Privacy Policy

Updated: September 29, 2026 · Applies to Stealr.io on the web, as a PWA, and in the iOS and Android apps.

Who is responsible?

What we process and why

• Playing as a guest: Firebase Authentication creates an anonymous user ID. We use it to operate lobbies and games, save game state and results, and reconnect a session. Your guest name and settings are also saved on your device. Guest data is not automatically available on another device.
• Optional Stealr account: Google sign-in is available on web/PWA, Android and iOS; Apple sign-in is available on iOS. Firebase receives the provider identifier and information the provider supplies, which may include your name, email address or an Apple relay address. We do not receive your Google or Apple password. We link or merge your previous guest progress when you sign in. Linking Google and Apple is your choice; matching email addresses alone do not merge accounts.
• Game and profile: We process player IDs and names, lobby membership, moves, cards, match results, XP, level, wins, win rate, streaks, bot/multiplayer statistics, chosen avatar and cosmetic frame. Account names are checked and reserved so another account or guest cannot use them. Level rewards are cosmetic and do not change game rules or winning chances.
• Safety and support: Reports, blocks, relevant player IDs and the reason given in a report are processed to investigate abuse and keep the game usable. If you contact us, we process your message and contact details to answer you.

We process the data needed to provide the game, optional account and purchases under Article 6(1)(b) GDPR where applicable. We use Article 6(1)(f) GDPR for security, abuse prevention and handling reports, based on our interest in a safe and reliable game. Legal duties may require processing under Article 6(1)(c) GDPR.

What other players can see

Players, including guests with an anonymous Firebase sign-in, can see names and shared lobby/game information needed for discovery and play. Your public account profile contains your name, level, frame and selected illustrated avatar. Your detailed account statistics and email address are not in the public profile. Shared game records can include your player name and actions.

The global leaderboard displays your public player name, avatar, level, confirmed multiplayer wins and rank. Detailed statistics remain private. Rematch scores are stored separately and visible only to the participants of that game; they are removed when a participating account is deleted.

Earlier custom pictures and moderation

Version 4.5 and later no longer offer or display custom pictures. Earlier app versions may still upload and display approved pictures. Uploads remain subject to the existing consent, size limits, Google Cloud Vision check and moderation. Pictures uploaded through earlier versions may remain in Firebase Storage until the account is deleted or you ask us to remove them at the email above. Earlier uploads were checked by Google Cloud Vision and, where needed, reviewed privately. We also review reports about player names.

Services, analytics and device storage

• Google Firebase / Google Cloud: Authentication, Firestore, Cloud Functions, Storage, Hosting and Cloud Vision support sign-in, game data, profiles, image review and hosting. Firebase Authentication processes data in US data centers; other services can process data in different regions. For international transfers, Google describes its EU–US Data Privacy Framework certification and standard contractual clauses in its Firebase privacy information and contractual terms.
• Google Analytics: The website and the app's shared web view load Google Analytics when a page opens. It measures page visits and interactions using browser/device information, approximate location and identifiers such as the first-party _ga cookie. Google says it does not log or store individual IP addresses in Google Analytics. How Google Analytics handles data.
• Google Fonts: The interface requests the Space Grotesk font from Google, which receives the technical data needed to serve it. Google Privacy Policy.
• On-device storage: Firebase keeps sign-in state and a Firestore cache in browser/device storage. We also save your guest name, language, card design, audio/haptic choices, active-game recovery information and ad-removal status locally. Clearing app or browser data can remove these settings and access to a guest account.

Ads and purchases in the native apps

The iOS and Android apps use Google AdMob for banner and interstitial ads. AdMob may process device identifiers, ad interactions and technical data to serve and measure ads. On iOS, the app asks for App Tracking Transparency permission when its status is undetermined; declining cross-app tracking does not by itself remove ads. Ad removal is offered through the native app stores; paid card designs are offered on iOS. We keep the resulting entitlement or selection, not your payment-card details. Apple and Google process purchases under their own privacy policies; iOS purchases can be restored through your Apple Account.

Retention and deletion

Account progress and profile data remain until the account is deleted. You can delete a registered account in the profile; this removes the Firebase authentication account, profile, progress, account result records and stored profile pictures. An iOS purchase remains with the Apple Account for restoration. Guest and shared game documents can remain after a match for reconnection, rematches and game integrity; there is currently no fixed automatic deletion period for all shared game records. Such records may still contain a name or player ID after account deletion. Contact us if you want access to or deletion of remaining personal data. Provider-side records are governed by the providers' own policies.

Your choices and rights

You can play as a guest, change your name and avatar, sign out, or delete a registered account from your profile. You may request access, correction, deletion, restriction or a copy of your data, and object to processing where applicable, by emailing canyuezer@icloud.com. You may also complain to a competent data-protection authority. We may ask for information needed to verify that a request concerns your account.

We update this page when our data practices change. The date above identifies the current version.