Privacy Policy

Who we are

Bridge Co is made and published by Nauvis, a sole proprietorship based in California, United States, which is the data controller for the information described below. You can reach us at support@nauvis.app; mail to that address reaches us through Cloudflare's email routing service.

There is no account

Bridge Co does not have user accounts. You are never asked to register, sign in, or provide an email address or password, and there is no "Sign in with Apple" or social login.

Instead, the first time you open the app it generates a random identifier — a UUID — on your device. That identifier is how our server recognises the same player returning, so your rating, coin balance and match history persist between sessions. It is not your Apple ID, not your device's advertising identifier, and not derived from any hardware identifier. It is a random number that means nothing outside Bridge Co.

Linked devices

From version 1.1 you can play the same profile — your name, coins, rank and progress — on up to two devices. On the device that has your profile, open Profile → Linked devices and make a code; on the other device, enter it. There is still no account: nothing is linked to an email address or an Apple ID, and the code is the only proof that both devices are yours.

Each device keeps its own random identifier, and our server records that the second one plays as your profile. The code is eight characters, works once, expires after ten minutes, and is held only in our server's memory, never written to its database. Before you confirm, the device entering the code is shown the display name of the profile it is about to join — so only ever enter a code on a device of your own, and don't share one.

Joining a profile replaces the one already on that device. If the device entering the code had a profile of its own, that profile is deleted from our server, exactly as Delete my player data would delete it, and the app warns you before it happens. Settings, cosmetics you've chosen and solo statistics stay on each device and aren't shared between them.

Either device can unlink the second one from Profile → Linked devices (the device the profile began on stays its home and can't be unlinked). Unlinking removes only the link: the unlinked device starts as a new player the next time it's opened, and your profile stays, whole, on the other device.

What we collect

This is the complete list of what Bridge Co itself collects, and it matches the privacy manifest inside the app. Google's ad software also collects some data of its own, described under "Ads".

• Player identifier. The random UUID described above. Stored on your device and on our server, and linked to the items below — along with when the record was created and when you last played, which the server keeps so it can tell an active player from an abandoned record.
• Avatar. Which of the app's built-in avatars you picked, so opponents see the same one at the table. It is a choice from a fixed set of drawings, never a photo.
• Display name. The name you type in the app, shown to other players at the table, in the match log and on the leaderboard. You are not required to enter anything — the app picks a placeholder until you do — and you should not enter your full name.
  
  Names are unique: no two players can hold the same one, ignoring capitalisation. To enforce that, our server stores a lower-case copy of your name alongside it and refuses a name someone else already has. Names are also filtered, and an unsuitable one is replaced. Changing your name needs a connection, because the new name has to be claimed on the server; if the name you picked was already taken by the time you first went online, you are given a numbered variant of it (for example "Maya2") and the app tells you so. Freeing your old name makes it available to somebody else.
• Gameplay content. Bids, scores, tricks won, final placements, your season rating, your coin balance, the record of matches you've played, your Daily Deal results (the moves you made, so the server can check the score) and the cosmetic items you've unlocked. Also your level and experience points, your progress on the day's challenges, your Daily Deal streak, the tier you finished each past season in, and any month you finished in the top 50 of the leaderboard — that badge is shown to other players next to your name at online tables and on your profile, unless you hide it in your profile. So that solo games count toward those, the app sends a short summary of each one you finish — how many rounds, how many bids you made exactly, how many you went over, and where you placed — with your display name. It never sends your cards. If you have never played online, the first such summary, a finished Daily Deal or an unlocked item is what creates your player record on our server.
• Coin history. A line for each coin movement: ranked entry fees, winnings, rewards, unlocks and daily top-ups, with the amount, your balance after it, and when.
• Video rewards. For each video you watch for coins: Google's reference for that viewing, a random number the app picked for it, the coins paid and when, so that a reward is never paid twice.
• Feedback. Anything you send from the app's "Send feedback" screen: what you write, the kind you picked (bug, idea or other), your display name, and the app and iOS versions — linked to your player record so that deleting your data removes it.
• Linked devices. If you link a second device: that device's own random identifier, which profile it plays as, the kind of device it is — a fixed word the app sends, "iPhone", never your device's own name — when it was linked, and the display name it last connected with, so that a name change made on one device isn't mistaken for one made on the other. Link codes themselves are never stored; see "Linked devices" above.
• Usage data. Which screens you open and which buttons you tap, with a separate, anonymous identifier. It's on unless you switch it off, and is described in full in the next section.

Everything except usage data is used for one purpose: making the app work — keeping score, ranking players, paying rewards and showing your history. We process it because it is necessary to run the game you asked us to run. Checking that results and rewards are genuine — replaying Daily Deal moves, verifying a video reward with Google — also serves our legitimate interest in keeping the game fair. Feedback is used to read it and act on it — fixing what you report and weighing what you suggest — which is what you ask for by sending it. Usage data is used for one other purpose, improving the app, as the next section explains. None of what we collect is used for advertising, profiling or tracking.

Usage data

To see what is working and what isn't, the app records how it is used and sends that to our own server. We built this ourselves; no analytics company is involved and nothing is shared.

What is recorded:

• which screens you open, and roughly how long you stay on each;
• which of the app's main buttons you tap — Ranked, Rematch, Settings and so on;
• game moments: a match starting or ending (its mode, number of players, bot difficulty, length, and whether it was finished or abandoned), how long you waited in the ranked queue, finishing or skipping the tutorial, changing a setting, and which emote you sent;
• when the app is opened and put away and how long it was open, the time of each event, the app's version and build, and the phone's operating system with its major version number;
• a random session number, which starts afresh after 30 minutes away from the app.

What is not recorded: your player identifier, your display name, anything you type, your cards or bids, your location, your contacts, your device model or your IP address.

Usage data carries its own anonymous identifier — a second random number, separate from your player identifier and never linked to it, so we can see how one device moves through the app without knowing whose it is. Unlike the player identifier it is deliberately short-lived: it is not included in device backups, and it is replaced with a new one when you switch usage data off, when you delete your player data, or when you reinstall the app.

If you play offline, the app keeps what it records on your device and sends it the next time you're connected. Nothing about recording it slows the game down or needs a connection.

Only we see usage data, through a private dashboard. It is kept for two years and then deleted automatically. We process it on the basis of our legitimate interest in improving the game, and you can object at any time:

To switch it off, open Settings → Privacy and turn off Share usage data. Recording stops at once, anything not yet sent is discarded, and the anonymous identifier is reset. What was already sent stays anonymous and expires on the two-year schedule — because it was never linked to you, we have no way to pick out which of it was yours.

Ads

From version 1.0.1, Bridge Co shows ads served by Google AdMob: a banner at the top of the table during games, a full-screen ad at the end of some matches, and short videos you can choose to watch for coins. They are how the game stays free.

To choose and measure those ads, Google's software in the app collects, directly from your device: your IP address (which gives an approximate location), identifiers limited to this app or to us as its developer, the ads you're shown and how you interact with them, and diagnostic data such as crashes and performance. Google handles this under its own privacy policy, and How Google uses information from sites or apps that use its services explains how.

No tracking. Bridge Co never shows the "Allow app to track your activity" prompt, so your device's advertising identifier (IDFA) is never available to the app or to Google. Without that permission, Apple's rules don't allow us or Google to link what you do in Bridge Co with data from other companies' apps and websites to target ads at you.

Google decides how it uses the data its software collects, as a separate controller from us. In the European Economic Area, the UK and Switzerland, Google asks for your consent before ads are shown, and that consent is the legal basis for them; elsewhere, we show ads on the basis of our legitimate interest in keeping a free game free. Where the law gives you a choice, you can change your answer at any time in Settings → Privacy → Ad privacy choices.

When you watch a video for coins, the app tells Google your public player ID — a random number other players' apps use to open your profile, which can't be used to sign in as you — and a random number for that one video. Google sends both back to our server, signed, when the video finishes, so we know whose coins to add. That is all we give Google about you.

Feedback, emails and crash reports

Feedback you send from the app (Settings → About → Send feedback, or touch and hold the app icon) goes to our own server and is read only by us, on the same private dashboard as usage data. It's for reading, not replying — we have no way to contact you — so if you'd like an answer, email us instead. It is kept for two years, then deleted automatically.

If you email us, we receive your email address, what you write and anything you attach, and use them only to answer you. Mail to support@nauvis.app passes through Cloudflare's email routing service on its way to our inbox. We keep a conversation for as long as it helps us support you, and then delete it.

Crash reports from the stores. If you've chosen to share analytics with app developers in your iPhone's settings (Settings → Privacy & Security → Analytics & Improvements), Apple sends us crash reports and anonymous usage statistics for Bridge Co. They reach us through Apple's developer tools and don't identify you to us.

What we do not collect

We never ask for your email address, phone number, real name or date of birth, and we collect no contacts, no location, no photos, no microphone or camera access, no health data, no browsing activity and no device advertising identifier (IDFA).

Bridge Co does not track you. The app links no analytics SDK — not Firebase, not Facebook, not any third-party measurement tool — and never presents the "Allow app to track your activity" prompt. Its one third-party SDK is Google AdMob, described under Ads, and without that permission it can't read your advertising identifier either. Nothing we hold about you is combined with data about you from other companies' apps or websites. The usage data described above stays with us, isn't linked to you and is never combined with anyone else's data.

Who can see your information

Other players in a match see your display name, avatar and any leaderboard badge you show, how you're doing in that match — your bid, your tricks and your score — and the emotes you send (emotes are passed on, never stored with your player record). The leaderboard shows your display name, rating, tier, games and wins, and the Daily Deal leaderboard your name, score and placement. Anyone who opens your profile from a match history sees your name, season rating, tier and rank, your career points, ranked matches and wins, and any badges you haven't hidden. That is the point of a multiplayer game, and these are the only places your information is shown to anyone else. Your coin balance and your player identifier are never shown.

If you link a device, the list of your devices — what kind each one is and when it was linked — is shown only on those devices. A device entering a link code sees the display name of the profile it would join, and nothing more, before the link is made.

We do not sell your data, and we do not share it with advertisers, data brokers or analytics companies. The one exception is the public player ID we give Google when you watch a video for coins, described under Ads. Usage data and feedback are seen only by us.

The service providers who handle information for us, and only to provide their service, are Railway (hosting our server and database), Cloudflare (routing email sent to us) and Google (serving ads, under "Ads" above).

We would disclose information beyond this only if the law requires it — for example a valid court order — or where it's needed to protect someone's safety or our legal rights. If Bridge Co is ever sold or transferred to someone else, the information needed to keep running it would go with it, still covered by this policy.

Where it's stored

Game data is stored in a PostgreSQL database operated by Railway, our hosting provider, on servers in the United States, and reached over an encrypted connection at api.bidbound.app. Railway processes the data only to host it for us. If you are outside the United States, your data travels there to be stored.

Like any internet service, your connection passes through our hosting provider, which sees your IP address and the address requested in the course of delivering it, and keeps its own short-lived network logs. We do not record IP addresses ourselves, and our server's own logs normally identify players only by a shortened form of the identifier that cannot be used to sign in. One exception: version 1.0.0 of the iPhone app put the full identifier into the web address of two requests, and if one of those requests fails, the server's error log records that address in full, with the app's version string. Those logs are seen only by us and kept only for the period our hosting provider keeps logs. Version 1.0.1 no longer sends the identifier that way.

Usage data is stored in the same database. On your device, the anonymous usage identifier and any usage data not yet sent are kept in app storage that is excluded from backups.

Settings you change in the app — sound, animation, table theme, room, card backs, your lifetime statistics — are kept on your device and are not sent anywhere. (Usage data records that a setting was switched on or off, not your settings themselves.)

Your player identifier is kept on your device, and deliberately outside the app's own storage: in your iPhone's keychain. That means it survives deleting and reinstalling the app, and follows a backup restore to a new phone. This is a choice made on your behalf rather than an oversight — the identifier is the only thing that proves a record is yours, so letting it die with the app would mean a phone upgrade permanently destroyed your rank, coins and display name with no way to get any of it back. Linking (see "Linked devices") is the other way to carry a profile to a new device, and doesn't depend on a backup.

How long we keep it

Your rating, career statistics and coin balance are running totals, kept while the game runs so that leaderboards and your profile stay meaningful. The record of an individual match — the standings and round-by-round detail you can open from your match history — is deleted automatically 30 days after that match finishes, and a Daily Deal result 30 days after the day it was played. Your level, experience total, Daily Deal streak and season badges are running totals like your rating; the record of which games earned experience, and each day's challenge progress, are deleted automatically after 30 days. Usage data is deleted automatically two years after it was recorded, and feedback two years after it was sent.

The rest is kept until you delete your player data: your player record itself, your coin history and video rewards, the items you've unlocked, your rating for each past monthly season, your season awards and badges, and the links to any devices you've linked (until you unlink them). Those make up your history in the game, and there is no automatic expiry for a player who stops playing — deleting is always in your hands.

Deleting the app does not delete your player identifier, because it is not kept inside the app's own storage; see "Where it's stored" above. Reinstalling returns you to the same player, with your rank, coins and display name intact, rather than starting you fresh.

You can also delete everything we hold, from inside the app — see the next section.

Deleting your data

Open Settings → About → Delete my player data (open Settings from the home screen; the copy in a game's pause menu doesn't have it, and it can't be done while you're in an online lobby or match). It asks once, and then it is done: there is no waiting period and no way to undo it. There is a page just about this if you'd rather read it on its own.

What is erased from our server:

• your player identifier, and with it everything attached to it;
• your display name and avatar — the name becomes available for another player to take;
• your season ratings, past and present, and your place on the leaderboard;
• your career statistics, your coin balance and its history, and your video rewards;
• your level, experience, challenge progress, Daily Deal streak and season badges;
• your Daily Deal results and the cosmetics you've unlocked;
• any feedback you've sent from the app;
• your own record of the matches you've played;
• the links to any other devices you'd linked to your profile.

With linked devices, deleting from either one deletes the whole profile. There is no such thing as deleting one device's share of a profile the devices hold in common; the other device becomes a new player the next time it's opened. To stop playing on the linked device without deleting anything, unlink it instead.

What stays on your device, because it was never sent to us: your settings, your table, room and card cosmetics, your lifetime solo statistics, and any solo game you have in progress. Deleting the app removes those.

One thing we can't erase, stated plainly. A match you played also appears in the other players' own match histories, and those records include the display name you were using at the time. We don't edit other players' records — that game genuinely happened to them — so your old name can remain visible there. Those records are deleted automatically within 30 days, under the rule above.

Google keeps its own records of the ads it showed you and of the videos you watched for coins, under its own privacy policy; deleting your Bridge Co data doesn't reach those.

On your device, the app forgets the identifier immediately. The next time you play online, finish a solo game or the Daily Deal, unlock an item or send feedback, you start as a brand-new player with a fresh rank and no history. This is the one place the old promise still holds: after deleting, a reinstall really does start you fresh.

Deleting also resets your anonymous usage identifier and discards any usage data not yet sent. Usage data that was already sent can't be erased this way, because it was never attached to your player record; it is deleted automatically after two years.

If you can't reach the button — you've lost the device, or the app won't open — email support@nauvis.app. Be aware of the limit, though: because there is no account, we have no email address or name on file to look you up by, so tell us the display name you played under and we'll do what we can. The in-app button is the reliable route precisely because it proves which record is yours.

Security

Everything the app sends to our server travels over an encrypted connection (HTTPS). Only Nauvis has access to the database and the usage dashboard, apart from our hosting provider's own systems that run them. Other players never see your player identifier — they see a separate public ID that can't be used to sign in as you. No system is perfectly secure; if a breach ever put your information at risk, we would notify players and regulators as the law requires — in the app and on this page, since we have no email address for you.

Children

Bridge Co is a card game suitable for a general audience, but it is not directed at children under 13 and we do not knowingly collect information from them. The app collects no personal details that could identify a child. The app's free-text fields are your display name, which our server filters, and feedback, which only we read. If you believe a child has entered something identifying, contact us and we will remove it, and if we learn that we have collected personal information from a child under 13 without a parent's consent, we will delete it.

Your rights

Depending on where you live, you may have the right to see the information we hold about you and get a copy of it, to correct it, to delete it, to restrict or object to how we use it, and to withdraw a consent you gave. The most common of these you can do yourself, at any time: change your display name from the Profile screen (online), erase everything from Settings → About → Delete my player data, switch off usage data in Settings → Privacy, and change your ad choices in Settings → Privacy → Ad privacy choices where that applies.

For anything else, email support@nauvis.app. Because there is no account, tell us the display name you play under; before handing over a copy of a record we may ask for details only its owner would know, so it doesn't go to someone else. We reply within one month, or within the period your local law sets if that is longer.

If you are in the European Economic Area, the UK or Switzerland, you can also complain to your local data protection authority — though we'd be grateful for the chance to put things right first.

US state privacy rights. Residents of California and several other US states have the rights above, a right to opt out of the "sale" or "sharing" of their personal information and of targeted advertising, and a right not to be treated differently for using any of them. We don't sell personal information, and nothing we hold about you is given to advertisers. Google's ad software collects data directly from your iPhone as described under "Ads"; where your state's law gives you a right to opt out of that, the choice appears in Settings → Privacy → Ad privacy choices.

This website

nauvis.app is a static site: it sets no cookies, runs no scripts and uses no analytics. The one third party involved is Google Fonts — the typefaces are loaded from Google's servers, so Google receives your IP address and browser details when a page loads, under Google's privacy policy. Nothing else on these pages contacts anyone but us. Because neither this site nor the app tracks you across other sites and apps, a browser's "Do Not Track" signal has nothing to switch off, and we don't change anything in response to one.

Changes to this policy

If what the app collects changes, this page changes with it and the date at the top is updated. Material changes will also be noted in the store release notes for the version that introduces them, and if a change ever needs your consent, the app will ask for it.