Rats at the Table

Privacy Policy

Last updated: September 29, 2026

The short version: we do not ask for an e-mail address or a phone number to open an account, we show no advertising, we use no advertising or tracking SDK, and we sell data to nobody. What we collect is what the game needs to work. Below it is set out item by item.

1. Data controller

Your data is controlled by:

• Sevgi Güzel
• Sarıyer, İstanbul, Türkiye
• E-mail: support@ratsatthetable.com
• ratsatthetable.com

2. What we collect for your account

• Player id: a random number we generate when your account is created. It is not derived from your device, your phone number or anything else.
• Display name: the name you type. Other players see it at the table, in lists and in notifications.
• If you linked a Google or Apple account: that account's identifier and which provider it is. We never see your password; there is no password in this game.
• Friend code: a six-character code generated the first time you want to add a friend.
• Your language: used only to choose the language of a notification sent while the app is closed.
• When your account was created and when you were last seen.

About your e-mail address, plainly: when you sign in with Google or Apple, the provider also sends us your e-mail address. We do not store it, we do not pass it on, and it is discarded when the request ends — there is no e-mail field in our database.

When you sign in with Google or Apple for the first time and there is no guest account to upgrade, the name on that account becomes your display name in the game. With Google this is usually your real name. You can change it in Settings.

3. What the game itself produces

• Match records: where you placed, which character you played, how many points you scored. Your profile, statistics and the rankings come from these.
• Payout ledger: how much respect and how many points each match paid you.
• Match event log: what happened at the table, in order. It exists only for the match summary screen and is deleted automatically after 90 days.
• Neighborhood, crew and cosmetics: what you own.
• Seat ledger: which table a seat was spent on and whether it was refunded.
• Friendships, friend requests and the players you have blocked.
• Players you have reported and the reason you gave.

Chat at the table is not stored on our servers. Your message is relayed to the players at your table and not recorded; when the table breaks up no copy remains. The one exception is a report: when a player at your table reports you, your last messages at that table (at most ten) are attached to the report so that we can review it, and they are kept with the report. So use the report button while you are still at the table.

Voice chat works only between friends at the same table, and the microphone is used only after you tap the voice button there. Your voice travels from your phone to theirs encrypted end to end; when the phones cannot reach each other directly it passes through our relay server, which only forwards packets it cannot decode. Voice is never recorded or stored. To connect the call the server passes connection details between the phones, and the relay sees your IP address, as any server you connect to does.

4. Notifications

If you allow notifications we store your device's notification address (a Firebase Cloud Messaging token) and your language. One device is kept per account: if you sign in from a new device, notifications go there instead.

Notification text travels through Google's servers, and on iOS through Apple's, to reach your phone. Some notifications contain the display name of the player who invited you or whose turn you are waiting for — so another player's name can appear on your lock screen this way.

You can withdraw the permission at any time in your device settings. When you sign out or delete your account we delete the notification address.

5. Purchases

Payment happens in the store. Your card number, your name and your billing address never reach us; we neither see nor store them.

Purchase information reaches us only through RevenueCat: which product, which store, the transaction id, the amount, the currency, the date and the state of the purchase (renewed, canceled, refunded). We store these together with the account they belong to.

When you buy something in the app we send RevenueCat only your player id — not your name, your e-mail or any device identifier.

You can see your own purchases in the spending panel under Settings.

If you ask the App Store for a refund, Apple may ask us about that purchase before it decides. RevenueCat answers on our behalf with information about the purchase and your account — for example whether it was delivered and how much of it has been used, and your purchase and refund history with us — together with our refund preference. Apple uses this only to decide on the refund, and the decision is Apple's. You consent to this when you accept this policy; you can withdraw that consent by writing to us, after which we no longer answer such requests for your account.

6. Analytics and crash reports

To see where the app stalls and where it crashes we use Firebase Analytics and Firebase Crashlytics. We use no advertising network, no tracking SDK and no attribution SDK; there is no advertising in the game.

What is sent: which screen was opened (the route pattern, not the room or player id inside it), events describing the flow of a game, and an error record if the app crashes. The code of the table you were at is attached to a crash report; without it a bug that happens at the table cannot be found.

Your player id is also sent to these two tools so that repeated crashes from the same person can be linked. Your name and e-mail are not sent.

You can turn analytics and crash reporting off completely under Settings. Once off, the app sends these two tools nothing at all. For data sent before you turned it off we have to ask Firebase to delete it — write to us and we will.

During development analytics is off entirely.

7. Technical logs

For operations and security the server keeps technical logs: the IP address a request came from, when it arrived and which operation it was. These exist to spot abuse and faults, not to build a profile.

8. Why, and on what legal basis

• Creating your account, seating you at a table, running the match, saving your progress: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Processing purchases and keeping financial records: performance of a contract and a legal obligation (GDPR Art. 6(1)(b) and (c); KVKK Art. 5(2)(a) and (c)).
• Fighting cheating, fraud and abuse, and securing the server: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). Concretely, those interests are keeping the game fair and keeping paid-for money from being stolen.
• Sending notifications: your device permission, that is consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)).
• Analytics and crash reporting: consent. You can withdraw it at any time by switching it off in Settings; withdrawal does not affect the lawfulness of processing carried out before it.
• Answering a refund request you made to the App Store: consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)), given when you accept this policy. You can withdraw it at any time by writing to us; withdrawal does not affect answers already sent.

No automated decision closes your account: suspension and closure are decided by a person.

9. Who we share with

We sell data to nobody. Your data goes only to the service providers the game needs in order to work:

• Google (Firebase): verifying sign-in, delivering notifications, analytics and crash reporting.
• Apple: delivering notifications on iOS, Sign in with Apple, and information about a purchase when you ask the App Store for a refund (see section 5).
• RevenueCat: verifying purchases, tracking subscription state and answering refund requests on our behalf.
• Our hosting provider: where the server and database run.

Each of these providers is contractually bound to provide the same or equal protection of your data as stated in this policy, and may process it only on our instructions and for the purposes set out here.

Beyond that we disclose information to public authorities only where we are legally required to, and only to the extent required.

Other players at your table see your display name, your game statistics and what you write at the table. Rankings are public.

10. Transfers outside your country

Our server and database are in Europe; some of the providers above are established in the United States. Your data is therefore transferred outside Türkiye and outside the European Economic Area.

Those transfers rely on the standard contractual clauses adopted by the European Commission and signed with each provider (GDPR Art. 46). Under KVKK the transfer rests on it being necessary for the performance of the contract and on appropriate safeguards being in place (KVKK Art. 9).

11. How long we keep it

• Your account details, game history and what you own: until you delete your account.
• Match event log: 90 days, then deleted automatically.
• Notification address: until you sign out, until your device's address stops working, or until you delete your account.
• Purchase records: kept after account deletion because of financial and legal obligations and the possibility of a chargeback (see section 12).
• Technical logs: short term, as long as operations require.
• Analytics and crash reports (Firebase): event data 2 months; data tied to a device or user identifier until 14 months after your last activity; crash reports 90 days. Google deletes them after that.
• Backups: deleted data stays in the daily database backups for at most 31 more days, then goes with them.

When you move from a guest account to a Google or Apple account that was already used in the game, the old guest record is not deleted. Your items and the respect you bought move to the permanent account; respect earned by playing moves only under certain conditions (enough matches played, not merging too often). The row left behind keeps an id, the name it had at the time, its friend code, its dates and match counters; the results and payouts of the matches you played as a guest, your friendships, reports and support conversations stay attached to it. When you delete your permanent account, that row and everything attached to it are deleted too; if you want a record left behind by a move made before September 29, 2026 deleted, write to us. When you link a guest account to a Google or Apple account that was never used in the game, no row is left behind: the same account becomes permanent.

12. What happens when you delete your account

You can delete your account from inside the app, under Settings, with 'Delete account'. It cannot be undone.

Deleted: your profile, your name, your friend code, your notification address, your friendships, your match results, your payout ledger, your match event log, your cosmetics, your neighborhoods, your crew, your seat ledger, your support conversations, the reports you filed and the reports filed about you, the guest record you used before moving to this account (see section 11), and, if you signed in with Google or Apple, your sign-in record at Firebase Authentication.

Kept: your purchase records. Your identity is detached from those rows — your player id and store user ids are removed — but the product, amount, currency, date, the store's transaction id and RevenueCat's event id remain. We need these for tax rules and for a possible chargeback. These rows are anonymous to us, but those two ids are still numbers that Apple, Google and RevenueCat can link back to you.

One more thing you should know: deleting your account here does not delete your Google or Apple account — you manage that with the provider. In the same way, records held by Firebase Analytics, Crashlytics and RevenueCat are not removed by our deletion; if you want those deleted, write to us and we will pass the request on.

If a match is running while you delete, it plays on to the end with the server playing your seat; when it ends, no result, payout or event record is written for you.

If you have an active subscription you must cancel it separately in the store; deleting your account does not cancel it.

13. Your choices

• You can change your name at any time.
• You can turn notifications off in your device settings.
• You can turn analytics and crash reporting off under Settings.
• You can block and report a player.
• You can delete your account.

None of these has to stay on for you to play; the only thing required to open an account is a name. Without a name no account can be created and the game cannot be played.

14. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, objection to processing, and data portability. Where processing rests on consent you may withdraw it at any time.

Under KVKK Art. 11 you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose and whether it is used accordingly; to know the third parties it is transferred to at home or abroad; to have incomplete or inaccurate data corrected; to request its erasure or destruction; to have correction, erasure and destruction notified to those third parties; to object to a result produced against you solely by automated analysis; and to claim compensation for damage caused by unlawful processing.

Write to support@ratsatthetable.com to exercise any of these. Under KVKK Art. 13 we answer within thirty days at the latest, and GDPR requests within one month.

If our answer does not satisfy you, you may complain to the Turkish Personal Data Protection Board. If you are in the European Union you may complain to the supervisory authority of the country where you live or work.

We do not send marketing messages. If we ever start, we will ask for your consent separately and explicitly, and you may object at any time.

15. Children

The game is not for children under 13 and we do not knowingly collect data from anyone under 13. If we learn that an account belongs to a child under 13 we close the account and delete its data.

If you believe your child has an account, write to us and we will find it and delete it.

In the European Union the age for consent-based processing ranges from 13 to 16 depending on the country. If you are below the age set in your country, that consent must be given by a parent or guardian.

We do not profile children, show them personalized advertising or market to them — we do none of these for anyone.

16. Security

All traffic between the app and the server is encrypted. Access to the server and the database is restricted. Because the game stores no passwords, there is no password to steal.

No system is completely secure. If a breach affects your data we will make the notifications applicable law requires.

17. Changes

We may update this policy; the date at the top of the page shows which version you are reading. If we ever need to process your data for a new purpose not described here, we will tell you before that processing begins and, where required, ask for your consent separately.

18. Contact and requests

Send data protection questions and requests to:

• Sevgi Güzel
• Sarıyer, İstanbul, Türkiye
• E-mail: support@ratsatthetable.com
• ratsatthetable.com

Rats at the Table · Sevgi Güzel · ratsatthetable.com · Last updated: September 29, 2026