Privacy Policy

1.Who is responsible for your data?

Spitakolus AB, Swedish company registration number 559554-6101, is the data controller. You can reach us at support@spitakolus.com.

2.What data do we store?

You need an account to play. With your account we store:

• Email address – so that you can log in and receive an email when you want to choose a new password.
• Username – shown to the other players at the table. If you have Premium, it is also shown to other Premium players in the ranking.
• Password – handled by Supabase Auth and stored only in hashed form. Nobody, not even we, can read it.
• Statistics – how many games you have played and won.
• Ranking results – for every online game you finish or leave, we store when the game ended, whether you won and how many ranking points it gave (win 3, loss 1, left early 0). Practice games against the computer are not stored.
• Premium – whether you have bought Premium (no ads and a place in the ranking).
• Time-out – whether you have left a game in progress, so that the 5-minute wait before your next game can be counted.
• Friend code – a random code you can share so that others can send you a friend request. You can replace it at any time, and the old code stops working immediately. The code is only created when you open Friends in the app.
• Friends, friend requests and blocks – who you are friends with, requests you have sent and received, and accounts you have blocked. A friend request is kept for at most 30 days.
• Online status setting – whether your friends may see when you are online.
• Notifications – if you allow notifications: your phone’s push address, whether the phone is Android or iPhone, the app language and when the app last checked in, and your notification and quiet hours settings (with your phone’s time zone when quiet hours are on).

There is no chat in the game. Games in progress – the cards, the moves and who is at the table – exist only in the game server’s memory and are not stored once the game is over. The only things kept afterwards are your statistics and your ranking result (see above). To send data to your phone, the game server needs technical data such as your IP address while you are connected.

Railway (the game server) and Supabase (the accounts) also keep technical logs of requests and events, including IP address, account ID, time and, for logins and password changes, email address. The logs are used only for troubleshooting and security and are deleted automatically after a limited time.

3.The ranking

If you have Premium, you are in the ranking: a monthly leaderboard and an all-time leaderboard. It shows your username, your position, your ranking points, your number of wins and your number of games. Only Premium players are listed, and only Premium players can view it – so being listed also shows that you have Premium.

Results are stored for all players, including those without Premium. When you have Premium, all your stored online games count towards what other Premium players see: this month’s games in the monthly leaderboard, and all your games – including those from before you had Premium – in the all-time leaderboard. If your Premium ends, you are no longer shown in the ranking, but the results are kept until you delete your account and show up again if you get Premium again.

4.Friends and friends tables

In the app you can play with friends. You only become friends through a friend code shared outside the game, and the owner of the code must accept the request. It is not possible to search for other players.

• Your username is shown to someone who enters your code (so that they can check it is the right person before the request is sent) and to your friends.
• Online status – only friends you have accepted can see whether you are online, playing or offline. The status is worked out while you are connected, exists only in the game server’s memory and is never stored. You can turn it off in the app. You then always appear offline, but invites still reach you.
• Invites and friends tables exist only in the game server’s memory and are not stored. An invite is valid for at most 20 minutes. The replies (“Yes”, “In 5 min” and “Not now”) are fixed texts – there is no chat and there are no messages.
• Games at friends tables count in your statistics and in the ranking only if each team had at least one real player when the game started. If two of you play on the same team against the computer, the game does not count and nothing about it is stored. If you leave a game that counts and do not take your seat back before it ends, it is stored as left (0 ranking points). Leaving a game at a friends table never gives you a time-out.
• If you decline a request or remove a friend, the other person is not told. If you block someone, they can no longer send you requests, invite you or see your status. A block applies to the account, even if one of you gets a new code.
• When you share your code via WhatsApp or your phone’s share menu, this happens in the app you choose. We receive nothing from it and never access your contacts. The link page on spitakolus.com shows only the code – never whose it is.

5.Notifications

If you allow it on your phone, you get a notification when a friend invites you to a friends table, when someone sends you a friend request and when your request has been accepted. No other notifications and no ads. A notification contains a fixed text, the sender’s username and a technical id for the table or request – nothing else.

• The push address is a random code from Google or Apple that lets the notification reach the right phone. We store it linked to your account, together with whether the phone is Android or iPhone and the app language (so the notification arrives in the right language). It is removed when you log out.
• Quiet hours are your own choice in the app under Friends. When they are on, your phone’s time zone (for example Europe/Stockholm) is stored so that the hours follow your clock. Invites in the app always arrive while the app is open.
• Whether the app is open or in the background is known to the game server while you are connected, so that you are not notified about something you can already see. It exists only in the server’s memory and is not stored.
• You can turn notifications off in the app or in your phone’s settings at any time.
• Notifications are sent through Firebase Cloud Messaging from Google and, for iPhone, passed on through Apple’s notification service. We do not use Firebase Analytics or any other tracking from Firebase.

6.Ads

If you do not have Premium, a banner ad is shown and a full-screen ad appears after each game. The ads come from Google AdMob. In the EU/EEA, the UK and Switzerland the app asks for your consent first. If you consent, Google may use your device’s advertising ID and your approximate location to show and measure ads. If you do not consent, ads are still shown, but they are not personalised.

In other countries, such as Brazil, the app does not ask for consent, and Google may show personalised ads using your device’s advertising ID and your approximate location. You can turn this off in your phone’s settings – on Android by deleting the advertising ID. On iPhone the app first asks whether it may track you (Apple’s tracking prompt), and the advertising ID is only used if you allow it. You can change your answer under Settings → Privacy & Security → Tracking.

If you have given your consent, you can withdraw it at any time. If you cannot find the option in the app, email support@spitakolus.com. Read more about how Google uses data at policies.google.com/technologies/partner-sites.

7.Buying Premium

Premium is a subscription bought through Google Play or the App Store. Google or Apple takes the payment and handles your payment details. The purchase is verified through RevenueCat, which receives the receipt from the store linked to your account ID (not your email address or username) and tells our game server whether you have Premium. We only learn that the purchase has been made – never your card number or other payment details.

8.App updates

The app can download updated game code – for example new texts, a new look and bug fixes – directly from our own game server, without going through Google Play or the App Store. The update comes from the same server as the game, and no personal data is sent to anyone else for it.

9.Why, and on what legal basis?

• To provide the game (account, login, username, games, statistics, ranking, time-out, Premium and app updates): necessary to perform our contract with you, i.e. the terms of use (Article 6(1)(b) GDPR).
• Personalised ads: in the EU/EEA, the UK and Switzerland, your consent (Article 6(1)(a) GDPR). In other countries, our legitimate interest in funding the free game with ads (Article 6(1)(f) GDPR; in Brazil, Article 7(IX) LGPD). You can object at any time by turning off personalised ads in your phone’s settings.
• Security, troubleshooting and stopping cheating and abuse (including technical logs): our legitimate interest in a safe, reliable and fair service (Article 6(1)(f) GDPR).
• Friends (friend code, friends list, requests, blocks, online status, invites and friends tables): necessary to perform our contract with you (Article 6(1)(b) GDPR).
• Notifications (push address, language, notification settings and quiet hours), once you have allowed notifications: necessary to perform our contract with you (Article 6(1)(b) GDPR). You can turn them off at any time.
• Limits on code lookups, requests and invites, and blocks, to stop abuse and protect players: our legitimate interest in a safe service (Article 6(1)(f) GDPR).

10.Where is the data kept, and who helps us?

• Supabase – accounts (email, username, hashed password, statistics, ranking results, Premium and time-out) and friends (friend code, friends list, requests, blocks and the online status setting) and notifications (push addresses and notification settings), on servers in the EU (Stockholm, Sweden).
• Railway – the game server, in the EU region (Amsterdam, the Netherlands). Railway is a US company, so data may be transferred to the United States. The transfer is protected by the EU Standard Contractual Clauses.
• Resend – sends the email when you tap “Forgot your password?”, and receives your email address for that. Resend is a US company, so data may be transferred to the United States. The transfer is protected by the EU Standard Contractual Clauses.
• RevenueCat – verifies Premium purchases (see above). RevenueCat is a US company, so data may be transferred to the United States. The transfer is protected by the EU Standard Contractual Clauses.
• Google AdMob – ads, for players without Premium (see above).
• Google Firebase Cloud Messaging – sends the notifications and receives the push address and the notification text to do so. Google is a US company, so data may be transferred to the United States. The transfer is protected by the EU Standard Contractual Clauses. For iPhone, the notification is passed on through Apple Push Notification service.
• Google Play and the Apple App Store – Premium purchases. They handle the payment as independent controllers under their own terms.
• Vercel – runs the spitakolus.com website, including this policy, the account deletion page and the link page for friend codes. Vercel keeps technical logs of visits (including IP address and the address visited – for the link page, that includes the friend code) for a limited time. Vercel is a US company, so data may be transferred to the United States. The transfer is protected by the EU Standard Contractual Clauses.

Supabase, Railway, Resend, RevenueCat, Vercel and Google Firebase process the data only on our behalf and may not use it for anything else. We never sell your data. Everything is sent encrypted.

11.How long do we keep the data?

Account data, statistics and ranking results are kept for as long as you keep your account. Games in progress exist only while the game is being played. When you delete your account, the account, the username, the statistics and the ranking results are deleted immediately and permanently. Technical logs (see above) are deleted automatically after a limited time.

Your friend code and friends list are kept until you replace the code, remove a friend or delete your account. A friend request is kept for at most 30 days. Blocks are kept until you lift them or one of the accounts is deleted. Online status and invites are never stored.

A push address is kept until you log out or delete your account, or until Google or Apple tells us it is no longer valid. A push address that has not been used for 180 days is deleted automatically. We do not keep notifications after they have been sent.

Data about Premium purchases (receipts linked to your account ID) is not deleted when you delete your account. It is kept by RevenueCat and in Google Play/the App Store for as long as needed for accounting and complaints.

12.Deleting your account

You can delete your account in three ways:

• In the app: profile menu → Delete account.
• On the web: spitakolus.com/buraco/ta-bort-konto.
• By emailing support@spitakolus.com from the address your account uses.

The account, the username, the statistics and the ranking results are deleted immediately. This cannot be undone. Technical logs are deleted automatically after a limited time, and purchase data stays with RevenueCat and the store (see above), and a Premium subscription keeps running until you cancel it in Google Play or the App Store.

At the same time, your friend code, your friends list (you disappear from your friends’ lists), friend requests to and from you, all blocks – both yours and other players’ blocks of you – and your phones’ push addresses and notification settings are deleted.

13.Your rights

You have the right to:

• know what data we hold about you and get a copy of it,
• have incorrect data corrected,
• have your data deleted,
• ask us to restrict processing, and object to processing based on our legitimate interest,
• receive data you have given us in a machine-readable format (data portability),
• withdraw your consent at any time.

Email support@spitakolus.com. We reply within one month.

14.Complaints

If you think we handle your data incorrectly, please contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se, or with the data protection authority in your own country.

15.Age

Mesa 11 is for people aged 13 or older.

16.Changes

If we change this policy we update the date at the top. For bigger changes we also tell you in the app.

17.Contact

Spitakolus AB, company reg. no. 559554-6101. Email: support@spitakolus.com.