UnderCard
Privacy Policy
Last updated: 7 November 2026
In short
UnderCard has no accounts, email or passwords. When you join an online room, your nickname and game state sit on Google's Firebase servers for the life of the room, and anyone with the room code can see them. Solo mode, settings and stats stay on your device. The game shows Google AdMob ads and has no analytics.
Who is responsible
UnderCard is published by Neuvikon. Neuvikon is the data controller under the GDPR and Turkey's Law No. 6698 (KVKK).
- Data controller
- Neuvikon
- neuvikon@gmail.com
Privacy contact: neuvikon@gmail.com
What this covers
This policy covers UnderCard, a multiplayer card game published by Neuvikon for Android and iOS, and the Firebase project that holds online rooms. We run no server of our own.
What we process and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Nickname (up to 16 characters), room code, cards, scores, turn state, emoji reactions, player ID and anonymous Firebase ID | Creating online rooms and syncing the game between players | GDPR Art. 6(1)(b): performance of a contract | The room is deleted when the last human player leaves. Otherwise it expires 24 hours after creation and Firebase typically deletes it within the next 24 hours |
| Anonymous Firebase identity record, and the IP address and user agent Firebase logs at sign-in | Giving access to rooms without an account, limiting abuse | GDPR Art. 6(1)(f): legitimate interest in protecting the room system | The identity record stays until we delete it; uninstalling does not remove it. Firebase keeps IP logs for a few weeks |
| Advertising ID, IP address, device and app details, ad interaction | Showing and measuring ads, limiting frequency, preventing fraud | GDPR Art. 6(1)(a): consent where the consent form is shown. Elsewhere, Art. 6(1)(f): legitimate interest in funding a free game with ads | Google's own periods; see its policy |
| Your email address and message when you write to us | Answering your support request | GDPR Art. 6(1)(f): legitimate interest in answering you | Up to 1 year after the matter closes |
How data is collected
You type the nickname. Game state is written to Firebase automatically as you play. The anonymous ID is created automatically when the app first opens, even if you only play solo. The AdMob SDK collects ad data automatically. Nickname, settings, stats and daily challenge progress are stored on your device.
Do you have to provide it
Online play needs a nickname; it does not have to be your real name and we suggest it is not. Solo mode creates no room data. Watching rewarded ads is optional; other ads are part of the game.
What we do not collect
- Name, email, phone number or password. There is no sign-up.
- Location, contacts, photos, camera or microphone. The app does not ask for these permissions.
- Text or voice chat. Players can only react with preset emojis.
- Analytics or crash reporting tools. The game has neither.
- Payment details. The game has no real-money purchases.
Who sees what in online rooms
Players in a room see your nickname, score and emoji reactions. Room codes have 4 digits. Room data, including cards and nicknames, can be read by any client signed in through the app that knows or guesses the code. Do not assume only the people you invited can reach a room.
Ads
Google AdMob shows the ads. In the EU, the UK and some US states, Google's consent form (UMP) opens before ads load; without consent no ads are requested. You can change your choice in Settings, Ad Privacy Choices. Banner ads are not personalised. Interstitial and rewarded ads may be personalised depending on your consent status, and also where the form is not shown, Turkey included.
On iOS, tracking permission (ATT) is asked in Apple's own prompt; you can change it in Settings, Privacy & Security. On Android you can reset or delete your advertising ID in device settings.
How Google uses this data: https://policies.google.com/technologies/partner-sites . Ad cookies and advertising IDs: https://policies.google.com/technologies/ads . Your ad settings: https://myadcenter.google.com
Who receives data
| Party | Role | Location |
|---|---|---|
| Google Firebase | Anonymous Authentication runs the anonymous ID, Cloud Firestore runs online rooms. | Authentication in the US; Firestore on Google Cloud infrastructure |
| Google AdMob | Shows ads. Processes advertising ID, IP address, device and ad interaction data under its own policy. | Global |
| Google Play and the App Store | Distribute the game and handle download records under their own policies. | Global |
| Google (Gmail) | Email service where support messages are stored. | Global |
We use these parties only for the purposes above and expect them to protect the data to the same or an equivalent standard as this policy. We do not sell your data. We may disclose information where a lawful request from an authority requires it.
International transfers
Anonymous identity records are processed in the United States, room data on Google's cloud infrastructure and ad data on Google's global infrastructure, so your data may leave your country. Support email is stored on Google's servers too. For users in Turkey this is a transfer abroad under KVKK Art. 9.
Security
Rooms can only be reached through the app's anonymous sign-in, and connections are encrypted. A room code is not a password: it has 4 digits and, as explained below, does not limit access on its own. So do not put personal details in your nickname.
Deleting your data
When you leave a room your player entry leaves with you; the room is deleted within the period above at the latest. Uninstalling or clearing app data removes the nickname, settings, stats and the link to your anonymous ID from your device. The anonymous record in Firebase is not affected and the app has no button to delete it; write to us to have it deleted. Firebase removes a deleted record from live and backup systems within 180 days. With no account, there is nothing else to delete.
Children
UnderCard is not directed at children under 13. We do not knowingly collect personal data from children. The app does not ask your age; if we learn we hold a child's data, we delete it.
Your rights
You may ask for access to your data, correction, erasure, restriction and portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time, without affecting earlier processing. Turkish users have the rights in KVKK Art. 11, listed on our data protection notice page.
Write to the address above with your name and request. It is free, and we answer within one month at the latest (30 days under KVKK). KVKK applications are made in Turkish.
Complaints
You can complain to us first. You may also complain to your local data protection authority (in the UK, the ICO) or, in Turkey, to the Personal Data Protection Board (KVKK).
Changes
When this text changes, the date at the top changes too. Significant changes are also announced in the product or its release notes. We do not respond to browser Do Not Track signals.