1. Data controller
The data controller is Alain Hirsch, independent publisher of the Crazy Rummy app, based at 173 rue de Courcelles, 75017 Paris, France. For any question about your personal data, please write to the contact address at the bottom of this page.
2. Data we collect
Crazy Rummy offers two ways to play. In solo mode, games run entirely on your device and can be played without an account: the course of play is never sent to our servers. The app does however contact them at launch to check their availability and whether your version is compatible and, if you have an account, to retrieve your number of gems, your subscription status and to record the experience points you earn. Online, an account and a connection are required to match you with other players, save your progress and maintain the ranking. The following data is collected only according to the features you actually use:
- Player account: nickname, chosen avatar, and depending on how you sign up either an email address with an encrypted (hashed) password, or a Google or Apple sign-in identifier. We never receive your Google or Apple password.
- Device identifier: a technical identifier specific to your device, used to grant free gems and to prevent multiple accounts being created to accumulate them.
- Game data: games played, results, ranking level, experience points, season stars and results, division, solved puzzles, gems, unlocked badges and emotes.
- Games in progress: a temporary save of the state of online games, so play can resume after a disconnection or a server restart.
- Social features: your friends list, invitations sent or received, and the list of players you have blocked. Quick messages and emotes exchanged during a game are sent to other players live but are not stored on our servers.
- Purchases: when you take out a subscription, the purchase receipt sent by Google Play or the Apple App Store, along with the subscription status and expiry date. Your payment details are handled by Google or Apple and are never shared with us.
- Advertising: if you are not a subscriber, the Google AdMob SDK may access your device advertising identifier to display ads. See the advertising section below.
- Diagnostics: if the computer opponent behaves abnormally, a technical report describing the state of the game may be recorded so the defect can be fixed.
- This website: it sets no cookies and uses no analytics or advertising trackers. Only the host technical logs record connections.
3. Purposes and legal bases
Each processing activity relies on a legal basis set out by the General Data Protection Regulation (GDPR):
- Running the game, managing your account, saving your progress, organising online games and the ranking — legal basis: performance of the contract between us when you create an account.
- Managing subscriptions and verifying purchases — legal basis: performance of the contract.
- Securing the service, preventing cheating and abuse of free gems through the device identifier, fixing defects — legal basis: our legitimate interest in offering a fair and reliable game.
- Displaying personalised advertising — legal basis: your consent, collected in the app and revocable at any time.
- Displaying non-personalised advertising if you decline consent — legal basis: our legitimate interest in funding a free app.
- Answering your support requests — legal basis: our legitimate interest in assisting you.
4. Advertising
The app displays advertising provided by Google AdMob in order to remain free. Subscribers see no advertising at all.
- If you live in the European Economic Area, the United Kingdom or Switzerland, a consent screen compliant with the Google UMP / TCF framework is shown before any ad is displayed. You choose to accept or decline personalised advertising, and you can change that choice at any time from the app privacy settings.
- If you accept, Google AdMob may use your device advertising identifier to select relevant ads. If you decline, ads are still shown but are not personalised.
- Google acts as an independent data controller for this data. Its practices are described in the Google privacy policy, available at policies.google.com/privacy.
- You can also reset or delete the advertising identifier in your Android or iOS device settings.
5. Recipients and processors
Your data is never sold, rented or traded. It is shared only with the providers required to operate the service:
- OVHcloud — hosting of the game server and database, on servers located in the European Union.
- Google Ireland Limited — AdMob advertising service and consent management.
- Google Play (Google Ireland Limited) — subscription processing on Android and purchase receipt validation.
- Apple Distribution International — subscription processing on iOS and purchase receipt validation.
- Google or Apple sign-in — only if you choose that sign-up method.
- Some profile information is by nature visible to other players: your nickname, avatar, badge, level and ranking position.
- Data may also be disclosed to an administrative or judicial authority where the law requires it.
6. Transfers outside the European Union
The game server and database are hosted in the European Union. However, Google and Apple may process some data in the United States as part of the advertising and subscription services. These transfers are covered by the European Commission standard contractual clauses and by the EU–US Data Privacy Framework, to which Google and Apple adhere.
7. Retention periods
We keep your data only for as long as necessary for the purposes described above:
- Account and progress: for as long as your account exists. An account left inactive for 24 consecutive months is deleted, together with the associated data.
- Saves of games in progress: deleted when the game ends, and at the latest 24 hours after being created.
- Game history and season results: 24 months.
- Diagnostic reports: 12 months.
- Purchase receipts and subscription data: kept for the applicable statutory accounting and tax period, namely 10 years.
- Host technical logs: 12 months at most.
- After your account is deleted, your nickname is detached from past games, which are no longer linked to an identifiable person.
8. Your rights
Under the GDPR, you have the following rights over your personal data:
- Right of access: obtain a copy of the data we hold about you.
- Right to rectification: correct inaccurate data.
- Right to erasure: request deletion of your account and your data. Deletion is done directly in the app, from your profile. The “Delete my account” page on this site sets out the full procedure, including if you have uninstalled the app.
- Right to restriction: request that processing be temporarily frozen.
- Right to object: object to processing based on our legitimate interest.
- Right to portability: receive your data in a structured, machine-readable format.
- Right to withdraw your consent at any time, in particular for personalised advertising, without affecting the lawfulness of processing carried out beforehand.
- To exercise these rights, write to the contact address below. We reply within one month. Proof of identity may be requested in case of reasonable doubt.
- If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, or at www.cnil.fr, or with the supervisory authority of your own country.
9. Security
Exchanges between the app and the server are encrypted (HTTPS and secure WebSocket). Passwords are stored as hashes and never in plain text. Access to the database is restricted to those who need it. As no system is infallible, we cannot guarantee absolute security, but we undertake to inform you and the supervisory authority in the event of a data breach posing a risk to your rights.
10. Children
Crazy Rummy is not intended for children under 16 and we do not knowingly collect their data. If you are a parent or guardian and become aware that a child under 16 has provided us with personal data, please write to us: the account and the corresponding data will be deleted.
11. Changes to this policy
This policy may change, in particular if new features are added to the game. The date of the last update is shown at the top of the page. In the event of a substantial change, you will be informed in the app before it takes effect.
12. Contact
For any question, or to exercise your rights, write to us at: contact.rummyworld@gmail.com
Alain Hirsch — 173 rue de Courcelles, 75017 Paris, France
Crazy Rummy