Privacy policy · Card Legends: Threefold

Card Legends: Threefold is a card game for iPhone and Android made by Anthony Nadaletti, Rua Assis Brasil 620, apto 1602, Maria Goretti, Chapecó, Santa Catarina, Brazil (“we”). This policy explains what the game keeps about you, where, why, and how to delete it.

The short version

You don’t need to sign up. The game makes an anonymous account for your phone by itself.
We keep your game progress on our server so it isn’t lost and so online tables know who is sitting down. That includes the player name you choose.
We don’t ask for your real name, email address, phone number, contacts, photos or location.
The game sends crash reports and usage statistics, tied to your game account (not to your real name). You can turn the statistics off in the game’s settings.
The game shows no ads. We advertise the game itself on Facebook and Instagram, and to learn which of our ads bring players, the game tells Meta and AppsFlyer, an ad measurement service, that it was installed and opened, a few moments of your journey (your first win, a Master beaten, seeing the Montaro offer), and whether you bought Montaro. On an iPhone, your device’s advertising identifier goes with them only if you allow tracking when iOS asks; on Android, your phone’s advertising ID goes with them unless you turn off Usage stats in the game’s settings. One thing is for sale: Montaro, a one-time purchase that opens the lands after the first two. Apple or Google takes the payment, through the App Store or Google Play; we never see your card. We don’t sell your data.
You can delete your account and your progress from inside the game at any time.

What stays on your phone

Your journey: your character, pets, the cards you’ve won and the rest of your progress, in a file inside the game’s own storage. Deleting the game deletes it.
Your phone’s code: a random code the game makes for this phone and keeps in the iPhone Keychain or, on Android, in the phone’s encrypted storage, for this phone only. Your journey counts the points, coins and scrolls each phone adds under that phone’s code, so two phones playing the same journey don’t overwrite each other. It isn’t your device’s identifier, and it’s used for nothing else.
Your account key: a random secret that proves your phone owns its account, kept in the iPhone Keychain or, on Android, in the phone’s encrypted storage. iOS keeps Keychain items when an app is deleted, so if you reinstall the game on an iPhone it can find your journey again; Android deletes them with the game, so on Android a reinstall needs your journey code (below). Deleting your account (below) removes it.
Your journey code, if you make one: kept in the same secure storage as your account key, so the Your account page can show it again. Deleting your account removes it; on Android, deleting the game does too, so write it down.
Small bookkeeping files: which saved journey your phone is on, and, during an online match, a short-lived code that lets the game sit you back down if it closes mid-match.

What our server keeps

The game server runs at threefold.bart.games. For each account it keeps:

A random account ID, made by the server. It isn’t based on your device or anything about you.
A fingerprint of your account key (a one-way hash), never the key itself.
Your journey code, if you make one: only a fingerprint of it (a one-way hash), never the code itself, and when it was made. Making a new code replaces it, and it’s deleted with your account.
Your saved journey: your player name, the look you picked, your partner, your pets, how far you’ve got in each land, the Fire-Water-Ice cards you’ve won, and your points, coins and scrolls, each counted under the code of the phone that added them. When you start a new journey, the previous one is kept as a single backup copy in case it was a mistake; starting another replaces that copy.
Name reports: when you report another player’s name after a quick match, or someone reports yours, we keep which account reported which, the name reported, and when. Reports are used only to stop the two players being matched again and to hide a name several players report. They’re deleted when either account is deleted.
When the account was created and when it was last used.
Montaro, if you buy it: that your account owns it, once RevenueCat (below) has confirmed it.
If you use Sign in with Apple (iPhone only): the identifier Apple gives our game for your Apple Account, and a token from Apple that lets us cancel the game’s access to your Apple Account when you delete your account. The game doesn’t ask Apple for your name or email address, so we never receive them.

We use this only to run the game: to keep your progress safe, to restore it on a new phone, and to seat you at online tables with the name, look, partner, cards and level your journey has. Quick matches pair whoever has waited longest with the player nearest their level; there’s no rating.

The server also keeps a running log of what happens at online tables: a table opening and closing, players sitting down, leaving and coming back, and who won each match, by player name. We use it only to find and fix problems; it holds no account IDs and no addresses. It is kept for a few days.

Purchases

The game sells one thing, Montaro, a one-time purchase that opens the lands after the first two. The App Store (on iPhone) or Google Play (on Android) takes the payment, so we never see your card or bank details. RevenueCat, a service that checks the stores’ receipts for us, keeps which purchases your game account owns, under your account ID; our server asks it whether your account owns Montaro before it keeps your progress in those lands. Restore purchases asks the App Store or Google Play what your Apple Account or Google Account has bought and moves those purchases to the game account on this phone; taking a journey found on another game account moves this phone’s purchases to it the same way. Deleting your account also asks RevenueCat to delete what it keeps about it; Apple and Google keep their own record of what your store account bought.

What other players see

When you play online (quick matches and friend tables), the other players at your table see your player name, your look, your partner pet, your level and whether you’re connected. They don’t see your account ID or the rest of your journey. There is no text chat.

When you open a table for friends, anyone who has its code can see your player name, look, partner pet and level in the invite, until the table fills or the match starts.

Please don’t use your real name or anything personal as your player name.

Names with offensive words aren’t allowed. If several players report your name, or it has a word the game doesn’t allow, other players see “Nameless” instead until you choose another (Journal → gear → Your account → the button next to your name). Nobody is told who reported them.

Internet addresses

Like any online service, our server sees the internet (IP) address your phone connects from. The game uses it for three things, all to stop abuse: limiting how many new accounts can be made from one address in an hour, how many table invites one address can look up in a minute, and how many journey codes one address can try in an hour (ten, so codes can’t be guessed). Those counts are kept only in the server’s memory and are never written to its database. Crash reports carry it too, but the service that receives them is set to throw it away without storing it (below).

Crash reports and usage statistics

To find what breaks and what’s confusing, the game sends two kinds of report. Both carry your account ID once your phone has an account, so we can follow a problem one player has.

Crash reports, when the game crashes or hits an error: what went wrong in the code, the screens just before it (which can show your player name or a table’s code), your phone’s model, its system version (iOS or Android) and the game’s version, and your account ID. They also reach the service with your IP address, which it throws away without storing it. The game also sends how long some launches and screens take to load, the game’s own log lines, and our server’s failed answers. When our server hits an error, its report carries the request it was answering (which can be your saved journey), the accounts at that table, and the server’s log, which names the players at its tables.
Usage statistics: which screens you open and what happens in the game, such as a duel started or won, a land opened or a wait for a random match, with your phone’s model, system version, language and time zone, and, if an ad brought you to the game, which campaign it was. They’re kept under your account ID; before your phone has an account, under a random ID made for this install of the game. They carry no name and no journey. To stop them, turn off Usage stats in the journal’s settings.

Deleting your account doesn’t delete these reports: they’re kept for as long as each service keeps them: crash reports for up to 90 days, usage statistics for up to a year.

We also count how many times the game is opened, by version.

Measuring our ads

We advertise the game on Facebook and Instagram. To learn which ads bring players who enjoy the game, and to show our ads to people likely to enjoy it too, two services get reports from the game:

Meta (Meta Platforms, Inc.): Meta’s own code in the game tells Meta that the game was installed and opened, and how long you played. With them go your phone’s model, system version, language and time zone, the game’s version, a random ID Meta makes for this install, your phone’s advertising identifier (iOS’s IDFA, if you allow tracking, or Android’s advertising ID), and, like any request over the internet, your IP address. They don’t carry your account ID, your player name or your journey. Meta uses what it receives under its own Privacy Policy as well: https://www.facebook.com/privacy/policy/
AppsFlyer (AppsFlyer Ltd.), an ad measurement service that works out which ad, if any, brought you to the game. The game tells it that it was installed and opened, when you win on the road for the first time, when you beat a Master for the first time, and when you see the Montaro offer; RevenueCat (below) tells it when you buy Montaro, and the price. With them go your account ID, your phone’s model, system version and language, the game’s version, the identifier iOS gives this game’s maker (IDFV), your phone’s advertising identifier (iOS’s IDFA, if you allow tracking, or Android’s advertising ID), and your IP address. AppsFlyer passes these moments and the purchase on to Meta, so Meta learns which ads lead to them, and tells the game which ad campaign brought you, which we keep with your usage statistics (above) and in RevenueCat. AppsFlyer’s privacy policy: https://www.appsflyer.com/legal/services-privacy-policy/

On an iPhone, iOS asks whether you allow the game to track you, right after you choose your name (or, if you found an existing journey, after your next win on the road). The advertising identifier (IDFA) is sent only if you allow it; you can change your answer in Settings → Privacy & Security → Tracking. If you don’t allow it, Meta and AppsFlyer still learn, only as totals and through Apple’s privacy-preserving ad measurement, which ads led to installs, without identifying you; Apple sends AppsFlyer a copy of those reports. On Android there is no question: the advertising ID is sent unless you turn off Usage stats, and you can reset or delete it in your phone’s settings. Turning off Usage stats in the journal’s settings stops the game’s reports to Meta and AppsFlyer, and on an iPhone keeps the question from being asked.

So that a purchase can be matched to the ad that brought you, RevenueCat (below) keeps, beside your purchases, AppsFlyer’s ID for your phone, your IP address and, on an iPhone, the IDFV and, if you allow tracking, the IDFA; on Android, the advertising ID and the ID Android gives the game on your phone.

Who else handles your data

We don’t sell or rent your data. Apart from Meta and AppsFlyer (above), these services help us run the game and process data only on our behalf:

Cloudflare, which carries all traffic between the game and our server and protects it. Cloudflare sees your IP address and the requests your phone makes. It keeps no log of them beyond a few days.
Our hosting provider, where the server, its database and the database’s backups run.
Apple and Google, which take the payment if you buy Montaro (the App Store on iPhone, Google Play on Android); Apple also signs you in if you choose Sign in with Apple on an iPhone. Their own privacy policies cover what they do: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy
RevenueCat (RevenueCat, Inc.), which checks the App Store’s and Google Play’s receipts and keeps which purchases each game account owns, in the United States. Deleting your account deletes what it keeps about you.
Sentry (Functional Software, Inc.), which receives the crash reports and log lines, and keeps them in the United States. It is set not to keep your IP address.
PostHog (PostHog, Inc.), which receives the usage statistics. It keeps them in the United States, and doesn’t work out your location from your IP address.
Expo (650 Industries, Inc.), which delivers the game’s updates and counts launches.

Our server and the services above store and process your data outside Brazil, in Europe and the United States. Those transfers rely on the safeguards LGPD allows for them.

How long we keep it

We keep your account and journey until you delete them. We don’t delete accounts for going unused.

Database backups are made every hour. A deleted account can stay in older backups for a few days, until they are replaced.

Deleting your account

In the game: open your journal, tap the gear, then Your account, then Delete account. This deletes your account and journey on our server at once, along with the backup copy of any earlier journey, asks RevenueCat to delete what it keeps about your purchases, and starts the game again from the beginning. If you bought Montaro, Restore purchases brings it back to a new account, on a phone signed in to the same Apple Account or Google Account that bought it. Your phone needs to be online for this.
If you used Sign in with Apple, deleting your account also cancels the game’s access to your Apple Account.
When you take a journey found with Apple or a journey code, the account this phone was on is deleted, with its journey, unless it has an Apple Account or a journey code that could still find it. The game asks before replacing a journey you have on this phone.
From your Apple Account: if you stop using Sign in with Apple with Card Legends: Threefold (in your iPhone’s Settings, or at account.apple.com under Sign-In and Security), we remove your Apple Account from your game account. If you delete your Apple Account, we delete your game account.
If you no longer have the phone: if you used Sign in with Apple or have your journey code, find your journey on another phone, iPhone or Android (Played before? Find your journey on the title screen) and delete the account there. If you have neither, write to us at [email protected]. [CHECK: the game shows no account ID, so for someone with neither an Apple ID nor a journey code there is currently no way to tell which account is theirs. See the support page, “Your journey, your account and your phone”.]

Your rights

Depending on where you live, including under Brazil’s LGPD and the EU’s GDPR, you can ask to see the data we keep about you, to correct it, to get a copy of it, or to have it deleted. Most of this you can do in the game: your journey is all there, you can change your name, and you can delete your account. For anything else, write to [email protected] and we’ll answer within 15 days. You can also complain to your data protection authority (in Brazil, the ANPD).

We use your data because we need it to provide the game you asked for, and, for the limits on internet addresses (above), because we have a legitimate interest in keeping the service safe.

Children

Card Legends: Threefold doesn’t ask for anyone’s age and doesn’t collect contact details. It isn’t designed for children under 13, and we don’t knowingly collect personal information from them. If you believe a child has given us personal information, write to [email protected] and we’ll delete it.

Security

Traffic between the game and our server is encrypted (HTTPS and secure WebSockets). Your account key is kept in the iPhone Keychain or Android’s encrypted storage, and our server keeps only a one-way fingerprint of it. No system is perfectly secure, but we keep what we hold to the minimum the game needs.

Changes

If we change this policy, we’ll update it here and change the date at the top. If a change affects what we collect, we’ll say so in the game’s release notes.

Contact

Anthony Nadaletti, [email protected]