Privacy Policy

1. Overview & Privacy-First Architecture

FortyFives ("we," "us," or "our") respects your privacy. 45s (the "Game") is engineered with a privacy-first, local-first architecture.

We collect only the minimum data strictly necessary to operate authoritative online multiplayer, protect table integrity, diagnose technical crashes, and fulfill in-app purchases. We do not track you across other apps, do not profile players, and never sell personal data.

2. Information We Collect

Offline Solo Play: Zero data is collected or transmitted during offline solo play. All gameplay, preferences, and bot simulations occur entirely on your local device.

Online Multiplayer & Authentication: When playing online, we generate a pseudonymous device-level identifier (a Guest session token, or Sign in with Apple linked to it) to maintain your online table state, friends list, and tournament records. We do not collect your real name, email, or contacts unless you explicitly provide them for support.

Operational Telemetry & Diagnostics: Our servers collect aggregated operational metrics (server latency, connection health, match completion rates, and crash reports) to maintain server availability and resolve software bugs. We do not record raw private card hands, player chat content, or secret authentication tokens in telemetry logs.

Session Recordings (planned, not yet available): We intend to add an opt-in feature that records screenshots of the app's own screens while you play. It does not exist in any released build. Section 4 describes it in full, including the fact that it is off until you turn it on.

3. Apple Privacy Manifest & Required Reasons API

In compliance with Apple App Store policies, our iOS application includes a declared PrivacyInfo.xcprivacy manifest with the following declarations:

NSPrivacyTracking is explicitly set to false: The Game does not track users or devices across third-party websites or apps for advertising purposes. This stays false for the planned session-recording feature as well. Apple defines tracking as linking your data with third-party data for advertising, or sharing it with a data broker; embedding another company's code is not itself tracking, and we do neither of the things that would make it tracking.

NSPrivacyAccessedAPITypes declarations are limited to standard platform operations: Disk Space (to ensure sufficient room for local assets and preferences), File Timestamp (to verify cache freshness of local theme and rules contracts), and System Boot Time (for precise delta-time animation clock synchronization).

4. Session Recordings (Planned — Not Yet Available)

This section describes a feature that is not in the app yet. We are writing it down now, before it is built, so that what we intend is on the record and can be checked against what actually ships. Nothing described here is recording anything today.

If you turn session recording on, the app will record a series of screenshots of its own screens while you play, together with where you tapped. We want this to see where players get stuck, which screens confuse people, and what gets skipped. It is a picture of the game as you saw it: the cards, the table, the menus, the buttons you pressed.

You choose. Recording will be off until you turn it on, and you will be able to turn it off at any time in Settings. The same single choice controls whether we keep records of the hands you play — one decision, not two. If you say no, no recording is made and nothing is sent.

What it will not include. Recordings will not capture your camera, your microphone, or anything from outside the app, and text you type will be masked unless a screen is explicitly allowed. We do not intend to record your IP address.

How long we will keep it. Thirty days. After that, recordings are deleted — not archived, deleted.

Who handles it. We do. Recordings will be stored on servers the operator runs. No other company receives them, and there is no advertising or analytics company involved. The app will contain software code written by a third party (the PostHog session-replay SDKs) to perform the recording; that is not the same as sending your recordings to another company, and we do not.

Because this feature is not built yet, we are not making promises about it. When it ships, this section will be rewritten to describe what the app actually does — including the country or region the servers are in, which is not yet confirmed — and reviewed before that build reaches players.

5. How We Use Information

We use collected information solely to: (a) authenticate your multiplayer sessions and prevent impersonation; (b) deliver authoritative multiplayer trick resolution and table matchmaking; (c) verify purchased themes and custom ruleset entitlements; (d) troubleshoot technical crashes and service degradation; and (e) comply with applicable legal obligations.

6. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We do not integrate third-party advertising SDKs, data brokers, or social graph trackers.

Third-party code is not the same as third-party sharing. The planned session-recording feature described in section 4 would add software written by another company (the PostHog session-replay SDKs) into the app itself. Recordings made by that code would go only to servers the operator runs. No other company would receive them, and we would not be handing your data to the company that wrote the code.

Limited service provider sharing: Online multiplayer traffic is routed through our authoritative cloud hosting and server relay infrastructure. Payment transactions are processed directly by Apple App Store or Google Play Store under their respective privacy policies.

7. Data Retention & Storage Security

Local Storage: User preferences (theme selection, text scaling, audio, haptics, motion reduction) are stored locally in user://settings-v1.cfg on your device and are never uploaded to remote servers.

Server Retention: Realtime online match relay packets are ephemeral and discarded after hand settlement. Aggregated match results and tournament standings are retained only for active competitive seasons and are periodically compacted.

Security: All network communications between the Game client and our servers use industry-standard HTTPS and secure WebSocket (WSS) encryption.

8. Your Rights: Access, Export & Deletion

Regardless of your location, you have the right to: (a) view and reset your local device preferences at any time via the in-app Settings screen (screen 9c); (b) request an export of any server-associated account and gameplay records; and (c) request the permanent deletion of your server account and identity records.

To exercise your access, export, or deletion rights, email us at [email protected] with your in-game player ID. We will verify and process your request within 30 days without charge.

9. Children's Privacy

45s is a family-friendly heritage card game. We do not knowingly collect personal information from children under the age of 13 (or under 16 in the European Economic Area).

Because the Game does not require personal information, social login, or location access, children may enjoy offline single-player and local family play safely. If you believe a child has provided us with personal information, please contact [email protected] and we will promptly delete it.

10. Changes to this Policy & Contact Information

We may update this Privacy Policy from time to time to reflect product updates, new platform regulations, or operator decisions. The current version and effective date will always be posted in-app and at https://fortyfives.app/privacy.

If you have questions, comments, or concerns about our privacy practices, please contact our privacy steward at [email protected] or visit https://fortyfives.app/support.