Privacy policy

Summary

• You sign in with Google or Apple. You verify a phone number only if you want to redeem vouchers.
• We collect your account details, what you do in the game, your chats, and device and diagnostic data.
• Other players can see your username, avatar, league and stats. They cannot see your email or phone number.
• We use analytics, crash reporting and ads. On the Play Store and App Store builds we also use session recordings with Microsoft Clarity.
• We do not sell your personal information.
• You can delete your account in the app, or by email. Details are in Delete your account and data.
• Questions or complaints: cabocardgame@gmail.com.

Who we are

Cabo is made by The Flutter Guy, an independent developer based in India. In this policy, "we" and "us" mean The Flutter Guy. We decide why and how your personal data is used. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary. Under the GDPR and UK GDPR we are the controller.

Contact: cabocardgame@gmail.com. This policy applies to the Cabo apps for iPhone and Android and to this website.

What we collect

You give us

• Account details: your name, email address and profile photo from Google or Apple (Apple may give us a private relay email address), a username, and a phone number if you verify one.
• Profile picture: an avatar from the app, or a photo you choose from your gallery. Photos you upload are stored in Firebase Storage.
• Messages: chat messages, stickers and table invites you send to other players, and reports you file about other players.
• Referral code: if you invite friends or join through an invite.
• Feedback: what you write in the in-app feedback sheet or in an email to us.
• Voucher requests: which voucher you redeemed and when. We use your verified phone number to contact you about it.

Collected while you play

• Gameplay: games you join and finish, moves, scores, wins, XP, PQ, league and leaderboard position, daily streaks, quests, spins, game stats, friends, blocked players, and your coin and gem history, including shop items and voucher redemptions.
• Device and app data: platform, device make and model, OS version, a device identifier, app version, language, and your push notification token.
• Advertising identifier: the Android advertising ID, or the iOS advertising identifier if you allow tracking.
• Diagnostics: crash reports, error logs, and the screens you view and actions you take in the app.
• Online status: whether you are online, so friends and tables work. Stale entries are cleared automatically.
• Session recordings: see Session recordings.

We do not collect your precise location, contacts, or microphone audio. The app may ask for camera or photo access only when you pick a profile picture or save a win card to your photos. You can refuse. The app still works.

Data, purposes and retention

The "basis" column says why we are allowed to use the data. In India, we rely on your consent (given when you create an account and use the features) and on legitimate uses the DPDP Act allows, such as providing a service you asked for and preventing fraud. For people in the UK and EU, we rely on contract (to run the game), legitimate interests (security, fair play, improving the game) and consent (ads personalisation, where required).

If a provider's own retention is shorter or longer than we describe, the provider's policy applies to its copy. Backups may keep deleted data for a short time before they are overwritten.

What other players see

Other players can see your username, avatar, equipped items (such as badges, card themes and pets), league, PQ, XP, streak and game stats. This happens at tables, on leaderboards, in friend lists and in chats. Messages you send are visible to the players in that chat.

The app does not show other players your email address, phone number, wallet or sign-in details. Do not put personal information in your username or chats. You can block a player from their profile and report a message or player from a chat.

Service providers

These companies process data for us or collect it through the app. Each has its own privacy policy, linked below. Providers act under their own terms. We do not sell your personal information to them.

We may also share information when the law requires it, to answer a valid legal request, or to protect the safety of players and the game. If we ever sell or merge the app, your data may move to the new owner, who must follow this policy.

Ads and tracking

Cabo is free and shows ads through Google AdMob. Some ads are rewarded: you choose to watch one to earn coins. AdMob and its partners may use your advertising identifier and device data to choose and measure ads.

• iPhone: the app asks permission before tracking you across other companies' apps and websites. You can change your choice any time in Settings, Privacy and Security, Tracking. Apple explains how.
• Android: you can reset or delete your advertising ID, and opt out of ad personalisation, in your device settings. Google explains how.
• Europe and the UK: the app shows a consent form from Google (User Messaging Platform) when the law requires it. If you decline, you get non-personalised ads.
• Ad settings: manage your Google ad personalisation at adssettings.google.com. Read how Google uses data from apps.

We do not sell personal information and we do not "share" it for cross-context behavioural advertising as those terms are defined under California law, except to the extent the ad providers above do so through ads in the app. California residents can opt out using the device controls above.

Session recordings

The App Store and Play Store versions of Cabo use Microsoft Clarity. Clarity records how you use the app: taps, scrolls, screens, and a visual replay of what is on screen. We use it to find confusing screens and bugs. Microsoft processes this data for us and under its own privacy statement.

Clarity masks sensitive content, including text typed into input boxes, so it does not capture it. We do not set any account ID, name, email or phone number on Clarity recordings. Other text on screen, such as usernames at a table or in leaderboards, may appear in a recording.

To avoid recordings, email us and we will tell you when a build without recordings is available, or you can delete your account. Recordings are kept for 30 days by Microsoft.

Data sent outside India

Our game server runs in Mumbai, and our databases are hosted by Google and MongoDB in Asia. Several of our providers, including Google, Mixpanel, Microsoft, Sentry, Meta and Slack, process data in other countries, including the United States and Europe. By using Cabo you understand your data may be transferred there. Under the DPDP Act, transfers are allowed to any country the Government of India has not restricted. For people in the UK and EU, we rely on the safeguards our providers offer, such as standard contractual clauses and the EU-US Data Privacy Framework where a provider is certified.

Delete your account and data

In the app

Open your profile, go to Account Actions and tap Delete Account. Your account is deactivated straight away and you are signed out. We then erase or anonymise your personal data within 30 days, as described below.

By email, without the app

Email cabocardgame@gmail.com with the subject "Delete my Cabo account". Send it from the email address linked to your account, and include your username. We may ask you to confirm it is you. We reply within 7 days and complete deletion within 30 days. You can also ask for a copy of your data, or for a correction, the same way.

What we delete

• Your profile, name, email, phone number, profile photo, username and sign-in link.
• Your friends, blocked list, push token and chat messages (or anonymised messages if the other person's copy must remain).
• Your stats, progress, inventory and wallet. Coins, gems, items and streaks are lost and cannot be restored.
• Your analytics profile in Mixpanel, where the provider allows us to delete it.

What we may keep

• Records of voucher redemptions and coin or gem transactions, for up to 3 years, for accounting, fraud prevention and disputes.
• Reports and logs about abuse, cheating or fraud, to stop banned users coming back, for up to 3 years.
• Game results other players took part in, kept without your name, so their history stays correct.
• Anything the law requires us to keep.
• Short-lived copies in backups and in provider systems, which expire on their own schedule.

Your rights

To use any right, email cabocardgame@gmail.com. We may need to confirm who you are. We reply within 30 days, or sooner when the law says so.

In India (DPDP Act, 2023)

• Get a summary of your personal data and who it is shared with.
• Correct, complete or update it.
• Ask us to erase it.
• Withdraw consent at any time. This does not affect what we did before. Some features need the data to work.
• Use our grievance process below. If we do not resolve it, you can complain to the Data Protection Board of India.
• Nominate another person to use these rights for you if you die or cannot act.

UK and EU (GDPR and UK GDPR)

You can ask for access, correction, erasure, restriction, a portable copy of your data, and you can object to processing based on legitimate interests. You can complain to your local data protection authority. In the UK that is the Information Commissioner's Office. In the EU, find your authority. Learn about your rights on gdpr.eu.

California (CCPA and CPRA)

You can ask what personal information we collect and use, ask us to delete or correct it, and ask not to be discriminated against for using these rights. We do not sell personal information. Read about your California rights.

Indian law text: MeitY, data protection framework.

Children and teens

Cabo is not for children under 13, and we do not knowingly collect data from them. If you are 13 or older but under 18, you need a parent or guardian's permission to use Cabo. Parents and guardians can email us to see, correct or delete a child's data, or to withdraw consent. If we learn that a child under 13 has an account, we will delete it.

Security and breaches

We protect data with encrypted connections, sign-in checks on our servers, and access limited to our team. No system is perfectly secure. If a breach puts your personal data at risk, we will tell you and the authorities as the law requires, without undue delay.

Changes to this policy

We may update this policy as the app changes. The date at the top shows the latest version. For big changes we will tell you in the app. Using Cabo after a change means you accept the new version. If you do not, stop using the app and delete your account.

Contact and grievance officer

If you have a question, a request or a complaint about your data, contact our Grievance Officer. This is also the contact required by the Information Technology Act, 2000 and the rules under it, and the DPDP Act.

Grievance Officer, The Flutter Guy
Email: cabocardgame@gmail.com
We acknowledge complaints within 48 hours and resolve them within 15 days.

See also our terms of service and support page.