Privacy Policy

KonKan (“KonKan”, “we”, “us”) is the operator of the KonKan multiplayer card-game service, available as the KonKan mobile applications for iOS and Android, and as the web application at konkan.krd (together, the “Service”).

For the purposes of the General Data Protection Regulation (GDPR), the UK GDPR, and equivalent laws, the data controller is [KonKan operating entity — replace with legal name and registered address].

Account data. Your username, password (stored only as a salted hash by Supabase Auth), and the email/phone you optionally attach. Sign-in via Google or Apple, if enabled, provides us with a unique identifier and basic profile information from that provider.

Profile data. Avatar image, display preferences, language, and any changes you make to your username.

Gameplay data. Games joined, hands played, scores, rank, win/loss history, achievements, tournament participation, friend list, squad memberships, and items you own or have equipped.

Communications. In-game chat messages, private messages between players, game-room messages, support emails, and any moderation flags raised on your content.

Device & technical data. Operating system and version, device model, application version, IP address (at session time), language and region settings, and push-notification tokens.

Diagnostics. Crash reports, error logs, and limited performance traces, collected via Firebase Crashlytics and our own logging.

Purchase data. Transaction identifiers, product purchased, amount, currency, and processing status. We never receive or store card numbers; payment instrument details are handled by Apple, Google, Stripe, or the relevant local payment processor.

Analytics. Event counts (e.g. game starts, store views) collected via Firebase Analytics and our own counters, used in aggregate to understand product usage.

We use the information above to:

• Operate the Service — accounts, matchmaking, gameplay, leaderboards, rankings, tournaments, and chat.
• Deliver items you have purchased and maintain your virtual-currency (gems) balance.
• Detect, prevent, and act on cheating, fraud, abuse, and other Terms violations, including by sharing chat logs with our moderation systems and team.
• Send transactional notifications (purchase confirmations, security alerts, game invites you have opted into).
• Provide customer support, including investigating reports you submit.
• Improve the Service through analytics, A/B testing, and diagnostic information.
• Comply with our legal obligations and enforce our agreements.

Where GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you have requested.
• Legitimate interests — to keep the Service safe, prevent fraud, run analytics, and improve features. We balance these against your interests and rights.
• Consent — where required (e.g. push notifications, certain optional analytics). You can withdraw consent at any time in the app settings or by writing to us.
• Legal obligation — to comply with applicable laws, including tax and record-keeping requirements relating to purchases.

We do not sell personal data, and we do not share it with advertising networks. We do share information with processors and partners who help us run the Service:

• Supabase — hosts our database, authentication, realtime, and file storage.
• Amazon Web Services (AWS S3) — stores user-uploaded media such as avatars and feedback attachments.
• Google Firebase — Crashlytics (crash reporting), Analytics (event counts), Cloud Messaging (push notifications), and Remote Config (feature flags).
• Stripe — processes web payments and stores card-payment-instrument data subject to Stripe's policies.
• Apple and Google — process in-app purchases on their respective platforms and provide us with non-card transaction metadata.
• Local payment processors (e.g. FIB, Zain Cash) — when enabled in your region, process payments according to their own policies.
• Law-enforcement and regulators — only where legally required, and only to the minimum extent necessary.

Each processor is bound by a data-processing agreement, where applicable, and processes data only on our documented instructions.

We keep account data for as long as your account remains active. If you delete your account, we delete or anonymise your personal information within 30 days, except where retention is required by law (for example, purchase records for tax purposes, which we retain for the statutory period in the relevant jurisdiction, typically up to 7 years).

Game chat and private-message content is retained for up to 12 months from the date of the message for moderation, abuse-reporting, and dispute-resolution purposes, after which it is deleted or anonymised, unless an open report or legal hold requires extended retention.

Aggregated, non-identifying analytics may be retained indefinitely.

We use industry-standard measures to protect your information, including TLS for data in transit, encryption at rest where supported by our processors, role-based access controls, audit logging, and routine security review of third-party dependencies.

No internet service is perfectly secure, however. Please use a strong, unique password and notify us immediately at [email protected] if you suspect your account has been compromised.

Subject to the laws that apply to you, you have the right to:

• Access the personal information we hold about you.
• Have it corrected if it is inaccurate or incomplete.
• Have it erased (subject to lawful exceptions).
• Object to, or restrict, certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, write to [email protected] from the email associated with your account. We respond within 30 days.

The Service is not directed to children under 13. Where the General Data Protection Regulation (GDPR) applies, the minimum age is 16, or the lower age permitted by your member-state law (down to 13). We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us with personal information, write to us and we will delete it promptly.

KonKan is operated and hosted on infrastructure that may be located in the European Union, the United Kingdom, the United States, and other jurisdictions where our processors operate. Where personal information is transferred outside your country, we rely on appropriate safeguards permitted under applicable law, including the European Commission's Standard Contractual Clauses where required.

On the web application we use a small number of strictly necessary cookies and similar storage mechanisms to keep you signed in and to remember language and accessibility preferences. We do not use advertising cookies or third-party analytics cookies on the web. The mobile applications do not use browser cookies but maintain authentication tokens locally in encrypted device storage.

We may update this Policy from time to time. When we make material changes, we will notify you in the app, by email if we have one on file, or by posting a prominent notice on konkan.krd. The “Effective” date above will be updated to reflect the date of the new version. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

For any privacy question, request, or complaint, write to [email protected] with the subject line “Privacy” and your username. If a data-protection officer is appointed for our company, their contact details will be listed here.

This Policy is provided for transparency and is not legal advice. Specific questions about your rights under applicable law should be directed to a qualified attorney in your jurisdiction.