Yavalath

Privacy Policy

Last updated 17 August 2026

Yavalath is a board game. It is free, it has no advertising, and it sells nothing. This policy explains the small amount of information it does handle, and why.

Playing offline

Games played on one phone are saved on that phone and nowhere else. No account is needed and nothing is sent anywhere.

Playing online

The first time you play online the app creates an anonymous account for you automatically. This is a random identifier — it contains nothing about you and is not linked to your phone, your Google account or anything else.

While playing online the following is stored:

• The name and picture you chose. These are shown to the people you play against, and are readable by other signed-in players of the app. Choose a name you are happy for strangers to see.
• A record of each online game — the moves, when they were made, the clock, and who won.
• A recent timestamp while a game is open, so your opponent can tell whether you are still there.

If you create an account

Creating an account is entirely optional and you can play everything without one. If you do create one, your email address and a securely hashed password are stored by Google's Firebase Authentication service.

Your email address is never shown to other players, and is never written to the profile that other players can read. It is used only to let you sign in again, to confirm the address, and to reset your password if you ask.

What is never collected

• No advertising identifier, and no advertising of any kind
• No analytics, usage tracking or crash reporting
• No location, contacts, photos, camera or microphone — the app requests none of these permissions
• Nothing is sold, rented or shared with third parties for their own purposes

Who stores it

The app uses Google Firebase (Authentication and Cloud Firestore) to run online play. Data is stored on Google's servers and Google processes it on our behalf. Their handling of it is covered by Firebase's privacy documentation.

Why we are allowed to hold it (GDPR)

Where the GDPR applies, the legal basis is performance of a contract for the parts required to play online at all — you cannot be matched with an opponent without an identity and a name — and consent for the optional account, which you give by choosing to create one and can withdraw by deleting it.

Your rights

• See and correct it. Your name and picture are editable in the app at any time, on the Account screen.
• Delete it. Account → Delete account removes your account and your profile for good. See the account deletion page for what that does and does not remove.
• Ask for a copy, or ask anything else, by email — the address is below.
• Complain. If you are in the EU you may complain to your national data protection authority. In Croatia that is AZOP.

How long it is kept

Your profile is kept until you delete it. Records of finished games are kept so that both players keep their own history — a game belongs to two people, so deleting one player's copy would take the other player's with it. When you delete your account your name comes off those records and the seat is left unnamed.

Children

The game is suitable for all ages, but it is not directed at children under 13 and no information is knowingly collected from them. If you believe a child has created an account, email the address below and it will be removed.

Changes

If this policy changes the date at the top changes with it. Anything that materially affects what is collected will also be announced in the app.

Contact

Bruno Ninčević — nincevic.bruno2005@gmail.com