Privacy policy

What we collect

• If you play as a guest: a guest account with a generated name (like "Guest4571") and a sign-in token kept on your device.
• If you sign in with Google: your name, email address, profile photo link and Google account ID, plus the sign-in tokens Google gives us. We store the photo link but don’t show it in the app.
• If you sign up with email: your email address, name and a scrambled (hashed) password. We never store your password itself.
• Every time you sign in: your IP address, your device or browser type (user agent) and when the session started and was last used.
• When you play: the rooms and matches you join, your scores, the answers and bluffs you type, the answers you pick, and the stats we build from them.
• Your Fibo (your avatar’s look), your coins and their history, the items you own and wear, your friends and friend requests.
• Whether you’re online right now, so friends can see it. This is only kept while the app is open.
• Error reports: when something breaks on our server, a report goes to our error-tracking provider (Sentry) so we can fix it.

What we don’t collect

• Your location, contacts or photos.
• Camera images. Heelah only uses the camera to scan a room’s QR code, and nothing from the camera is saved or sent.
• Your app settings (theme, language, sound) stay on your device.

Analytics

The app uses Google Analytics (through Firebase) to see how Heelah is used overall: which screens you open, and steps like finishing the welcome tour, starting a room, sharing an invite, starting or finishing a game and buying an item. It uses an ID Google makes for this install, never your Heelah account, name or email.

In the EU, the UK and Switzerland, the app asks you first and sends nothing until you agree. Anywhere, you can turn it off in Settings › Usage data.

Our own figures (how many games are played, how many players come back) are counted on our server from the game itself, and aren’t sent to Google.

Once ads are on (they aren’t in this version), Google AdMob reports the revenue from ads you watch to the same Google Analytics account.

Push notifications

If you allow notifications, we store your device’s push token, its platform (iPhone or Android) and your app language, so we can tell you when a friend invites you, when your game needs you, or when we have news.

Pushes go out through Expo’s push service, then Apple or Google. You can turn each kind off in Settings › Notifications, or all of them in your device’s settings.

Ads

Ads aren’t active in this version of Heelah. The app shows no ads, doesn’t ask for ad consent or to track you, and collects nothing for ads. The rest of this section is how ads will work if we turn them on later, and we’ll update this policy when we do.

Heelah only shows an ad when you choose to watch one, for coins or to unlock a category. No ad ever plays on its own.

Ads come from Google AdMob. Before any ad, we show Google’s consent message where the law needs it, and on iPhone, Apple’s “Allow tracking” prompt. If you say no, you can still watch ads; they’re just not personalised.

AdMob may collect your device’s advertising ID, IP address and how you interact with the ad, under Google’s privacy policy (policies.google.com/privacy). When you finish an ad, Google tells our server your Heelah user ID and what you earned, and we keep that record so a reward is paid once. You can change your choice any time in your device’s privacy settings.

Why we use it

• To run the game: put you in rooms, keep score, show your Fibo to other players, and keep your progress.
• To keep your account signed in and secure.
• To find and fix bugs.
• To understand how the game is used overall (for example, how many games were played this week).

Who sees it

• Other players in your room or match see your name, your Fibo, your score and the bluffs you wrote.
• Your friends see your name and whether you’re online.
• Our service providers: our server host (Hostinger, in France), Google (if you sign in with Google, Google Analytics, and Google AdMob when you watch an ad), Expo (push notifications) and Sentry (error reports). They only process data to provide their service to us; Google also uses ad data under its own privacy policy.
• We don’t sell your data.
• We may share data if the law requires it.

How long we keep it

We keep your data while you have an account. When you delete your account, your personal data is deleted straight away (see "Delete your account" below). Backups are kept for up to 30 days and then overwritten.

Games you played with other people stay in their history, but your seat becomes an anonymous "Deleted player" with no name, email or photo attached.

Delete your account

You can delete your account any time from Settings › Delete account in the app, guest or not. For the steps, and what is deleted, see our account deletion page. You can also email hello@heelah.app.

Your rights

Depending on where you live, you may have the right to see, correct, export or delete your data, or to object to how we use it. To ask, email hello@heelah.app. We’ll answer within 30 days.

Children

Heelah is not meant for children under 13. If you think a child has given us data, email hello@heelah.app and we’ll delete it.

Changes

If we change this policy, we’ll update the date at the top, and tell you in the app if the change is important.

Contact

Jamil Al Shamaa. Email: hello@heelah.app.