Privacy policy for Durak, a card game with offline and optional online play.
Last updated: 2026-09-18
This privacy policy covers Durak, a free card game for iOS, Android, and web. Durak can be played offline against computer opponents, and also offers an optional online multiplayer mode.
Developer: Sava Stosic
Durak stores some game data locally on your device so the app can work:
Offline play uses only this on-device data and does not transmit it. You can remove it by deleting the app or clearing the app’s local storage using your device or browser controls.
Online multiplayer is optional — Durak never requires it, and offline play works with no network connection. When you create, join, or browse online rooms, the app connects to the Durak game server, operated by the developer on Cloudflare’s Workers and Durable Objects platform.
What the app sends to the server. To seat you at an online table, Durak transmits:
What other players can see. Players in the same room see your username if you have an account with one, and your avatar. If you do not have a username — because you are playing as a guest — they see only a seat number, such as “Guest 2”. The private name you edit in your Durak profile stays on your device and is not shown to other players. If you host a public room, your username (or “Guest”) and the table’s basic details (game mode, deck size, and seat counts) appear in the in-app public room list that other players can browse. Durak never shows other players the cards in your hand — the server sends each player only their own hand.
Network information and Cloudflare. Connecting to the server necessarily reveals your device’s IP address and connection metadata to Cloudflare, which provides the server infrastructure and protects it from abuse. Cloudflare processes this information as our infrastructure provider under its own privacy terms (https://www.cloudflare.com/privacypolicy/).
Retention and deletion. The server stores the current room state to run the game and reconnect players. Room cleanup removes that state when the room closes or expires; public listings are removed through directory cleanup. These operations can be delayed by failures or retries. Guest play also leaves operational connection records, so ending a room does not erase every server or provider record immediately. There is no online replay archive. Account records, operational logs and recovery copies have separate lifecycles described below. For any privacy question or request, contact us at the address below.
Optional accounts. You can play online as a guest (avatar and the device player id only, shown to others as a seat number), or sign in with an account for a named identity, online stats, and friends — see Online Accounts below.
Online accounts are optional. You can play online as a guest, or create an account to play under a unique public username, keep online stats, and add friends across devices. Offline play never requires an account.
Authentication. Accounts use Firebase Authentication, a Google service. You can sign in in three ways: with an email address and password, with Google, or with Sign in with Apple. Whichever you choose, Firebase Authentication processes sign-in credentials, account/provider identifiers, email and verification status, and tokens used to authenticate you. The developer never sees or stores your raw password.
Google sign-in can also provide your name and profile-photo URL to the sign-in software and Firebase Authentication. Apple can provide a name depending on the sign-in flow and consent; previously provided names can remain in Firebase. Apple does not provide a profile-photo URL. We do not receive your Google or Apple password or contacts, and we do not post to those accounts. Sign in with Apple lets you use a private relay email address instead of sharing your real email address. Account identifiers and any supplied profile information are separate from that email choice. We use your email for account access, verification and password resets where applicable.
Durak does not use a provider name or photo as your in-game identity. Your public username and chosen preset avatar serve that purpose. The private name you edit in Durak stays on your device. Ignoring unused provider profile fields in the app does not remove them from Firebase Authentication or the provider’s records. They follow the account-closure and provider-retention processes described below; deleting a Durak account does not delete your Google or Apple account.
What an account stores. Firebase Authentication stores your sign-in account, including your email, sign-in methods, identifiers and any provider name or photo URL it retains. This is separate from Google Firestore, where the Durak server stores the following, keyed to your account:
The developer is the controller of this data and operates it on Google’s Firebase / Firestore and Cloudflare infrastructure. We do not use it for advertising, tracking, or analytics, and we do not sell it.
Cross-device. Signing in on another device gives you the same account, username, stats, and friends. Offline stats, achievements, saved games, and cosmetics stay on each device and are not part of your account.
Safety and moderation. Usernames are user-generated and are screened against a profanity blocklist and a reserved-name list. You can report a player and block another user from the in-app Friends screen; reports are reviewed by the developer, who may remove a username or terminate an account for abuse. If an account is banned for abuse and is then deleted, we keep its username, ban-reservation status and reservation date to prevent reuse and impersonation. The reservation no longer holds the account identifier or email, but a recognizable username can still identify its former owner. It has no automatic expiry. The developer reviews these reservations at least quarterly and on a correction request, and removes those no longer needed or created in error.
Online rating. Rated online games change a public rating (Elo) calculated entirely on the server from the result of the match. Your rating is visible to other players. Only public games between verified accounts with no bots are rated; private games, games with bots, and guest games never change it.
Rating records. So that a rating change can be explained or corrected if something goes wrong, the server keeps one record per rated match containing the match identifier, the accounts that took part, each player’s rating before and after, the result, and the time. These records become eligible for automatic deletion seven days after the server writes them. That can be later than the match itself if saving was delayed. Deletion is asynchronous, so the expiry time is not a guaranteed physical-deletion deadline. They never contain your cards, the deck order, or a replay of the game.
Account closure. Account data is kept while the account is active. You can
request deletion under Profile → Online account → Delete account. When
deletion succeeds, it removes the active Firebase sign-in account, the Durak
account/profile, online stats and rating, friends and blocks, and the username
reservation unless it was banned. This cannot be undone in the app. A failed or
interrupted request may need a retry or support assistance; starting a deletion
is not confirmation that every step finished. If you cannot open the app, see
our Delete Your Account page (/delete-account/) or email the contact below.
Records that can outlive account closure:
For records with an expiry, managed database cleanup runs after that time and can be delayed. We distinguish removal from active use, eligibility for cleanup, and physical deletion rather than promising that all copies disappear at once.
Connection and diagnostic records help operate the service, investigate faults and prevent abuse. Cloudflare and authentication providers process network and security information separately from account and match records. Their retention depends on the service and its configuration; deleting a Durak account does not immediately remove every provider log or recovery copy.
Firebase states that authentication IP logs last a few weeks and that other authentication data is removed from its live and backup systems within 180 days after we initiate deletion of the associated user with Firebase Authentication. An interrupted Durak request may not have reached that step. This is a provider-specific commitment, not a deadline for every record Durak or another provider holds. Provider security, service-operation and legal records may follow different, longer periods. Provider backups and any configured database backups or exports have their own expiry and deletion processes. We restrict recovery copies to recovery and security purposes. Before restored account data returns to service, it must be checked against subsequent deletions and expired data; a backup must not be used to reactivate a deleted account.
Support messages and exports you send are used to handle your request. They are reviewed for deletion when no longer needed; any continued retention for a specific dispute, safety investigation or legal obligation must have a documented reason and review date. These are separate from the automatic match/report expiry periods. Apple, Google and email providers also retain their own account, transaction or service records under their respective policies.
Durak can generate local bug-report export data to help diagnose gameplay issues. This export is created on your device. It leaves the app only if you choose to copy or share it outside the app.
If you voluntarily send a bug report or support message, we may receive the information you choose to send and use it only to investigate the issue and respond.
Durak offers optional one-time purchases for cosmetic theme packs. They are purely cosmetic and never change game rules, bot strength, stats, ratings, or offline play. A confirmed purchase or restore also unlocks the on-device “Supporting the Cause” achievement, which has no gameplay effect. Separate cosmetic themes can be earned for free through achievements; the paid packs are unlocked only by purchase.
Purchases are handled entirely by the Apple App Store or Google Play. Those stores process your payment and any associated data under their own privacy policies; Durak does not receive your payment card or billing details. Durak stores only a local record of the packs you own. On iOS and Android, each time the app starts it also asks the store for pack prices and for purchases you already own, so an interrupted or later-approved purchase can still be delivered. “Restore Purchases” repeats that check. Durak does not send your purchases to its own server.
Durak includes no third-party advertising, analytics, or tracking SDKs of any kind. The app bundles two kinds of third-party software: sign-in software for optional online accounts, which runs only when you sign in or create an account and then keeps you signed in, and an in-app purchase library that contacts the App Store or Google Play each time the app starts on iOS or Android. Durak uses neither for advertising or tracking. The providers behind them, and the services that host online play, are listed below.
These providers process data under their own privacy policies. The app is also distributed through web hosting platforms, which may process data under their own policies when you use them.
Durak does not knowingly collect personal data from children. Online play and online accounts (which involve interacting with and being visible to other players) are for players age 13 and older, and the app asks you to confirm you are before your first online game. Online play lets players choose a username that other players can see; please do not include personal information in it.
Playing offline needs none of this. Games against the bots collect no personal data, involve no other players, and are available without an account, without an age confirmation, and without ever going online.
If you believe a child under 13 has created an account, email us at the address below and we will delete it and its data.
These rights apply to everyone. If you are in the UK, the EU, or the EEA, the GDPR gives them to you by law; we apply them to every player regardless of where you live, because it would be strange not to.
You can ask us to:
/delete-account/) explains the completion/retry process and
the records that can outlive account closure.How to ask. Email support.durak@gmail.com from the address on your account. We will confirm you control that address — otherwise anyone could ask for your data — and then answer.
How long it takes, and what it costs. Within 30 days, and free. If a request is unusually complex we may take longer, and we will tell you why before the 30 days are up.
What we cannot include. A copy of your data will not contain other players’ identifiers, or anything that would identify another person — for example, who reported you. The law is explicit that your right of access does not override someone else’s privacy. We will always tell you what was held back and why.
If we get it wrong. You can complain to your local data-protection
authority. In the UK that is the Information Commissioner’s Office
(ico.org.uk); in the EU it is the supervisory authority for the country you
live in.
If a future version changes what data Durak collects or transmits, this policy and the store privacy declarations will be updated before that version is released.
Privacy contact: support.durak@gmail.com.