How we handle data

Last updated: 28 October 2026

This page explains what data the Giochiamo a Carte app (iPhone and Android) and this website use. It is written for players and for Google Play and the App Store. It is not a certification, and it does not describe controls we do not have.

Controller

The data controller is Promoself S.r.l., with registered office at Via Campania 65, 81100 Caserta (CE), Italy, VAT number (P.IVA) 02686910619. For privacy, access, and deletion: info@giochiamoacarte.it.

On the stores the app is called Giochiamo a Carte and the identifier is it.giochiamoacarte.app.

In short

You can play without an account. Progress then stays on the phone.
The account is optional. It is there so coins, collection, bonus, missions, and stats can be saved in the cloud.
Online matches go through our server and, in the current code, are not linked to the account.
Coins and gems are game points. They cannot be withdrawn or exchanged for money. This is not real-money gambling.
You can watch optional Google AdMob rewarded videos, up to ten a day, to receive coins or gems. Paid gem packs are shown in the shop but are not for sale yet.

Without an account, on the phone

Guest mode does not create a user on the account server. The app stores locally:

a game name (if you do not choose one, it suggests a name like “Giocatore” plus three digits);
virtual coins and gems, owned items, and equipped items (card back, table, avatar, frame, opponent, effect, sound);
the daily bonus: last claim date and streak;
the day’s rewarded videos: how many you have watched and when the last one was, for the daily cap and the pause;
the day’s missions;
wins, losses, and draws against the computer;
if you have played online, the secret for the online profile and a local copy of those coins;
the sound preference;
a random id for that installation, used only if you later create an account, so guest progress can be merged once.

This stays on the phone until you sign in or open an online match. Uninstalling the app removes it from the phone. An online profile on our server, if you created one, is not removed by uninstalling. That profile is described below.

Optional account

Sign-in uses Supabase. There are three ways in.

Email. You enter an address and Supabase sends a numeric code. A link may be included. You do not choose a password.
Google. A browser opens, you sign in with Google, and you return to the app. We do not receive your Google password.
Apple. On an Apple device, or in the browser. The app asks Apple for email and name, but it only uses the identity token. The in-game nickname is the one you type. If Apple gives you a hidden address, we see that relay address, not your real email. We do not receive your Apple password.

Supabase stores the user id, the email when the provider shares it, and the session tokens. On the phone the session is kept in the keychain when the system allows it, otherwise in app storage. A local copy remembers the id, email, and name until you sign out or delete the account.

You then choose a name of 2 to 16 characters (letters, numbers, space, apostrophe, or hyphen). Among accounts it must be unique, ignoring capital letters.

In the database, on your row, we store:

name and avatar in use;
virtual coins (a new account starts at 500);
owned items and equipped items (including card decks);
season progress, if you have an account: experience points, rewards already claimed, and whether the Premium pass is on;
daily bonus and missions (date, list, progress, missions already claimed);
stats for Scopa, Briscola, Cucù, and Tressette: wins, losses, draws;
a ledger of coin operations from offline matches (operation id, kind, amount, date), so the same match is not counted twice;
the phone’s random id, once, to remember that guest progress from that phone was already merged.

The first time a phone signs in to an account, local progress is merged with the cloud: the higher coin balance is kept, the two balances are not added, and items are combined. The same phone cannot repeat that merge.

The app can read only its own row. It cannot write itself an arbitrary balance. Shop purchases, the bonus, missions, and offline match stakes go through database functions that recompute the amount.

Online matches

The game server is ours: Node.js and Socket.IO, hosted on Render in the Frankfurt region (Germany). Online profiles are a file on the server disk (/data, 1 GB). That is not the Supabase database. The code does not link the online profile to the account.

On the first connection the phone receives a secret token and stores it. The server stores only the SHA-256 hash of that token, together with:

a random id;
the name in use at that moment;
a rating (Elo, starting at 1200), wins, losses, and draws;
virtual coins for that rating table;
creation time and last seen time.

Opponents see your name and rating, not your email. The online name does not have to be unique: the token is what identifies the phone.

The queue matches people looking for the same game with a nearby rating. In the current code the server accepts online play only for two-player games: Scopa and Briscola. Cucù and Tressette are played against the computer.

To play with a friend the server creates a 5-character code. It stays in memory for about 15 minutes, then expires, and it is not written to the player file. If you share it, you use the phone’s share sheet. The operating system handles that share, not us.

During a match you can send only phrases from a fixed list, such as “Ciao” or “Bella giocata”. Free text is dropped. The phrase is delivered to the people at the table and is not stored. Cards and moves stay in memory for the match. When it ends, only the rating and online coins remain in the file.

The program does not write IP addresses into the player file. Render may keep technical connection logs for the service. We do not use them to build a marketing profile. The server health address answers with aggregate counts (connected, playing, searching), without names.

Coins, gems, the shop, and no real money

Coins are earned by playing, from the bonus, from missions, and, if you choose, from rewarded videos. Gems are earned from some of those videos. They are spent on cosmetic items: base items for coins only, rare items for coins or gems. You can also exchange gems for coins. Items do not change cards, points, or legal moves.

The code includes three coin packs and five gem packs prepared for a possible future store purchase, with the sale turned off: gem packs appear in the shop with the label “in arrivo” (coming soon). There is also a season pass (product giochiamoacarte.pass.s1) with a price written in the game. The app does not include the store payment library, and a receipt does not turn Premium on by itself. A real purchase with money cannot be completed today. A development build can show a trial, marked as a trial, with no payment. If purchases are turned on, we will update this page first.

This is not real-money gambling. Coins and gems have no cash value, cannot be withdrawn, and cannot be exchanged for money.

Ads, analytics, tracking

The data controller remains Promoself S.r.l. The app can show rewarded videos with Google AdMob. Watching is optional: the game works without it. There are at most ten a day, with a short pause between them. The prize (coins or gems) is calculated by our server, not by a number sent from the phone.

To deliver the ad, Google may process the phone’s advertising identifier (Android Advertising ID or Apple IDFA), the IP address, device data, and whether the video was watched. If you consent, ads may be personalised. If you refuse, or if you are not asked, non-personalised ads may be shown, or no ad. In the European Union and the European Economic Area the consent request is Google’s form (UMP), before the first video in a build that includes AdMob. You can change your mind from the phone’s privacy settings or from the form, when the system offers it.

In Expo Go, the test environment, a countdown inside the app stands in for AdMob: no request is sent to Google in that case. We do not use other behaviour-analytics tools, and we do not send crashes to an outside service. We do not ask for location, contacts, camera, microphone, or photos. Sounds are files shipped with the app. The microphone is off. Haptics stay on the phone.

Expo is the system the app is written with and, for the stores, it can be built with EAS. The app has no libraries that send game or account data to Expo, and the project has no silent update channel configured.

Who processes data for the service

We decide why the data is needed. These providers process it to run the parts named here:

Supabase — account, sign-in code, and cloud-save database. The region is chosen in the Supabase dashboard and is not written in the repository. The project should be kept in the European Union.
Mail for the sign-in code — Supabase sends it. If the SMTP server in the dashboard is Resend, Resend sees the address and the message (code or link) only to deliver it. That setting is not in the code and should be confirmed in the dashboard.
Render — the game server in Frankfurt and the disk with the player file. This static site is meant to be hosted there as well. Render can see technical hosting logs.
Google — if you tap “Continue with Google”, for sign-in. And, if you watch a rewarded video in a build with AdMob, Google AdMob processes the advertising data described above as an independent controller for advertising, under Google’s privacy policy and its advertising policies. Promoself S.r.l. decides to offer the video and to credit the game prize. We do not sell data to Google: Google receives what it needs to show the ad.
Apple — only if you tap “Continue with Apple”. Their own policy also applies to that sign-in.

We do not sell data. We do not do our own marketing profiling. Any personalisation of the ad is Google’s, and only if you consent in the form.

Legal bases

The service you ask for (GDPR Article 6(1)(b)): running the game, the account if you create one, the cloud save, and online matches.
Legitimate interests (GDPR Article 6(1)(f)): keeping the service up, avoiding double-counted coins, recognising the online phone, and technical hosting logs. The interest is a fair game, not advertising. You can object by emailing us.
Consent (GDPR Article 6(1)(a)): the advertising identifier and personalised AdMob ads, if you accept them in the form. You can refuse and keep playing. You can withdraw consent with the tools the form and the phone provide.
A legal obligation (GDPR Article 6(1)(c)), if an authority asks for data. That is not the purpose of the app.

The game itself is not based on consent, and we do not send a newsletter. You ask for the email code in order to sign in. The rewarded video is separate: without consent, a personalised ad does not start.

How long we keep it

Cloud account data: until you delete the account in the app or ask by email. The code has no automatic expiry.
The online player file: until you ask us to delete it. The “Delete account” button does not delete that file, because it is not linked to the account. See Delete your account.
Room code: about 15 minutes in memory. The reason a room closed stays in memory for about 30 minutes.
The match and phrases: only while the match is running, in memory.
Rewarded videos on the account: the day’s count and the time of the last video stay in the save until you delete the account. The ledger that prevents a double prize stays until you delete the account.
On the phone: while the app is installed. Signing out or deleting the account removes the session, not guest progress already stored locally.
Logs at Supabase, Render, and the mail service: under their own rules. The code does not set a different period.

Where the data is

On your phone, for guest play and the session.
At Supabase, for the account. It should stay in the European Union.
At Render in Frankfurt, Germany, for online matches.
This website is static files, intended to be hosted on Render.

Google and Apple are based in the United States. If you use their sign-in, or if you watch an AdMob video, processing goes through Google and can involve a transfer outside the European Economic Area, under Google’s rules (standard clauses and its privacy policy). We do not send the coin balance to Google. For rewarded-video verification Google may receive an account identifier and a code for that attempt, so the prize is not counted twice. We do not claim transfer terms other than those in the contracts with those providers.

If mail goes through Resend, that service also handles the address in order to deliver the message. Where its servers are depends on the plan set in the dashboard, not on this website.

Security

Connections to Supabase and to the game server use HTTPS. In the database each account can read only its own data. The online token is stored as a hash. The session stays in the keychain when the phone provides one.

Promoself S.r.l. has no security certification to show. If an incident affects your data, we tell you when the law requires it.

Children

The app is a card game for a general audience. It is not directed at children under 14. In Italy, consent for information-society services is considered from the age of 14. We do not ask for a date of birth, and the app has no age check. We do not create an account knowing the person is under 14. If you are a parent and believe we have a child’s data, write to info@giochiamoacarte.it and we will delete it.

Your rights

You can ask for access, rectification, erasure, restriction, and you can object to processing based on legitimate interests. You can ask for portability of the cloud data: the app has no export button. If you write to us, we send the profile and save we hold in a common format.

The name can be changed in Profile. The account can be deleted from Profile → Delete account, or by email. The steps are on Delete your account. We reply within one month.

You can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali.

This website

These pages are HTML and CSS. They do not use cookies, they have no forms, and they do not load analytics or fonts from other sites. If you email us, we use the address and the text to reply and to do what you asked, such as deleting the account. The host may log the technical request (IP address, time, page). We do not use that to recognise you on a later visit.

Changes

If what we collect changes, or who the controller is, we update this page and the date below. We do not have a newsletter to notify you. The date of this version is 28 October 2026.