Privacy

King Barbu · last updated 21 September 2026

Who is responsible

King Barbu is made by Riccardo Taglietti, an independent developer in the United States. For anything in this policy, write to privacy@kingbarbu.com.

This policy covers the King Barbu app and the kingbarbu.com website.

Playing on your own

A solo game — you against three computer players — is played entirely on your phone. The cards, the deal, the bots' decisions and your scores never leave the device, and none of it is sent to us or to anyone else. You do not need an account to play this way.

Playing online

If you have an account

You can sign in with an email address and password, with Apple, or with Google. What is kept depends on which:

• Email: your email address and a password that is stored only as a hash — we never see or keep the password itself.
• Apple: the identifier Apple issues for this app and the email address Apple passes on. If you choose Hide My Email, that is a relay address and we never learn your real one. We do not ask Apple for your name.
• Google: the identifier Google issues and the email address on the token. We do not request access to your contacts, your Drive, or anything else in your Google account.

You then choose a username. That username is public: it is what the other three people at a table see on your nameplate, and it is the only part of your account anyone else can read. Your email address is never shown to other players.

If you join as a guest

Opening someone's invite link lets you take a seat without signing up. You pick a name for that table, and that name lives on the seat rather than in an account — it is visible to the other three players at that table and to nobody else. The anonymous session behind it is deleted automatically after a day, once you are no longer sitting at a live table. There is no password, no email address, and nothing to sign back into.

The table itself

While an online game is being played, the server holds what the game is made of: which seats are taken and by whom, the cards in each hand, the cards played, the running scores, the round being played and the table's join code. This is what makes an online game possible — the server is the referee, and it is the only thing that is allowed to see all four hands at once. Each player's phone is only ever sent its own hand.

Tables are kept while they are being played and for a while afterwards so the final scores can be read. Abandoned tables are closed automatically six hours after anybody last touched them.

How the game performs

The app measures how the game feels on your phone — how long a tap took to come back, how late an update arrived, how long the board took to catch up after you unlocked the screen — and sends those timings up in batches. Each one is a name, a number, the table it happened at and your account identifier. They are timings and nothing else: no screen contents, no messages, no device identifiers, no location. They are kept for 30 days and then deleted, and they are used only to find out whether the online game is fast enough.

What is never collected

• No advertising, no ad identifiers (no IDFA), no ad networks.
• No analytics or crash-reporting services. There is no third-party SDK in the app that watches what you do.
• No location, contacts, photos, camera, microphone, calendar or health data. The app never asks for any of these permissions.
• No tracking across other apps or websites, and nothing shared with data brokers.
• Nothing is sold, and nothing is used to build a profile of you.

Who else is involved

Running an online card game means a few companies handle parts of it. Each one is used for one job, and none of them is paid in your data:

• Supabase — the database, sign-in, and the server that runs the game. Accounts, tables and timings are stored there, on infrastructure in the United States (AWS, Oregon). Their logs, like any web server's, record the IP addresses that requests come from.
• Apple and Google — only if you choose to sign in with them, and only to confirm that you are who the token says you are.
• Resend — sends the confirmation and password-reset emails, and so handles your email address to deliver them.
• Cloudflare — hosts kingbarbu.com, and records website requests as part of serving them.

If you are in the UK or EEA, note that this means your data is transferred to and stored in the United States.

The website

kingbarbu.com is a handful of static pages: this one, the page an invite link opens, and the page an email confirmation lands on. None of them uses cookies, and none of them runs any analytics. They do load the Fraunces typeface from Google Fonts, which means Google sees the IP address of anyone who opens a page here. That is the only request any of these pages makes to anybody but this domain.

Deleting your account

In the app: Settings → Delete account. It is immediate and it is permanent — there is no recovery.

What goes: your sign-in, your email address, your username, and your seat at every table you have played. If you are in the middle of a game, the app will say so first, because a seat cannot simply vanish from a round three other people are still playing — you can stand your seat down to a computer player and delete anyway.

What remains, for a while: the tables you played continue to exist for the other players, with your seat no longer attached to you. Performance timings carry your account's identifier and are not removed by a deletion — they age out on their own 30-day schedule, after which nothing in them points back to you.

Guest sessions need no deletion — they expire by themselves within a day.

Your rights

Depending on where you live — this includes the UK, the EEA under GDPR, and California under the CCPA — you have the right to ask for a copy of what is held about you, to have it corrected, to have it deleted, and to object to how it is used. Deletion is built into the app and is the fastest route. For anything else, write to privacy@kingbarbu.com and you will have an answer within 30 days.

Where a legal basis is needed: your account and the tables you play are processed to perform the service you asked for, and the performance timings on the legitimate interest of keeping the game working properly.

Children

King Barbu is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, write to privacy@kingbarbu.com and it will be deleted.

Changes

If this policy changes, the date at the top changes with it, and anything that materially affects what is collected will be announced in the app before it takes effect.

Questions: privacy@kingbarbu.com