Privacy Policy

Last updated: 17 October 2026

This policy explains what information Pishpirik LLC ("we", "us") collects when you play the Pishpirik game on iPhone or Android or visit pishpirik.com, why we collect it, who we share it with, and the choices you have. We wrote it to be read, so it is in plain words.

The short version: we keep what the game needs to work: your account, your profile and progress, your friends and your purchases. Matches run on our own game server, which keeps a record of each match for 90 days to keep the game fair. We never sell your personal information. We never see your payment card. Chat messages go live to the players in your match and we do not store them, unless a player reports you: a report keeps your recent chat lines from that match for up to a year. Voice and video at the table stay off until you turn them on in a match; they go live to the other players at your table who turned theirs on too, and we never record or store them. You can delete your account in the app, or by email if you play as a guest.

1. Who we are

Pishpirik LLC, Charlotte, North Carolina 28210, United States, is responsible for your information (the "controller"). Contact us at info@pishpirik.com for anything about privacy.

2. What we collect

Your account

• How you sign in: as a guest, with an email address and password, or with Google or Apple. With email, we send you a verification link and, if you ask for one, a password reset link. Google and Apple give us your email address, an account identifier and your name (Apple only if you allow it). If you choose Apple's "Hide My Email", we receive Apple's relay address instead.
• Sign-in is handled by Google Firebase Authentication, which holds your email address and password. We never see your password.
• A guest account is tied to the game on your device. You can add an email, Google or Apple sign-in to it at any time to keep it; otherwise, if you delete the game or lose the device, you lose access to it.

Your profile and progress

• The player name you choose and its number (for example Name#1234), and how many times you changed it.
• The avatar you pick, or a profile photo you upload (see below).
• Coins, the items you own and use (card backs, Pishpirik effects, emotes), your Pishpirik Pass progress and quests, and whether you bought the Pass.
• Game statistics: games played, won, lost and drawn, trophies, league and rank (also your trophies in past seasons), Pishpiriks, best scores and streaks, your recent results, your game history and your results against each player you played.
• Your progress against the AI opponents, your tutorial progress, how many reward ads you watched each day (for free coins, and to double a win), and when you were last online.

Profile photos

If you upload a profile photo (registered accounts only), the game takes it from your photo library only when you choose to, shrinks it to a small square picture and removes its location and other hidden details before sending it. Every photo is checked for nudity by our own moderation server. Photos that pass are shown to other players. Photos that are refused are discarded, and after three refused photos the account can no longer upload one. A few photos the check cannot decide are held for a person at Pishpirik to look at; a copy of such a photo is kept on the reviewer's computer for the review and deleted afterwards. The uploaded picture is removed from our database once it has been checked. If you think a photo was refused by mistake, write to us.

Friends, invites and online status

• Your friends list and friend requests, your game invites, your recent opponents, and whether you are online or in a game right now (shown to other players).
• We do not read your phone's contacts.

Matches on our game server

Matches, chat, voice and video at the table, and your coins and items run on our own game server. When the game connects, it signs in to the server with your account, and the server notes the session: an identifier for it, your platform (iPhone or Android), when it started, and your time zone's offset from UTC, which keeps invite notifications from reaching you at night.

The server keeps a record of every match for 90 days: who played, the table and format, the cards dealt, every move and when it was made, the result, and the coins and trophies won or lost. We use these records to settle each match, to answer questions about a match, and to keep the game fair (see "Fair play" below). Versions of the game before 1.2 still run matches and chat through Photon, a multiplayer service of Exit Games GmbH in Germany.

Chat and emotes

Chat messages, emotes and the "typing" signal are sent live through our game server to the other players in your match. The server removes hidden characters from each message and checks it against a list of bad words; a message that fails the check is not passed on. We do not store chat messages, except in a report (see "Reporting and blocking players"). You can switch chat off in Settings.

Voice and video at the table

From version 1.3, players at a table can talk, and see each other, while they play. Both are off in every match until you turn them on, and turning them off is final for that match.

• Voice. The game uses your microphone only after you tap VOICE in a match (your phone asks your permission the first time). It sends your voice only while you speak, live through our game server, to the other players at your table who turned voice on too.
• Video. The game uses your front camera only after you turn video on in a match (your phone asks your permission the first time). Video needs voice on, and turning voice off turns video off too. Video is only for players who confirm that they are 18 or older. That confirmation is kept on your phone, not by us: when you turn video on, the game tells our server only that you gave it, and the server keeps nothing of it. A small live picture from your camera goes through our game server, only to players at your table whose camera is on too: two players see each other only when both cameras are on. Video costs coins, at a price the game shows before you turn it on (currently 50 a match), taken only if your camera was on while you could see another player's camera. The match record notes it with the match's other coins.
• Nothing is recorded. Our game server passes your voice and picture on as they arrive and keeps none of them. We do not record, store, listen to or watch voice or video, and a report never includes any. The server counts only how much voice and video pass through, not what they contain.
• Blocking a player also stops voice and video between the two of you, both ways.
• We cannot stop another player from recording their own screen, so turn your camera on only when you are comfortable being seen. If something happens while voice or video is on, report the player from their profile and describe it in your note.

Reporting and blocking players

If you are signed in (not playing as a guest), you can report a player from their profile, saying in your own words what happened. A report includes your account identifier, your note, the match it happened in, and the reported player's account identifier, player name and number, and profile photo as they were at that moment (we keep one copy of each reported photo, however many reports name it). If you report a player you were in a match with, the report also includes that player's recent chat messages from the match (at most their last 20; our game server holds them in memory only, from the start of the game until 10 minutes after you all leave the table, which can be after rematches, and keeps none otherwise; in a match that runs through Photon, your phone sends the messages it received from that player instead). A person at Pishpirik is told that new reports came in (the notice names no one), reads each report, and may remove a profile photo, replace a player name with a generated one (the player then chooses a new name for free) or turn off a player's chat for a time. When we remove a photo, we keep a fingerprint of it (a one-way hash, not the picture) so the same photo cannot be uploaded again. The reported player is not told who reported them. A report, and the copy of the photo it names, is kept for up to 1 year, then deleted.

You can also block a player. You no longer see their chat, emotes, invites or friend requests, and the game hides their name and photo from you. Blocking ends a friendship with them. We keep the list of players you blocked with your account, so it works on every phone you use; the blocked player is not told. You can unblock a player in Settings. When a player deletes their account, other players' block lists may still hold its account identifier, which no longer leads to a profile.

Purchases

Purchases are made through the Apple App Store or Google Play, which handle your payment. We never receive your card or bank details. When you buy, the game gives Apple or Google a code made from your account identifier with a one-way function (Apple's "app account token", Google's "obfuscated account ID"). This way each purchase belongs to the Pishpirik account that made it, and no other account can claim it. Our server checks each purchase with Apple or Google to confirm it was paid and which account it belongs to, then delivers it. It checks again later whether the purchase was refunded; a refunded purchase is taken back from the account (its coins, item or Pass). We record what you bought, the price and currency, the store's order number (on Android also its purchase token), your account identifier and your player name. To move a purchase to another of your accounts, write to info@pishpirik.com.

The start gift

A new account gets a gift of coins, once per phone. To give it only once per device:

• The game sends our server a one-way hash (SHA-256) of your device's identifier; the identifier itself never leaves your phone. We keep the hash with a note that the device's gift was given.
• On iPhone, the game also sends our server a token from Apple's DeviceCheck. With it, our server reads and sets a mark that Apple keeps for each device ("this device's gift was given"). The mark holds no personal information, and Apple does not tell us who you are.
• The gift goes only to the real Pishpirik app on a genuine phone, checked with Firebase App Check (Apple DeviceCheck on iPhone, Google Play Integrity on Android).
• Our server counts the gifts given to one internet (IP) address in a day. When an address has had many, the gift waits for another day.

Fair play

Only our servers can change coins, items, trophies and results. They keep a record of those changes, with your player name, and flag changes the game could not have made. To spot cheating, we also look at:

• the match records, for results and play patterns that look like a bot, or like players helping each other win coins;
• your device's hash and your IP address, which our server receives when the game connects (kept 90 days), to find many accounts on one phone or one address;
• start gifts taken more than once on one phone, and coins that do not add up.

Changes the game could not have made count as strikes against the account. When we find cheating, the account is first frozen for 7 days: no coin or ranked games, while friend games and games against the AI still work. A repeat can lead to a permanent ban. The game tells you when your account is frozen or banned, until when, and where to appeal: info@pishpirik.com. Some checks can freeze an account on their own; a ban is always decided by a person at Pishpirik, and a person answers every appeal.

Device and technical information

• Your IP address, device model, operating system and app version, which we and our service providers receive when the game connects to them. Our game server keeps IP addresses in its logs for 90 days.
• A one-way hash of your device's identifier (see "The start gift"). Our server also uses it to keep your notification settings per device and to keep the game fair.
• A token from Firebase App Check (Apple DeviceCheck or Google Play Integrity) that helps our services tell the real Pishpirik app on a genuine device apart from copies.
• Your device's advertising identifier, used by Google AdMob to show reward ads (on iPhone only if you allow tracking; see section 5).
• When you watch a reward ad to the end, Google AdMob tells our server so, with your account identifier and a one-time code (AdMob's "server-side verification"). Our server then gives the coins, once per ad, and keeps a record of each reward for 90 days. If you watch a reward ad to double what you won in a match, AdMob's message also names that match: our server checks that you won it, pays once per match, and keeps a record that the win was doubled for 90 days.
• The game may send basic usage events to Google Analytics for Firebase, such as a match starting or ending (with the other players' account identifiers, not their names) and a purchase being made, to help us understand how the game is played.
• Notifications, only if you allow them. Reminders (free coins, challenges, friends) are scheduled by the game on your phone itself, at most two a day, and nothing about them leaves your phone. Invite notifications (push) come from our server only when a friend invites you to a game while you are offline: at most 2 a day from the same friend and 5 a day in all, and only between 9:00 and 22:00 your time. An invite notification shows your friend's player name, or "A friend" when we would not show the name on a lock screen. For these we keep your device's notification token (for up to 5 of your devices), use it only to deliver them, and never show it to other players. You can turn either off in Settings.

What we do not collect

We do not collect your phone number, your precise location, your contacts, your age (video asks you to confirm that you are 18 or older; that confirmation is kept on your phone, not by us) or your gender, and we do not record or store any audio or video (see "Voice and video at the table").

3. Why we use it

Fair play matters to us. If we find cheating, we may freeze or ban the account, reset what was gained unfairly or remove items, as our Terms of Service explain. Two kinds of decisions in the game are automatic: the photo check, and the fair-play checks that can freeze an account for 7 days. You can ask a person at Pishpirik to look at either: write to us about a photo, or to info@pishpirik.com about a freeze or a ban.

4. Who sees your information

• Other players see your player name and number, your avatar or photo, your statistics and trophies, your online status, how many friends you have, and their own results against you. In a match they see your chat messages and emotes, and, when you turn them on, hear your voice and see your video.
• Our team can view your game account data (not your email) to answer appeals and keep the game fair, and reads the reports players make (see "Reporting and blocking players").
• Our service providers, who process it for us under contract:
  • Google (Firebase Authentication, Cloud Firestore, Realtime Database, Cloud Functions, Remote Config, App Check with Play Integrity, Cloud Messaging and Analytics, and AdMob for ads and their reward checks);
  • Exit Games GmbH, Germany (Photon), for matches and chat in versions of the game before 1.2;
  • Apple and Google, for sign-in, purchases and the start gift's device check;
  • Unity Technologies, whose purchasing library connects the game to the stores;
  • Hostinger, which hosts our game server and our photo moderation server.
• When the law requires it, or to protect players, our rights or the public.
• If Pishpirik LLC is sold or merged, the new owner would continue under this policy.

We do not sell your personal information. Google AdMob may use your advertising identifier for personalised ads where you allow it (see section 5); Google's own privacy policy applies to that use.

5. Ads and your choices

The game shows reward ads only when you choose to watch one: for free coins, or to double what you won in a quick match. Ads are served by Google AdMob, which receives your advertising identifier, IP address and device details to serve and count them. When you finish an ad, AdMob passes your account identifier back to our server, so the coins reach your account (see section 2). On iPhone, the game asks your permission before it can use your advertising identifier ("Allow Tracking"); if you say no, ads are not personalised with it. On Android, you can opt out of ad personalisation or reset your advertising ID in your phone's settings (Google, then Ads). How Google uses this information is explained at policies.google.com/technologies/ads. If you would rather see no ads at all, simply do not watch them: nothing in the game requires it.

6. Where your information is kept

Our main services run on Google's servers, which may be in the United States. Matches, chat, voice and video run on our own game server, which we rent from Hostinger in Manchester, in the United Kingdom. The European Commission recognises that the United Kingdom protects personal data adequately (an "adequacy decision"), so information from the EU can go there without further safeguards. Versions of the game before 1.2 still run matches and chat on Photon's servers in the European Union. Your information may be processed in the United States and other countries. When it leaves the EU, the UK or Switzerland, we rely on the safeguards our providers offer, such as the EU–US Data Privacy Framework (Google is certified under it) and the European Commission's Standard Contractual Clauses.

7. How long we keep it

• Your account and profile: while you have an account. When you delete it, we delete your sign-in, profile, photo, friends, game history, fair-play records, online status, session record, notification tokens and the list of players you blocked: most of it at once, all of it within 30 days, and any copies in backups within 90 days.
• A minimal record after you delete your account: to prevent abuse, we keep any ban or freeze that was on the account, its fair-play strikes, and whether the start gift was given, for 1 year. Then it is deleted.
• Fair-play reports (the daily anti-cheat results, which can include your account identifier and the reason an account was flagged): 13 months, then deleted. Records of freezes and bans on an account are kept while the account exists, and for 1 year after it is deleted (the minimal record).
• Match records: 90 days from the match, then deleted automatically, also after you delete your account.
• Reports: up to 1 year from the report, then deleted automatically, also after the player who made it, or the player it is about, deletes their account. The note you write and the chat lines in a report are kept only in the report. The copy of a reported profile photo is kept as long as the newest report that names it, also after its player deletes their account.
• Our game server's logs, which include IP addresses: 90 days.
• Ad reward records, and the record of which match's win you doubled: 90 days.
• Voice and video: never stored.
• Notification tokens: until you turn invite notifications off, sign out or delete your account. We keep tokens for at most your 5 newest devices.
• Your phone's start-gift mark: the hash of your device's identifier and the note that its gift was given, kept while the game runs so the gift is given once per phone. When you delete your account, your account identifier is removed from it.
• Purchase records, and the record of which account each purchase belongs to: kept for 7 years, for tax and accounting and so the same purchase cannot be claimed twice, then deleted. When you delete your account, your player name is removed from them; your account identifier stays.
• Other players' records: their game history and their results against you keep your account identifier, which no longer leads to a profile once your account is deleted.
• A special number for your player name, if you bought one: the record of that purchase keeps your account identifier.
• Chat: not stored by us, except the reported player's recent lines in a report (see "Reports" above).
• Profile photos: a refused photo is discarded after the check; a photo held for review is deleted after the review; your current photo is deleted with your account. The fingerprints (one-way hashes) of photos we removed after a report are kept with your photo checks and deleted with your account.

8. Your rights

Depending on where you live, you can ask us to:

• tell you what information we have about you and give you a copy;
• correct it;
• delete it (you can delete your account yourself, see Delete your account);
• give it to you in a machine-readable format;
• stop or limit uses based on our legitimate interests, such as personalised ads;
• withdraw a consent you gave.

Write to info@pishpirik.com from the email on your account, or include your player name and number. We answer within one month. We will never treat you differently for using your rights. If you are in the EU, the UK or Switzerland, you can also complain to your data protection authority.

California and other US states: you have the rights above, including to know, delete and correct your information and to opt out of its "sale" or "sharing" for targeted advertising. We do not sell personal information; to opt out of ad personalisation, use the settings in section 5 or write to us.

9. Children

Pishpirik is not made for children under 13, and we do not knowingly collect information from them. In the EU and the UK, players under 16 need a parent's permission. Players under 18 need a parent's permission for purchases. We do not ask your age when you sign up, so we rely on you and your parents to follow these rules. Video at the table is only for players who confirm that they are 18 or older. If you think a child has given us information, write to us and we will delete it.

10. Security

Information travels encrypted (HTTPS/TLS). Access to our database is limited by security rules, and only our servers can change coins, items, trophies and results. Our game server checks every connection with your sign-in and with Firebase App Check, which tells the real app from copies, and limits how many requests an account can make. Passwords are handled only by Firebase Authentication, and purchases are checked with Apple and Google. No system is perfectly secure, so please use a strong password and keep your sign-in safe.

11. This website

pishpirik.com uses no cookies, no trackers and no analytics, and its fonts are served from our own site. Your browser stores only three small settings: the language you chose, whether we already suggested another language, and whether you turned the sound off. Our hosting provider may keep standard access logs (such as IP addresses) for security.

12. Changes

We will update this policy when the game or the law changes, and change the date at the top. If a change matters, we will tell you in the game or on this site before it takes effect.

13. Contact

Pishpirik LLC · Charlotte, NC 28210, United States · info@pishpirik.com