BridgeRivalry
Privacy Policy
Who we are
BridgeRivalry is an online bridge card game. This policy explains what information the service collects, why, who else handles it, and the choices you have.
The service is operated by Tapirly, LLC, a Colorado company. Questions about this policy: support@bridgerivalry.com.
What we collect
- Account details. Your email address, a hashed (never plain-text) password if you use one, an optional name, a public display name, and your settings (theme, game speed and similar preferences). Your display name is shown to other players in group play and on leaderboards; your email address never is.
- Google and Apple sign-in. If you sign in with Google or Apple, we receive from them your account ID with that provider, your email address and whether it is verified, and (if you allow it) your name. We store the account ID so we can recognise you next time. If you choose Apple's "Hide My Email", we only receive an Apple relay address that forwards to you. We never receive your Google or Apple password.
- Guest identities. If you play without signing up, we create an anonymous guest profile with a generated display name and store your daily-deal results against it. If you later sign up, your guest results are moved to your new account.
- Game history. Every completed hand you play: the deal, the contract, your calls and plays, and the score. For group play and the daily deal we also store your results for each board so scores can be compared across players, and who joined which session.
- Premium AI records. When you play a premium AI hand, we store each AI move: the full game information the AI was given (the auction, the cards played, and the cards visible to the AI seat), the AI's answer and reasoning, token counts, cost and timing. This is game state, not personal information, and is linked to your account so we can show you your hands, review AI quality and measure cost. If you rate an AI move and add a note, we store that note. Please don't put personal information in feedback notes.
- Usage analytics. We use Google Analytics, and nothing else, to understand how the product is used. It receives page views and in-app actions. Examples: starting or finishing a daily deal, creating an account and which sign-in method you used (email, Google or Apple), signing in, opening checkout and buying or starting a trial, hosting or joining a group session, and using the coach. Each action carries only simple values such as the plan you chose, its price and currency, or the sign-in method, and never your account ID, email address, display name or session codes. For each page you view it receives the page address (with the part after a question mark and any code, token or ID in the address removed, for example a group-play session or invite code) and the page title. Google also collects some things itself when your browser contacts it: your IP address (which Google uses to work out your approximate location), your browser and device details, and its Analytics cookies. We do not send Google your account ID, email address or display name, and we turn off Google signals and ad personalization, so Google Analytics is not used for advertising; we use no advertising tools. If you are in the European Union, the United Kingdom or Switzerland, Google Analytics does not load unless you accept it (see Cookies and local storage).
- Sign-in and security. A session token kept in a cookie so you stay signed in (see Cookies and local storage), and one-time tokens for email verification and password resets (stored hashed).
- Support emails. If you write to us we keep the message and our reply.
When you subscribe, payment is handled by our payment providers (see below). We give them your account ID and email address at checkout. They send us a record of each billing event (a purchase, renewal, cancellation or refund), which we store as received: your subscription status, plan, price and currency, trial and renewal dates, the store and its transaction IDs, your country, and the email address you checked out with. We never see or store your card number.
How we use it
- To run the game: sign you in, save your hands, score and compare boards.
- To send account emails: verification and password reset.
- To provide, price and improve premium AI features.
- To understand which parts of the product are used, and to fix problems.
- To prevent cheating and abuse, especially in competitive play.
We do not sell your personal information, and we do not show advertising.
Who else handles your data
- Amazon Web Services (AWS). Hosting, our database, and email delivery (Amazon SES). Our servers and database are in the US (us-east-2, Ohio).
- Anthropic. When you play with premium AI opponents, the game state for that move (auction, cards played, the cards the AI seat can see, and the vulnerability) is sent to Anthropic's Claude API to choose a move. We do not send your name, email, account ID or other identifying details with the request. Free-tier bots run on our own servers and never contact Anthropic.
- RevenueCat and Stripe. When you subscribe, RevenueCat manages your subscription and Stripe processes the payment. They receive your account ID and payment details as needed to do so.
- Google and Apple. If you sign in with Google or Apple, that sign-in happens on their pages under their own privacy policies. We only send them what is needed to sign you in.
- Google Analytics (Google LLC). Counts page views and in-app actions, as described under Usage analytics. It runs only if you have accepted it (where we ask first) or you are outside the regions where we ask, and it receives your IP address, browser and device details, the page address and the simple values described above, but not your account ID, email or display name.
We may also disclose information if the law requires it, or to protect the service and its users from abuse.
How long we keep it
- Guest profiles and their data are deleted automatically after 30 days of inactivity.
- Account data, game history and premium AI records are kept for as long as your account exists.
- Google Analytics keeps event data for 2 months and user-level data (tied to its cookie) for 14 months, then deletes it.
- Session tokens expire after 7 days; verification and reset tokens expire quickly.
You can delete your account yourself from your account page (Delete account, which asks you to confirm with your password, or with Google or Apple if that is how you sign in). If you have a subscription that is still set to renew, cancel it first from Manage subscription; you keep access until the period ends and can then delete your account.
Deleting your account immediately and permanently deletes your email, password, name and display name, any linked Google or Apple account IDs, your settings, your sign-in sessions and any pending verification or reset tokens, your premium practice hands, and any feedback notes you wrote on premium AI moves. If you hosted a private session, its name is cleared.
What we keep, no longer linked to you:
- Your scores and plays on shared boards in group sessions and the daily deal. Other players' matchpoint standings are computed against the whole field, so removing your results would change theirs. They show as "Deleted player".
- Your past solo game results (deal, contract and score).
- Premium AI move logs (game state and usage counts).
- Page views and actions already sent to Google Analytics. They are not tied to your account, so we cannot find and delete them; Google deletes them on the schedule above.
- Billing event records from our payment provider, which we keep for accounting. We remove the email address from them when you delete your account. They keep the internal ID that was your account ID, but nothing ties it to a person on our side after deletion.
Your choices and rights
You can delete your account yourself (see How long we keep it). You can also ask us to access, correct or export your information by emailing us. You can change your display name and preferences in the app. Depending on where you live (for example, the EU, UK or California) you may have additional legal rights; contact us and we will respond as the law requires.
Security
Passwords are hashed, traffic is encrypted in transit, and the unplayed cards of a competitive board are kept on our server until you have played them. No system is perfectly secure, so we cannot guarantee absolute security.
Children
BridgeRivalry is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.
International users
The service is run from the United States. By using it you understand your information will be processed and stored there.
Changes to this policy
We will post updates on this page and change the effective date. If a change is significant we will tell signed-in users by email or in the app.