Privacy policy
What the Rummy Trio game and the ramitrio.app website collect, why, and how to exercise your rights.
Last updated: 11 November 2026
Rummy Trio is the English name of Rami Trio. The French version of this policy is the reference version.
1. Data controller
The controller is [TO COMPLETE: publisher's name or company name], [TO COMPLETE: postal address].
For any question about your data: [TO COMPLETE: privacy contact e-mail]. You can also write to support from the game's settings.
2. In short
- No sign-up: a guest account is created on first launch. No e-mail, password or phone number.
- No ads, no data selling, no advertising tracker or third-party analytics kit in the game.
- The game only asks for Internet access, network state and vibration. It never accesses your location, contacts, photos, microphone or camera.
- Push notifications are off by default and only turn on with your consent.
- You can export your data and delete your account at any time, from the game.
3. Data we process
| Category | Content |
|---|---|
| Guest account | Internal ID, 8-character public ID, creation and last-activity dates, account status. The game generates a random secret on your phone: the server only keeps a fingerprint of it (SHA-256), never the secret itself. |
| Sign-in | Session tokens (stored hashed), expiry date, name and version of the connecting app. |
| Profile | Nickname, avatar, level, experience, language. |
| Preferences | Felt, card back, card size, four-colour deck, high contrast, reduced motion; notification preferences (consent, categories, quiet hours, device time offset). |
| Games | Table, seat, opponents, moves played (game log), result, placement, forfeits. |
| Chips and progress | Balance and full history of virtual chip movements, missions, streak, league and seasons, collection items owned and equipped, gifts claimed. |
| Messages | Support requests (category, subject, messages, related game, app version, platform, language), inbox messages, in-app notifications. |
| Reports | Reports you file about a nickname, avatar or behaviour, and reports about you. |
| Push notifications (only if you turn them on) | Firebase Cloud Messaging device token, platform, app version. |
| Security and fair play | A fingerprint of your IP address (hashed with a secret key) and its truncated form (e.g. 203.0.113.x), a fingerprint of your device identifier (computed on the phone, then hashed again by the server), first and last seen dates. They are used to detect cheating (multiple accounts, collusion between players). |
No payment data is processed: the game offers no payment today.
4. Purposes and legal bases
- Providing the game (account, online games, chips, progress, collection, support): performance of the contract when you use the game (GDPR art. 6(1)(b)).
- Security, anti-cheat and moderation (nicknames, reports, collusion): our legitimate interest in fair and safe games (art. 6(1)(f)).
- Improving the game with aggregated internal statistics (games played, retention, table balance), computed on our own servers, without third-party tools: legitimate interest (art. 6(1)(f)).
- Push notifications: your consent (art. 6(1)(a)), which you can withdraw at any time in Settings › Notifications.
No decision with legal effects is based solely on automated processing. Accounts are only banned after a human review.
5. What other players see
At the table and in leaderboards, other players see your nickname, avatar, level, division, season rank, the items you equip or showcase, your game stats (games played, wins) and the month your account was created. They never see your chip balance, your support messages or technical data.
6. Recipients and hosting
- The game team, with limited roles (support, moderation, administration). Every sensitive action is logged.
- Cloudflare, Inc. hosts the game server (Cloudflare Workers, D1 database) and this website. Cloudflare processes IP addresses to route and protect traffic.
- Google (Firebase Cloud Messaging), only if you turn on push notifications, to deliver them to your device.
- Google Play distributes the app; its use is governed by Google's privacy policy.
These providers may process data outside the European Union. Such transfers are covered by [TO COMPLETE: safeguards used, e.g. European Commission standard contractual clauses or the Data Privacy Framework].
We never sell or rent your data and never share it for advertising.
7. Retention
- Account and game data: as long as your account exists. [TO COMPLETE: inactivity period after which an account is deleted, if any]
- Sessions: 30 days after last use, then deleted automatically.
- Security data (IP and device fingerprints): until the account is deleted.
- Push notifications: the device token is erased when you withdraw consent or delete your account.
After an account is deleted, some records are kept without your nickname, linked only to an internal ID:
- the history of chip movements, so the game's chip total stays exact (your balance is set to zero);
- game and season results, so other players' history stays consistent;
- collection item serial numbers already assigned;
- your support requests, closed and emptied of your messages, when they are linked to a compensation.
The internal game log, readable by the team only, may contain the nickname used before deletion.
8. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions for what happens to it after your death. Most of these work directly in the game:
- Access and portability: “Export my data” produces a readable JSON file.
- Rectification: nickname, avatar, language and preferences can be changed in your profile and settings.
- Erasure: “Delete my account”.
- Objecting to notifications: Settings › Notifications.
For anything else, write to [TO COMPLETE: privacy contact e-mail]. As the account is not tied to an identity, include your public ID (shown in your profile); we may ask you to confirm the request from the game. You can also lodge a complaint with your data protection authority, in France the CNIL (www.cnil.fr).
9. Export or delete your data
In the game: Settings › Account › “My data and my account”.
- Export my data: account, profile, settings, wallet and chip history, progress, seasons, games, support requests, gifts, collection, notifications and reports filed. The file contains no secret.
- Delete my account: deletion is immediate and permanent. Your nickname is replaced by “Joueur supprimé” (deleted player); the link with your device, your sessions, push tokens, notifications, support messages and security data are erased. It is not possible during a game in progress.
Simply uninstalling the game does not delete your account. Delete it from the settings before uninstalling.
10. Security
Traffic is encrypted (HTTPS). Your device secret and session tokens are only stored as fingerprints. Session tokens are rotated regularly, and any suspicious reuse closes all related sessions. Team access is limited by role, logged, and can require two-factor authentication.
11. Children
Rummy Trio is not intended for children under [TO COMPLETE: minimum age chosen for the game]. The game never asks for an age, a name or contact details. If you believe a child has sent us data, write to us and we will delete the account.
12. This website
ramitrio.app sets no cookies, uses no analytics and loads no third-party script, font or image. Its host, Cloudflare, processes your IP address and technical connection data to serve the pages and protect the site against abuse.
13. Changes
We will update this policy if the game changes (for example if in-app purchases open). The date at the top shows the latest version. We will tell you in the game about any significant change.