GabbleGames Privacy Policy
Last updated: 2026-10-18
This policy explains what GabbleGames collects, why, and what you can do about it. It's written in plain English, not legal boilerplate.
Operator: [PLACEHOLDER: legal entity name] Registered address: [PLACEHOLDER: address] Contact: [PLACEHOLDER: contact email] Governing law: [PLACEHOLDER: governing law / jurisdiction]
A lawyer has not reviewed this document. See "Before this goes live" at the bottom for what still needs checking.
1. Who this is for
GabbleGames is meant for people aged 13 and over. If you're under 18, please read this with a parent or guardian. We treat under-18 accounts ("minors") differently from adult accounts — see section 7.
2. What we collect
| Category | What | Why |
|---|---|---|
| Account | Your name and photo from Google Sign-In, your Google account identifier and email address (held by Firebase Authentication). Your public card holds a one-way fingerprint (hash) of your email, not the address | To create and secure your account, show you to other players, and let people who know your email find you |
| Age | Your answers to "Are you 18 or older?" and, if not, "Are you 13 or older?" — not your date of birth. We store whether you're an adult, and your card and your sign-in token say whether you're a minor. If you answer that you're under 13, we keep only that, on your Google sign-in, so the app refuses that account on every device | To keep minors to free play and apart from adults (section 7), and to keep under-13s out |
| Country | Worked out from your IP address each time the app starts (a lookup at Cloudflare), or from your phone's region setting if that fails. Saved once, at sign-up | Shown as a flag by your name, and used to match you with players near you |
| Invitation | Who invited you. When you join, the app sends them a message saying so | GabbleGames is invite-only |
| Profile and settings | Favourite game, privacy settings (whether your room shows, whether strangers' messages go to Requests, invisible mode), sound and appearance choices | To apply your choices |
| Games | The rooms you join and your seat, the moves you play, room chat, the people you've played with, your requests to be matched (table, number of seats, country). Your game history is kept on your phone | To run matches and rooms |
| Coins and items | Your coin balance, the looks you own, and a record of your last 1,000 coin movements (entries, wins, refunds, purchases, gifts, welcome and test coins), kept on our live server; the looks you wear, in Firestore. A one-way fingerprint of the Google or Apple account you signed in with (or of your email address, if you signed in with a verified address), made with a secret key only our live server holds, marking that its one-time welcome coins were given, so a new account made with it doesn't get them again | To run the coin economy (section 4) |
| Messages | What you send in direct messages and groups: text, photos, videos, voice messages, documents, polls, contact cards, and your location if you choose to send it | To deliver them |
| Voice | Who is in a call, and when. The audio goes between the phones in the call; we don't record it | To run room voice and calls |
| Presence | Whether you're online and when you were last seen (unless you turn on invisible mode), the room you're in (unless you hide it), and who you've blocked | So friends can join you, and so blocks work |
| Play nearby (Android) | When you use it, your phone uses Bluetooth and Wi-Fi to find phones close by and shows them your name and the game. Once connected, the phones exchange your card (name, photo, country, favourite game, minor or not), the game and its chat directly | To play with people in the same place without the internet |
| Reports | What you report, your reason and notes, and copies of up to 20 of the reported messages from your phone | To review reports |
| Push | A device token from Firebase Cloud Messaging | To send notifications |
| Usage and crashes (Android app only) | App events, crash reports and performance data from Google Analytics for Firebase, Crashlytics and Performance Monitoring, tied to your account identifier. The web app sends none of these | To fix bugs and see which features are used |
| Visit | Your IP address and browser, as with any website | To serve the site |
On your phone or in your browser the app also keeps your game history, your messages and your settings.
We don't ask for your date of birth, a phone number or your address book. Sign-in in the app is Google only.
3. How we use it
- Run the app: matching you with other players, hosting rooms and games, chat and voice, keeping your coins and items.
- Keep it safe: separating minors from adults, the invite-only gate, the chat filter, room owners' kick/ban/mute tools, and reviewing reports.
- Improve it: crash and performance reports and aggregate use from the Android app. We do not sell this data.
- Future: show ads. We may show in-app ads to fund free play. If we do, the ad provider may process some device/usage data under its own privacy policy; we'll update this page and tell you before that starts.
4. Coins are virtual, not money
Coins are a virtual item inside the game. Right now you cannot buy coins with money: while GabbleGames is being tested, coin packs are free ("Free while testing"), and adult accounts get a one-time welcome grant of 1,000 coins. You can also win coins.
Coins are spent on looks (boards, pieces, tables, cues, card backs and the like), on gifts of looks for other players in your room, and on entries to coin tables, where the winner takes the pot less a 10% fee. When nobody else is available, a robot may fill a seat at a coin table; its entry is put up by us, and if a robot wins, the coins stay with us.
Coins have no cash value. They cannot be redeemed, exchanged, cashed out, transferred for money, or sold to anyone — in or out of the app.
5. Who else handles your data
- Google Firebase / Google Cloud (United States): sign-in (Firebase Authentication), your account and settings (Cloud Firestore), photos and files you send (Cloud Storage), notifications (Firebase Cloud Messaging), the server function that sends them, and, in the Android app, Analytics, Crashlytics and Performance Monitoring.
- Our live server: rooms, moves, matchmaking, room chat, message delivery, call set-up, online status and players' cards travel through a message server (MQTT, with a Redis store for matchmaking and coins) that we run on Google Cloud and share with our other apps. Your coin balance, items and coin record are kept in that Redis store, and only the server changes them. Direct messages wait there only until the recipient's phone collects them, for up to 30 days.
- Notifications include the sender's name and up to the first 140 characters of a message, through Google's push service.
- Cloudflare answers the country lookup, so it sees your IP address.
- Voice and games go phone to phone where possible, using Google's public STUN server to find a route; Metered (metered.ca) relays the encrypted traffic when a direct route is blocked. A direct connection means the other players' devices can see your IP address.
- Google Play services (Nearby Connections) runs Play nearby.
- Broadcasts: a room's owner can stream the board and the players' names to a streaming service. Your room chat is shown in a broadcast only if you agree.
- Links you share: a game invitation link shows your name and photo to anyone who opens it. A clip you share shows its moves and caption, without names.
- The web app loads its engine and fonts from Google's content network (www.gstatic.com, fonts.gstatic.com).
Other than these, we share your data only when the law requires it.
6. Who can see what
- Other players see your card: name, photo, country flag, favourite game, who invited you, when you joined, and whether you're a minor — plus whether you're online and which room you're in, unless your privacy settings hide them.
- People in a room see the game, the room chat and who is speaking.
- People in a chat or group see what you send there. A photo or file is stored at an unguessable address that any signed-in user holding the address can open.
7. Minors (13–17)
If you say you're under 18 but at least 13, your account is a minor account. Minor accounts:
- Play free tables only, can't give or receive gifts, and have a monthly limit of 2,000 coins on spending — our live server enforces all three. They can't send their location or view-once messages, and the chat filter also hides links, handles and swearing for them.
- Are kept apart from adult accounts by our servers: on the live server minors and adults are in separate spaces (rooms, matching, room chat, calls, online status, cards and direct messages), decided by the age on their sign-in token, which only our server sets; follows are kept within the same age group too.
- Don't see Play nearby, which connects to any phone close by.
If you say you're under 13, the app doesn't create an account, and remembers that on your Google sign-in, so the same account is refused on any device.
If you are a parent or guardian and believe your child has provided information to us in a way that doesn't match this policy, contact us at [PLACEHOLDER: contact email] and we will investigate and, where appropriate, delete the account.
8. Your choices
- Invisible mode (Me) hides when you're online; Privacy (Me → Privacy) hides which room you're in and sends strangers' messages to Requests.
- Download my data (Me → Account): a copy of your profile, your coin record and your messages.
- Delete account (Me → Account): deletes your account at once, for good: your coins, items and coin record and everything the live server holds in your name, your profile, settings, follows and notifications, and your Google sign-in with us. There is no undo. Only the welcome fingerprint stays (section 9).
- Block anyone; report a player, room or message.
- Correction: your name and photo come from Google; update them there.
- A message you sent stays on its recipients' phones, and a report you filed stays with us, after you delete your account.
9. Retention
- Undelivered direct messages: up to 30 days on our live server.
- Room data on the live server: about 10 minutes after the room ends.
- Invitation links: 48 hours.
- Your account, coins, items and the files you sent: while your account exists; deleting it removes them at once (files you sent stay with their recipients). Your coin record keeps your last 1,000 movements. [PLACEHOLDER: retention period for matchmaking records and reports.]
- The welcome fingerprint (section 2): kept after you delete your account, so deleting and signing up again doesn't give the welcome coins twice. It holds nothing else, isn't linked to your account or anything you did, and can't be turned back into your Google or Apple account or your email address.
10. Security
Firebase security rules and the live server's sign-in check and topic permissions control access to your data; no player's app can change another player's coins. No system is perfectly secure; if we learn of a breach affecting your data, we'll tell you as required by law.
11. Changes to this policy
We'll update the "last updated" date above when this changes, and tell you in-app for anything material (like starting to sell coins, showing ads, or changing how coins work).
12. Contact
Questions, requests, or complaints: [PLACEHOLDER: contact email].
Before this goes live — a lawyer must check
- What the code enforces today (fix or reword before launch):
- Coins, entries, purchases, gifts and the minors' rules are the live server's since 2026-10-04, but phones still run the games, so who won a game is a player's app's word: a changed app can claim wins, including against robots, whose stakes the house puts up.
- The age answer is self-declared; the under-13 refusal is kept per Google account, so a new Google account can answer again. An uninvited sign-in still leaves a Firebase account.
- Robots carry human names and flags and are not labelled as robots.
- Direct messages already delivered to a recipient's devices stay there after the sender deletes their account.
- Virtual currency rules by country. Several jurisdictions (e.g. parts of the EU, China, South Korea) regulate "virtual currency" or loot-box-like mechanics even when nothing cashes out.
- India's online gaming rules. Confirm the coin design (no cash-out, 10% fee, house-staked robots) keeps GabbleGames outside "real money game" definitions once coins are sold.
- Minors / COPPA / UK AADC / EU-DSA minor protections. A yes/no age question is light-touch age assurance; GDPR Art. 8 lets member states set the age of consent between 13 and 16.
- GDPR/UK GDPR. Lawful basis per purpose, international transfer mechanism, a real retention schedule, and an EU representative if needed.
- CCPA/CPRA (California). The CCPA categories table, and a "Do Not Sell or Share" mechanism if targeted advertising launches.
- Advertising ID. Firebase Analytics adds the advertising-ID permission on Android; the Play Data safety form must match.
- Governing law, operator identity and address are placeholders.