Durak Classic

Your data

Durak Privacy Policy

How Durak handles offline games, online accounts, feedback and your privacy rights.

Last updated

This privacy policy covers Durak, a free card game for iOS, Android, and web. Durak can be played offline against computer opponents, and also offers an optional online multiplayer mode.

Developer: Sava Stosic

Summary

  • Offline play collects no personal data. Your games, settings, stats, and saves stay on your device.
  • Online multiplayer is optional. When you choose to play online, Durak sends a small amount of data — an avatar, a device-generated player id, and your in-game moves — to the Durak game server so you can share a table with other players. The private name you edit in your Durak profile is not part of that: it stays on your device. Information received during Google or Apple sign-in is separate and is described under *Online Accounts*.
  • Online accounts are optional. You can create an account with an email and password, Google, or Sign in with Apple to play online under a unique public username, track online stats, and add friends across devices. Offline play never needs an account, and online play can still be used as a guest.
  • Online tables can include computer-controlled opponents. Some eligible public account games against these opponents can change your online rating.
  • Durak has no ads, no analytics SDKs, and no tracking.
  • The only purchases are optional cosmetic theme packs, processed by the Apple App Store or Google Play; Durak does not receive your payment details.

Data Stored On Your Device

Durak stores some game data locally on your device so the app can work:

  • gameplay settings;
  • saved or resumable games;
  • local stats;
  • the private name you edit in your Durak profile, and your avatar (the edited name stays on your device);
  • a device-generated player id (used to identify your profile to the game server and other players during online play);
  • which cosmetic theme packs you own (earned or purchased);
  • local replay or bug-report export data generated by the app.

Offline play uses only this on-device data and does not transmit it. You can remove it by deleting the app or clearing the app's local storage using your device or browser controls.

Online Multiplayer

Online multiplayer is optional — Durak never requires it, and offline play works with no network connection. When you create, join, or browse online rooms, the app connects to the Durak game server, operated by the developer on Cloudflare's Workers and Durable Objects platform.

What the app sends to the server. To seat you at an online table, Durak transmits:

  • your selected avatar;
  • a device-generated player id (a random identifier created on your device that identifies your profile to the server; it is not your name, email, or an advertising/tracking id);
  • the room code, match settings, and the moves you make during a game.

What other players can see. Players in the same room see your username if you have an account with one, and your avatar. If you do not have a username — because you are playing as a guest — they see only a seat number, such as "Guest 2". The private name you edit in your Durak profile stays on your device and is not shown to other players. If you host a public room, your username (or "Guest") and the table's basic details (game mode, deck size, and seat counts) appear in the in-app public room list that other players can browse. Durak never shows other players the cards in your hand — the server sends each player only their own hand.

Network information and Cloudflare. Connecting to the server necessarily reveals your device's IP address and connection metadata to Cloudflare, which provides the server infrastructure and protects it from abuse. Cloudflare processes this information as our infrastructure provider under its own privacy terms (https://www.cloudflare.com/privacypolicy/).

Retention and deletion. The server stores the current room state to run the game and reconnect players. Room cleanup removes that state when the room closes or expires; public listings are removed through directory cleanup. These operations can be delayed by failures or retries. Guest play also leaves operational connection records, so ending a room does not erase every server or provider record immediately. There is no online replay archive. Account records, operational logs and recovery copies have separate lifecycles described below. For any privacy question or request, contact us at the address below.

Optional accounts. You can play online as a guest (avatar and the device player id only, shown to others as a seat number), or sign in with an account for a named identity, online stats, and friends — see *Online Accounts* below.

Computer-controlled opponents. Online tables can include opponents run by Durak's server, using fictional names and preset avatars. They are simulated game participants, not people with Firebase accounts or human account history. They can have persistent public player profiles showing fictional usernames, preset avatars, ratings and stats from actual completed games. Named account players can find these profiles, send requests that remain pending, block them, or report them. These actions and profiles are stored separately from human sign-in accounts; their individual automation identity is kept on the server. The table uses the ordinary player presentation. Deleting your account removes your friend-request and block data, including request copies in these profiles.

Online Accounts

Online accounts are optional. You can play online as a guest, or create an account to play under a unique public username, keep online stats, and add friends across devices. Offline play never requires an account.

Authentication. Accounts use Firebase Authentication, a Google service. You can sign in in three ways: with an email address and password, with Google, or with Sign in with Apple. Whichever you choose, Firebase Authentication processes sign-in credentials, account/provider identifiers, email and verification status, and tokens used to authenticate you. The developer never sees or stores your raw password.

Google sign-in can also provide your name and profile-photo URL to the sign-in software and Firebase Authentication. Apple can provide a name depending on the sign-in flow and consent; previously provided names can remain in Firebase. Apple does not provide a profile-photo URL. We do not receive your Google or Apple password or contacts, and we do not post to those accounts. Sign in with Apple lets you use a private relay email address instead of sharing your real email address. Account identifiers and any supplied profile information are separate from that email choice. We use your email for account access, verification and password resets where applicable.

Durak does not use a provider name or photo as your in-game identity. Your public username and chosen preset avatar serve that purpose. The private name you edit in Durak stays on your device. Ignoring unused provider profile fields in the app does not remove them from Firebase Authentication or the provider's records. They follow the account-closure and provider-retention processes described below; deleting a Durak account does not delete your Google or Apple account.

What an account stores. Firebase Authentication stores your sign-in account, including your email, sign-in methods, identifiers and any provider name or photo URL it retains. This is separate from Google Firestore, where the Durak server stores the following, keyed to your account:

  • your chosen public username — unique, permanent, and visible to other players;
  • your selected preset avatar, synchronized across your signed-in devices. The editable name in your local profile is not synchronized with your account;
  • your online stats (games played, wins, losses, and win streaks), which other players can view on your profile;
  • your online rating (Elo), which other players can view on your profile and alongside your name in an online room;
  • your friends list and friend requests, and your blocked-users list;
  • reports you file about other players, to keep online play safe.

The developer is the controller of this data and operates it on Google's Firebase / Firestore and Cloudflare infrastructure. We do not use it for advertising, tracking, or analytics, and we do not sell it.

Cross-device. Signing in on another device gives you the same account, username, stats, and friends. Offline stats, achievements, saved games, and cosmetics stay on each device and are not part of your account.

Safety and moderation. Usernames are user-generated and are screened against a profanity blocklist and a reserved-name list. You can report a player and block another user from the in-app Friends screen; reports are reviewed by the developer, who may remove a username or terminate an account for abuse. If an account is banned for abuse and is then deleted, we keep its username, ban-reservation status and reservation date to prevent reuse and impersonation. The reservation no longer holds the account identifier or email, but a recognizable username can still identify its former owner. It has no automatic expiry. The developer reviews these reservations at least quarterly and on a correction request, and removes those no longer needed or created in error.

Online rating. Rated online games change a public rating (Elo) calculated entirely on the server from the result of the match. Your rating is visible to other players. Eligible public games with verified human accounts can be rated, including games against server-controlled opponents. A new simulated opponent receives an estimated starting rating between 800 and 1300 once, with no previous rated games. New persistent identities retain their name, avatar, rating and actual game record across tables; actual rated results change their rating within that range. When a simulated opponent reaches a rating boundary, the transfer between it and another player can be smaller so the complete match remains zero-sum. Already started games retain the rating rules and identities under which they began, including older saved appearances that did not share a persistent profile. Offline games, private games, guest games, and games with ordinary manually configured bots do not change your online rating. The lobby shows whether a game is Rated or Unranked.

Rating records. So that a rating change can be explained or corrected if something goes wrong, the server keeps one record per rated match containing the match identifier, the participating accounts and any simulated-player identifiers, each participant's rating before and after, the result, and the time. These records become eligible for automatic deletion seven days after the server writes them. That can be later than the match itself if saving was delayed. Deletion is asynchronous, so the expiry time is not a guaranteed physical-deletion deadline. They never contain your cards, the deck order, or a replay of the game.

Account closure. Account data is kept while the account is active. You can request deletion under Profile → Online account → Delete account. When deletion succeeds, it removes the active Firebase sign-in account, the Durak account/profile, online stats and rating, friends and blocks, and the username reservation unless it was banned. This cannot be undone in the app. A failed or interrupted request may need a retry or support assistance; starting a deletion is not confirmation that every step finished. If you cannot open the app, see our Delete Your Account page (https://durakclassic.com/delete-account/) or email the contact below.

Records that can outlive account closure:

  • Rating and integrity records explain results, prevent duplicate credits, and investigate failed rating updates. Match records and failed-update records receive a seven-day expiry when written; rewriting a failed-update record restarts its expiry. Duplicate-credit markers also receive a seven-day expiry when written and are removed with the account during successful deletion. Shared match records and failed-update records can still contain your account identifier until they are purged.
  • Safety reports become eligible for deletion 30 days after filing, whether reviewed or not. On successful account-data deletion, reports matched to your account as their subject are removed, and your reporter identifier on reports about others is replaced. Reports about an unresolved username instead follow the report expiry. Review notes can still identify people; replacing an identifier does not make the remaining record anonymous.
  • Deletion records hold an account identifier, deletion state and timestamps to block access and allow retries. A completed-deletion record is assigned an expiry 24 hours after completion is recorded. A pending record is assigned an expiry 30 days after the latest deletion attempt. Expiry does not itself finish an interrupted deletion or erase its remaining data.
  • Banned username reservations are retained without automatic expiry and reviewed as described under Safety and moderation.
  • Room and matchmaking records, including room-directory and active-match reservations, are cleared by server cleanup rather than an account-deletion deadline. They can contain account or guest identifiers while cleanup is outstanding.

For records with an expiry, managed database cleanup runs after that time and can be delayed. We distinguish removal from active use, eligibility for cleanup, and physical deletion rather than promising that all copies disappear at once.

Operational Records and Recovery Copies

Connection and diagnostic records help operate the service, investigate faults and prevent abuse. Cloudflare and authentication providers process network and security information separately from account and match records. Their retention depends on the service and its configuration; deleting a Durak account does not immediately remove every provider log or recovery copy.

Firebase states that authentication IP logs last a few weeks and that other authentication data is removed from its live and backup systems within 180 days after we initiate deletion of the associated user with Firebase Authentication. An interrupted Durak request may not have reached that step. This is a provider-specific commitment, not a deadline for every record Durak or another provider holds. Provider security, service-operation and legal records may follow different, longer periods. Provider backups and any configured database backups or exports have their own expiry and deletion processes. We restrict recovery copies to recovery and security purposes. Before restored account data returns to service, it must be checked against subsequent deletions and expired data; a backup must not be used to reactivate a deleted account.

Support messages and exports you send are used to handle your request. They are reviewed for deletion when no longer needed; any continued retention for a specific dispute, safety investigation or legal obligation must have a documented reason and review date. These are separate from the automatic match/report expiry periods. Apple, Google and email providers also retain their own account, transaction or service records under their respective policies.

Optional Feedback and Bug Reports

Settings → Submit feedback prepares an email draft on your device addressed to support@durakclassic.com. It includes the feedback type and message you choose, the app version and platform. It does not automatically include account details, game saves, diagnostic logs or attachments. Durak opens your email app so you can review and edit the draft; nothing is sent unless you choose to send it. Sending shares your email address and the final message with us and your email provider. We use them to respond and handle your feedback, with retention as described under Operational Records and Recovery Copies above.

Durak can generate local bug-report export data to help diagnose gameplay issues. This export is created on your device. It leaves the app only if you choose to copy or share it outside the app.

If you voluntarily send a bug report or support message, we may receive the information you choose to send and use it only to investigate the issue and respond.

In-App Purchases

Durak offers optional one-time purchases for cosmetic theme packs. They are purely cosmetic and never change game rules, bot strength, stats, ratings, or offline play. A confirmed purchase or restore also unlocks the on-device "Supporting the Cause" achievement, which has no gameplay effect. Separate cosmetic themes can be earned for free through achievements; the paid packs are unlocked only by purchase.

Purchases are handled entirely by the Apple App Store or Google Play. Those stores process your payment and any associated data under their own privacy policies; Durak does not receive your payment card or billing details. Durak stores only a local record of the packs you own. On iOS and Android, each time the app starts it also asks the store for pack prices and for purchases you already own, so an interrupted or later-approved purchase can still be delivered. "Restore Purchases" repeats that check. Durak does not send your purchases to its own server.

Third Parties

Durak includes no third-party advertising, analytics, or tracking SDKs of any kind. The app bundles two kinds of third-party software: sign-in software for optional online accounts, which runs only when you sign in or create an account and then keeps you signed in, and an in-app purchase library that contacts the App Store or Google Play each time the app starts on iOS or Android. Durak uses neither for advertising or tracking. The providers behind them, and the services that host online play, are listed below.

  • Cloudflare provides the hosting and network infrastructure for online multiplayer and processes connection data (such as your IP address) when you play online.
  • Google Firebase provides authentication (Firebase Authentication) and the account database (Firestore) for optional online accounts, processing your authentication details, available provider profile information and the account data described above under Google's privacy policy (https://firebase.google.com/support/privacy). This is used only to operate accounts — not for advertising, analytics, or tracking.
  • Google Sign-In and Sign in with Apple are optional ways to create or access an account. Their sign-in flows can provide the identifiers, email and profile information described under Online Accounts. Provider processing also includes security and connection information, under Google's privacy policy above and Apple's (https://www.apple.com/legal/privacy/). Google's iOS sign-in software declares that it may also collect identifiers, device and usage information, a phone number and approximate location, partly for analytics. Durak does not receive that analytics data.
  • Apple App Store / Google Play process payments for optional cosmetic purchases and distribute the app.

These providers process data under their own privacy policies. The app is also distributed through web hosting platforms, which may process data under their own policies when you use them.

Children

Durak does not knowingly collect personal data from children. Online play and online accounts (which involve interacting with and being visible to other players) are for players age 13 and older, and the app asks you to confirm you are before your first online game. Online play lets players choose a username that other players can see; please do not include personal information in it.

Playing offline needs none of this. Games against the bots collect no personal data, involve no other players, and are available without an account, without an age confirmation, and without ever going online.

If you believe a child under 13 has created an account, email us at the address below and we will delete it and its data.

Your Rights

These rights apply to everyone. If you are in the UK, the EU, or the EEA, the GDPR gives them to you by law; we apply them to every player regardless of where you live, because it would be strange not to.

You can ask us to:

  • Give you a copy of your data — everything the account holds: your email, sign-in methods and retained authentication profile information, your username, your online stats, your rating and the record of your rated matches, your friends and blocks, and any abuse reports you filed. You get it as a JSON file, which is a structured, machine-readable format you can keep or take elsewhere.
  • Correct anything that is wrong. Change your private Durak name and preset avatar under Profile → Edit profile. That does not change your Google or Apple profile or remove previously retained authentication information; contact us about information held with your Durak sign-in account. Your username is permanent by design — it is how other players know you — so ask us if it needs to change.
  • Delete your account and its data. You do not need to ask: it is in the app under Profile → Online account → Delete account. The Delete Your Account page (https://durakclassic.com/delete-account/) explains the completion/retry process and the records that can outlive account closure.
  • Object to or restrict what we do with your data, or withdraw your consent. In practice, an account exists to let you play online under a name, so withdrawing consent and deleting the account amount to the same thing.

How to ask. Email support@durakclassic.com from the address on your account. We will confirm you control that address — otherwise anyone could ask for your data — and then answer.

How long it takes, and what it costs. Within 30 days, and free. If a request is unusually complex we may take longer, and we will tell you why before the 30 days are up.

What we cannot include. A copy of your data will not contain other players' identifiers, or anything that would identify another person — for example, who reported you. The law is explicit that your right of access does not override someone else's privacy. We will always tell you what was held back and why.

If we get it wrong. You can complain to your local data-protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is the supervisory authority for the country you live in.

Changes

If a future version changes what data Durak collects or transmits, this policy and the store privacy declarations will be updated before that version is released.

Contact

Privacy contact: support@durakclassic.com.

Website: https://durakclassic.com/. Support: https://durakclassic.com/support/.