Open Hearts — Privacy

The short version

• Playing alone stays on your device Your name, your picture and your games against the bots are kept on the device you play on, and not sent anywhere.
• Live play is public, on purpose To play people, your name, your picture, your account's number and your results go through our relay, where anyone who asks can read them. Rooms and pictures are kept a day; results are kept for the ratings.
• Accounts, but no email or password Nothing is sold, rented or used for advertising. There are no trackers in the app or on this site. Subscribing makes an account: a random number our service gives you, which your devices play under. There is no password, and we hold no email address.
• Paying is Stripe's job On the web a subscription is bought through Stripe, which has your email address and card. We keep a note of which account it pays for and which devices are in that account. We never see your card number.

Who we are

This policy is part of the terms and covers what they cover; "we" are who they say. The code is public, so everything on this page can be checked against what the app actually does.

On your device

The app keeps these on the device you play on — in the browser's storage for play.openhearts.game, or in the app's own storage on a phone:

• A key your device makes for itself. It is a long random number with a public half and a secret half. The public half is this device at a live table; if you subscribe, your licence ties it to your account. The secret half never leaves the device.
• Your name and how you look: an icon and a colour, or a picture of your own. The picture is cut down to 64 by 64 pixels on your device, and only that small copy is kept. The photo you picked it from is not stored or sent.
• Your last thirty games against the bots, which your profile counts up. They leave the device only if you tap Copy record.
• How quickly you play, your game options, the language you chose, your licence and your account's number if you subscribe, and the players whose pictures you chose to hide.
• The live game you are in, while you are in it: the table, every move and vote your device signed there, and the secrets it dealt your cards with, so that a page reloaded mid-game can come back to its seat. Let go of when the game ends or you leave it, or two minutes after you were last there.

To remove all of it, clear the data of play.openhearts.game in your browser (and of openhearts.game, where a browser that played before the game moved to play.openhearts.game keeps its earlier copy), or delete the app. That also removes your key, so the device comes back as a new player, until a backup code or your sign-in brings it into your account again.

Playing alone

A game against the bots is played entirely on your device. Nothing about it is sent anywhere.

The phone apps do what the game on the web does when it starts: they ask our service for the game's current settings, which says nothing about you, and make the licence check below. Live play in them works as described below. They do not use New Relic or Google's font servers.

Opening the game on the web

• Cloudflare hosts this site and the game, so it sees each request your browser makes: your IP address, your browser, and the address you asked for. We add no logging of our own.
• Google's font servers, sometimes. The game carries its own font, but when it has to draw a character that font lacks — an emoji, an arrow, or a name written in a script such as Chinese or Arabic — the toolkit it is built with fetches the extra font from fonts.gstatic.com. When that happens, Google receives your IP address and the fact that you are visiting this site.
• A licence check. Each time the game starts it sends your device's public key to our service to ask whether it holds a subscription. If it does, the service also notes that this device is the one your account is using now, when, and which live table it is at, if any; that note is replaced the next time any of your devices opens the game. If it does not, nothing is kept.
• Your profile page asks our relay for game results so it can show your rating. Nothing about you is published by it.
• New Relic tells us when the game breaks or is slow for you on the web at openhearts.game. The game's page sends it the errors it meets, how long it took to load, the addresses of the calls it makes to our service (without anything after a "?"), and your browser, device type and rough location. Your IP address is used for that location and dropped within a day. It sets no cookies, records no screen or session, and reads nothing you type. Under New Relic's privacy notices.

Live play

What everyone can see

A live game is played between devices, through our relay, relay.openhearts.game, a server that passes messages between apps. It is open: anyone who asks it for a room, a table or the results can read what it carries there, and some of it is kept. In live play:

• Kept, and readable by anyone who asks: your name, icon and colour, your account's number, and your device's public key with the licence that ties the two together, each time you are seated at a table; your picture, if you chose one; and the result of every live game you play, rated or not — the table, each seat's account, key, licence and final score, and who left. Ratings belong to accounts and are worked out from these results by anyone who cares to, which is the point: nobody has to take our word for a rating. Names, icons, keys, account numbers and pictures are kept a day; results are kept for as long as the ratings are.
• Kept, and readable by any subscriber with the game's address: the whole of every live game once it is over — each seat's account and key, the licence tying them, the name it played under, every card dealt, passed and played, and the signatures that prove it. A player's device sends it to our service when the game ends, and it is kept for good, so a game can be looked at and checked afterwards, from the device a subscriber's account is using. Its address is a long random code that nobody can guess; it is shared by whoever shares it.
• Passed on but not kept: while you wait for a game, your name, rating, icon and colour and how many seconds you usually take over a card, every couple of seconds; and while the app is open, that your device is online or at a table, with your account's number and a short-lived note from our service saying this is the device your account is using. The relay forwards these to whoever is listening at that moment and keeps nothing — but anyone listening could record them.
• Passed on, while anyone watches: a live game can be watched as it is played by any subscriber with its address. While someone is watching, one player's device sends, after each move, what everyone at the table can already see — the names, the scores, the cards played so far this hand and whose turn it is — and never a hand still held. The relay forwards it and keeps nothing. If you watch, it is under your own device's key and licence, so the player's device that answers sees your account's number; it answers nobody whose account is playing at that table.

A friends' table is private in one sense only: strangers cannot sit down at it. What it publishes is as public as any other table.

Where it goes

Only to our relay, which runs on Cloudflare. Every message is signed by the device that sent it, so anyone who keeps a copy can show it is genuine; we cannot delete a copy someone else made.

What only your table sees

The cards are dealt between the devices at the table so that each player's hand can be read by that player alone, and no server of ours ever sees a hand. Plays go from device to device.

Those connections all go through Cloudflare's relay service (TURN), so the other devices at your table never learn your IP address — not the other players, and not the jurors: the apps of other players, drawn at random, that help settle a table and play the bots' seats. Cloudflare sees your IP address, as any server you connect to does, and passes the traffic on encrypted, so that it cannot read it.

Subscribing

Live play is a subscription. On the web it is bought through Stripe, on Stripe's own page: Stripe asks for your email address, your card and the billing details it needs, under its own privacy policy.

Subscribing makes an account: a random number, not your name or email. We give Stripe your device's public key so the payment can be matched to it. In return our service keeps a short record: which account the subscription pays for, which device keys are in the account and when each was added, which one is in use now, and the dates the subscription runs to. In Stripe we can see your email address, name, country, card brand, the last four digits of your card and your payments.

That means we could connect a subscriber's email address with their account, and so with the names and results its devices have published. We do not publish that connection, and we use it only to run your subscription.

If you add another device to your account, our service keeps a record of the one-use code you made and which devices made and used it. Any device in the account can see the others' keys, which one is in use, and remove them. Your account plays on one device at a time: opening the game on one makes it the one in use, and the device before it stops playing live until you take it back.

An account also has five backup codes, kept by our service with the account and shown on its devices, with a note of which have been used. If you subscribed on the web, we email them to the address you paid with when you subscribe, and again whenever a device in the account asks us to. To do that we read the address from Stripe at that moment and hand it to Cloudflare, which sends the email for us; we do not keep the address.

If you sign in with Apple or Google, we keep a scrambled form of the number they give for your sign-in — not your name or email — linked to your account, so that signing in the same way on another device brings it into the account. Your device keeps only which of the two you used. Apple or Google does the signing in, under its own privacy policy; on the web, its sign-in code is fetched only while a sign-in button is on the screen.

Telling us what's broken

The menu has a "Tell us what's broken" page. Nothing on it is sent until you press Send, and everything that would be sent is shown on the page first: what you write, which version of the game you have, the kind of device, the app's language and the size of the screen — and, from a game against the bots, that game's record, only if you tick the box for it. Send opens a new issue on our public GitHub page with it filled in. Anyone can read GitHub issues, so leave out anything private.

What we don't do

• No ads, and nothing sold or shared for advertising.
• No advertising identifiers, and nothing that follows you from app to app or site to site.
• No cookies from our pages. Stripe sets its own, on its own site, when you buy.
• No location, no contacts, no microphone. The camera only while you scan a code to add a device; the picture stays on the device.
• No email address held by us, no password, and no account unless you subscribe. Email is sent only with backup codes, as above.
• No chat.

How long things are kept

• On your device: until you remove them.
• On our relay: moves, presence and waiting for a game: not kept. Rooms, seatings and pictures: a day. Game results: for as long as the ratings are worked out from them.
• Finished live games: for good, in Cloudflare's storage, unless you ask us to delete one you played in.
• Our service's account and subscription records: while the subscription runs, and afterwards until you ask us to delete them. The note of which device is in use is replaced each time another of your devices opens the game.
• Stripe: as long as Stripe's policy and the law on payment records require.
• Cloudflare and Google: under their own policies.
• New Relic: the errors and timings, eight days.

Your choices

• Play alone, and nothing about you leaves your device.
• Play live with a name that is not your real one, and with no picture.
• Change your name or picture at any time. What was already published stays where it is.
• Ask us for a copy of what our service keeps about your account and its devices, or ask us to delete it, including the results its devices published on our relay.

Where data protection law gives you rights — to see, correct or delete what is held about you, to object, or to complain to your data protection authority — you have them here too.

Children

Open Hearts is not made for children under 13, and they should not play live, since it shows a name and picture to strangers. If you think a child has published something through it, tell us and we will do what we can to remove it.

Changes

If what the app does with data changes, this page changes with it, and the date at the top moves. Its history, and the code's, is on GitHub.

Contact

For a privacy request — a copy of what our service keeps about your account, or deleting it — or any other question about this page, email help@openhearts.game, or write to us at the address in the terms. So that we can find what is yours, tell us the name you play under and, if you subscribed on the web, the email address you paid with.