating system, approximate country or region (derived from the IP address) and a random app-instance ID it creates for the app. On Android it also reads the Google Play install referrer (which store page or campaign, if any, the app was installed from). We never send player names, card text, your own cards, room codes or anything you type. We do not collect the advertising ID (AAID/IDFA), we do not use analytics for advertising or share it with advertisers, and we do not link it to your identity. Google processes this data as our service provider (see firebase.google.com/support/privacy); analytics data is deleted after at most 14 months. When you switch off "Share usage stats", no more events are sent and the app resets its analytics ID, so anything sent later can't be linked to what was sent before.

6. Crash reports (Firebase Crashlytics)

Crash reports follow the same "Share usage stats" switch. When it is on and the app crashes or hits a serious error, a crash report is sent to Firebase Crashlytics (Google): the technical error details, app version, device model, operating system, free memory and storage, and a random installation ID. Crash reports never contain player names, card text, your own cards, room codes or anything you type. Reports not yet sent are deleted when you switch the setting off. Google keeps crash reports for up to 90 days.

7. Ads (Google AdMob)

Darezo is free and shows a few ads from Google AdMob, a service provided by Google: a banner at the end of the results and trophies screens; sometimes a full-screen ad when you leave the results screen after a game on this phone (at most every other game, and never in your first games); and a short video you can choose to watch to try a locked bottle style for a day. Ads never appear during a game, on the setup screen, in online rooms or with Spicy (18+) games. Ads are never personalised: we do not use the advertising ID (AAID/IDFA), we never ask to track you on iOS, and ad content is limited to the "PG" rating. To show and count ads and to prevent fraud, Google receives your IP address (and an approximate location from it), device and app information (such as model, operating system, app version and language) and how you interact with the ads; on Android this can include an app set ID that is shared only by apps from the same developer. Google uses this data as described at policies.google.com/technologies/partner-sites. In the EEA, the UK and Switzerland, Google's consent form asks for your choice before any ad is requested, and you can change it at any time in Settings › Privacy › Ad privacy choices. Nothing about your players, cards or games is shared with Google for ads.

8. Optional online features

When Online features are on (Settings), Darezo contacts our server to: download the daily challenge and themed card packs (the request contains only a language and a date); send anonymous card feedback when you favourite, hide or report one of our cards (the card's text, language, mode, level and your vote or report reason, with no identifiers; your own cards are never sent); run online rooms; and download new cards for the decks you play (the request contains only language, mode, level and how many cards you already have). When a deck runs low, our server asks OpenAI to write new, generic cards. This happens on our server only: nothing about you or your device is sent to OpenAI. When you host, join or report in an online room, the app also sends a random install ID: a random number created on your phone the first time you use online rooms and stored only there. It is not your name, a device ID or the advertising ID, and it is never shared with analytics or linked to who you are. The server uses it only to prevent abuse (limits on seats and rooms per phone, wrong room codes, and keeping removed players out of a room) and keeps it only in memory, never on disk. Nothing else is uploaded to our server.

9. Online rooms

When you host or join a room, the name and emoji you enter, and the game (players, scores and cards), are shared with the other players in that room. Your own cards are never used in online games. Offensive names are refused. The server keeps rooms only in memory, never on disk, and deletes them when the game ends, when the room is idle for 30 minutes, or after 6 hours at most. Any player can report another player to us from the waiting room. The report is sent to our server, which keeps only the reported player's name and the reason, for 90 days, so we can moderate; we review reports within 24 hours. Only share a room code with people you want to play with.

10. Server logs

Like any internet service, our server receives your IP address in order to reply. We use it only to prevent abuse: per-minute limits keep it in memory for one minute, and daily limits keep a salted hash of it (the salt is replaced every day, so it can't be reversed or linked across days) that is deleted within 2 days. We do not store your IP address itself in logs or in our database.

11. Where data is processed

Our server is hosted by Hostinger. If you turn on usage stats, Google processes analytics and crash data in the United States and other countries where it operates. Google also processes the ad data described in "Ads" there. OpenAI, in the United States, only receives requests for generic card text from our server, never data about you. When data leaves your country, we rely on the safeguards these providers offer, such as standard contractual clauses.

12. Legal bases

Usage stats and crash reports: your consent, which you can withdraw at any time in Settings. Ads: in the EEA, the UK and Switzerland, the consent you give in Google's form (change it in Settings › Privacy › Ad privacy choices); elsewhere, our legitimate interest in keeping Darezo free. Online features you choose to use (daily challenge, packs, new cards, card feedback, rooms): to provide the feature you asked for. Abuse prevention (rate limits, hashed IP addresses, the install ID, player reports): our legitimate interest in keeping Darezo safe and available.

13. Permissions

Darezo uses internet access only for usage analytics, crash reports, ads and the optional online features above. It asks for notification permission only if you turn on Reminders (Settings): reminders are scheduled on your phone, nothing is sent to our server, and you can turn them off in Settings at any time. It does not ask for camera, microphone, contacts, location or photos permissions, and it does not use the advertising ID.

14. Your rights

Depending on where you live (for example under the GDPR in the EU, EEA or UK, or India's Digital Personal Data Protection Act), you have the right to:

• access the personal data we hold about you;

• have it corrected or deleted;

• withdraw your consent at any time (switch off "Share usage stats", or change Ad privacy choices in Settings);

• object to processing based on our legitimate interest;

• complain to a data protection authority: in India the Data Protection Board of India, in the EU, EEA or UK your local authority.

We have no accounts, and analytics and crash data are pseudonymous, so we may need your help to find data about you. Email apps@quantumplugtech.com and we will reply within 30 days.

15. How to delete your data

• Switch off "Share usage stats" in Settings: nothing more is sent and the analytics ID on this phone is reset. Data already sent is deleted automatically (analytics after at most 14 months, crash reports after 90 days).

• Clear the app's data (Android Settings › Apps › Darezo › Storage › Clear data) or uninstall Darezo to delete everything stored on your phone. To remove the copy in your Google backup, delete it in your Google account's backup settings.

• Online rooms are deleted automatically (after 6 hours at most).

• For anything else, email apps@quantumplugtech.com.

16. Changes

If this policy changes, the updated version will be posted on quantumplugtech.com and in the app with a new "Last updated" date.