Cardiva Privacy Policy

Summary

The sections below explain these points in detail.

1. Who we are and scope

Cardiva (the “Game”) is a collection of classic card games published by Mali's Games (“Mali's Games”, “we”, “us”, “our”), an independent game studio. This policy explains how information is processed when you install and play Cardiva on iOS or Android, and when you contact us about it. It applies to version 1.0 of the Game and later versions until this policy is updated.

This policy does not cover the services of third parties, such as the app stores you download the Game from or the advertisers whose ads appear in the Game. Those parties process information under their own privacy policies. Information about the Mali's Games website is given separately in section 20.

You can contact us about privacy at privacy@malisgames.com.

2. What Mali's Games controls, and what third parties process

It is important to distinguish between information that Mali's Games itself handles and information that third-party service providers process through the software development kits (“SDKs”) built into the Game. Mali's Games does not operate its own servers or backend for the Game.

Handled by Mali's Games

• On your device: your settings (such as screen orientation, language, card colours, sound and haptics), the nickname you use in friend rooms, your game statistics, games left half way so you can continue them, the card back and table you chose, the purchases you own, the end time of any cosmetic trial, and your advertising and analytics privacy choices. This information is stored locally and is not sent to us. There is no account or cloud save, so uninstalling the Game or clearing its data removes it; purchases can be restored from the app store.
• Analytics reports (only if you allow Analytics): we decide which events the Game records (see section 8) and we view the resulting reports in Unity’s dashboard. These reports are mainly aggregated or linked to pseudonymous identifiers, not to names or contact details.
• Sales reports: the app stores give us reports about purchases of the Game’s products. These reports do not include your payment details.
• Messages you send us: if you contact us by email, we receive your email address and whatever you include in your message.

Processed by third-party providers

Most of the technical information described below is collected and processed directly by the advertising, analytics and app store providers listed in section 11, under their own terms and privacy policies. Depending on the service and the applicable law, a provider may act as our service provider or processor, or as an independent controller of the information it receives. Mali's Games does not build or maintain advertising profiles of players; any advertising profiles are created and held by advertising providers, subject to their policies and your choices.

What the Game does not ask for

The Game does not ask you to create an account (friend rooms use an anonymous player ID, see section 9) and does not request your name, email address, phone number, contacts, photos or precise (GPS) location. It never receives your payment card or bank details: purchases are paid to Apple or Google. The Game involves no real-money gambling, betting or prizes.

3. Information processed

Depending on your device, your operating-system settings, where you are and the choices you make, the following categories of information may be processed. The table in section 11 shows which services are involved.

By the advertising services (when advertising is active)

• Device and app information: device type and model, operating system and version, screen size, language and region settings, and the Game’s version.
• Network information: IP address and connection type.
• Approximate geographic information: such as country or region, typically derived from your IP address. The Game does not request your precise location.
• Identifiers: identifiers generated by the advertising SDKs, vendor identifiers such as Apple’s Identifier for Vendors (IDFV), the Identifier for Advertisers (IDFA) on iOS only if you allow tracking (see section 10), and, where available and permitted, the Google Advertising ID on Android.
• Ad requests, impressions and interactions: ad requests, ads shown, clicks, viewing time, whether a rewarded or interstitial ad was completed, and related technical and fraud-prevention signals.
• Consent signals: the advertising consent choices you make, which are passed to advertising providers so that they can respect them.

By the app stores (when you make or restore a purchase)

• Purchase and transaction information: which product you bought, the transaction and its status, and the store receipt. Apple or Google process the payment under their own terms; the Game receives only the confirmation of what you own.

By Unity Analytics (only if you choose Allow)

• Pseudonymous installation identifiers: identifiers generated to recognise an installation of the Game over time.
• Session information: for example when the Game is opened and how long a session lasts, and settings such as language and orientation.
• Gameplay events: for example which card game is started or finished, the mode and bot level, whether it was won, how long it took, and whether a saved game was continued; whether an optional ad was watched; and the result of a purchase attempt. These events contain game-related values only. They do not contain free text you type.
• Device information: such as device model, operating system and version, language and the Game’s version.
• Approximate region: such as country or region, derived from your IP address.

By Unity Gaming Services (only when you use friend rooms)

• Anonymous player ID: a random identifier and sign-in tokens created by Unity Authentication, so that you can get your seat back after a lost connection.
• Nickname: the name you choose for friend rooms (3 to 16 characters).
• Room information: the game, the number of seats, the room code, who sits where, the moves played, and the emojis and set phrases sent in the room.
• Network and device information: IP address and connection details needed to connect the players’ devices, and basic device and app information processed by the Unity SDKs.

Analytics data is pseudonymous. It is not linked to your name or contact details, but it is not completely anonymous, because it is associated with identifiers for your installation.

4. Why information is processed

Mali's Games does not sell personal information for money.

5. Advertising

Cardiva is supported by ads. Version 1.0 uses the following advertising services:

• Unity LevelPlay — a mediation platform operated by Unity. For each ad opportunity it may request ads from the advertising networks integrated into the Game and select which ad to show.
• ironSource Ads and Unity Ads — advertising networks operated by Unity.
• Google AdMob — an advertising network operated by Google.

No other advertising networks are integrated into version 1.0. If we add or remove an advertising network, we will update this policy.

Ad formats

• Interstitial ads are full-screen ads shown only after a finished game or between Solitaire deals, never during play, subject to frequency and timing limits. A player’s first few games show no interstitials.
• Banner ads appear at the bottom of the main menu and the Solitaire screen only.
• Rewarded video ads are optional. You may choose to watch one for an extra Solitaire hint after the free hints, or to try a locked card back or table for 24 hours. You can always decline.

Buying Remove Ads (alone or in the bundle) removes interstitial and banner ads; optional rewarded videos stay available.

Personalised and non-personalised ads

• Personalised ads are selected using information about your device and activity, which may include activity in other apps and websites linked through identifiers. Personalised ads are shown only where permitted by applicable law, by your choices and by your device settings — for example, only with your consent in regions where consent is required.
• Non-personalised ads are selected based on context, such as the Game itself and your approximate location, rather than on a profile of your past activity. Non-personalised and limited ads still involve some processing of information, for example to deliver and measure ads, limit how often they are shown and prevent fraud.

6. Advertising consent

Users in regions where consent is required — including the European Economic Area (EEA), the United Kingdom and Switzerland — are shown a privacy and consent message managed with Google’s User Messaging Platform (UMP). The message may use the IAB Transparency & Consent Framework to communicate your choices to advertising providers. Advertising consent is separate from your Unity Analytics choice (see section 8).

How the Game respects your choice

• The Game requests applicable consent before it initialises ad mediation (Unity LevelPlay).
• If you do not give the consent required to store or access information on your device for advertising, the Game does not initialise ad mediation when it starts. You can keep playing without ads, but optional rewarded videos are unavailable.
• If you give consent for only some purposes, limited or non-personalised advertising may still be possible, depending on the purposes you grant and the requirements of each advertising provider.
• Your choices are stored on your device and are also respected when you restart the Game without an internet connection.

Changing or withdrawing consent

You can review or change your choices at any time in Settings › Privacy options in the Game (this entry is available where the consent requirements apply to you). If you grant consent later, advertising can be enabled. If you withdraw the required consent, the Game stops loading and showing further ads; an advertising SDK that was already initialised may remain initialised until the Game is restarted. Withdrawing consent does not affect processing that took place before you withdrew it.

These controls govern how the Game itself starts and uses its advertising services. They do not guarantee that no technical information is ever exchanged with a third party — for example, the consent platform itself needs to communicate with Google to show the consent message and store your choice.

7. In-app purchases

Cardiva offers optional one-time purchases: Remove Ads, a Card Back Pack, a Table Pack, and a bundle of all three. They are bought through the Apple App Store or Google Play and processed by Apple or Google under their own terms and privacy policies. The Game uses Unity In-App Purchasing to request a purchase and to learn which products you own; it does not receive or store your payment details.

• What you own is remembered on your device so that it works offline, and is confirmed with the app store when the Game starts.
• Use Settings › Restore purchases to get your purchases back on a new device or after reinstalling the Game, with the same store account.
• Refunds are handled by Apple or Google according to their policies.

8. Unity Analytics (opt-in)

Cardiva includes Unity Analytics, a service operated by Unity Technologies, to help us understand how the Game is played and how it performs. Analytics is off by default for all players worldwide, and is separate from advertising consent.

• After the consent message (if any), the Game asks once whether to allow Analytics, with the options Allow and No thanks.
• The Game does not enable Analytics data collection unless you choose Allow. Events from before your choice are not collected.
• You can turn Analytics on or off at any time in the Game’s Settings. Turning it off stops further Analytics collection.
• Your choice is stored on your device and remembered between sessions.

The information Unity Analytics may process is described in section 3. Deleting Analytics data is explained in section 13.

9. Friend rooms

Friend rooms let you play Pişti, Batak and Pis Yedili with people you invite. They are optional: nothing described in this section happens until you choose Play with Friends and create or join a room.

• Services used: Unity Gaming Services, operated by Unity Technologies — Unity Authentication (anonymous sign-in), and Unity Multiplayer Services sessions with Relay, which create the private room and pass game messages between the players’ devices. One player’s device runs the game; Mali's Games does not operate its own game servers.
• What other players see: the players in your room see your nickname, your seat, your moves and the emojis and set phrases you send. Please do not use your real name or personal details as your nickname. Nicknames are checked against a list of offensive words.
• No free-text chat: players can only send a fixed set of emojis and phrases; anything else is dropped by the Game.
• Private rooms: a room can only be joined with its code or invite link, and nobody can join once a game has started. Rooms end when the players leave; the Game does not keep a history of rooms or moves online.
• Invite links: if you share an invite, the Game opens your device’s share menu with a link to malisgames.com that contains the room code. You decide which app and which people receive it. Opening the link shows the code and opens the Game if it is installed; the page does not use cookies, analytics or tracking.
• Deleting your online identity: Settings › Delete online identity asks Unity to delete the anonymous player and its data. A new anonymous ID is created the next time you use a friend room.

10. iOS tracking and device identifiers

On iOS, Cardiva asks for permission to track you across apps and websites owned by other companies through Apple’s App Tracking Transparency (ATT) prompt. The prompt is shown once, after the advertising consent message where one applies, and only when ads may be shown.

• If you choose Allow, the advertising SDKs may use your device’s Identifier for Advertisers (IDFA) to show you more relevant ads and to measure their performance.
• If you choose Ask App Not to Track, the IDFA is not available to the Game or its advertising SDKs, and the Game still works normally with ads that do not rely on it.
• You can change your choice at any time in iOS Settings › Privacy & Security › Tracking.

Advertising and analytics SDKs may also process other device information, such as device model, operating-system version, the Identifier for Vendors (IDFV) and IP address, for purposes such as delivering ads, measuring ad performance (including through Apple’s privacy-preserving attribution frameworks), preventing fraud and, where you allow it, analytics. These purposes are subject to your consent choices where consent is required.

11. Third-party service providers

Version 1.0 of the Game uses the following third-party services. Each provider processes information under its own terms and privacy policy, which we encourage you to read.

The app stores also process information about your download and use of apps under their own terms and privacy policies. We may also disclose information where required by law, to protect the rights and safety of players or others, or if the Game is transferred to another publisher, in which case this policy or one offering comparable protection will continue to apply.

12. Your privacy choices

• Advertising consent: where applicable, use Settings › Privacy options in the Game to review, change or withdraw the choices you made in the consent message (see section 6).
• Tracking on iOS: change your choice in iOS Settings › Privacy & Security › Tracking (see section 10). See Apple’s guide: If an app asks to track your activity.
• Analytics: use the Analytics on/off setting in the Game’s Settings to allow or stop Unity Analytics at any time (see section 8).
• Delete analytics data: use this option in the Game’s Settings to request deletion of your Unity Analytics data (see section 13).
• Delete online identity: use this option in the Game’s Settings to delete the anonymous player ID used for friend rooms (see section 9).
• Fewer ads: buy Remove Ads to stop interstitial and banner ads; rewarded videos are always optional.
• Android advertising ID: you can reset or delete your advertising ID in your device settings (on many devices under Settings › Privacy › Ads or Settings › Google › Ads; the exact location varies by device).
• Google ad settings: you can manage Google ad personalisation at My Ad Center.
• Stop all processing by the Game: uninstall the Game. This also removes the information stored on your device.
• Ask us: email privacy@malisgames.com and we will help where we can.

13. Deleting your data

Delete analytics data

The Game’s Settings include a Delete analytics data option. When you use it:

• the Game sends Unity a request to delete the Unity Analytics data associated with the identifiers available to the current installation of the Game on your device;
• Analytics collection is turned off;
• if your device is offline, the request is sent when a connection is available.

Deletion is carried out by Unity on its systems, under Unity’s own processes and timelines, so data may not be removed immediately or from every system at once. The request covers only Unity Analytics data linked to the current installation’s identifiers. It does not necessarily cover data associated with a previous installation of the Game, with other identifiers, or held by advertising providers or app stores. To make a request to those providers, use the links in section 11.

Delete online identity

If you have used friend rooms, Settings › Delete online identity asks Unity Authentication to delete your anonymous player ID and the data linked to it. It cannot be used while you are in a room. Your nickname stays on your device until you change it or uninstall the Game.

Data on your device

Settings, statistics, games in progress and privacy choices stored on your device are removed when you uninstall the Game or clear its data. Because there is no cloud save, this cannot be undone; purchases can be restored from the app store.

Other requests

For any other deletion or privacy request, contact privacy@malisgames.com.

14. Users in the EEA, United Kingdom and Switzerland

Legal bases

Where the EU General Data Protection Regulation (GDPR), the UK GDPR or the Swiss Federal Act on Data Protection applies, the processing we are responsible for relies on:

• Consent — for Unity Analytics, for personalised advertising, and for storing or accessing information on your device where consent is required;
• Contract — for providing the products you buy and restoring your purchases, and for running the friend rooms you choose to create or join;
• Legitimate interests — for operating the Game, non-personalised or limited advertising and ad measurement where these do not require consent, security and fraud prevention, and answering support requests, where these interests are not overridden by your interests and rights;
• Legal obligation — where processing is needed to comply with the law.

Your rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• have your information deleted;
• restrict processing, or object to processing based on legitimate interests;
• data portability;
• withdraw consent at any time, using Settings › Privacy options and the Analytics setting in the Game, or by contacting us;
• lodge a complaint with your local data protection authority.

To exercise these rights, email privacy@malisgames.com. Because the Game has no accounts and we do not operate our own servers for it, we may need additional details — such as an identifier from your device — to find information relating to you, and in some cases we may not be able to identify it at all. For information held by third-party providers, you can also contact them directly using the links in section 11.

15. Users in the United States

Several US states have comprehensive privacy laws, and their requirements differ. Depending on the state you live in and subject to the limits in those laws, you may have the right to:

• know about, and access, personal information processed about you;
• correct inaccurate personal information;
• delete personal information;
• opt out of targeted advertising, and of the “sale” or “sharing” of personal information as those terms are defined in your state’s law;
• not be discriminated against for exercising your rights;
• appeal a decision we make about your request, where your state provides this right.

Mali's Games does not sell personal information for money. However, the use of device identifiers and related information by advertising providers to show personalised ads may be treated as “targeted advertising”, “sharing” or a “sale” under some state laws. You can limit this by denying tracking on iOS, by resetting or deleting your advertising ID and limiting ad personalisation in your device settings, by using the privacy options in the Game where available (see section 12), or by contacting us.

The categories of information involved are described in section 3, the purposes in section 4, and the categories of recipients in section 11. To make a request, email privacy@malisgames.com. Where your state allows it, you may use an authorised agent.

16. Children’s privacy

Cardiva is not specifically directed to children. It is a general-audience collection of classic card games with no real-money gambling. We do not knowingly collect personal information from children in a way that requires parental consent under applicable law.

If you are a parent or guardian and believe your child has provided personal information through the Game, please contact privacy@malisgames.com. We will take appropriate steps, which may include asking the relevant service providers to delete the information.

17. Data retention

Information stored on your device remains there until you delete the Game or clear its data.

The anonymous player ID for friend rooms is kept by Unity until you delete it with Settings › Delete online identity or ask us to help delete it. Room sessions end when the players leave.

Information processed by Unity Analytics, Unity Gaming Services, the advertising providers and the app stores is retained according to those providers’ own retention policies and, where available, the settings we choose. Where we can configure retention, we aim to keep information only for as long as it is needed for the purposes described in this policy. You can request deletion of Unity Analytics data as described in section 13.

Support and privacy emails are kept for as long as needed to handle your request and any follow-up, unless we need to keep them longer to meet legal obligations.

18. Security

We take reasonable measures to protect information under our control, for example by limiting access to provider dashboards and working with established service providers. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of information.

19. International processing

Third-party service providers may process information in countries other than the one you live in, including the United States and other countries where they or their sub-processors operate. These countries may have different data protection laws. Where required, transfers of personal information from the EEA, UK or Switzerland rely on appropriate safeguards — such as Standard Contractual Clauses or adequacy decisions — as provided by the relevant service providers.

20. The Mali's Games website

This section concerns the website malisgames.com only, not the Game. The website is hosted and delivered by Cloudflare, which processes technical information such as IP addresses, browser details and requested pages in order to deliver the website and protect it against abuse.

The website does not use Cloudflare Web Analytics or any other analytics or tracking service. As part of delivering the website, Cloudflare keeps aggregate traffic statistics, such as request counts by country, which we can see only in summary form. For details, see the Cloudflare Privacy Policy.

The website does not show advertising and does not use advertising or analytics cookies. Cloudflare may set strictly necessary cookies for security purposes, such as distinguishing legitimate visitors from automated traffic.

21. Changes to this policy

We may update this policy from time to time, for example when the Game’s features or service providers change. The “Last updated” date at the top of this page will reflect the latest changes. If changes are significant, we will take reasonable steps to let you know, for example through a notice in the Game or on this page.

22. Contact