Wurl Backgammon — Privacy Policy
This privacy policy explains how Deslater ("Deslater Studios", the "Service Provider", "we") handles information in the Wurl Backgammon mobile application and its online services (together, the "Application"). It is written to describe what the Application actually does, so that it matches our Google Play Data safety declaration.
1. Who is responsible for your data
Deslater is the data controller for the Application. You can reach us at any time at [email protected].
2. Playing as a guest
You do not need to create an account to play. When you first open the Application, an anonymous account is created automatically through Google Firebase Authentication. This produces a random user identifier ("uid") that is not linked to your name, email address, or any other real-world identity.
As a guest, the information associated with you is limited to that random identifier, your in-app settings, and any gameplay records described in section 4.
3. Signing in with Google (optional)
You may optionally upgrade a guest account by signing in with Google. This keeps your existing progress and rating. If you do so:
- Google Firebase Authentication handles the sign-in and holds the account identifiers associated with it, including the email address of the Google account you sign in with. Firebase acts as our processor for authentication.
- Our own game servers receive and store only your player name. We do not store your email address in our game database, and we do not store your Google profile picture.
- We never receive your Google password, and we do not request access to your contacts, calendar, files, photos, or any other Google service data.
Signing in is entirely optional. Guest play remains fully available.
4. Information collected when you play
The Application stores the following on our servers, associated with your uid:
- Profile — your player name, whether the account is a guest, the date the account was created, and your in-app settings and preferences.
- Skill ratings — a numeric rating, rating deviation, volatility, and games-played count, kept separately for each game variant and for each track (practice and ranked).
- Match history — a record of completed matches, including the result and the time the match ended.
- Live match state — while an online match is in progress, the server keeps a snapshot of the board so the match can be resumed if your connection drops. These snapshots relate to the match, not to you personally, and are transient.
Some data never leaves your device at all — including your local settings, your solo games against the computer, and your dice statistics.
In online matches, dice are rolled by our server using a cryptographic commitment scheme so that either player can verify the rolls were fair. This concerns match integrity, not your personal data.
5. Analytics and crash reporting
We use two Google services to understand how the game is used and to fix problems. Both report to us in aggregate; neither is an advertising service.
- Google Analytics for Firebase records anonymous usage counts tied to a randomly generated app-instance identifier — not to your account, your player name, or your email. The events we send are: a game starting, a match finishing (with win, loss or draw), starting a quick match, creating or joining an invite, and signing in. Alongside these, the SDK records general usage such as sessions, screen views, app version, device model, operating system and country.
- Firebase Crashlytics reports crashes so we can fix them. It is active on the Android app only — never on the web version — and only in released builds. A report contains the technical error trace, the device model, the operating system version and the state of the app at the moment it failed.
Neither service ever receives board positions, player names, chat, or anything you type into the game. Analytics is deliberately configured not to collect your device's advertising identifier, and the app does not request the Android AD_ID permission at all. Analytics identifies an installation only by a random app-instance identifier.
Where the law requires your consent for analytics, we will ask for it before collecting, and you can change your mind at any time.
6. Information collected automatically
When the Application communicates with our servers, our hosting infrastructure processes standard technical information as part of delivering and securing the service:
- Your device's IP address
- The date and time of the request and which endpoint was called
- Basic device and operating-system information sent by your device
This is used to operate the service, diagnose faults, and protect against abuse and fraud. We do not use it to build advertising or marketing profiles. The Application does not collect your precise location, your contacts, your photos, your microphone or camera input, or your payment details. Google Analytics for Firebase does derive an approximate, country- or region-level location from your IP address; we never receive a precise position.
7. What other players can see
Some information is intentionally public inside the Application:
- The global leaderboard displays your player name, your rating, and your number of games played to anyone using the Application.
- During an online match, your opponent can see your player name, your rating for that game, your games-played count, and your head-to-head record against them.
Please do not use your real name, email address, or any other personal detail as your player name. You can change your player name at any time in the Application. Your email address is never shown to other players.
8. Why we process your information, and our legal bases
Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:
- Performance of a contract — creating your account, saving your progress, matching you with opponents, running online matches, and maintaining ratings and leaderboards. Without this we cannot provide the Application.
- Legitimate interests — keeping the service secure, preventing cheating, fraud and abuse, diagnosing technical faults, and maintaining the integrity of competitive play. We balance these against your rights and use the minimum data necessary.
- Legitimate interests, or consent where the law requires it — the anonymous analytics and crash reporting in section 5, used to understand which games are played and to fix faults. Where consent is required in your country, we ask first.
- Consent — where you choose to sign in with Google, and for anything else we specifically ask you to opt into. You may withdraw consent at any time.
- Legal obligation — where we must retain or disclose information to comply with applicable law.
9. Advertising and tracking
The Application contains no advertising SDKs and no third-party tracking SDKs. The analytics and crash reporting described in section 5 are used to operate and improve the game, never to advertise. Specifically:
- We do not serve ads, and no advertising network receives your data from us.
- We do not collect or use your device's advertising identifier (GAID/IDFA). Collection is switched off in our Analytics configuration and the app does not declare the Android
AD_IDpermission. - We do not use cookies, pixels, SDKs or similar technologies for cross-app or cross-site tracking.
- We do not sell or share your personal information, and we do not engage in "targeted advertising" or "profiling" as those terms are used in US state privacy laws.
10. Who we share information with
We do not sell your personal information and we do not disclose it for anyone else's marketing. We use a small number of service providers who process data strictly on our instructions:
- Google Firebase Authentication — account creation and sign-in. Privacy information
- Google Sign-In — only if you choose to use it. Google Privacy Policy
- Google Analytics for Firebase — anonymous usage statistics. Privacy information
- Firebase Crashlytics — crash reports, Android app only. Privacy information
- Google Cloud Platform — hosts our game servers, in the Frankfurt (EU) region. Cloud Privacy Notice
- Neon — hosts the PostgreSQL database holding the records in section 4. Privacy Policy
We may also disclose information where we are legally required to do so — for example to comply with a subpoena or similar legal process — or where we believe in good faith that disclosure is necessary to protect our rights, protect the safety of any person, or investigate fraud or abuse. If we are ever involved in a merger, acquisition or sale of assets, we will give notice before your information becomes subject to a different privacy policy.
11. International data transfers
Our service providers may process data in countries outside your own, including outside the United Kingdom and the European Economic Area. Where the law requires safeguards for such transfers, we rely on appropriate mechanisms, including Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, adequacy decisions, or another legally recognised transfer mechanism.
12. How long we keep information
- Account and profile data — kept while your account exists. If an account is inactive for 36 months, we may delete it along with its associated records.
- Ratings and match history — kept while your account exists, because they define your competitive standing.
- Live match snapshots — deleted or superseded shortly after the match concludes.
- Analytics events — retained by Google Analytics for Firebase for up to 14 months, then deleted automatically. Aggregate reports built from them may be kept longer.
- Crash reports — retained by Firebase Crashlytics for approximately 90 days.
- Server and security logs — retained for a limited period, normally no more than 12 months, then deleted or aggregated.
- Aggregated or anonymised data — may be kept indefinitely, as it can no longer identify you.
- Records we must keep by law — retained for the period the law requires.
When you delete your account, we delete the data described in section 12 rather than waiting for these periods to expire.
13. Deleting your account and your data
You can delete your account and its associated data at any time, and you do not need to reinstall the Application to do it:
- In the Application — go to Profile and use the Delete my data button at the bottom of the screen. You will be asked to confirm twice.
- On the web, without the app — visit wurlbackgammon.deslater.com/delete and sign in with the Google account you used in the game. If you played only as a guest, your identity exists solely on your device, so use the in-app button instead.
- By email — write to [email protected] if you need help with either route.
Deleting your account removes your profile, ratings, match history and any stored match state from our database, and then deletes the underlying authentication account. Deletion is immediate, permanent and cannot be undone. Some information may persist briefly in encrypted backups or in server logs until those expire on the schedule in section 11, and we may retain the minimum records required by law.
Uninstalling the Application on its own does not delete data already stored on our servers — please use one of the methods above.
14. Your rights
Depending on where you live, you may have some or all of the following rights over your personal information:
- Access — obtain a copy of the personal information we hold about you
- Rectification — have inaccurate information corrected
- Erasure — have your information deleted (see section 12)
- Restriction — ask us to limit how we use your information
- Portability — receive your information in a portable, machine-readable format
- Objection — object to processing carried out on the basis of legitimate interests
- Withdraw consent — at any time, without affecting processing already carried out
- Complain — lodge a complaint with your local data protection authority. In the UK this is the Information Commissioner's Office; in the EEA it is your national supervisory authority
To exercise any of these rights, contact [email protected]. We will respond within the timeframe required by applicable law — generally within one month. We do not charge for exercising your rights and we will never treat you differently for doing so.
15. US state privacy rights
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another US state with comprehensive privacy legislation, you have the right to know what personal information is collected, to access and delete it, to correct it, and to opt out of its sale, sharing, or use for targeted advertising or profiling.
We do not sell or share personal information, and we do not use it for targeted advertising or profiling, so there is nothing for you to opt out of. You may still exercise your other rights by contacting [email protected]. You may use an authorised agent to make a request on your behalf, and we will not discriminate against you for exercising any of these rights.
16. Children
The Application is not directed to children and is not intended for anyone under 13 years of age, or such higher minimum age as applies in your country. We do not knowingly collect personal information from children under 13.
If you are a parent or guardian and believe your child has provided us with personal information, contact [email protected] and we will delete it promptly.
17. Security
We take reasonable technical and organisational measures to protect your information. All communication between the Application and our servers is encrypted in transit using HTTPS/TLS. Access to production systems is restricted, sign-in tokens are cryptographically verified on every request, and our servers are hosted on managed cloud infrastructure with the security controls those providers maintain.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
18. Data breach notification
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required by law, affected users, within the timeframes the law requires.
19. Automated decision-making
We do not carry out automated decision-making that produces legal or similarly significant effects about you. Skill ratings are calculated automatically from match results, but they affect only in-game matchmaking and leaderboard position.
20. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page with a new effective date, and where the change is material we will give notice in the Application before it takes effect. Where the law requires your consent to a change, we will ask for it. Previous versions are available on request.
21. Contact us
Questions, requests, or complaints about this policy or your personal information:
Deslater Studios
Email: [email protected]
Web: deslater.com/contact