Open Hearts — Privacy

The short version

• Playing alone stays on your device Your games against the bots are kept on the device you play on, and not sent anywhere. So are your name and picture, until you subscribe: then our service keeps them with your account too, so that all its devices show the same ones. A copy of each picture your account sets is kept apart, to act on reports, until a year after it stops being your account's.
• Live play is public, on purpose To play people, your name, your picture, your account's number, your moves and your results go through our relay, where anyone who asks can read them. Rooms, pictures and a game's moves are kept there a day; results are kept for the ratings.
• Accounts, but no email or password Nothing is sold, rented or used for advertising, and nothing follows you from site to site. The game on the web reports its errors and load times to New Relic, as described below; this site and the phone apps report nothing. Subscribing makes an account: a random number our service gives you, which your devices play under. There is no password, and we hold no email address.
• Paying is Stripe's job On the web a subscription is bought from Link, Stripe's affiliate, which has your email address, card and billing address. We keep a note of which account it pays for and which devices are in that account. We never see your card number.

Who we are

This policy describes what Open Hearts does with data. It is not part of the terms, and it covers what they cover; "we" are who they say. The code is public, so everything on this page can be checked against what the app actually does.

On your device

The app keeps these on the device you play on — in the browser's storage for play.openhearts.game, or in the app's own storage on a phone:

• A key your device makes for itself. It is a long random number with a public half and a secret half. The public half is this device at a live table; if you subscribe, your licence ties it to your account. The secret half never leaves the device.
• Your name and how you look: an icon and a colour, or a picture of your own. The picture is cut down to 192 by 192 pixels on your device, and only that small copy is kept. The photo you picked it from is not stored or sent. If you subscribe, our service keeps a copy with your account, as below.
• Your last thirty games against the bots, which your profile counts up. They leave the device only if you tap Copy record.
• How quickly you play, your game options, the language you chose, whether you have opened Learn to play, when the phone app last asked its store for a rating, when you last left a live game early, your licence and your account's number if you subscribe, the players whose pictures you chose to hide and those you blocked, and the notices of changes to the terms or this policy that you dismissed.
• The live game you are in, while you are in it: the table, the names, icons and colours it was started with, and the secrets your device dealt your cards with, so that a page reloaded mid-game can come back to its seat. It is deleted when the game ends or you leave it. If the app closes mid-game, it is deleted the next time the app opens, unless that is within two minutes, when you go back to your seat.

To remove all of it, clear the data of play.openhearts.game in your browser (and of openhearts.game, where a browser that played before the game moved to play.openhearts.game keeps its earlier copy), or delete the app. That also removes your key, so the device comes back as a new player, until a backup code or your sign-in brings it into your account again.

Playing alone

A game against the bots is played entirely on your device. Nothing about it is sent anywhere.

The phone apps do what the game on the web does when it starts: they ask our service for the game's current settings, which says nothing about you, and make the licence check below. Live play in them works as described below. They do not use New Relic or Google's font servers. After a game you win, they may ask the App Store or Google Play to show its own prompt to rate the app, at most once every four months. Whether it shows is up to the store, and what you choose in it goes to the store, under its own privacy policy; the app is told neither.

Opening the game on the web

• Cloudflare hosts this site and the game, so it sees each request your browser makes: your IP address, your browser, and the address you asked for. We add no logging of our own.
• Google's font servers, sometimes. The game carries its own font, but when it has to draw a character that font lacks — an emoji, an arrow, or a name written in a script such as Chinese or Arabic — the toolkit it is built with fetches the extra font from fonts.gstatic.com. When that happens, Google receives your IP address and the fact that you are visiting this site.
• A licence check. Each time the game starts it sends your device's public key to our service to ask whether it holds a subscription. If it does, the service also notes that this device is the one your account is using now, when, and which live table it is at, if any; that note is replaced the next time any of your devices opens the game. If it does not, nothing is kept.
• Your profile page asks our relay for game results so it can show your rating. Nothing about you is published by it.
• New Relic tells us when the game breaks or is slow for you at play.openhearts.game. The game's page sends it the errors it meets, how long it took to load, the addresses of the calls it makes to our service (without anything after a "?"), and your browser, device type and rough location. Your IP address is used for that location and dropped within a day. It sets no cookies, records no screen or session, and reads nothing you type. Under New Relic's privacy notices.

Live play

What everyone can see

A live game is played through our relay, relay.openhearts.game, a server that passes messages between apps and keeps each live table's moves in order. It is open: anyone who asks it for a room, a table or the results can read what it carries there, and some of it is kept. In live play:

• Kept, and readable by anyone who asks: your name, icon and colour, your account's number, and your device's public key with the licence that ties the two together, each time you are seated at a table; your picture, if you chose one; and the result of every live game you play, rated or not — the table, each seat's account, key, licence and final score, and who left. Ratings belong to accounts and are worked out from these results by anyone who cares to, which is the point: nobody has to take our word for a rating. Names, icons, keys, account numbers and pictures are kept a day; results are kept for as long as the ratings are.
• Kept, and readable by any subscriber with the game's address: every live game, move by move — each seat's account and key, the licence tying them, the name it played under, every card played, every card dealt and passed once its hand is over, when each player's connection to the table closed and opened again, and the signatures that prove it. Our relay keeps the moves as they are made, until a day after the game's last. A player's device sends the whole game to our service when it ends, and it is kept for good, so a game can be looked at and checked afterwards, from the device a subscriber's account is using. Its address is a long random code that nobody can guess; it is shared by whoever shares it.
• Passed on but not kept: while you wait for a game, your name, rating, icon and colour and how many seconds you usually take over a card, every couple of seconds; and while the app is open, that your device is online or at a table, with your account's number and a short-lived note from our service saying this is the device your account is using. The relay forwards these to whoever is listening at that moment and keeps nothing — but anyone listening could record them. Reactions you send at a table (👍 Nice and the rest) are passed on the same way, to the table and anyone watching it, and not kept.
• Passed on, while anyone watches: a live game can be watched as it is played by any subscriber with its address. While someone is watching, one player's device sends, after each move, what everyone at the table can already see — the names, the scores, the cards played so far this hand and whose turn it is — and never a hand still held. The relay forwards it and keeps nothing. If you watch, it is under your own device's key and licence, so the player's device that answers sees your account's number; it answers nobody whose account is playing at that table.

A friends' table is private in one sense only: strangers cannot sit down at it. What it publishes is as public as any other table.

Where it goes

Only to our relay, which runs on Cloudflare. Every message is signed by the device that sent it, so anyone who keeps a copy can show it is genuine; we cannot delete a copy someone else made.

What only your table sees

The cards are dealt between the seats at the table so that each player's hand can be read by that player alone. Our server plays every bot's seat, so it knows the bots' cards: at a table of one player and three bots, those are every card but the player's, so it could work out the player's hand from them, and we do not. Opening a player's hand takes our server's half of what opens it and another player's half together; our server's half alone is nothing. The hand of a player who leaves mid-hand is opened for the rest of that hand, so that the table can finish. Every move goes through our relay.

Your device connects only to our relay, so the other devices at your table never learn your IP address — not the other players, and not our server that plays the bots. Cloudflare, which runs the relay, sees your IP address, as any server you connect to does.

If nobody else is waiting and you choose to wait for a person, our service emails us that someone is waiting: the pool, the time, and the first few characters of your device's key and of your subscription — never your name or email address. One of us may come and play.

If you report a player, our service emails us your report: what you chose and wrote, the table, the name and picture you saw, your account's number and theirs, and the first few characters of your device's key. The player isn't told. We keep a report for as long as we need it to deal with it, and our service notes for a day that you sent it, so that the same report reaches us once.

Subscribing

Live play is a subscription. On the web it is bought from Link (Sold through Link, LLC), Stripe's affiliate, on Stripe's own page: it asks for your email address, your card and your billing address, which the tax where you live is worked out from, under Stripe's privacy policy.

Subscribing makes an account: a random number, not your name or email. We give Stripe your device's public key so the payment can be matched to it. In return our service keeps a short record: which account the subscription pays for, which device keys are in the account and when each was added, which one is in use now, and the dates the subscription runs to. It also keeps your account's profile — the name, icon, colour and picture you chose — so that every device in the account shows the same ones, and a change on one reaches the others. In Stripe we can see your email address, name, billing address, card brand, the last four digits of your card, and your payments and the tax on them.

That means we could connect a subscriber's email address with their account, and so with the names and results its devices have published. We do not publish that connection, and we use it only to run your subscription.

If you add another device to your account, our service keeps a record of the one-use code you made and which devices made and used it. Any device in the account can see the others' keys, which one is in use, and remove them. Your account plays on one device at a time: opening the game on one makes it the one in use, and the device before it stops playing live until you take it back.

An account also has five backup codes, kept by our service with the account and shown on its devices, with a note of which have been used. If you subscribed on the web, we write to the address you paid with in these cases only: when you subscribe, with what you bought, how it renews, how to cancel, and the codes; with the codes again, whenever a device in the account asks for them; before a change of price applies to your subscription; and when the terms or this policy change in a way that matters to subscribers, to tell you what changed. To do that we read the address from Stripe at that moment and hand it to Cloudflare, which sends the email for us; we do not keep the address, only a note of which changes your subscription was told of, and when. Link also writes to you itself about your payments, such as receipts and a reminder before each renewal, under Stripe's privacy policy.

If you sign in with Apple or Google, we keep a scrambled form of the number they give for your sign-in — not your name or email — linked to your account, so that signing in the same way on another device brings it into the account. Your device keeps only which of the two you used. Apple or Google does the signing in, under its own privacy policy; on the web, its sign-in code is fetched only while a sign-in button is on the screen.

When a subscription is bought, our service emails us which store it was bought in, the first few characters of it, and the dates it runs to, so that we can keep an eye on the service while it is small — never your name or email address.

Telling us what's broken

The menu has a "Tell us what's broken" page. Nothing on it is sent until you press Send, and everything that would be sent is shown on the page first: what you write, which version of the game you have, the kind of device, the app's language and the size of the screen — and, from a game against the bots, that game's record, only if you tick the box for it. Send opens a new issue on our public GitHub page with it filled in. Anyone can read GitHub issues, so leave out anything private.

What we don't do

• No ads, and nothing sold or shared for advertising.
• No advertising identifiers, and nothing that follows you from app to app or site to site.
• No cookies from our pages. Stripe sets its own, on its own site, when you buy.
• No location, no contacts, no microphone. The camera only while you scan a code to add a device; the picture stays on the device.
• No email address held by us, no password, and no account unless you subscribe. We write to you only about a subscription, as above: nothing else, and no marketing.
• No chat.

How long things are kept

• On your device: until you remove them.
• On our relay: presence and waiting for a game: not kept. A live game's moves: until a day after its last. Rooms, seatings and pictures: a day. Game results: for as long as the ratings are worked out from them. The relay carries only the picture an account has now.
• Finished live games: for good, in Cloudflare's storage. If you ask us to delete your account's data, your name comes off the games you played; the moves stay, for the other players.
• Our service's account and subscription records, your account's profile among them: while the subscription runs, and afterwards until you delete your account or ask us to delete them. A changed profile replaces the one before. The note of which device is in use is replaced each time another of your devices opens the game. If we suspend your account from live play, or take its name or picture off, as the terms allow, our service also keeps a note that it is suspended and since when, and the name or picture it took off, so that either can be undone. Each is kept until it is undone, or until your account's records are deleted.
• The pictures your account sets: each is checked as it is set. Project Arachnid, run by the Canadian Centre for Child Protection, compares a fingerprint of it with known images of child sexual abuse and other abuse of children, and is never sent the picture itself. If we can't use Project Arachnid, Microsoft's PhotoDNA does this in its place: it compares a fingerprint of the picture with known images of child sexual abuse, and is never sent the picture either. A program run by Cloudflare looks at it, and hides one that seems to show nudity or sexual content, violence or a hate symbol. We keep a copy of each picture apart, with what the program made of it and which service checked it against known images, and when, for us to look at and to act on a report; once it is no longer your account's picture, nobody else is shown it. A copy is kept until a year after the picture stops being your account's — when you replace it, we take it off, or your account is deleted — and then deleted.
• Stripe and Link: as long as Stripe's policy and the law on payment and tax records require.
• Cloudflare, Google, the Canadian Centre for Child Protection and Microsoft: under their own policies.
• New Relic: the errors and timings, eight days.
• Our relay's own log: seven days, in Cloudflare's Workers Logs. Besides counts and timings that name nobody, it notes which account a set of backup codes was emailed for, or could not be; which account's pictures were left to be checked on the next run, each by its file name, a code made from the picture; and the code of a picture that is too plain to compare or that matches a checker's own test pictures.
• What the law has us report: if something published through Open Hearts has to be reported to the authorities, as US law requires of child sexual abuse material, we keep what we reported and the account's records for as long as the law requires, a year at the least, even if you ask us to delete them, and delete them once that time is over.

Your choices

• Play alone, and nothing about you leaves your device.
• Play live with a name that is not your real one, and with no picture.
• Change your name or picture at any time; if you subscribe, the change reaches all your account's devices. What was already published stays where it is.
• Delete your account in the app (how), or ask us to delete it, or to send you a copy of what our service keeps about your account, its profile and its devices. Once it is deleted, your name comes off the finished games you played, and the results your devices published stay on our relay, for the ratings, without your name: each still names your account's number and your device's public key. The copies of the pictures your account set are deleted a year after it is. If you subscribed on the web, Stripe's payment records still hold your email address with your device's public key, which those results name, for as long as Stripe keeps them.

Where data protection law gives you rights — to see, correct or delete what is held about you, to object, or to complain to your data protection authority — you have them here too.

Children

Open Hearts is not made for children under 13, and the terms do not let them play live, since it shows a name and picture to strangers. If you think a child has published something through it, tell us and we will do what we can to remove it.

On a phone, before you play live or buy live play in the app, the app asks the App Store or Google Play whether you are 13 or older; Google Play also says whether a parent or guardian has approved the app's latest changes, or needs you to confirm your age. Whether a store can answer, and whether it asks you first, is up to the store. The app uses the answer only to decide whether live play is open to you, then forgets it: it is not kept on your device, and is never sent to us or to anyone else.

Changes

If what the app does with data changes, this page changes with it, and the date at the top moves. A change that matters to subscribers is told to them by email and in the app, as the terms say. Its history, and the code's, is on GitHub.

Contact

For a privacy request — a copy of what our service keeps about your account, or deleting it — or any other question about this page, email help@openhearts.game, or write to us at the address in the terms. So that we can find what is yours, tell us the name you play under and, if you subscribed on the web, the email address you paid with.