Privacy Policy

Card Rush XYZ is a party card game from Luis Suárez, who operates under the name Luewell (“Luewell,” “we,” “us”). You don’t need an account, and your progress stays on your device. This policy explains what limited information Card Rush XYZ processes and how it is handled.

1. Information we process

Card Rush XYZ works without an account or sign-in. We do not ask for your name, email address, or any profile information. Your game progress, your Credits, your level, and your settings are stored only on your device, and we never receive them except for the details online play needs, described in section 2.

2. While you play

Classic, Frenzy, Practice, and Tournament matches run on your device, and the other players in them are AI players created by the app.

Private rooms and quick online matches go through our rooms server at rooms.luewell.dev, hosted by Luewell. When you play online, the app sends the server your nickname (by default, “Player”), the ID of the avatar you chose, and your player level; the server gives you a random player ID and a session token, and relays the game moves between the players in your room. The other players in the room see that nickname, avatar, and level. There is no chat.

The server keeps this only temporarily: a session lasts up to 24 hours, a room that is waiting for players expires after 10 minutes, and a room that is being played or has finished expires 2 hours after its last activity. Session tokens are stored only as SHA-256 digests, and gameplay messages are never logged. To prevent abuse, the server counts requests per player and new sessions per IP address in 60-second windows; our hosting provider may keep technical access logs for a short time.

Card Rush XYZ does not ask for access to your location, contacts, camera, microphone, or photos.

3. Advertising

Card Rush XYZ shows ads served by Google AdMob: full-screen ads between offline matches, at most one every third match. To show and measure ads, limit how often you see the same ad, and prevent fraud, Google’s software in the app may collect device identifiers, your IP address and approximate location, information about the ads you see and tap, and diagnostic information, as described in Google’s Privacy Policy.

On iPhone, Card Rush XYZ asks for your permission to track you (App Tracking Transparency) before personalized ads can be shown. If you allow it, Google’s software in the app receives Apple’s advertising identifier (IDFA) and may use it, together with the information above, to show you personalized ads and to measure them. If you don’t allow it, the IDFA is not available and you see non-personalized ads. You can change your choice at any time in your device’s Settings → Privacy & Security → Tracking.

Before any ad is requested, the app uses Google’s User Messaging Platform to check whether a privacy message is required where you are. Where the law requires it, the message lets you consent to or refuse personalized ads, or opt out of the sale or sharing of your personal information for personalized ads. When a message applies to you, you can review or change your choice at any time in the app’s Settings. Buying “Remove Ads” or “VIP” stops the ads between matches; rewarded ads stay optional.

4. Purchases

Card Rush XYZ offers optional in-app purchases: “VIP,” a one-time purchase that removes ads and unlocks Frenzy mode (it also includes rank protectors and VIP avatar frames); and “Remove Ads,” a one-time purchase. They are processed by Apple through the App Store; Luewell never receives your payment details. To manage purchases, we use the purchase management service RevenueCat.

RevenueCat acts on our behalf and receives a randomly generated, anonymous app user identifier, the App Store purchase information needed to deliver what you bought, and your device model, operating system, and app version. It does not receive your name and uses this information only to operate and validate your purchases.

No sign-in is needed to buy: “VIP” and “Remove Ads” can be restored on your other devices that use the same Apple ID with “Restore purchases” in the Shop or in Settings.

5. What we don’t do

• We do not track your activity across other apps or websites unless you allow it, and then only so Google can show and measure personalized ads.
• We do not use analytics, crash reporting, or push notifications.
• There is no chat; online rooms show other players only your nickname, your avatar, and your level.
• We do not sell your data to data brokers.

6. Data retention and deletion

Your progress, Credits, level, and settings live on your device; uninstalling Card Rush XYZ removes them, and we keep no copy. Online sessions and rooms expire as described in section 2. “VIP” and “Remove Ads” stay with your Apple ID and can be restored at any time. Purchase information is retained while the RevenueCat record linked to your device remains active. Your ad consent choice is saved on your device by Google’s User Messaging Platform until you change it or delete the app, and advertising data collected by Google is kept according to Google’s policies.

7. Children’s privacy

Card Rush XYZ is suitable for a general audience but is not directed at children, and we do not knowingly collect personal information from children. The app never asks for a name or email address, and online rooms have no chat. Purchases are made through Apple, where parents can use Family Sharing controls such as Ask to Buy.

8. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective” date above. Significant changes will be reflected on this page.

9. Contact us

If you have any questions about this Privacy Policy or how Card Rush XYZ handles your data, please contact us at [email protected].