DeckHost 1.1.0 · com.addelovein.cardapp
DeckHost has no accounts, no ads and no analytics. It does send some data to our servers and to a few service providers, and this page lists all of it.
The name you choose to show at a table.
Theme, sound, haptics, hints and house rules.
A game in progress, recently played games, and rejoin tokens for tables you sit at.
On iPhone, a random ID kept in the keychain. On Android, the system's per-app Android ID.
Deleting DeckHost removes the app's storage. On iPhone the keychain ID can survive a reinstall, and on Android the Android ID stays the same for a reinstall signed with the same key — so a reinstalled app is still recognised by friends who played with you.
The phones talk directly to each other on your network; nothing passes through our servers. What travels between them is the game itself (moves, and to each phone only the cards that player may see), the display names players chose, and a one-way hash of each player's device identifier, which the phones at the table use to recognise a returning player and to keep each player's record against the others. The raw identifier never goes to another phone.
On iPhone you can also start a table over SharePlay in a FaceTime call. Apple carries that session between the people on the call, under Apple's own privacy terms.
An online table runs on the DeckHost server (lobby.deckhost.info). To run
it, the server stores:
Room code, the game, its moves and cards, and each seat's display name — so a dropped player can rejoin.
Stored only as a one-way hash (SHA-256), never in a form we can read back.
Sent when you join and stored only as a one-way hash. The players you sat with receive that hash, so they can invite you again.
A table that has ended is deleted after about a day, and one left paused after about two days; an unused lobby goes within the hour. These are the server's default windows. Our database backups, which hold copies of everything the server stores, are deleted after 14 days.
So that you can invite people you have played with online, the server keeps a list of which device-identifier hashes shared a table, which game it was and when. That history is deleted after 30 days.
If you allow notifications, the app registers with our server: your device identifier (hashed on arrival), the push token Apple or Google issued for this phone, the platform, and your display name — which is how the name appears in your friends' recent-players list. The server then issues the phone its own credential for later requests. A push token nobody has refreshed for 90 days is deleted.
An invitation records who invited whom, to which table and game, and expires after 15 minutes. Turn reminders and invitations are delivered by Apple Push Notification service (iPhone) and Firebase Cloud Messaging (Android); they see the notification and the push token, not your game. On iPhone, a table can also show as a Live Activity on your Lock Screen; that activity's update token is kept for at most 12 hours.
You can decline or later turn off notifications in your phone's settings. Without them DeckHost still works; you just cannot be invited from outside a table.
Solo play needs no network. When a solo game finishes, the app uploads it to our server — the full list of moves, the scores, your display name and the names of the computer players, and which computer strategy played — so we can study and improve how the computer players play. It carries no device identifier, deliberately, so a solo game is not linked to the players you meet online. If the phone is offline, it waits and tries again later. Uploaded solo games are kept for that analysis; to have games deleted, email us with the display name you used and roughly when you played.
DeckHost is free to download and to join any game. Inside the app you can buy a single game or a pack, or subscribe to the whole catalogue monthly or yearly. Subscriptions renew automatically until you cancel them in your App Store or Google Play account settings; see the Terms of Use.
Payment is handled entirely by Apple or Google; we never see your card number, billing address or name. To know which games you own, the app uses RevenueCat (RevenueCat, Inc.), a purchase processor that receives the store's purchase records together with a pseudonymous purchase identifier the app derives one-way from this install's device identifier. That identifier is used only with RevenueCat and is never sent to other players. RevenueCat also receives basic technical details such as the app version, the operating system and your store country. It processes this on our behalf; see RevenueCat's privacy policy.
DeckHost checks deckhost.info for updates to its game code. The
request carries the platform, the app's version and release channel, and a random
installation ID that the update library (Expo) generates. On Android, a copy
downloaded from this site also checks a small file here to see whether a newer APK
exists. Neither check sends your name or device identifier.
Every connection to deckhost.info and lobby.deckhost.info
passes through Cloudflare, our network provider, and reaches our
servers with your IP address. We use it to deliver the connection, to limit abuse
(rate limits are counted per address) and to keep the service secure — not to
identify or profile you.
Only the providers named above, each for the purpose stated: Apple and Google (app distribution, payment, push delivery, SharePlay), RevenueCat (purchase records) and Cloudflare (network). We do not sell or rent data, and we do not share it for advertising.
DeckHost is suitable for all ages and has no accounts or advertising. It does not ask for anyone's age, so the handling described above applies to every player; a parent who wants a child's data removed can email us.
You can play locally or solo without ever joining an online table, refuse notifications, and delete the app at any time. Depending on where you live you may have the right to access, correct or delete the data we hold about you, or to object to its use. Because there are no accounts, tell us what to look for — the display name you used, roughly when, and a room code if you have one — and we will find and delete what we can. If you think we handle your data wrongly, you can also complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the data protection authority where you live.
If this policy changes, the revised version will appear at this address with a new date above.
DeckHost is provided by Anand Lovein, Örnens väg 38, 136 37 Handen, Sweden, who is responsible (the controller) for the personal data described on this page.
Questions or requests about privacy: [email protected].