All4sPrivacy Policy
This policy explains what the All4s app collects, why, who else handles it, how long we keep it and what you can do about it. We collect only what the game needs.
The short version
- You can play the bots without an account. Nothing about your games leaves your phone.
- Online play uses an account (a guest account, or one with your email) run on Google Firebase.
- We do not collect your location, contacts, photos, microphone or health data.
- We never see your card or bank details: the App Store and Google Play handle payment.
- Ads are served by Google AdMob. You control ad tracking with your phone's settings and our consent prompt.
- We do not sell your personal information.
- You can delete your account and its data at any time, in the app or by email.
What we collect, and why
| Data | When | Why |
|---|---|---|
| Account identifier (a random user id) | When you play online, as a guest or with an account | To sign you in, seat you at tables and keep your profile, stats and purchases together |
| Email address (optional) | Only if you create or link an email account, or sign in with Apple or Google | To sign you in, recover your account, and answer you if you contact us |
| Display name and avatar | When you set up your profile | Shown to the other players at your table, in invites and on the leaderboard |
| Gameplay data and stats (moves at online tables, scores, games and hands won, streaks) | When you play online | To run the game on our server fairly, and to show your stats and leaderboard rank |
| Online status | While the app is open and signed in | So friends can see you are online and invite you to a table |
| Chat messages and reports | When you send a table message or reaction, or report a message | To deliver messages to your table, filter offensive words, prevent spam, and review reports of abuse |
| Push notification token | If you allow notifications | To tell you about table invites and your turn |
| Purchase records (product, store transaction id, dates, subscription status) | When you buy a sign pack or All4s Pro | To verify the purchase with Apple or Google, give you what you bought, restore it, and handle renewals and refunds |
| Device identifiers and ad data (advertising id where permitted, IP address, device and app information, ad interactions) | When an ad is shown (not for All4s Pro subscribers) | Collected by Google AdMob to serve, measure and limit ads, and to prevent ad fraud; used for personalised ads only with your consent |
| Settings stored on your phone (options, muted players, avatar choice) | Always | To remember your choices. These stay on your device and are not sent to us |
Camera. If you scan a table invite QR code, the camera image is processed on your phone only to read the code. No image or video is stored or sent.
Crash and diagnostics data. The app does not include its own crash reporting or analytics tools. If you have chosen to share diagnostics with Apple or Google, they may pass anonymous crash reports to us through their developer consoles. Our server keeps short technical logs (for example, errors) for security and troubleshooting.
Legal bases (EEA, UK and similar laws)
- Contract: running your account, online games, chat, stats and purchases you ask for.
- Legitimate interests: keeping the service secure, stopping cheating, spam and abuse, and non-personalised ads that keep the game free.
- Consent: push notifications, personalised ads, and (on iPhone) tracking under App Tracking Transparency. You can withdraw consent at any time.
- Legal obligation: keeping records we are required to keep, and responding to lawful requests.
Ads, tracking and consent
All4s shows banner ads through Google AdMob. All4s Pro subscribers see no ads.
- iPhone and iPad: we use your device's advertising identifier for personalised ads only if you allow it in Apple's App Tracking Transparency prompt. If you decline, or turn off Allow Apps to Request to Track in Settings > Privacy & Security > Tracking, ads are not personalised using that identifier.
- EEA, UK and Switzerland: we show Google's consent message (User Messaging Platform) before personalised ads, and you can change your choice later from Get signs > Ad privacy choices in the app.
- Android: you can reset or delete your advertising ID, or opt out of ad personalisation, in Settings > Privacy > Ads (or Google > Ads).
Learn how Google uses data from apps that use its services: policies.google.com/technologies/partner-sites.
Who we share data with
We do not sell personal information. We share it only with these service providers, to run the app:
- Google Firebase (Google LLC): sign-in (Firebase Authentication), our game database (Cloud Firestore and Realtime Database) and server code (Cloud Functions). Data is processed on Google Cloud servers, which may be outside your country. Firebase privacy.
- Google AdMob (Google LLC): ads, as described above. Google Privacy Policy.
- Apple (App Store, Sign in with Apple, push notifications) and Google (Google Play, Google sign-in, Firebase Cloud Messaging): payments, purchase verification, subscriptions and delivering notifications. Their own privacy policies cover what they collect when you pay.
- Expo (650 Industries, Inc.): the Expo push notification service passes your push token and the notification text to Apple or Google for delivery. Expo privacy.
- Other players: your display name, avatar, online status, table messages, moves and leaderboard stats are visible to other players as part of the game. Signs you send are shown only to your partner.
- Authorities: when the law requires it, or to protect the safety of our players or others (for example, reporting child sexual abuse material to the relevant authorities).
How long we keep it
- Account, profile, stats and purchase records: while your account exists. When you delete your account we delete them within 30 days, except purchase records we must keep for tax, accounting or fraud prevention (kept up to 7 years, without your profile).
- Guest accounts: a guest account that has not been used for 12 months may be deleted with its data.
- Chat messages: kept with the table they were sent at, and deleted within 90 days after that table closes.
- Abuse reports: up to 1 year after the report is resolved, or longer if needed for a legal claim or a law-enforcement request.
- Push tokens: until you turn off notifications, sign out, or the token stops working.
- Server logs: up to 30 days.
- Ad data: kept by Google under its own retention policy.
Your rights and choices
- Delete: delete your account in the app (Settings > Delete my account) or by email.
- Access and copy: ask us for a copy of your data.
- Correct: change your display name and avatar in the app, or ask us to correct other data.
- Object or restrict: ask us to stop or limit certain uses.
- Withdraw consent: turn off notifications, tracking or personalised ads in your phone's settings or from Get signs > Ad privacy choices.
Email support@all4s.dreadrocksoftware.com from the email on your account (or with your display name if you play as a guest). We may ask for information to confirm it is you, and we reply within 30 days (45 days under California law). We will not treat you differently for using your rights.
EEA and UK (GDPR)
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local data protection authority (in the UK, the ICO). When data leaves the EEA or UK, Google and our other providers use safeguards such as the European Commission's Standard Contractual Clauses.
California (CCPA/CPRA) and other US states
In the last 12 months we collected the categories in the table above: identifiers (user id, email, advertising id, IP address), customer records (purchases), internet activity (gameplay, chat, ad interactions) and inferences made by Google for ads. We do not sell personal information. Letting Google AdMob use data for personalised ads may count as "sharing" for cross-context behavioural advertising; you can opt out by declining tracking on iPhone, opting out of ad personalisation on Android, or emailing us with "Do Not Share". We honour Global Privacy Control signals where they apply. You may use an authorised agent. We do not use sensitive personal information.
Children
All4s is not directed to children under 13 (or the minimum age in your country) and we do not knowingly collect personal data from them. Kids' chat limits chat to preset phrases and reactions for younger players on a family device. If you believe a child under 13 has given us personal data, email us and we will delete it. See also our child safety standards.
Security
Data travels encrypted (HTTPS/TLS) and is stored on Google Cloud, which encrypts data at rest. Access to our database is limited by security rules, and only our server can write stats, purchases and chat. No system is perfectly secure, so please use a strong password for an email account.
Changes to this policy
If we change this policy we will update the effective date above, and tell you in the app before important changes take effect.
Contact
Dreadrock Software
support@all4s.dreadrocksoftware.com