Privacy policy
The 500 Card Game · last updated 30 September 2026
The 500 Card Game is a card game for iPhone, iPad and Android made as a personal project. This page says what the app stores about you, why, who handles it, and how to delete it. If anything here is unclear, write to fivehundredcardgame@gmail.com.
Playing solo
Games against the computer run entirely on your device. Your settings (theme, sound, accessibility), your statistics and a game in progress are saved on the device only and are never sent anywhere.
Playing online
When you first open Play Online, or Settings > Account, the app signs you in anonymously, so you can play without an account. To run online games it stores:
- An anonymous user id, created by the app, to know which seat is yours.
- Your display name, which the other players at your table see, and the preset avatar and card theme you picked. Names with slurs or profanity are refused.
- Your e-mail address from Apple or Google, only if you choose to link your account with Sign in with Apple or Google Sign-In (to keep your online name, avatar and theme across devices; your stats stay on the device). If you use Apple's "Hide My Email", we only get the relay address. When you link Google, Google's sign-in also passes on your Google profile name and a link to your profile picture, which the sign-in service stores with your account; the game does not use or show them.
- Game data for online games only: the rooms you join, your seat, the bids and cards played, the results, and the preset quick-chat phrases and emotes you send (those are deleted after a day). Your statistics are not uploaded: they stay on the device.
- A push notification token, if you allow notifications, so the app can tell you when it is your turn, when you are invited, and when a game starts or ends.
Quick-chat is limited to preset phrases and emotes; there is no free-text chat.
Reporting and blocking players
At an online table, Quick chat > Report or block lets you report another player or block them. Report opens an e-mail to us, from your own mail app, with that player's display name, Player ID and room code and your Player ID; we use it only to deal with the report (for example to rename or delete an offensive account) and delete the e-mail once it is dealt with. Block is kept on your device only: that player's quick-chat is hidden and their name shows as "Blocked player". You can unblock in Settings > Account.
Crash reports
If the app crashes or hits an error, it sends a crash report: the error, the app version, the device model and operating system, and non-personal context such as the screen you were on and whether you were online. Crash reports never contain your cards, your messages or any sign-in tokens.
Who handles the data
- Supabase hosts the online game server, the database and sign-in.
- Google Firebase delivers push notifications (Firebase Cloud Messaging) and collects crash reports (Firebase Crashlytics).
- Apple and Google handle Sign in with Apple and Google Sign-In when you choose them.
- Cloudflare hosts this website and the invite links. Its Turnstile check may run once, when the app creates a new online profile, to stop automated sign-ups: it looks at browser and device signals and your IP address. It is used for security only, not for tracking or advertising.
The data is used only to run the game. It is never sold, never used for advertising, and there are no ads or tracking in the app.
Keeping and deleting your data
Online data is kept while your account exists. You can delete your account at any time in the app under Settings > Account > Delete account (step by step: fivehundredapp.pages.dev/delete-account): this removes your profile, your sign-in and your personal data from the server, and any online game you are in continues with a computer player in your seat. If you linked Sign in with Apple, the app asks Apple to confirm and revokes its Apple sign-in, so the game also disappears from your Apple ID's list of apps using Sign in with Apple. Push tokens are removed when you sign out or delete your account. Crash reports are kept by Firebase for a limited time (90 days) and then deleted. Uninstalling the app removes everything stored on the device.
You can also ask for a copy of your data, a correction, or deletion by writing to fivehundredcardgame@gmail.com.
Children
The app is a general-audience card game. It does not knowingly collect personal information from children under 13 beyond the anonymous game data above; linking an Apple or Google account is optional.
Changes
If this policy changes, the new version is posted on this page with a new date.