Privacy policy

Ruff

Android and iOS game com.crackoncloud.ruff, published by crackoncloud · Last updated 20 September 2026

1. What the game stores on your device

All of it lives in app-private storage — a local database and a settings file — readable by Ruff and not by other apps. Uninstalling takes every bit of it with you.

• The match you are in and any you have quit and can continue: the game, its setup (who sits where, at what level, under which rules, to what target), the journal of every action so far, the hand you are on, the running scores and the hints used. Reopening the app replays the journal and lands you where you stopped.
• Every hand you have played: the game, the rules in force, the seed it was dealt from, the scores, the tricks card by card, and flags for a moon, a nil made or set, a march or a euchre — kept so a hand review can show every trick and the Fair deal screen can show the seed
• Every match you have finished: the game, the rules, the levels, the mode, whether you won, the margin, the number of hands and hints, and the date
• Your bests per game and level, which Daily days you have played and how they scored against the expert's baseline, and each Tour match's stars and margin
• Your streak: the current run, your best, banked freezes, the last day played and the days a freeze covered
• Your settings: how a card is played, confirm point cards, auto-play the only card, undo, thinking delay, trick pause, auto-collect, table, deck, card size, four-colour suits, court letters, left-handed layout, hand sort and the order you last arranged a hand in, animation speed, reduce motion, sound, haptics, the Daily reminder switch and its time, the two diagnostics switches, and the screen you were last on
• The date of first launch, whether the rating sheet has been shown, which first-run tips you have dismissed, and whether this phone has switched Expert to its reduced search
• Whether Ruff Unlocked has been bought, as last reported by the store. It is kept device-local.

None of it identifies you, because none of it is asked for. There is no name, no email, no profile and no sign-in anywhere in this game. The hand history and the statistics are append-only by design: no update ever deletes a row from them, and there is no button in the app that does either.

The backup file

Settings › Backup › Export writes one file, ruff-backup-<date>.json, through the system's own file picker, to wherever you point it — a folder on the phone, a drive app, a cable. It is plain, readable JSON holding your finished matches, your hands, your bests, your Daily days, your Tour progress and your streak; it does not carry a match in progress, your settings, or the unlock. The app never reads the file again unless you choose it in Import, and an import merges — a result already present is skipped, a best is the higher of the two, a streak keeps the longer — so nothing you have is ever lowered by it. Ruff has no way to send the file anywhere. Where you put it, and who else can read that place, is up to you and the app you saved it with.

The share card

Share, on a result card, draws the card as a picture — the game, the margin, the level and the sealed deal's code, nothing that is not already on the screen — writes it to the app's own cache and hands it to the system share sheet with a one-line caption. Which app receives it is your choice on that sheet; the picture goes to that app and nowhere else, and the file in the cache is replaced by the next card you share. Nothing is sent unless you tap Share.

Your device's own backup

On Android, the game allows the platform's own backup, so if you have Android backup switched on, your device may copy the app's files into your Google account backup along with everything else on the phone. That is Android's backup of your device, made with your own account and governed by Google's terms — we neither see it nor hold a key to it. On iOS the same is true of an iCloud or an encrypted local device backup. Turning device backup off, or excluding the app from it, stops that copy being made.

2. Permissions, and exactly what each one is for

Permission	What Ruff does with it
Vibrate	The tick under a card. Granted at install, never asked for, and idle while the haptics setting is off.
Notifications	One local reminder for the Daily, off until you switch it on in Settings › Daily reminder. The permission is asked for at that moment and never on a cold open; a refusal switches the setting back. It fires once a day at the time you pick, skips a day whose Daily you have already played, and is scheduled by the phone's own clock — there is no push service, no token and no server behind it. On Android the app also listens for the phone finishing a reboot, only to put that alarm back.
Internet Network state	No hand needs a connection: every deal and every decision is computed on the device, including the Daily. It is here for the store — the purchase, the restore, Android's in-app update check and the rating sheet — and for the diagnostics in §3, which the two switches in Settings turn off.

That is the whole list. The advertising-identifier permission that the analytics library would otherwise bring along is explicitly removed from the Android manifest, because nothing in this game reads it. There is no storage permission, because the backup goes through the system picker; and no permission for location, contacts, the camera, the microphone, the phone, all-files access, or for listing the other apps you have installed.

3. Crash reports, and Usage statistics

Two switches, under Settings › Diagnostics. Either can be turned off at any time, permanently, from that screen, and each is honoured before anything is collected rather than after: all three collectors ship disabled in the app's own manifest and property list, and are switched on only after the stored preferences have been read. A player who turns one off is off from that moment, and stays off across launches.

Both switches start off in the EEA, the United Kingdom and Switzerland, and on elsewhere. A device that names no country at all takes the cautious side and starts off too. Either way the switches are yours, in both directions, from the first launch.

Crash reports

When the game crashes or hits an error it handled, a stack trace, the device model, the operating system version, the app build and the game's own breadcrumbs go to Firebase Crashlytics so the fault can be fixed. A handled error carries the name of the place in the code that handled it — a saved match that would not restore, a review that would not open — and nothing else about what you were doing.

Usage statistics

The second switch covers Firebase Analytics and Firebase Performance together. The whole vocabulary is written out in the code as the only events the game sends:

• A match started, with the game, the mode, the levels at the table and a number that identifies the rules in force; a hand ended, with the game, each seat's score and whether there was a moon, a nil or a march; a match ended, with the game, whether you won, the margin, and how many hands, hints and undos it took
• The Coach asked, and whether its card was played; a Daily played, with the game, the margin and the streak; a Tour match done, with the chapter and stars
• The Unlock page opened, and from where; a purchase; a restore, and how it went; a purchase receipt that did not verify on the device; a setting changed, by its name; a result card shared, with the game; and this phone switching Expert to its reduced search
• One sampled measurement: one AI decision in fifty is reported by its level, how many milliseconds it took and how many iterations it searched, so the levels' budgets can be checked on real phones
• The platform's own app-start and screen-rendering measurements from Firebase Performance
• The Firebase app-instance ID, which is what makes two events from one install countable as one session. It is the SDK's own identifier: it names an installation rather than a person, it is reset when the game is reinstalled or its data cleared, and there is no account in this game to join it to.

None of what these switches send is shared with anybody. Nothing here profiles anyone, and nothing is joined to data from any other company or app. Everything sent goes over HTTPS. Google acts as our processor for these reports, and their handling of them is covered by Google's own privacy terms.

The switches cannot carry your cards, a seed or a seal code, because every parameter comes from the fixed list above. The seal is a hash of a random number drawn on your phone; it is not personal data, and it never leaves the app's own database.

4. Advertising

There is none. Ruff contains no advertising SDK, requests no ad, and reads no advertising identifier: on Android the permission for it is removed from the manifest (§2), and on iOS the game never calls for App Tracking Transparency permission, so the prompt is never shown and the IDFA is never available to anything in the app. Google's own collection of the advertising ID by the analytics library is switched off in the build as well.

The app's iOS privacy manifest declares no tracking and no tracking domains. Nothing in this game is earned by watching anything, and nothing in it is bought by the piece.

5. Buying Ruff Unlocked

The unlock is one purchase, once — a non-consumable — made through Google Play Billing on Android or StoreKit on iOS. Both run in the store's own process, not in ours: the game never sees or stores a card, a billing address or a store account name. There is no server of ours in the path. On Android the signed purchase is checked against the app's licensing key on your own device, and nothing about that check leaves the phone; the entitlement is then cached locally, which is also why a purchase keeps working with no connection.

Restoring on a new device asks the store, not us; the Restore button is on the Unlock sheet. What the store collects in the course of a purchase is governed by Google's or Apple's privacy policy, not by this one. No game is behind the purchase, so nothing you have played becomes unplayable if a store ever fails to answer.

6. What you can do with your data

• Turn either switch off in Settings › Diagnostics. Collection stops from that moment. The app-instance ID is not carried to anyone else, and reinstalling the game or clearing its data gives the install a new one; reports already sent can be deleted on request — write to the address in §9.
• Export a backup from Settings › Backup, and read it: it is your data, in a plain file you hold.
• Uninstall, or clear the app's data. That removes everything the game kept on the device. Because we never held a copy, there is no server-side record to ask for the deletion of, and no deletion URL to send you to.

7. Children

Ruff is a card game for a general audience and is not directed at children under 13. It has no social features, no messaging, no user profiles and no accounts, it shows no advertising, and it asks no one for a name, an email address or any other personal detail, at any age. There is no wagering, no chips and no currency of any kind: Hearts, Spades, Euchre, Whist, Oh Hell and Bid Whist are scored games, and a bid, a book or a bag is a game term. Because it is not a child-directed app it is not in Google Play's Designed for Families programme.

8. Changes to this policy

If what the game stores or sends changes, this page changes with it and the date at the top is updated. Anything that would move an answer here — an identifier of any kind, a cloud copy of your progress, a push service, an online leaderboard, an advertising SDK, or a third-party framework this page does not name — is a change to the product's own promises, not merely to its wording, and it is announced here before it is relied on.

9. Contact

Questions about this policy, or about anything Ruff stores: support@crackoncloud.com