Privacy Policy

1. Who We Are

Plump is a multiplayer card game available as a web application and a native iOS app. It is developed and operated by:

Studio Barbanson, the trade name of De Barbanson Data Consultancy (KvK 78453208)
The Netherlands
debarbanson@debdc.nl

For the purposes of the EU General Data Protection Regulation (GDPR), De Barbanson Data Consultancy, trading as Studio Barbanson, is the data controller.

2. What Data We Collect

Plump is designed with a privacy-first approach. We collect the absolute minimum data necessary to enable gameplay.

2.1 Data Provided by You

• Player name: A display name you enter when joining a game. This is temporary, used only during the active game session, and is not stored after the game ends.

2.2 Data Generated During Gameplay

• Game state data: Card hands, predictions, trick results, scores, and round progression. This data exists only while a game is active. The live game record is marked inactive when the game finishes and purged shortly after.
• Connection data: Temporary connection identifiers used to support real-time gameplay and reconnection if your connection drops.

2.3 Data Retained After a Game Ends

When a game completes, the following summary is saved so that long-term statistics and a history of past games are available:

• Game history: Game ID, start and end timestamps, player names, final scores, final plump counts, winner, and game duration.
• Player statistics: Aggregated per player name: games played, games won/lost, total and average score, highest score, prediction accuracy, first and last game timestamps.

Player statistics are keyed on the player name you type when joining a game. If you use the same player name across multiple games, your statistics are aggregated under that name. If you use a different name each time, no cross-game profile is built.

2.4 Operational Diagnostics

To debug connectivity issues, the app records a small set of technical events to an internal diagnostics table. These events include things like “successfully subscribed to game updates”, “channel timed out”, “reconnect attempt”, “mutation retried”, and the like. Each event includes:

• Event type (a fixed string from a short list)
• Your player name and game ID (if a game is active at the time)
• Your browser or device user agent string
• A timestamp

This data is used exclusively to diagnose technical problems. It is never used for advertising, marketing, behavioural profiling, or building a user profile across games.

2.5 Data Stored Locally on Your Device

• Settings preferences: Your chosen theme, language, sound mute state, and card sorting preferences are stored in your browser's localStorage. This data never leaves your device and is not transmitted to our servers.
• Plump Pro: Whether you have Plump Pro (including an earlier "Play with friends" purchase, or buying Plump when it was a paid app) is checked with the App Store or Google Play on your device and remembered there. We do not receive your purchase receipt or any store account information. When you open a room to friends, our server only records that the room is open.
• Stats and game history: The stats and game history that come with Plump Pro, including scorepad table stats, are kept only on your device (local storage). They are never sent to Studio Barbanson or anyone else. The bot level you choose for a game (Standard or Expert) is stored on our server with that game, like other game data.

2.6 Data We Do NOT Collect

• Email addresses, phone numbers, or other contact information
• Real names, addresses, or government identifiers
• Location data
• Persistent advertising identifiers (IDFA, IDFV, GAID)
• Behavioural or marketing profiles
• Financial or payment information. All purchases are processed by Apple or Google; we never see your card details, Apple ID, Google account, or billing address
• Microphone, camera, contacts, photos, or any other device sensors

3. How We Use Your Data

The limited data we collect is used exclusively to:

• Enable real-time multiplayer gameplay
• Display player names to other participants during a game
• Maintain game state and synchronize it across players
• Support reconnection if a player temporarily loses their connection
• Keep a history of completed games and aggregated per-player statistics
• Diagnose connectivity problems and improve the reliability of the service

We do not use any data for profiling, marketing, advertising, or any purpose other than delivering and improving the core game experience.

4. Data Storage and Retention

Our database infrastructure is hosted by Supabase in the Frankfurt, Germany (EU) region. No data is transferred outside the European Economic Area.

5. Cookies and Tracking

Plump does not use:

• Tracking cookies
• Analytics services (e.g., Google Analytics)
• Advertising networks or pixels
• Third-party tracking scripts

The only client-side storage used is localStorage on your device, for your settings (theme, language, sort preferences), your saved scorepad games and your Plump Pro stats and game history. This is not a cookie, stays on your device and is never sent to us or anyone else.

6. Third-Party Services

We use the following third-party services to operate Plump:

• Supabase: Database hosting, real-time communication, and serverless functions. Data is stored in the EU (Frankfurt). Supabase Privacy Policy.
• Netlify: Web hosting and content delivery for the web version. Netlify Privacy Policy.
• Apple App Store: Distribution of the iOS app and processing of the optional one-time "Plump Pro" in-app purchase. Apple receives and stores all payment-related information; we never receive your Apple ID, card details, or billing address. Apple's own privacy terms apply. Apple Privacy Policy.
• Google Play: Distribution of the Android app and processing of the optional one-time "Plump Pro" in-app purchase. Google receives and stores all payment-related information; we never receive your Google account, card details, or billing address. Google Privacy Policy.

No data is shared with third parties for advertising, marketing, or analytics purposes.

7. Data Security

We take reasonable measures to protect game data during active sessions:

• All communication between the app and our servers uses HTTPS/TLS encryption
• Database access is restricted through row-level security policies
• Edge Functions validate all game actions server-side to prevent tampering
• No sensitive personal information is collected or stored

8. Your Rights Under GDPR

As we are based in the Netherlands, the GDPR applies. The personal data we hold about you is limited to the player name(s) you have used, and the game history and statistics attached to those names. You have the following rights:

• Right of access: You can request a copy of all game history rows and statistics associated with a given player name.
• Right to erasure: You can request that we delete all game history, player statistics, and operational diagnostics associated with a given player name.
• Right to rectification: If a player-name record contains an obvious error, we can correct it on request.
• Right to data portability: You can request your data in a machine-readable format (JSON).
• Right to object: No data processing for profiling, marketing, or automated decision-making takes place.

To exercise any of these rights, email debarbanson@debdc.nl with the player name(s) you have used. We will respond within 30 days, as required by the GDPR. Because we do not link player names to verified identities, we may ask you to confirm context (e.g. approximate dates of games played, names of co-players) to prevent erroneous or malicious deletion requests.

9. Children's Privacy

Plump is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Since the app does not require accounts or collect personal information, there is minimal risk. If you believe a child has provided personal data through the app, please contact us and we will take steps to remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Since we do not collect email addresses or contact information, we cannot notify users directly of changes. We encourage you to review this page periodically.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Studio Barbanson
Email: debarbanson@debdc.nl