Privacy

This notice describes VAVA Backgammon / Nardy data. For access, correction, export or deletion requests, use the support email below.

Profile, games and communication

The server stores a profile ID, nickname, selected avatar, rating, results, statistics, gems and transaction history, clubs and settings. Other players see public game information. Friends, invitations and communication use social links, requests, recent activity and read status. The phone address book is not accessed.

Direct messages are visible to participants; club chat is visible to current club members. Ordinary history is limited to 30 days and 300 messages per conversation. Authorized administrators can access reports and support submissions, which may be retained separately. Reviewed reports are removed on cleanup after 90 days; pending reports remain until reviewed. Decisions, restrictions and support conversations are recorded.

Terms records include the accepted version and date; individual features retain the relevant consent. Online play and communication require explicit acceptance of current terms. Local bot play remains available without acceptance.

Local bot games and pending rewards

The device stores an unfinished game and a persistent results queue. For registered players, the server issues single-use account tickets in advance. The device stores the ticket and the sequence of dice rolls and player and bot actions. On connection, it sends the log to the server to replay and validate the game. The last presence time and the automatic forfeiture deadline are stored to handle a return to the table.

Until the server issues a receipt, a reward is pending, excluded from spendable balance and cannot be spent. Resending a ticket cannot award it twice. The server retains tickets and compact result receipts; it does not write the full verification log to the game database. An unsent queue remains on the device until synchronization or local-data deletion. Results from different accounts are not combined. Guest games do not require submitting a result for rewards.

Email, Google and Apple

Email supports verification, sign-in and recovery. Passwords are stored as strong hashes. Linked-account sessions last up to 30 days unless revoked earlier; a password reset revokes earlier sessions. The device stores session data, preferences and game cache.

Google sign-in checks a signed credential, account ID and verified email. An available photo URL is used only after the player chooses it; the image is moderated. Gmail, Drive, calendar and contacts access are not requested.

Apple sign-in in the supported iOS app uses an Apple identifier and shared email, including Hide My Email. The authorization used to revoke the Apple link is encrypted on the server. Account deletion queues revocation and retries after temporary failures. The game never receives an Apple or Google password or access to iCloud files.

Photos and country flag

Uploaded avatars and club crests are re-encoded as WebP without metadata and moderated. Pending images are visible only to their owner and authorized administrators; approved images are visible to players. Unused images older than 24 hours are removed on cleanup; separate backup copies may remain.

Country display is off by default. After separate consent, the server estimates the connection country from IP using a local database and displays it to players. GPS, city and precise coordinates are not requested. Disabling the feature removes the saved country code and display-consent timestamp. A VPN can change the country; this is not nationality.

Voice, video and notifications

Camera and microphone require a player action, in-game consent and device permission. WebRTC sends media to club-table participants and processes connection metadata, with a configured relay where needed. The game server does not record video calls. Other participants may independently record received audio or video.

Voice notes stay in server memory: delivery is available for up to 60 seconds and authorized recipient-report review for up to three minutes after recording. Reports do not extend this window. The service does not write audio to disk; report metadata may remain.

Players can opt into Android notifications through Firebase Cloud Messaging. Delivery uses a device token, account link, language, time zone and notification settings. Signing out disables the link. Firebase Analytics is disabled. iOS notifications are not yet connected.

Infrastructure and retention

Oracle Cloud hosts the game server and active database. Old app addresses may pass through a Railway compatibility relay; it is not a second active game database. Google provides Google sign-in and Android notifications, Resend delivers email and Apple processes Apple sign-in. Configured WebRTC providers process connection data. Traffic uses HTTPS; processing may occur outside your country.

IP and technical information support connectivity, abuse prevention and diagnostics. We do not sell game data or use it to track people across unrelated apps and websites. Profile and support data remain as needed to operate accounts and handle cases; no general inactivity-deletion period is set. Encrypted backups are separate from the active database and are not erased immediately on account deletion.

Account deletion

In the game, open Profile → Account → Delete account. Confirm deletion and verify ownership using a linked-email code or fresh Apple sign-in when available. Internet is required. Club owners must first transfer or delete their clubs. Without the app, contact support from the linked email; the deletion page explains this route.

Deletion removes sign-in identities, sessions, selected profile and country data, personal statistics and balance, authored messages and social links, and offline-reward tickets and receipts from the active database. Shared game records may remain with an anonymous deleted-profile marker. Unused images are cleaned separately. Server deletion does not automatically erase local data on every device. Do not send passwords or one-time codes to support.

Children

The game is not intended for children under 13. If you believe a child has provided personal data to us, contact support.