ARZ-7 is an online multiplayer card game, available at arz7.com and as a mobile app for Android and iOS. It is operated by Studio Aices ("we", "us"), which is responsible for your personal data as the data controller. This policy explains what data ARZ-7 collects, why, how long we keep it, who we share it with, and what your rights are. It covers the website and the mobile apps alike. You can contact us about anything in it at support@arz7.com.
In short: we collect only what is needed to run the game, we do not show ads, we do not use third-party analytics or tracking, and we never sell your data.
Data we receive from Google
You can sign in to ARZ-7 with your Google account. When you do, Google asks you to allow ARZ-7 to see your basic profile information. We request only these standard sign-in scopes, and no others:
- openid - lets Google confirm to us, in a signed token, that it is really you signing in.
- email - your Google account email address, and whether Google has verified it.
- profile - your name as shown on your Google account. We do not use your Google profile picture.
How we use it. We use this information only to sign you in:
- Your email address is used to find your existing ARZ-7 account or create a new one, to link your Google sign-in to an account you made with email and password, and to send you account emails such as a password reset code.
- Your name is used once, when your account is created, to suggest your in-game nickname. You can change the nickname at any time, and other players see only the nickname, never your real name or email address.
What we do not do with it. We do not access your Gmail, contacts, calendar, Drive, or any other Google service. We never receive your Google password. We do not use Google user data for advertising, we do not sell it, we do not use it to build a profile of you, and we do not use it to train artificial intelligence or machine learning models. No person at ARZ-7 reads it except where you ask us to (for example, for a support request), where it is needed for security, or where the law requires it.
Storage and sharing. Your email address and nickname are stored in our database on Microsoft Azure, encrypted in transit. We do not store your Google access token: the sign-in token Google issues is checked once and then discarded. Google user data is not shared with anyone, except with the service providers listed below that host the game, and only so they can do that.
Retention and deletion. We keep this data for as long as your account exists. When you delete your account it is erased immediately. You can also remove ARZ-7's access at any time from your Google Account at myaccount.google.com/connections; this stops future Google sign-ins but does not delete your ARZ-7 account by itself.
ARZ-7's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Other data we collect
- Email accounts. If you sign up with an email address instead of Google, we store your email address and a salted hash of your password, never the password itself. We email you a one-time code to confirm the address is yours and to reset your password. We use your email address only for these account emails, never for marketing.
- Sign in with Apple. On iOS you can sign in with Apple. We receive a unique Apple identifier and the email address you choose to share, which may be an Apple private relay address. We use them only to sign you in.
- Profile. Your nickname and the avatar you pick from our built-in set. Both are visible to other players. We do not let you upload photos.
- Gameplay data. Tables you create or join, your moves, scores, wins, losses, points and play history. This is needed to run the game, and to show your statistics and the leaderboards. Your nickname, avatar and score are visible to other players at your table and on the leaderboards. There is no free-text chat between players; you can send only a fixed set of emoji reactions.
- Purchases. Whether you have bought Premium, the store it was bought from (Stripe on the web, Google Play on Android, the App Store on iOS), the store's purchase or transaction reference, and, for the legacy annual subscription, its renewal date. Payment is handled entirely by that store. We never see or store your card details.
- How you use the game. Which screens you open, when you open and leave the app and how long you spent in it, games you start, finish or leave, and when you open the Premium page. This is linked to your account when you are signed in, and to a random identifier stored on your device or browser when you are not. It is recorded by our own servers - no analytics company is involved - and it is used only to understand, in aggregate, which parts of the game people use and where they give up.
- Technical data. Our servers keep standard request logs, including your IP address, device or browser type and app version, for security and troubleshooting.
We do not collect your contacts, photos, location, microphone, camera, or files, and we do not use advertising identifiers.
Why we use it, and our legal basis
- To provide the game you asked for - your account, sign-in, tables, scores, leaderboards and Premium. The legal basis is performance of our contract with you (our Terms of Service).
- To keep the service secure and working - request logs, abuse prevention, and limits on how often codes can be emailed. The legal basis is our legitimate interest in running a safe service.
- To improve the game - aggregate usage statistics. The legal basis is our legitimate interest in understanding how the game is used. It is never used to target advertising.
- To meet legal obligations - for example, keeping purchase records for tax and accounting.
Who we share data with
We do not sell or rent your personal data. We share it only with the providers that run the game for us, and only what each one needs:
- Microsoft Azure - hosting, database, and sending verification and password reset emails.
- Google - Google sign-in, and Google Play billing on Android.
- Apple - Sign in with Apple, and App Store billing on iOS.
- Stripe - card payments on the website.
Each processes data under its own privacy policy. We may also disclose data if required by law, or to protect the rights and safety of our players or ourselves.
Where your data is stored
Our servers and database run on Microsoft Azure. Data is encrypted in transit. Our providers may process data outside your country; where data leaves the European Economic Area, it is protected by the safeguards the law requires, such as the European Commission's standard contractual clauses. On your phone, the app keeps your sign-in token in the device's secure storage so you stay signed in. On the website it is kept in your browser's local storage. We do not use advertising or tracking cookies.
How long we keep it
- Account, profile, gameplay and purchase data: for as long as your account exists.
- Usage events: when you delete your account they are detached from it and kept only as anonymous counts.
- Server request logs: for a limited period, no longer than 90 days.
- Records we must keep by law, such as purchase records held by the payment stores, are kept for as long as the law requires.
Deleting your account
You can delete your account and its data yourself at arz7.com/account/delete, from the website or inside the app. It takes effect immediately: your account, email address, nickname, gameplay history and purchase records with us are erased. If you cannot sign in, email support@arz7.com from the address on the account and we will delete it within 30 days. Deleting your account does not refund a purchase; if you hold the legacy annual subscription through Google Play or the App Store, cancel it in that store too.
Your rights
Depending on where you live, including under the EU and UK GDPR, you have the right to access the data we hold about you, correct it, delete it, export it, object to or restrict how we use it, and withdraw any consent you have given. To use any of these rights, email support@arz7.com. We will answer within 30 days. You also have the right to complain to your local data protection authority.
Children
ARZ-7 is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, contact us and we will delete it.
Changes and contact
If this policy changes we will update the date at the top of this page, and tell you in the game if the change is significant. Questions about your data can be sent to Studio Aices at support@arz7.com.