Privacy policy — 29 Card Game - Baithak

Accounts and data on your device

Guest play against the computer needs no account. Your chosen name, settings, local record and unfinished offline match remain on your device. When the device is connected, the app can still request service configuration and use the ad services described below. Signing out does not by itself turn off advertising.

If you choose Google or Apple sign-in, we store the following account data:

Sign-in identity

The provider account identifier and email supplied by Google or Apple, to recognise you and secure the account. Apple may supply a private relay address. Your email is not shown to other players or used for marketing. Sign in with Apple is offered on iPhone only, because that is the only place the app is given the credential it needs to revoke your Apple grant if you later delete the account; Google sign-in is available on both platforms.

Profile and settings

Your display name, username, random public handle, language, theme, text size, sound, haptics, coach settings, computer skill, rule variants, avatar, frame, table and deck, so your choices can follow you across devices.

Record and progression

Matches finished, matches won, your last five win/loss outcomes and the recent match identifiers used to prevent duplicate counting, plus XP, level, rank points and achievements. Signed-in games against the computer can update these counters too; their cards and round-by-round play are not uploaded.

Wallet and purchases

Kaudi balances, a ledger of changes, reward claims, inventory, store product and transaction identifiers, purchase-token hashes and refund state. These records deliver purchases and rewards, support restoration and prevent duplicate grants. The stores handle your payment details.

Friends

Friend requests and accepted relationships, so you can find friends and invite them to a table. Friends are added by typing an exact username, from a shared link, or from a table you played at. We do not access your contacts or address book.

Notifications

Push notifications are off until you allow them on your device. If you do, Google’s Firebase Cloud Messaging gives this installation a Firebase installation identifier and a push registration token. We store the token with your account, together with the platform, app version, your language and your device’s time-zone offset, and your three notification switches. We use them only to tell you about friend requests, accepted requests, friends coming online and at most two reminders a day, in the morning and evening, to come back and play, outside quiet hours. We keep a short queue of the notifications we are about to send, or have sent, to apply those limits. Notifications are never used for advertising.

Safety and terms

The terms version you accepted, player blocks and reports. A report records the reporting and reported accounts, the reported name, a selected reason, submission time and review status. There is no free-text report field. These records help us review abuse and enforce the community rules.

The app does not request access to your location, photos, microphone, calendar, health data, SMS or call logs. The ad service can infer approximate location from an IP address; see Advertising. We do not receive card, bank or UPI details.

Matches and accounting

Stored game history was retired on 7 September 2026. The account now retains the counters and recent outcomes described above, rather than a list of past hands. Online play sends the server your display name, authentication token, room code when used, and game actions so it can run the table. Live cards and table state last only while the table exists.

Online reward accounting separately keeps the match identifier, outcome, abandonment status, completion time and anti-abuse hashes. Paid tables also keep the entry and return amounts. These records prevent duplicate rewards and settle the wallet; they do not contain cards, scores, round history or other players’ names.

Anti-abuse hashes are derived from an app-generated random installation identifier and the group of players in a match. They are not advertising identifiers or hardware device identifiers. They let the service recognise repeated claims and repeated groups; hashing does not make these account-linked records anonymous.

What other players can see

At a table

Your chosen display name and look. Other seats can open your profile to see your username, total matches, total wins and last five results. They cannot see your email, sign-in identity, settings or Kaudi balance through the table.

Weekly League

Signed-in players can see the week’s top twenty display names alongside rank, matches, wins and points. The board does not show Kaudi balances.

Your username

Every signed-in player has a unique username, made from English letters, digits and underscores. A new account is given one from its display name, and you can change it in Settings. Anyone who types your username exactly can see your display name and avatar and send you a friend request; there is no list of players and no partial search, and lookups are rate limited. A player who has blocked you, or whom you have blocked, cannot find you this way.

Friends online

While you are signed in and connected, your accepted friends, and only they, can see that you are in the app, waiting for a table or at a table. Presence is held in server memory, not written to the database. Signing out or closing the app removes you when the server detects the connection ending.

Friends

A friend request shows your name, avatar, match and win totals and last five results. Once accepted, each friend can also see the other’s Kaudi balance and send a table invitation that holds a seat for 45 seconds. Pending requests do not reveal balances. Either person can remove a friendship; declining a request prevents another request from that person for 24 hours.

Reporting and blocking

You can report an inappropriate name or abusive behaviour and block a player. Blocking removes the friendship and pending requests, prevents new friend requests and invitations between you, hides you from each other’s username search, and hides that player from name-bearing League rows. It is not a guarantee that you will never share a public match. We screen names for some prohibited words and characters and can review reported content; no filter catches every problem.

Sharing a result

A result-card image includes your display name, rank title and total wins, never your Kaudi balance. It goes to the app you choose in your device’s share sheet, whose own privacy policy then applies.

Choose a display name you are comfortable showing strangers.

Advertising

A full-screen ad may appear after you tap to leave a completed match’s result, or after you confirm leaving a match part-way, including games against the computer. There is at most one automatic ad per completed or abandoned match, and no forced ads in your first app session. Remote settings can only make these ads rarer or disable them. Ads never appear during active play, on the felt or over Home.

The match result is readable before its shareable card is covered. You may choose an ad to uncover that card; it also uncovers if the ad is unavailable or dismissed. Round history stays readable, and Play again and Home remain available throughout.

Rewarded videos are voluntary. The general reward is 100 Kaudis per verified completion, capped at three grants per day. Other offers have their own stated benefits and limits, such as doubling a daily bounty, an early claim, unlocking a shop item, refreshing the shop or a watch run. A signed reward reference and your Baithak account identifier go to Google so its verification callback can deliver the correct reward. Automatic ads do not receive that account identifier from us.

Google AdMob serves the ads. Its SDK can collect IP addresses (including approximate location inferred from them), app or device identifiers, ad interactions and diagnostic or performance data for advertising, reporting and fraud prevention. This can happen while an ad is loading, even if it is never shown. See Google’s Android disclosure and iOS disclosure.

• On iPhone, the app asks through Apple’s App Tracking Transparency prompt, after you tap to leave a table or to watch a rewarded video, whether ads may use your device’s advertising identifier. Ads are personalised only if you choose Allow; otherwise they are non-personalised. You can change the answer at any time in iOS Settings → Privacy & Security → Tracking. On Android every ad request is non-personalised and the advertising-ID permission is removed.
• Sexual content is blocked from our ad inventory. Other categories permitted by Google’s policies, including ads for mature audiences, may appear.
• Google’s consent service checks whether ads may be requested. Where consent choices are required, the form appears after you tap to leave a table, never during play. Settings → Privacy choices reopens the available options.
• Grandfathered permanent Remove Ads and a current paid Ad-free year subscription suppress forced ads. The first verified Kaudi-pack purchase includes seven days without forced ads. Rewarded videos remain optional in every case.

Kaudis, purchases and online entry

Kaudis are virtual entertainment items for use only inside Baithak. They have no monetary value and cannot be transferred, sold, exchanged or redeemed for money or anything outside Baithak. Optional purchases are fixed Kaudi packs, premium-wheel spins and the one-year auto-renewing Ad-free year subscription. Existing permanent Remove Ads purchases remain permanent. Apple or Google processes payment; we verify the store receipt before delivery and retain the accounting records described above. For a subscription, those records include the product, transaction references, paid-through date, renewal status and active, cancelled, grace, expired or revoked state. We retain hashes rather than raw receipts or purchase tokens.

Public and private online tables currently require a signed-in account and a fixed Kaudi entry at Silver, Gold or Royal. Returns depend on whether your pair wins and are fixed and funded by the app, rather than other players’ entries. Offline computer play is free and unlimited. The Weekly League, Challenge Rooms and tournaments have no entry fee. A free online room is available only as a fallback if the server publishes no paid tiers.

Servers, sharing and retention

Supabase stores account data in Mumbai, India. Fly.io runs the live game server in Singapore and handles game, presence, economy and notification requests. Google’s ad services, Google’s Firebase Cloud Messaging (which relays notifications through Apple’s push service on iPhone) and the Apple and Google app stores operate internationally. We use these providers to operate the features described here. We do not sell or rent personal data. We may also disclose information where required by law.

Account records

Profile, settings, counters, wallet, ledger, inventory, progression, reward and ordinary purchase-delivery records are retained for the account’s life and deleted with it. Recent outcomes and match identifiers are replaced as you play. If the account has a subscription, deletion removes its account link; limited store transaction and renewal records may remain without that Baithak account link so we can reconcile later store notifications and a valid restore.

Friendships and presence

Friend records last until removed or either account is deleted. Presence lasts only in memory while the server regards the connection as active.

Usernames

Your username is kept with your account and deleted with it. When you change it or delete your account, the old username is held for 30 days as a reserved name, so nobody else can take it and pose as you; it is then released.

Notification records

A push token is kept with your account until the account is deleted. It is switched off, and never used again unless that device registers afresh, when you sign out on that device or the provider reports it invalid; the app also deletes the token from the phone when you sign out. Finished notification records are deleted seven days after they were sent, cancelled or expired. Your notification switches are kept with the account and deleted with it.

Safety records

Blocks remain until unblocked or either account is deleted. Reports are kept for review and follow-up until removed, or either linked account is deleted. Terms acceptance is kept with your account. Reports are available to support, not other players.

Device data

Local settings and offline play data remain until cleared or the app is deleted. Signing out or deleting the account clears its signed-in cache.

Connection logs

Our hosting providers can retain ordinary operational metadata, including IP addresses, under their service retention settings. Account deletion does not immediately erase those logs. We use them to operate and protect the service, not for advertising profiles.

Store and ad records

Apple, Google and their services retain their own transaction, subscription, advertising and operational records under their policies. Deleting a Baithak account does not delete your app-store transaction history and does not cancel an active subscription.

Account access is authenticated and restricted by database access rules. Purchase and reward verification runs on the server. The wallet ledger prevents ordinary edits; account deletion removes the records associated with that account.

Your choices and rights

• You can play against the computer as a guest, sign out, edit your display name and settings, remove friends, report or block players, and reopen available ad privacy choices.
• Notifications stay off unless you allow them. Settings → Notifications switches each kind off separately, and your device’s own settings can turn them all off. Signing out stops notifications to that device.
• Settings → Delete profile removes your account, profile, settings, wallet and ledger, inventory, progression, achievements, purchase-delivery records, online accounting records, friendships, blocks, reports, push tokens and notification records linked to that account. You may need to sign in again to confirm it is you.
• If you signed in with Apple, deleting the account also revokes the Sign in with Apple grant you gave Baithak. The app asks Apple to confirm it is you at that moment, and the grant is revoked before the account is deleted; if Apple cannot be reached, nothing is deleted and you are asked to try again.
• Deletion is permanent. The app returns to guest computer play. Permanent Remove Ads and a current Ad-free year can be verified again through your store account after you sign in, but delivered Kaudi packs and their unused balance cannot be restored after account deletion. Deleting the account does not cancel Ad-free year; cancel it separately in your App Store or Play Store subscription settings if you do not want it to renew.
• Deleting the app removes its local data; it does not delete your signed-in account. Use Delete profile or the account-deletion email route.
• For access, correction, deletion, a privacy grievance or a nomination request under applicable Indian data-protection law, contact the publisher below. We may verify account ownership before acting. Never send a password or sign-in code.

House of the Card is responsible for the account data described here. For players in India, the purposes of processing are listed above; account features are your choice and can be ended by deleting the account. Applicable privacy rights and complaint routes are not limited by this policy.

Children

Baithak is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us so we can investigate and delete it.

This website

The houseofthecard.com website has no advertising, analytics, tracking pixels or cookies. Fonts and assets are served from our domain. Your theme and language choices are saved only in your browser. Our host, AWS Amplify, can receive ordinary request metadata including IP addresses to serve and protect the website.

Contact and changes

For support, data requests and privacy grievances, write directly to House of the Card at houseofthecardofficial@gmail.com. We keep correspondence as needed to answer and follow up on your request; we do not add you to a mailing list. We update the date above when this policy changes.