Waraqi Privacy Policy
Last updated: September 30, 2026
Who we are
Waraqi is a card game app published by HD Designs Studio Games LLC, 418 Broadway, Ste N, Albany, NY 12207, United States. In this policy, "we" and "us" mean that publisher, and "you" means the person using the app.
Questions about this policy, or about your own data, can be sent to admin@waraqi.games or through Contact Us inside the app (Settings > Contact Us).
The short version
- We do not ask for your email address, your real name, your phone number, your postal address, or your location.
- You play as a guest, or connect Apple or Google. We do not store your email address, even though those services can offer us one — we deliberately keep only the identifier that tells us it is you again.
- What we hold is what the game needs to work: a username you choose, that sign-in identifier, an identifier for your device, and your progress in the games.
- We show your chat to the other players at your table, and we keep a copy for one day so that a report can be looked into. If nobody reports anything, it is gone within 24 hours.
- You can delete your account from inside the app, and it deletes what we hold about you except records that protect other people.
- We do not sell your data. We do not share it except with the services listed under "Who else sees anything".
- On an iPhone, advertisements are personalized only if you tap Allow when Apple asks. On Android they may be personalized unless you turn that off in your phone's settings.
What we collect, and why
Your account
Every player has an account. It starts as a guest account, or is connected to Apple or Google from the start, and a guest can connect Apple or Google later. Players' accounts have no passwords.
| What | Why |
|---|---|
| Your chosen username | It is how other players see you. It is public. |
| A sign-in identifier from the service you chose (Apple or Google) | It is how we know it is you next time. It is a string of characters that service gives us for you, and it tells us nothing else about you. |
| If you sign in with Apple: a token Apple gives us | So that when you delete your account, we can tell Apple to disconnect Waraqi from your Apple ID. We use it for nothing else. |
| A device identifier | To keep you signed in, to enforce one device per account, and to limit how many accounts can be made from one device in a day. |
| The date you signed up | To know which announcements you were here for. |
We do not keep the email address a sign-in service offers us. Signing in with Apple can pass an email address to the app, including one of Apple's private relay addresses, and Google's sign-in carries your Google address. We discard it. We have no use for it, and holding an address we never send anything to would only be something else to lose.
A guest account is given a name like Guest123456 and an identifier, and no other details. If you later connect Apple or Google, the account keeps the same identifier, so your games, friends and history stay with it.
While you play
- Game results: who won, scores, statistics, your rating and rank in each game, your level and experience.
- In-game currency: coins, gems and game tickets, and what you have spent them on.
- Your choices of look: avatar, room theme, card deck, shuffle, deal and title.
- Where you are from and what languages you speak, if you choose to say so on your profile page. Both are optional, both are shown to other players, and a report or a support message you send carries the languages you picked so that it can be answered in one of them.
- Social: your friends list, your clan, friend and clan chat, tournament registrations, and a list of players you recently played with (kept for seven days).
- Presence: whether you are online, and when you were last seen. You can turn this off in Settings ("Appear offline").
- Recordings of games you played ("replays"), so that you and your friends can watch a game back, and so that a report about a game can be reviewed.
- Messages you send us through Contact Us, and our answers, so that the conversation can continue. They carry the languages on your profile, if you chose any, so that we can answer in one of them.
Chat
Messages you send at a table, to a friend, or in a clan are shown to the people they are addressed to.
We keep a copy of table chat for 24 hours. This exists for one reason: if somebody reports a player, we need to be able to see what was actually said. After 24 hours it is deleted automatically. The only exception is chat that has already been attached to a report — see below.
Voice
You can talk to the other players at your table between hands, and to the people in a waiting room, if you turn on Allow Voice Communication in Settings. It starts off, and nobody hears you or is heard by you until you turn it on.
- Your voice goes from your phone through our voice server to the other people at that table or in that waiting room who have also turned voice on, including friends watching the table, and nowhere else.
- It is not recorded. We keep no audio, and a report about something said out loud is judged without a recording.
- Muting a player stops their voice reaching you, and they are not told.
- The microphone is used only while the mic button is on, and only where talking is allowed. Turning the switch off ends any voice session at once.
Reports and moderation
If you report another player, or somebody reports you, we keep:
- the report itself, permanently;
- the chat from rooms you shared, and recordings of the games in question, captured at the moment the report is made, and kept for 30 days after a decision is reached;
- any warning or other action taken, permanently.
These records survive account deletion, and that is deliberate: if they did not, deleting an account would be a way to erase a history of harassing other people and start again. Reports you filed survive too, because they are about somebody else.
Creating your avatar
If you buy a custom avatar, you send us two photographs of your face, taken with the camera at the time, together with your confirmation that the photos are of you and that you have the right to use them.
- The photos are used for one thing: drawing your avatar.
- They are reviewed by a person, and shown to the image service that draws the artwork. See "Who else sees anything".
- They are deleted as soon as the order is finished — whether the avatar was made or the order was refunded. No copy is kept afterwards.
- Nothing measures your face. There is no face recognition here, nothing is compared against anybody, and no record of your features is created or kept.
Your network address
Like any server, ours sees the network address your device connects from. We use it in two ways:
- to limit how many new guest accounts can be made from one connection in an hour, for which it is held in memory for that hour only;
- in our servers' logs, which record the address with each request to our website and each voice connection, so that abuse and faults can be looked into. The logs are deleted after 14 days.
It is not attached to your account and is not used for anything else.
What we do not collect
We do not collect your location, your contacts, your photo library (the avatar photos are taken with the camera at the moment of purchase and are the only images we ever receive), your browsing on other apps or sites, or any advertising identifier. (Google's advertising software inside the app reads a device identifier for its own purposes, and, where you allow it, your device's advertising identifier too; both are described under Advertisements below, and we never receive either.) The app asks for three permissions: on an iPhone, Apple's tracking question the first time you open the app; the camera when you buy a custom avatar; and the microphone when you turn the mic on.
How signing in works
Players' accounts have no passwords. You sign in with Apple or Google, and that service tells us that the sign-in succeeded and gives us an identifier for you. We do not see your password for that service, and we hold no password of yours that could be guessed or stolen to get into your account.
To confirm a sign-in is genuine, our server checks it with the service that made it, against the service's published signing keys.
If you lose access, you sign in with the same service again — there is no password to reset and no reset email to send. Each service is a separate way in: signing in with Google and later with Apple makes two separate accounts.
You may connect the other sign-in service to the same account later, from Settings. Connecting both is worth doing: it is how you get back in if you ever lose access to one of them.
In transit, data between the app and our servers is protected with TLS, the same encryption a bank's website uses.
Who else sees anything
Our hosting provider, Apple, Google, Google's advertising service, and — if you buy a custom avatar — the image service that draws it. This section is updated before any other service is added.
- Hosting. Our game, voice and web servers run on computers rented from DigitalOcean in New York. What we hold is stored on those computers; DigitalOcean keeps them running and has no permission to use what is on them for anything of its own.
- Sign in with Apple or Google. The service you choose handles signing you in, and it knows that you use Waraqi; we receive an identifier, and we discard any email address offered. Each service's own privacy policy governs what that service does.
- Purchases made through the App Store or Google Play. The store tells us that a purchase happened, and later whether it renewed, was canceled or was refunded; we do not see your card details at any point.
- Advertisements, served by Google AdMob. See the next section.
- The image service that draws a custom avatar. Your two photographs are shown to an outside image service, because that is how the artwork is made. It is used for that purpose only. Its setting for improving its own models from what we send it is turned off, so your photographs are not used to train anything.
The image service applies only to players who buy a custom avatar. It is a single optional purchase, and if you do not make it, we hold no photograph of you and no image service receives your data from us.
We run our own game and voice servers, and use no analytics service.
We do not sell your data, and we do not share it for anyone else's advertising. The only advertising data that leaves the app is what Google's own software collects, as described below.
Advertisements
The app shows advertisements in two places, and both are served by Google AdMob (Google LLC): a small banner in the band at the bottom of most screens, and a video you can choose to watch in the shop to earn a reward (Watch & Earn, and a second turn at 3-Card Monte). No advertisement interrupts a game.
- Personalized only if you allow it, on an iPhone. The first time you open the app on an iPhone, a short screen from Google explains why, and then Apple asks whether Waraqi may track you. If you tap Allow, Google may use your device's advertising identifier, together with what it knows from other companies' apps and websites, to choose advertisements that suit you. That is what Apple calls tracking. If you tap Ask App Not to Track, we ask Google for non-personalized advertisements, chosen from the context and the country rather than from a profile of you, and Google does not receive the advertising identifier. You can change your answer at any time in your iPhone's Settings > Privacy & Security > Tracking.
- On Android, personalized unless you turn it off. Android has no question like Apple's, so the app does not ask one. Google may use your device's advertising ID to choose advertisements that suit you, unless you have turned that off in your phone's settings (Settings > Google > Ads, where you can delete your advertising ID). If you have, you see non-personalized advertisements.
- What Google receives. To serve and count an advertisement, Google's software in the app sends Google the usual technical details: your network address, the device model and operating system, the app's name, and a device identifier. Google's use of that information is governed by [Google's privacy policy](https://policies.google.com/privacy) and its [advertising terms](https://policies.google.com/technologies/ads). Where the law requires it (for example in the European Economic Area and the United Kingdom), Google's consent form is shown before any advertisement, and you can decline.
- Rewarded videos. When you finish a rewarded video, Google tells our server that you did, using your player identifier and the name of the reward it was for, so that the reward is paid only for a video actually watched. That is the only thing about advertisements our server keeps: a record that a particular video was credited, kept for three days so it cannot be credited twice.
- The VIP Pass. Players with an active pass see no banner; the band shows their quick buttons instead. Rewarded videos remain a choice.
Automated players
Some of the players you meet are operated by our software rather than by people. See the Terms of Use for what that means. It has no privacy consequence for you beyond this: those players are not people, so no other person is watching that table through them.
How long we keep things
| What | How long |
|---|---|
| Table chat | 24 hours |
| Chat and recordings attached to a report | 30 days after a decision |
| Reports and moderation decisions | Permanently |
| Recent-contacts list | 7 days |
| Custom avatar photographs | Until the order is finished, then deleted |
| Voice | Not kept at all |
| A rewarded video's credit (see Advertisements) | 3 days |
| Server logs, which can hold your network address | 14 days |
| The rest of your account | Until you delete your account |
Deleting your account
Settings > Account > Delete My Account removes your account from inside the app, whether it is a guest account or connected to Apple or Google.
It cannot be undone. There is no grace period and no restore.
It deletes what we hold about you across the game — your account, games, statistics, ratings, currency, purchases, friends, chat, clan membership, tournament entries, replays, support messages and cosmetics.
Three things are kept, and each is about somebody other than you:
- Reports in both directions, and any moderation decisions.
- Chat and recordings already attached to a report.
- Your username, recorded as taken. Usernames appear on reports and on games other people saved; releasing yours would let somebody else wear the name of a person who has left.
A receipt number for a purchase you made through the App Store or Google Play stays marked as used, with nothing tying it to you, so that the same purchase cannot be credited to anyone twice.
Your rights
Wherever you live, you may ask us to tell you what we hold about you, to correct it, to delete it, or to send you a copy. The deletion right is built into the app (Settings > Account > Delete My Account). For anything else, write to us and we will answer within a month.
You may also withdraw a consent you have given, object to what we do with your data, or complain to the privacy regulator where you live.
We do not sell your personal information. We do not share it for cross-context behavioral advertising. The one exception is Google's advertising software in the app, which may use your device's advertising identifier to personalize advertisements: on an iPhone only if you tapped Allow when Apple asked, and on Android unless you have turned ad personalization off in your phone's settings (see Advertisements). You can change either at any time in your phone's settings. We do not use your information to make decisions about you automatically, and we do not profile you.
Why we are allowed to hold what we hold. We hold your username, sign-in identifier, device identifier and game progress because we cannot run the game for you without them. We keep table chat for a day, and reports permanently, because we have a genuine need to protect players from harassment and to answer a complaint fairly. We rely on your consent for the custom avatar photographs, and you can withdraw it by canceling the order.
Where your data is held. Our servers are in the United States. If you use Waraqi from outside the United States, what we hold about you is held there.
Children
Waraqi is not for children under 13, and we do not knowingly collect anything from a child below that age. Some countries set a higher age for a child to agree to this kind of service on their own; where that is so, the higher age applies.
If you believe a child under 13 has made an account, write to us and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top and tell you in the app. If a change is significant, we will say so plainly rather than quietly replacing the text.