Privacy

King Barbu · last updated 3 November 2026

Who is responsible

King Barbu is made by Riccardo Taglietti, an independent developer in the United States. For anything in this policy, write to privacy@kingbarbu.com.

This policy covers the King Barbu app and the kingbarbu.com website.

Playing on your own

A solo game — you against three computer players — is played entirely on your phone. The cards, the deal, the bots' decisions and your scores never leave the device, and none of it is sent to us or to anyone else. You do not need an account to play this way. (If you happen to be signed in while you play, the app still counts you as online — see Who is online below — but nothing about the game itself is sent.)

Playing online

If you have an account

You can sign in with an email address and password, with Apple, or with Google. What is kept depends on which:

• Email: your email address and a password that is stored only as a hash — we never see or keep the password itself.
• Apple: the identifier Apple issues for this app and the email address Apple passes on. If you choose Hide My Email, that is a relay address and we never learn your real one. We do not ask Apple for your name.
• Google: the identifier Google issues and the email address on the token. We do not request access to your contacts, your Drive, or anything else in your Google account.

You then choose a username. That username is public: it is what the other three people at a table see on your nameplate — friends at a private table, or strangers at a public one you were matched into — and what anyone watching that table sees. Your email address is never shown to other players. Usernames and guest names are checked against a list of offensive words when they are saved, and one that matches is refused.

Your account also keeps a global score: the running total of your results in every public round you finish, and in every private round finished with at least one other person at the table. It is public too — shown beside your name to the other players at any online table, and on the scoreboard at the end of a public round — and together with your username it is the only part of your account anyone else can read. It is calculated by the game's server from the rounds you play; nothing else goes into it.

If you join as a guest

Opening someone's invite link lets you take a seat without signing up. You pick a name for that table, and that name lives on the seat rather than in an account — it is visible to the other players at that table and to anyone watching it, and to nobody else. The anonymous session behind it is deleted automatically after a day, once you are no longer sitting at or watching a live table. There is no password, no email address, and nothing to sign back into.

Who is online

The lobby shows how many players have the app open. To count you, the app announces your account's identifier — a random string, not your username or email — on a shared live channel while it is open and you are signed in, and withdraws it when the app goes to the background. Other signed-in copies of the app receive the identifiers in order to count them. Nothing else is sent on that channel, and nothing about it is stored.

The table itself

While an online game is being played, the server holds what the game is made of: which seats are taken and by whom, the cards in each hand, the cards played, the running scores, the round being played and the table's join code. This is what makes an online game possible — the server is the referee, and it is the only thing that is allowed to see all four hands at once. Each player's phone is only ever sent its own hand.

Someone who opens the code of a private table that has no free seat can watch it instead, and is seated when a chair comes free. A watcher sees the table without anybody's cards, and the players see the names of whoever is waiting. Leaving the queue takes your name out of it at once; somebody who has not had the table open for ten minutes is dropped from it the next time a chair is handed out.

The server also keeps track of whether each player is still there. While you are in a waiting room, watching a table, or looking at a private table's scoreboard between rounds, the app tells the server every fifteen seconds that you still have it open. Only the time it last heard from you at that table is kept, and it is deleted with the table. A public waiting room uses it to give up the seat of somebody who has gone before the table fills; a private table uses it to pass the host's role to another player still there, if the host has been gone for five minutes while the table waits to be dealt.

If the server has to play two turns in a row for you because your time ran out, your seat is marked as away — the other players see a small zzz beside your name — and when the round ends you are taken off the table so someone else can have the seat. Sitting down at another table, or joining another table's queue, counts as leaving the one you were at: your seat there is given up, or marked as away if a round is being played. At a private table, the host can also give your seat up between rounds. Either way, your name and final score for that round stay on the table's scoreboard, marked inactive.

A waiting room that never starts is closed automatically six hours after it was opened, a game that stops moving is closed six hours after the player on turn ran out of time, and a private table nobody has done anything at for two hours between rounds is closed then. A table that is closed or sitting between rounds is deleted 30 days after it was last touched, along with its seats, the names on them and the cards dealt.

How the game performs

The app measures how the game feels on your phone — how long a tap took to come back, how late an update arrived, how long the board took to catch up after you unlocked the screen — and sends those timings up in batches. Each one is a name, a number, the table it happened at and your account identifier. They are timings and nothing else: no screen contents, no messages, no device identifiers, no location. They are kept for 30 days and then deleted, and they are used only to find out whether the online game is fast enough.

Notifications

A table often waits on somebody — the host to deal, or a fourth player to sit down — and you may go and do something else meanwhile. If you agree to it, the app can tell you when your table is dealt, or, if you are waiting to be seated at one, when a chair there comes free. It asks you first, and then your phone asks for its usual permission; you can say no to either and play exactly the same, or turn notifications off later in your phone's settings.

If you allow them, the app stores a push token for your device: a string issued by Apple or Google that lets a notification reach this copy of the app, and nothing else. It is kept with your account identifier and which kind of phone it is, and it is used for those two notices only — that a table you are sitting at has been dealt, or that a table you are waiting at has a chair free. It is deleted when you delete your account, when a guest session expires, or when the app is removed from the phone.

On your phone

The app keeps your sign-in session in its own storage on the phone, so you stay signed in between launches. It is removed when you sign out or delete the app.

What is never collected

• No advertising, no ad identifiers (no IDFA), no ad networks.
• No analytics or crash-reporting services. There is no third-party SDK in the app that watches what you do.
• No location, contacts, photos, camera, microphone, calendar or health data. The app never asks for any of these permissions. The only one it asks for is permission to show notifications, and that is optional.
• No tracking across other apps or websites, and nothing shared with data brokers.
• Nothing is sold, and nothing is used to build a profile of you.
• No marketing email. The only emails ever sent are the ones you ask for: confirming your address and resetting your password.

Who else is involved

Running an online card game means a few companies handle parts of it. Each one is used for one job, and none of them is paid in your data:

• Supabase — the database, sign-in, and the server that runs the game. Accounts, tables and timings are stored there, on infrastructure in the United States (AWS, Oregon). Their logs, like any web server's, record the IP addresses that requests come from.
• Apple and Google — only if you choose to sign in with them, and only to confirm that you are who the token says you are.
• Resend — sends the confirmation and password-reset emails, and so handles your email address to deliver them.
• Expo — delivers the "your table is being dealt" notifications, if you allow them, by passing them to Apple (on iPhone) or Google (on Android). They handle your device's push token and the text of the notice.
• Cloudflare — hosts kingbarbu.com, and records website requests as part of serving them.

If you are in the UK or EEA, note that this means your data is transferred to and stored in the United States.

Keeping it safe

Everything the app and the website send travels encrypted (HTTPS and secure WebSockets). The database only answers the game's own server, which checks who is asking on every request; your phone can read your own seat and nothing else, and can write nothing directly. Passwords are stored only as hashes. No system is perfectly secure, but if your data were ever exposed in a breach you would be told, and so would the relevant authority where the law requires it.

The website

kingbarbu.com is a handful of static pages: the home page, this policy and the terms, the page an invite link opens, and the page an email confirmation lands on. None of them uses cookies, and none of them runs any analytics. They do load the Fraunces typeface from Google Fonts, which means Google sees the IP address of anyone who opens a page here. Apart from that, the only request any of them makes to anybody but this domain is the confirmation page's: opened on a computer, it sends the code from your email link to Supabase to confirm your account.

Deleting your account

In the app: Settings → Delete account. It is immediate and it is permanent — there is no recovery.

What goes: your sign-in, your email address, your username, your global score, your devices' push tokens, your seat at every table you have played, and your place in any table's queue. If you are in the middle of a game, the app will say so first, because a seat cannot simply vanish from a round three other people are still playing — you can stand your seat down to a computer player and delete anyway.

What remains, for a while: the tables you played continue to exist for the other players, with your seat no longer attached to you and your name taken off them, until they are deleted 30 days after their last move. Performance timings carry your account's identifier and are not removed by a deletion — they age out on their own 30-day schedule, after which nothing in them points back to you.

Guest sessions need no deletion — they expire by themselves within a day.

Otherwise, an account is kept for as long as it exists: there is no expiry on an account you are not using. Delete it whenever you like.

Your rights

Depending on where you live — this includes the UK, the EEA under GDPR, and California under the CCPA — you have the right to ask for a copy of what is held about you, to have it corrected, to have it deleted, to receive it in a portable form, and to object to how it is used — and you will not be treated any differently for asking. Deletion is built into the app and is the fastest route. For anything else, write to privacy@kingbarbu.com and you will have an answer within 30 days.

Because nothing is sold or shared for advertising, there is nothing to opt out of: a Do Not Track or Global Privacy Control signal changes nothing, because nothing it would stop is happening.

Where a legal basis is needed: your account and the tables you play are processed to perform the service you asked for, and the performance timings on the legitimate interest of keeping the game working properly.

If you are in the UK or EEA and are unhappy with how your data is handled, you can complain to your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk). Writing to us first is welcome, but not required.

Children

King Barbu is not directed at children under 13 — or under the age of digital consent where you live, which in parts of the EEA is as high as 16 — and accounts are not knowingly created for them. If you believe a child has created an account, write to privacy@kingbarbu.com and it will be deleted.

Changes

This page always describes what the app and the website do now. When that changes, the policy is updated and the date at the top changes with it.

Questions: privacy@kingbarbu.com