- Home
- Privacy Policy
Privacy Policy
Effective date: 30 October 2026 · Version 1.0 · Applies to the ERAM CARDS mobile app, its online services (game servers, store, chat, support, web pages) and our operator control panel.
Summary in plain words
We collect what is needed to run an online multiplayer card and board game: your account, your play, your purchases and basic technical data. We use it to run the game, keep it fair and safe, answer you and improve it.
- We do not sell your data — No sale or sharing of personal data for advertising.
- No ad tracking — No personalised ads, no cross-app tracking, no advertising SDKs.
- 18+ only — The service is not for minors.
- You can delete your account — In the app, on the web, or by email.
- No card details — Payments are handled by Google Play / App Store.
- Contact — eram@eram.app
1. Who we are
ERAM CARDS (“ERAM”, “we”, “us”, “our”) is operated by ERAM and acts as the data controller of the personal data described here. The single official contact for privacy questions, data requests, support and legal notices is eram@eram.app. Our public account-deletion page is https://app.eram.app/delete-account.
2. Scope and definitions
This policy covers personal data we process when you install or use ERAM CARDS or contact us. “Personal data” means information that identifies you or can reasonably be linked to you. “Coins” are the virtual in-game currency; “Items” are digital in-game goods such as cards, tables, frames, badges and gifts. By creating an account you confirm you have read this policy; our Terms of Use also apply.
3. Data we collect
3.1 Data you give us
| Category | Data | Why |
|---|---|---|
| Account | Username, display name, email address, optional phone number and region code, password (we store only a salted one-way hash, never the password itself), date of birth, gender (male/female), interface language, acceptance of the Terms and the 18+ declaration. | Create and secure the account, verify age, show your name, recover access, communicate with you. |
| Profile | Optional avatar picture you upload; Items you equip; profile choices and preferences. | Personalise the game and show your profile to other players. |
| Communications | Chat in rooms, alliances and private messages; invitations; reports you file; messages to support; feedback and problem reports (text and optional pictures you attach). | Operate chat and social features, moderate, support you, improve the game. |
| Alliances and social | Friends list, friend requests, alliance membership, join requests, invite settings and mutes. | Provide social features. |
3.2 Data created when you play
| Category | Data | Why |
|---|---|---|
| Gameplay | Rooms, seats, matches, in-match actions, results, rankings, statistics, partner statistics, recently met players, friendly challenges. | Run matches, scoreboards, anti-cheat, dispute handling. |
| Progress and rewards | Level and experience, badges, achievements, missions and progress, daily/monthly login claims, rewards and their ledger. | Run progression and reward features and keep them consistent. |
| Coins and purchases | Coin balance and complete transaction ledger, gifts sent or received, purchase records (product id, amount, currency, time, store transaction/receipt token), owned and equipped Items. | Deliver purchases, accounting, fraud prevention, refunds and chargebacks. |
3.3 Data collected automatically
| Category | Data | Why |
|---|---|---|
| Device and connection | App-generated device identifier, device name/model, operating system and version, app version, language/locale, IP address, time zone-related timestamps, hashed trusted-device fingerprint, last-active time. | Security, session management, fraud prevention, compatibility. |
| Push token | Firebase Cloud Messaging registration token and your notification choices. | Deliver notifications you allow. |
| Diagnostics and crashes | Error and warning logs sent by the app to our servers, and crash reports and device state via Firebase Crashlytics. Passwords, tokens and secrets are removed before logs are stored. | Diagnose bugs and keep the service stable. |
| Security and behaviour | Sign-in events, security events, anti-abuse and behaviour metrics, chat-violation evidence (with words masked), bans, restrictions and appeals. | Detect cheating, abuse and ban evasion; protect players. |
3.4 Data we do not collect
We do not collect precise or approximate location, your contacts, calendar, microphone audio (voice chat is currently disabled), health data, biometric data, government identifiers, or payment-card numbers. We do not read your photo library: when you choose an avatar, your device’s system picker opens and the app receives only the picture you select.
3.5 Data from others
Other players may report you or mention you in chat; Google Play or the App Store tell us whether a purchase succeeded; Firebase supplies delivery status of notifications.
4. How we use data
- Provide the service: accounts, sign-in, matchmaking, rooms, chat, friends, alliances, store, Coins, rewards, missions and notifications.
- Safety and integrity: detect and prevent cheating, collusion, fraud, abuse, harassment and ban evasion; enforce the Terms; protect minors from accessing the service.
- Support: answer tickets, feedback and reports; restore accounts and balances.
- Improve and maintain: fix crashes, measure performance and reliability, test and develop features. We use aggregated or de-identified data where practical.
- Communicate: service messages (security, purchases, policy changes) and optional in-game notifications.
- Legal compliance: accounting, tax, consumer-protection, anti-fraud and lawful requests.
We do not use your personal data to train third-party advertising or to build advertising profiles.
5. Legal bases (EEA, UK and similar regimes)
- Contract — to provide the account and game you asked for.
- Legitimate interests — security, fraud and abuse prevention, service improvement, defending legal claims; we balance these against your rights.
- Legal obligation — accounting, tax, responding to authorities.
- Consent — push notifications and optional pictures/feedback attachments; you may withdraw consent at any time without affecting earlier processing.
6. What other players see
Your username, display name, avatar, level, badges, public statistics, equipped Items and the messages you post in shared rooms and alliances. Your email address, phone number, date of birth and gender are never shown to other players. Content you share in a room or alliance can be seen by its members and may be copied by them outside our control.
7. Sharing and service providers
We share personal data only as described below.
| Recipient | Role | Data | Purpose |
|---|---|---|---|
| Google LLC (Firebase Cloud Messaging, Firebase Crashlytics) | Processor / independent provider under its terms | Push token, crash data, device and app info | Notifications, crash diagnosis |
| Google Play / Apple App Store | Independent controllers for payment; we receive receipts | Purchase identifiers and receipt tokens | Process and verify purchases, refunds |
| Hosting, database, storage and email/SMS delivery providers | Processors | Data needed to host and deliver the service | Operate our servers and send messages |
| Professional advisers, auditors | Confidential service providers | As needed | Legal, accounting, security reviews |
| Authorities and courts | Recipients where required | As legally required | Comply with law, protect rights and safety |
| Successor entity | Recipient | Account data | Merger, acquisition or asset sale, with notice to you |
All processors act on our instructions under written terms that require confidentiality and appropriate security. We do not sell personal data, do not “share” it for cross-context behavioural advertising, and do not give it to advertisers or data brokers.
8. Cookies and similar technologies
The mobile app does not use advertising cookies or trackers. It stores a sign-in session, your language and settings on your device. Our public web pages (for example the account-deletion page) use only the essential storage needed to work and no analytics or advertising cookies. If this changes we will update this policy and ask for consent where required.
9. Device permissions (Android)
| Permission | Use | Control |
|---|---|---|
| Internet / network state | Connect to game servers and detect connectivity. | Required to play online. |
| Notifications | Match invitations, missions, service alerts. | Optional; decline or switch off in device settings. |
| Vibration | Haptic feedback during play. | Controlled in app/device settings. |
| Storage (Android 9 and below only) | Temporary files. | Not requested on newer Android versions. |
The app does not request camera, microphone, location, contacts or media-library permissions.
10. Retention
| Data | How long |
|---|---|
| Account, profile, social, gameplay and progress data | While your account exists; erased when your deletion is completed. |
| Coin ledger, purchase records and store receipts, reward and gift records | Kept after deletion in pseudonymised form for accounting, tax, consumer-protection and chargeback obligations, for the period those laws and store rules require. |
| Finished match records | Kept so other players’ history and statistics stay correct; your name is replaced with “deleted account”. |
| Ban, restriction, security and abuse evidence | Kept in minimal form to prevent ban evasion and protect players, for as long as the risk remains. |
| Support tickets and your written messages | The text you wrote is cleared at deletion; the case record (category, status, dates) may remain. |
| Diagnostic logs | Rotated and deleted on a short cycle. |
| Backups | Overwritten on the normal backup cycle; deleted data is not restored except to recover from a failure. |
11. Deleting your account
- Inside the app, or at https://app.eram.app/delete-account (no app needed), or by emailing eram@eram.app from the account email.
- After you confirm, your account is hidden and all sign-ins are closed immediately.
- Our team completes the deletion by hand within 14 days. During that time you can recover the account by contacting support with your case number.
- If you founded an alliance, transfer or disband it first. Remaining Coin balance and Items are lost and are not refundable.
- Items in section 10 that we must keep are retained as described there.
12. Your rights
Subject to local law you may: access your data; correct it; delete it; receive a portable copy; object to or restrict processing; withdraw consent; and not be discriminated against for exercising rights. Most profile data can be edited in the app. For other requests email eram@eram.app from your account email; we may ask you to verify your identity and will respond within 30 days (or the shorter period your law requires). Requests are free unless manifestly excessive.
13. Regional notices
European Economic Area, United Kingdom, Switzerland
You have the rights in section 12 and may lodge a complaint with your local data-protection authority. Transfers outside these regions rely on adequacy decisions or standard contractual clauses (section 16).
California and other US states
You may request to know, access, correct, delete and obtain a portable copy of your personal information. In the last 12 months we have collected the categories in section 3 (identifiers, account and commercial information, internet/device activity, user content, inferences limited to gameplay and security). We do not sell or share personal information as those terms are defined by California law, and do not use or disclose sensitive personal information beyond what is needed to provide the service. You may use an authorised agent; we will verify the request.
Other countries
Where your local law (for example in the Gulf region, Brazil, Canada, Australia, India, Turkey or elsewhere) grants additional rights, we honour them on request.
14. Security
We protect data with encryption in transit (HTTPS/TLS), salted password hashing, role-based staff access with audit logs of administrative actions, removal of secrets from logs, separation of environments, rate limiting and abuse monitoring, and regular backups. No system is perfectly secure. Use a strong, unique password and tell us immediately at eram@eram.app if you suspect unauthorised access. If a breach affects your personal data we will notify you and the authorities as the law requires.
15. Age restriction (18+)
ERAM CARDS is intended only for people aged 18 or older. We verify age from the date of birth you enter and do not knowingly collect data from anyone younger. If we learn that an account belongs to a minor we close it and delete its data. Parents or guardians who believe a minor registered should contact eram@eram.app.
16. International transfers
We and our providers may process data in countries other than yours, including countries with different data-protection laws. Where required we use safeguards such as adequacy decisions, standard contractual clauses and contractual security commitments.
17. Automated decisions and profiling
We use automated checks to detect cheating, fraud and abuse (for example unusual play patterns, repeated violations, suspicious sign-ins). These can lead to warnings, restrictions or bans. Such decisions are reviewable: you may ask for human review and appeal by email. We do not make decisions with legal effects based solely on automated profiling for marketing.
18. Third-party links and services
The app may link to store pages or other websites. Their privacy practices are their own; read their policies. Google and Apple process purchases under their own terms and privacy policies.
19. Changes to this policy
We may update this policy. The effective date above shows the current version. For material changes we will notify you in the app or by email before they take effect where practicable. Continuing to use the service afterwards means you accept the update; if you do not, stop using it and delete your account.
20. Contact and complaints
Questions, requests and complaints about privacy or your data: eram@eram.app. Please write from your account email and include your username so we can find your records. If you are not satisfied with our answer you may contact your national data-protection authority or consumer-protection authority.
21. Website and contact form
Website and contact form: when you write to us through this website we store your name, email and message to answer you and keep them for up to 24 months; we use no advertising cookies or analytics trackers.