RUNG Privacy Policy

Last updated: 24 October 2026

RUNG is an online multiplayer Court Piece / Rang card game. This policy explains exactly what the game stores, why it needs it, and how to get rid of it. It covers the RUNG Android app and the game servers behind it.

The short version. You can play without giving us anything: the app creates an anonymous account by itself. We store what a competitive game needs — a name, a rating, match results, friends. The game is funded by ads (see Advertising), but we do not sell your data or give your account to advertisers, and there is no real-money gambling. You can delete everything from inside the app at any time.

1. Who we are

RUNG is operated by Haider Zaman (“we”, “us”). For anything in this policy, contact haideryzai2@gmail.com.

2. What we collect

Account

Data	Why
A random identifier the app generates on first launch	It is the credential for your anonymous account, so your progress survives closing the app. It is created by the app, is not a hardware or advertising identifier, and is not shared with anyone.
Display name, avatar colour, country flag	Shown to the other three players at your table and on leaderboards.
If you choose Google sign-in: your Google account identifier, email address and the name on that account	So you can sign back in on a new phone and keep your rating. Google sign-in is optional — the game is fully playable without it.

Gameplay

Data	Why
Match results: who played, the cards played, tricks, scores, duration	To run the match, settle the result, and show match history. The record of a move is also what lets us investigate cheating and answer a dispute.
Rating, rank, statistics, streaks, achievements, daily missions	The competitive ladder and progression the game is built around.
Friends, friend requests, blocks, and reports you file	To run the social features and act on abuse or cheating reports.
In-game coin purchases and owned cosmetics	So you keep what you unlocked. Coins are earned in-game; there is no real-money gambling in RUNG.

Technical

Data	Why
IP address and request timestamps, in short-lived server logs	Delivering traffic, rate limiting, and blocking abuse. Kept for a limited period and not used to build a profile of you.
Online presence, matchmaking queue position, current table	Temporary, live state only — so friends see you online and you can reconnect to a match after losing signal. It expires by itself.
Your device’s advertising identifier	Selecting and measuring the ads in the app, and analytics telling us which parts of the game get played. Android gives every app the same resettable id; we never store it against your RUNG account, and you can reset or delete it in your phone’s settings. See section 6.
A record of the ads the app showed you: when, on which screen, during which match, whether an ad was available at all, which ad network supplied it, the country the request came from, and what it earned us	To know what the advertising actually earns, which is what keeps RUNG free to play. It is linked to your account because that is the only way to tell whether the ads cover the cost of running the game for the people who really play it. It does not include your advertising identifier, and it does not record what the ad was for. See section 6.
How the app was installed, as Google Play reports it on first launch: the link that led to the install (a friend’s invite code, an advertising campaign, or the Play Store itself) and when it was clicked and installed	To give a friend who invited you their reward, and to measure which of our marketing actually brings players. It is not shared with anyone.
A one-way hash of your phone’s Android ID (never the ID itself)	Only to stop one phone claiming the same invite reward again by reinstalling or making new accounts. The hash cannot be turned back into the ID, and it is not shared with anyone.

3. What we do not collect

No location data.
No contacts, photos, microphone or files. The camera is used only when you choose to scan a friend’s QR code, and that image never leaves your phone.
No hardware identifiers such as IMEI or MAC address. The Android ID is only ever stored as the one-way hash described above.
No voice or free-text chat. In-game communication is a fixed set of reactions, which keeps a conversation from being something we have to store or moderate.

4. Why we are allowed to hold it

We process this data to provide the game you asked to play (performing our agreement with you), and to keep it fair and safe for everyone — preventing cheating and abuse — which is our legitimate interest. Measuring what the advertising in the game earns, so that it can stay free to play, is our legitimate interest too. Where consent is the right basis, such as linking a Google account, you give it by choosing to do so and can withdraw it by deleting your account.

5. Who else sees it

Other players see your display name, avatar, country flag, rating and rank, your presence, and results of matches you played together. Your email address is never shown to another player.
Google, only if you use Google sign-in, and only as part of that sign-in. See Google’s privacy policy.
Google Play, if you rate RUNG from inside the app. The rating and any review go straight to Google Play under your Google account, as a review on the store; the app never sees what you wrote.
Our hosting provider, which runs the servers storing this data on our behalf.
Ad networks, for the ads the app shows. What they receive is set out in section 6.

We do not sell your data, and we never hand your account — your name, email address, friends or match history — to an advertiser.

6. Advertising

RUNG is free to play and is funded by advertising, so the app may show ads supplied by third-party ad networks.

An ad network may read your device’s advertising identifier and basic technical details — device model, language, country, and which ad was shown — to choose an ad and to count it. We give the ad network no way to connect any of that to your RUNG account.
We do not pass your display name, email address, Google account, friends or match history to an ad network.
We keep our own record of the ads you were shown, and this one is linked to your RUNG account: the time, the screen you were on, the match you were playing at the time (nothing, for an ad in the lobby or the shop), whether an ad was available, which ad network supplied it, the country the request came from, and what the ad paid us. We keep it to see what the advertising earns and whether it covers what the game costs to run — nothing more. It does not include your advertising identifier, it does not record what the ad was for or who placed it, and it is never used to choose which ads you see, to build a profile of you, or to decide anything about your account. We do not share it with the ad networks or with anyone else.
You control the identifier on the phone, not in the game: Android Settings → Privacy → Ads lets you reset it or delete it entirely, which turns off personalised advertising.
Each ad network decides for itself what it does with what it collects, under its own privacy policy.

7. Analytics and crash reporting

We use Firebase Analytics (provided by Google) to understand how the game is played — which screens are visited, how often matches are completed, and broad demographic categories such as country and language. Firebase Analytics collects your device’s advertising identifier, app-instance identifier, device model, operating system version, and interaction events. It does not receive your display name, email address, friends or match history. See Firebase’s privacy information.

We use Firebase Crashlytics (also provided by Google) to detect and fix crashes. When the app crashes, Crashlytics receives a crash trace, your device model, operating system version, and an anonymous identifier we set so we can group crashes that affect the same account. It does not receive your name or email address. See Crashlytics terms.

Both services are disabled in debug builds and are only active in the version distributed through Google Play.

8. How long we keep it

Account and progression data: until you delete your account.
Match records: kept as shared history — a match belongs to four players, and a result cannot be removed for one of them without corrupting the other three. After you delete your account those records no longer carry your name or any link to you.
Live state (presence, queue, current table): minutes to hours; it expires automatically.
How the app was installed, and your invite code: until you delete your account.
Invite records: that one account invited another, with the hashed device ID, are kept after an account is deleted, to stop the invite reward being claimed again from the same phone. They hold no name, email or game data.
The record of ads you were shown: each ad for 90 days, after which it is added into monthly totals that no longer say which ads they came from or when. Both are deleted when you delete your account.
Server logs: a limited retention period, then deleted.

9. Your choices

Delete everything

In the app: Settings → Danger zone → Delete account. This removes your profile, rating, statistics, friends, achievements, missions, inventory, install record, invite code, the record of ads you were shown, and sign-in details immediately and permanently. Only the invite record described in section 8 remains. Matches you already played remain in the other players’ history, anonymised. It cannot be undone.

Without the app: If you no longer have access to the app, email haideryzai2@gmail.com from the address linked to your account (or include your player ID) and ask us to delete it. We will verify your identity and process the deletion within 15 days.

Get a copy of your data

Ask us at haideryzai2@gmail.com and we will send a machine-readable export of what your account holds.

Android, not the game, holds the switch: Settings → Privacy → Ads resets or deletes your advertising identifier, and deleting it stops personalised ads across every app on the phone.

Correct it

You can change your display name and avatar at any time in the app. For anything else, contact us.

Depending on where you live you may also have rights to object to or restrict processing, or to complain to your local data protection authority.

10. Security

Sign-in tokens are short-lived, and the long-lived refresh token is stored only as a hash on our side — a copy of our database cannot be replayed against the service.
Passwords, where used, are stored hashed with bcrypt, never in plain text.
Google sign-in tokens are verified against Google’s published keys before an account is touched.
Traffic between the app and our servers is encrypted in transit.

No service can promise perfect security, but we design so that a single failure does not expose your account.

11. Children

RUNG is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

12. International transfers

Our servers may be located outside your country. Where data is transferred internationally, we rely on appropriate safeguards for that transfer.

13. Changes to this policy

If we change what we collect or why, we will update this page and change the date at the top. Significant changes will be announced in the app.