KNACK

Knack has no user accounts and no analytics tools. Your settings and game statistics stay on your device, and solo and local play work offline. The app is financed by advertising, delivered by Google AdMob — what that means, and how you agree to it or refuse it, is set out in Section 8; a one-off purchase removes it for good (Section 9). Only optional online multiplayer sends your player name and the game state to our server so the game can be relayed between the players (see Section 4); at startup the app merely asks that server whether online play is currently available — with nothing about you in the request (Section 5). Optional diagnostic and usage data are described in Section 6.

1 Data Controller

The party responsible for data processing under the General Data Protection Regulation (GDPR) is:

2 What Data Is Processed

Knack is a card game that works without registration. In solo and local play, the app processes the following data exclusively on your device:

• Player name: a display name you choose freely (default: "Player").
• Settings: e.g. game rules, appearance (light/dark), volume and sound options, timer settings, and the selected card deck.
• Game statistics: the history of games played on this device (games played, wins, losses, rounds).

This data is stored in your operating system's standard storage (Android: SharedPreferences, iOS: NSUserDefaults) and is not transmitted to us or any third party. You can delete it at any time by clearing the app's data or uninstalling the app. If you choose to play online multiplayer, some of this data is additionally processed on our server — see Section 4.

3 Local Multiplayer (Wi-Fi & Bluetooth)

When you play against other players nearby, your device communicates directly with the other devices — either over the same local network (Wi-Fi) or over Bluetooth. To make the game work, your chosen player name and the game state (cards played, moves made) are sent to the participating devices.

This connection runs directly between the devices (peer-to-peer). For local multiplayer there is no central server that receives or stores this data. Online multiplayer is covered separately in Section 4. If you would rather not be identifiable, please avoid choosing a player name that reveals your identity.

4 Online Multiplayer (optional)

Knack also offers optional online multiplayer, so you can play with people who are not on your local network. You only use it if you actively create or join an online room (for example by sharing or entering a room code). It requires no account.

When you use online multiplayer, the following data is processed on a server we operate (knack.ismuch.fun) so that moves can be relayed between the players while the game is running:

• Player name: the display name you chose.
• Game state: the moves and seat information of the running game, relayed live between the players. The server keeps this only in memory for the duration of the game — it is not written to disk.
• Game rules: the rule settings selected for that room.
• For technical reasons the server also sees your IP address, as with any ordinary internet request.

This data is kept only as long as needed to run the game: it lives in the server's memory while the game is on and is gone once the room closes. Only the server's technical operating log is kept: it records room codes, a random identifier of the hosting app that changes with every app start, and connection events — no player names, no game content and no IP addresses — and is kept for 90 days on a machine we operate. You can leave a room at any time. It is not used for advertising, tracking or profiling and is not sold or shared with third parties.

If a request to our server is refused (for example because it does not come from the app), we record that in the operating log as well: the time, the requested path, the reason for the refusal, the app identifier, the program identifier (user agent) and the country the request comes from. No IP address is stored. These entries are deleted after 90 days and serve only to protect and troubleshoot the server (legitimate interest, Art. 6(1)(f) GDPR).

5 Update Check and Startup Server Query

The app may check at startup whether a newer version is available. That request does not go to us but to the store the app came from: Google Play on Android, Apple's App Store on iOS. No personal data about you is transmitted in the process; for technical reasons, the server in question only sees your IP address, as with any ordinary internet request.

Separately from that, the app asks our own server (knack.ismuch.fun) at every start — and again whenever the network connection changes — whether online play is currently offered and whether this build speaks the same protocol version as the server. This happens even if you never play online: it is the only way for the app to decide whether to show the online options at all. No player name and no game state are sent — the request carries nothing about you. Here too the server sees your IP address for technical reasons, as with any ordinary internet request; it is not stored permanently and is not used for advertising, tracking or profiling.

6 Diagnostic and usage data (only with the switch)

So that we can find faults and see how the app is used, you can switch on “Send diagnostic data” in the app's settings. It is off by default. While it is on, the app records technical data and sends it to our server (knack.ismuch.fun), which passes it on, without storing it itself, to a machine we operate. These are the categories:

• Connection history of multiplayer sessions: timestamps, the connection type used (Wi-Fi, Bluetooth or online), the connection and error events of the session — whether you host it or join it, including connection attempts that fail — and the network addresses involved: IP addresses and ports in your local network, Bluetooth device addresses and the codes of online rooms,
• Start and end of every game, solo and with other players: the timestamps, the duration, the number of human players and bots, your role (host or guest) and how it ended (for example finished, left, host no longer reachable or app closed).
• Your reaction to the rating prompt (rate or later) and how often it was shown to you,
• with all of these: the app version, your device model and operating system version, your chosen player name, the player names of the others in that session and a randomly generated installation id.

It contains no cards or moves and no contact details. If it cannot be sent (for example without an internet connection), the data stays on your device, up to 1 MB and for at most 90 days; once it has been sent it is deleted there. Switching off “Send diagnostic data” deletes it from the device immediately.

The legal basis is your consent, which you give by switching it on (Art. 6(1)(a) GDPR). You can withdraw it at any time by switching it off — from then on nothing is transmitted. The data is used solely to find and fix faults and to understand how the app is used. They are never used for advertising, tracking or profiling and are not shared with third parties. Each entry is deleted automatically at the latest 90 days after we received it; on request to [email protected] we delete it sooner.

7 Hosting and Cloudflare

Every connection to our server (knack.ismuch.fun) — the startup query, online play, diagnostic data and these web pages — runs through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which connects our server to the internet and protects it against attacks. For that, Cloudflare processes your IP address and the technical data of each request. The encrypted connection is decrypted at Cloudflare on its way to our server, so its content passes through Cloudflare's systems as well; Cloudflare uses it only to deliver it. The transfer of the diagnostic data from our server to our machine also runs through Cloudflare.

Cloudflare acts on our behalf as a processor (Art. 28 GDPR) and may process the data in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework; should that lapse, the EU Standard Contractual Clauses apply. The legal basis is our legitimate interest in running the server reliably and securely (Art. 6(1)(f) GDPR). Details are in Cloudflare's privacy policy.

8 Advertising (Google AdMob)

Knack is free to play and financed by advertising. The app can show a small banner on the waiting screens (browse, lobby, statistics) and an occasional full-screen ad between two games. This version has no ad-free trial period — ads can therefore appear from the first start, as long as you have not bought the removal (Section 9). No ad is ever shown on the table during a running game.

The ads are delivered by Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To select, deliver, frequency- cap, measure and protect an ad against fraud, Google processes:

• the advertising ID of your device (on Android the Advertising ID or App Set ID, on iOS the equivalent identifier) — a resettable id assigned by the operating system,
• your IP address and the approximate region and language derived from it,
• device and app information: device model, operating system version and app version,
• your interaction with the ad: that it was shown, for how long, and whether it was tapped.

We do not receive any of this data ourselves — in the AdMob console we only see aggregated figures such as impressions and revenue, never anything about an individual person. For this processing Google acts as its own controller; the details are in the Google Privacy Policy and under How Google uses information from sites or apps that use our services. Google may process the data outside the EU, in particular in the USA, on the basis of the EU standard contractual clauses and the EU-US Data Privacy Framework.

Your consent decides. In the EEA, the UK and Switzerland the app asks you before the very first ad request, using Google's User Messaging Platform consent dialog. Your answer leads to one of three states:

• You agree to everything → you see personalised ads, selected with the help of a profile held by Google.
• You allow information to be stored on your device but refuse personalisation → you see non-personalised ads, selected without any profile of you.
• You refuse outright → the app requests no ad at all: no banner, no full-screen ad, nothing. It stays that way until you change your mind.

Additionally on iOS. There, before the first ad request, the operating system shows its own App Tracking Transparency (ATT) dialog — the question whether the app may track you across other companies' apps and websites. That is a second dialog, required by Apple, alongside the consent dialog above. If you decline, the device-wide advertising identifier (IDFA) is unavailable and is not used. To measure which ad led to an install, the app also uses Apple's SKAdNetwork: it runs through the operating system, reports only aggregated figures to the ad network, and allows no attribution to you. Beyond that the ad SDK brings Google's own measurement components with it — on both platforms — which belong to ad measurement and fraud detection; we receive no data out of them.

Storing information on your device and reading it back needs your agreement in every case (Art. 6(1)(a) GDPR, § 25(1) TDDDG) — that is why the third state exists at all. Withdraw your consent later under “Privacy options” and it takes effect with the very next request. Knack is available from the age of 16, so anyone who reaches this dialog is old enough to answer it for themselves. We additionally cap what may be advertised at a content rating suitable for teenagers, which keeps gambling, alcohol and dating ads out.

Changing your mind. The app's settings contain a “Privacy options” entry that reopens the same dialog whenever you like, so you can withdraw or change your consent. A withdrawal does not affect the lawfulness of the processing carried out until then. On Android you can additionally reset or delete your advertising ID in the system settings (Settings → Privacy → Ads).

Reporting an ad. If an ad strikes you as inappropriate or misleading, use the “Report an ad” entry in the settings, or write to [email protected].

9 Ad-Free (In-App Purchase)

A one-off in-app purchase removes the advertising permanently. The purchase itself runs entirely through the platform's store — Google Play (Google Ireland Limited) or the App Store (Apple Distribution International Ltd.) — and those stores are the controllers for it. Your payment data goes to them, never to us: we receive no name, no address and no payment details.

The app itself only keeps, on your device, whether the purchase exists. “Restore purchases” asks the store again for that same yes-or-no answer. No account is created for this either.

While ad-free is active, no ad request is made at all, so none of the data described in Section 8 arises in the first place.

10 What We Do Not Do

• No analytics or tracking services of our own are used — we without the switch from Section 6 we measure neither your sessions nor how you use the app. The ad SDK brings measurement components of Google's own; those are described in Section 8. We do not switch them off, but we do not receive their data either.
• No data is sold or shared with third parties; the only third parties involved at all are the ad provider in Section 8, the app store in Section 9 and Cloudflare as our hosting service provider in Section 7.
• No user accounts and no sign-in.
• No advertising during a running game, and none inside the multiplayer connection — your player name, your game state and the diagnostic data are never used for advertising, tracking or profiling.

11 Permissions

The app uses the Internet / network access and Wi-Fi state permissions (for local network multiplayer, Section 3, online multiplayer, Section 4, and the update check, Section 5), the Bluetooth / nearby-devices permissions (to find and connect to devices over Bluetooth). On older Android versions (12 and below) the system requires the location permission in order to scan for Bluetooth devices; the app does not use, request or collect your location and declares this scan as never being used to derive location.

So that a running multiplayer connection does not drop the moment you switch apps or the screen goes off, the app on Android also uses a foreground service for connected devices (FOREGROUND_SERVICE, FOREGROUND_SERVICE_CONNECTED_DEVICE) and keeps the device awake meanwhile (WAKE_LOCK). Both apply only while a game is running, and serve the connection alone.

On Android the app additionally declares the permissions the ad provider described in Section 8 needs in order to deliver ads: the advertising ID (com.google.android.gms.permission.AD_ID) and the Android Privacy Sandbox advertising permissions (ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_TOPICS). The Privacy Sandbox is Google's replacement for the device-wide advertising ID: through it the operating system can — after the consent described in Section 8 — supply interest categories (“Topics”) and ad-to-install attributions without the app itself recognising you.

12 Your Rights

For solo and local play, no personal data is transmitted to us or stored by us unless you switch on sending diagnostic and usage data (Section 6). If you use online multiplayer, we process the data described in Section 4. Under the GDPR you generally have the rights to access, rectification, erasure, restriction of processing, data portability and objection. You can delete data stored on your device yourself at any time by clearing the app's data in your device settings or by uninstalling the app; online-game data only exists while the game is running and disappears with it.

For advertising you can withdraw your consent at any time under “Privacy options” in the settings (Section 8). Because Google is its own controller for the ad data, please address requests for access or erasure concerning that data to Google directly; we will gladly help you find the right place. The surest way to end the processing altogether is the ad-free purchase in Section 9 — after it, no ad request is made at all.

You also have the right to lodge a complaint with a data protection supervisory authority.

13 Children

Knack is intended for a general audience and does not knowingly collect personal data from children. The app is not directed at children, and its ad requests are not marked as child-directed.

14 Changes to This Policy

We may update this privacy policy when the app changes. The current version is always available at this address. The date above indicates the last update.

15 Contact

If you have any questions about privacy, you can reach us at: [email protected]