GabbleGames Privacy Policy

Last updated: 2026-10-24

This policy covers every GabbleGames game: CarromTalk, LudoTalk, ChessMingle, BackgammonTalk, SpadesTalk, 29Talk, CuePub, CheckersTalk, GutiTalk, MorrisTalk and the GabbleGames app, on the web, Android and iOS (together, "the games"). It says what we collect, why, who else sees it, how long we keep it and what you can do about it.

1. Who the games are for

The games are for people aged 13 and over. If you're 13 to 17, read this with a parent or guardian. Accounts of 13 to 17 year olds ("minor accounts") are kept apart from adults and have extra limits — see section 8.

2. What we collect

What you or your sign-in provider give us

What Details Why
Sign-in You sign in with Google, Apple or Facebook (where offered). We receive your name, profile photo, email address and that provider's account ID. We never see your password. With Apple you may hide your email; we then receive an Apple relay address. We don't receive your Facebook friends, posts or contacts To create and secure your account and show you to other players
Age Your answers to "Are you 18 or older?" and, if not, "Are you 13 or older?" — never your date of birth To keep minors safe (section 8) and under-13s out
Your card Name, photo, country flag, favourite game, languages, when you joined, who invited you, and whether you're a minor. It holds a one-way fingerprint (hash) of your email, never the address Shown to other players
Settings Privacy choices (who can message you, who sees you online, whether your room shows, invisible mode), sound, theme, language To apply them
Messages What you send in direct messages and groups: text, photos, videos, voice messages, documents, polls, contact cards (an in-app name only), view-once media, and a location pin only when you choose to send one To deliver them
Reports What you report, your reason and notes, and copies of up to 20 of the reported messages from your device To review reports and keep players safe
Purchases What you bought, when, its order number and price. Card details go to Stripe (web) or to Apple / Google (phones), never to us; Stripe asks for your billing country To credit what you bought, handle refunds, and meet tax law

What is collected while you play

What Details Why
Country Worked out from your IP address at each start (a lookup at Cloudflare), else your device's region. Saved at sign-up Your flag, matching you with nearby players, country leaderboards, which purchases are offered where you are, your default language
Games Rooms you join, your seat, your moves, room chat, results, ratings (Chess ratings are public), who you played with, your match requests (table, seats, country). Your game history is kept on your device To run matches, rooms and leaderboards
Coins, gems and items Your coin and gem balances, the looks you own and wear, VIP status, daily claims, win streaks, and a record of your last 1,000 coin movements To run the in-game economy (section 4)
Voice Who is in a call and when. The audio goes between devices; we don't record calls To run room voice and calls
Presence Whether you're online and when you were last seen (unless invisible), the room you're in (unless hidden), who you follow and who you've blocked So friends can join you and blocks work
Device and app data Device type, app version, a push-notification token, an app-integrity check (Firebase App Check: reCAPTCHA on the web, Play Integrity / App Attest on phones), crash reports To deliver notifications, keep out fake apps and bots, fix bugs
Usage App events (for example: table joined, shop opened, purchase completed, invite sent, call placed) tied to your account ID, through Google Analytics for Firebase and Firebase Performance Monitoring, on the web and on phones; Crashlytics on phones To see what works, fix problems and improve the games
Advertising For adults who see ads: your device's advertising ID (phones), cookies (web), IP address and the ads you saw (section 6) To show and measure ads
Visits Your IP address and browser, as with any website To serve the site

Play nearby (Android): when you choose to use it, your phone uses Bluetooth and Wi-Fi to find phones close by, shows them your name and the game, and once connected exchanges your card, the game and its chat directly with them, without our servers.

We don't ask for your date of birth, phone number, address book or precise location (except a pin you choose to send).

3. How we use it, and our legal basis

Purpose Legal basis (EU/UK GDPR)
Your account, games, rooms, chat, voice, messages, purchases and items Our contract with you (the Terms)
Keeping players safe: separating minors, chat filter, reports, bans, fraud and cheat prevention, App Check Legitimate interests (a safe, fair service); legal obligation where the law requires it
Analytics, crash reports and performance Legitimate interests (fixing and improving the games); consent where the law requires it
Personalised ads Consent in the EEA, UK and Switzerland; elsewhere legitimate interests, with an opt-out
Non-personalised ads Legitimate interests (funding free play)
Tax, accounting and answering lawful requests Legal obligation

We don't sell your personal data for money. We don't use your messages, chat or voice to target ads.

4. Coins, gems and VIP

5. Robot players and AI

When no person is free to play, a robot (a computer player) may fill a seat. Robots have made-up names and flags and AI-generated portraits. Their seat shows a robot badge during the game. At a coin table we put up the robot's entry.

In some games a robot can talk in the room's voice call. Its voice comes from Google's Gemini AI (through Firebase AI Logic). While it talks, the call audio of the people in the room, the table as everyone sees it, and — in a card game while you're alone with it — your own hand are sent to Google to make its replies. Google processes this for us as a service provider, under its terms for business customers. We don't record or keep it.

6. Ads

Adults who aren't VIP may see ads: rewarded ads you choose to watch for coins, and an ad between games. Minor accounts never see ads. On the web, ads come from Google AdSense (H5 Games Ads); in the phone apps, from Google AdMob. Google may use cookies or your device's advertising ID to show and measure ads, under Google's policies.

7. Who else handles your data

We use these service providers, under contracts that limit them to providing their service:

We also disclose data when the law requires it (a valid court order or law-enforcement request, which we check before answering), to protect someone's safety (for example, child exploitation, which we report to the authorities), to enforce our Terms, or as part of a merger or sale of our business (we'd tell you first).

International transfers: our providers store data in the USA and elsewhere. Transfers from the EEA, UK and Switzerland rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) and, where the provider is certified, the EU-US Data Privacy Framework.

8. Minors (13–17)

If you say you're under 18 but at least 13, your account is a minor account. Minor accounts:

An account that answered "minor" stays a minor account if the same Google, Apple or Facebook account signs up again.

If you say you're under 13, no account is created. We keep only a note that this sign-in was refused, so the same Google, Apple or Facebook account is refused on any device. We don't knowingly collect data from children under 13. A parent or guardian who believes their child gave us data can write to [PLACEHOLDER: contact email] and we will delete it.

9. Who can see what

10. How long we keep it

Data Kept
Account, card, settings, coins, gems, items, files you sent While your account exists; deleted when you delete it
Coin record Your last 1,000 movements
Undelivered direct messages Up to 30 days on our live server
Rooms About 10 minutes after the room ends (its move log up to 24 hours)
Match requests 24 hours
Invite and call links 48 hours
Presence, notification devices, saved cards and blocks on the live server 30–90 days after last use
Chess ratings Up to 10 years, or until you delete your account
Shared clips Until you delete your account
Analytics events [PLACEHOLDER: the Google Analytics retention setting, 2 or 14 months]
Reports [PLACEHOLDER: e.g. 2 years after the report is closed]
Purchase and refund records (order number, amount, account ID) As long as tax and accounting law requires (up to 10 years)
Under-13 refusal note, minor-age note, welcome fingerprint After deletion: each holds only that fact, so nobody can get round the age rules or the welcome grant by signing up again

11. Your rights and choices

In the games:

By law, depending on where you live, you can also ask us to access, correct, delete, restrict or port your data, object to how we use it, or withdraw consent at any time:

Write to [PLACEHOLDER: contact email]. We'll answer within one month (45 days in California), and may ask you to show the account is yours, for example by writing from your sign-in's email address.

12. Security

Access to your data is controlled by Firebase security rules and our live server's sign-in check and permissions; traffic to our servers is encrypted; no player's app can change another player's coins, gems or items; card numbers never reach us. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

13. Cookies and similar technologies

The web app keeps your settings and sign-in on your device (local storage and IndexedDB); it needs them to work. Google Analytics and, for adults who see ads, Google AdSense use cookies; in the EEA, UK and Switzerland we ask first. Stripe sets its own cookies on its checkout page to prevent fraud.

14. Changes

When this policy changes we update the date above. For anything material (a new kind of data, a new ad partner, a change to how your data is shared) we tell you in the app first.

15. Contact

Questions, requests or complaints: [PLACEHOLDER: contact email].

Before this goes live — still to do