We store what the game needs to work — your display name, your tiles and moves during a game, your rating, and your progress. We do not sell any of it, we do not track your location, and you can delete everything from inside the app.
One thing worth calling out because it is unusual: while a game is running, the tiles on your rack are stored in a way that no other player can read them, and the shuffled draw pool is stored so that nobody can read it at all, including you. That is a rule of the game, and we enforce it in the database rather than trusting the app.
You can play without an account. Games against the bot, pass-and-play on one device, the 20 Solo Challenges and Practice mode all work with no sign-in and no internet. An account is needed only for online play and leaderboards.
How long your rack is private: your tiles are readable only by you for the whole round. At the end of a round every player's remaining tiles are revealed to everyone in that game, because the scores are calculated from them — exactly as happens at a physical table when everyone shows their hand.
We record simple counters so we can tell which parts of the game people actually use and where they get stuck: when the app opens and closes, when a game starts and ends (and against what kind of opponent), when a move is made, when a tutorial or puzzle is completed (and whether a hint was used), when a daily reward or achievement is earned, and when an advertisement is shown, watched or skipped. These records are tied to your account but contain no message content and nothing you type.
App version, Android version, and device model — used only for crash reporting and for checking that the game performs acceptably on older phones.
To run the game: Your moves and the game state have to be stored somewhere both players can reach, or an online game could not continue when one of you closes the app.
To rank fairly: Your rating is calculated from completed online games and is used to find you opponents of a similar standard and to place you on the leaderboards.
To remember your choices: Your avatar, your themes, your sound settings and your rack sort order are stored so the game looks the way you left it.
To improve the game: Aggregated usage counters tell us which tutorials people abandon and which difficulty levels are too easy or too hard. We look at totals, not at individuals.
To notify you: If you turn notifications on, we send a message when it is your turn, when your turn is about to expire, and when a game finishes. You can turn these off entirely in Settings.
To detect impossible results: At the end of every online game we check that all 106 tiles are accounted for. If they are not, the result is flagged for review and does not affect anyone's rating. This check looks at tiles, never at people.
Rummikub relies on a small number of trusted services. Each has its own privacy policy:
| Service | Purpose | Their Policy |
|---|---|---|
| Supabase | Database, authentication, realtime multiplayer (self-hosted on our own server) | supabase.com/privacy |
| Google AdMob | Advertisements | policies.google.com/privacy |
| Google Play Games Services | Achievements, sign-in, leaderboards | policies.google.com/privacy |
| Google Play Billing | Purchases | play.google.com/about/play-terms |
| RevenueCat | Purchase and entitlement management | revenuecat.com/privacy |
| Facebook SDK | Social features — only if you connect Facebook | facebook.com/privacy |
| Expo / React Native | App framework and push notification delivery | expo.dev/privacy |
We do not sell your personal information and we do not share it with third parties for their own marketing.
Advertisements: if you have not bought Remove Ads, AdMob may use an advertising identifier to show relevant ads. You can reset or limit that identifier in your Android settings at any time, and buying Remove Ads stops all advertisements in this game.
Access: Request a copy of the data we hold about you by emailing [email protected]. We will respond within 30 days.
Deletion: Delete your account from Settings → Account → Delete Account. There is a 30-day grace period during which signing in again cancels the deletion; after that your account and its data are removed permanently.
Correction: Change your display name from Settings → Profile, or email us for anything else.
Portability: Request your complete match history as a JSON file by emailing [email protected]. We will respond within 30 days.
Opt out of analytics: Email [email protected] and we will flag your account to exclude it from all analytics aggregation. Operational data — the moves in a live multiplayer game — cannot be excluded while your account is active, because the game cannot run without it.
Rummikub is rated Everyone (E) on Google Play. We do not knowingly collect data from children under 13. If we learn that we have collected data from a child under 13, we will delete it immediately. If you are a parent or guardian and believe a child under 13 has created an account or given us personal data, contact [email protected] and we will investigate and delete the data within 30 days.
Data is transmitted over encrypted connections and stored with row-level access rules that prevent one player's device from reading another player's private data. Authentication tokens are held in the device's secure storage, not in ordinary app storage. No method of transmission or storage is 100% secure. If you become aware of a security concern, please contact us at [email protected].
If we make a significant change we will tell you through the What's New screen the next time you open the app after the update. Minor corrections — fixing a typo, clarifying a sentence — may be made without notification, and the "Last updated" date at the top of this page always reflects the most recent change.
2DGameClub Studio
[email protected]