Privacy Policy
Last updated: September 24, 2026
In brief: CribDuel requires an account to access online features and stores your profile, game statistics, and match history on Firebase infrastructure operated by Google LLC. The app uses Firebase Analytics and Firebase Crashlytics to fix bugs and understand which features are used: device model, OS version, app version, country, in-app events, and crash reports. Your data is encrypted in transit and at rest, and you can delete your account from Settings at any time. We do not sell your personal data or share it with data brokers or advertisers.
1. General information
CribDuel ("the App") is a 1v1 cribbage card game, developed and published by IOCODO LLC ("we", "our", "us"). Two players share one board and play to 121 points, offline against a bot or online against another player through matchmaking.
This Privacy Policy explains what information is collected, how it is used and protected, how long it is kept, and the choices available to you when you use the App.
2. Local data stored on your device
The App stores certain data locally on your device to support offline access, performance, and a consistent experience. Depending on how you use the App, this may include:
- Account information such as your display name and email address
- Game statistics including wins, losses, draws, and your current ELO rating
- In-app preferences and settings (music, volume, hints)
- Crash reports and diagnostic data (collected by Firebase Crashlytics)
- Usage analytics and in-app events (collected by Firebase Analytics)
Some of this data is also synchronized with Firebase backend services operated by Google LLC, as described in the sections below.
3. Account and authentication
CribDuel allows you to play against the bot as a guest without creating an account. To access online matchmaking, the ELO leaderboard, and to save your progress, you may sign in via Firebase Authentication (Google LLC).
Supported sign-in methods: Google Sign-In, Sign in with Apple, Email/Password, and Anonymous (guest). When you sign in, Firebase Authentication processes your credentials and we store a user profile (display name and email address) in Firebase services. Anonymous guest sessions generate a random identifier; no email or credential is collected.
4. Data stored in Firebase backend services
CribDuel uses several Firebase services operated by Google LLC to store and synchronize data required to run the game:
- Firebase Realtime Database: stores live game state, match data, matchmaking queues, and presence information.
- Cloud Firestore: stores user profiles, game statistics, and leaderboard entries.
- Firebase Cloud Functions: runs server-side logic for ELO calculation, account deletion, and other game operations. These functions process your account identifiers and game data to perform their tasks.
- Firebase Remote Config: delivers configuration values (feature flags, game parameters), fetched without sending your account details.
- Firebase App Check: attaches a device attestation token to requests so that we can check they come from a genuine copy of the App. The token does not identify you personally.
- Firebase Cloud Messaging (FCM): sends push notifications, for example when another player is waiting for a match. For this we store a push token for your device, the device platform, and your language and country, so that notifications arrive in your language. You can turn notifications off in the App's Settings or in your device's system settings.
Data stored in Firebase is subject to Google LLC's data processing terms and privacy policies.
5. Analytics and crash reporting
The App uses Firebase Analytics and Firebase Crashlytics (both Google LLC) to help us understand how the App is used and to diagnose technical issues.
- Firebase Analytics collects usage events and app activity (such as screens viewed, features used, and session duration) along with device and instance identifiers. This data is used in aggregate to improve the App.
- Firebase Crashlytics collects crash reports and diagnostic data (including stack traces, device model, operating system version, and App version) when the App encounters an error. This helps us identify and fix bugs.
The App does not currently offer an in-app switch for analytics or crash reporting. If you prefer that this data is not collected, you can uninstall the App at any time and ask us to delete the data linked to your account (see section 11).
6. Monetization and advertising
We do not sell your personal data. Any future change to how CribDuel is monetized, including the addition of advertising, will be described in an update to this policy and, where required, confirmed with an in-app consent request before it applies to you.
7. Network requests and third-party services
During normal operation, the App communicates with the following third-party services:
- Firebase Authentication (Google LLC): account sign-in and session management
- Firebase Realtime Database (Google LLC): live game data and matchmaking
- Cloud Firestore (Google LLC): user profiles and leaderboard
- Firebase Analytics (Google LLC): usage analytics
- Firebase Crashlytics (Google LLC): crash and diagnostic reporting
- Firebase Remote Config (Google LLC): app configuration
- Firebase App Check (Google LLC): request integrity verification
- Firebase Cloud Functions (Google LLC): server-side game logic
- Firebase Cloud Messaging (Google LLC): push notifications
- Google Sign-In (Google LLC): optional social authentication
- Sign in with Apple (Apple Inc.): optional social authentication
- Resend (Resend, Inc.): account emails, such as email address verification and password reset. Resend receives your email address and the message only to deliver it.
Important: Google LLC acts as the data processor for Firebase Analytics, Crashlytics, and the other Firebase services listed above, and Resend, Inc. acts as the processor for account emails. Each third-party service processes data under its own privacy policy; see Google's Privacy Policy and Resend's Privacy Policy for provider-specific details on data handling, retention, and your rights.
8. Data sharing and sale
We do not sell your personal data. We do not share your personal data with third parties except as required to operate the App (specifically, by transmitting data to Firebase and Google services, and your email address to Resend for account emails, as described in this policy) or as required by law.
Your display name and ELO rating are visible to other players on the in-app leaderboard. No other personal data is exposed to other users.
9. Data security
We protect your personal data with these safeguards:
- Encryption in transit: all traffic between the App and our servers uses HTTPS (TLS).
- Encryption at rest: data stored in Firebase is encrypted on Google Cloud's servers.
- Passwords: if you sign in with email and password, Firebase Authentication stores only a salted hash of your password. We never see or store the password itself.
- Access rules: security rules on our databases decide what each signed-in player can read or change. No player can edit another player's profile or statistics.
- Restricted access: only authorized IOCODO LLC personnel can access the backend, and only to operate and support the App.
No method of transmission or storage is completely secure. If we learn of a security incident that affects your personal data, we will notify you and the relevant authorities as required by law.
10. Data retention
- Account data (profile, game statistics, match history, and leaderboard entries) is kept for as long as your account exists.
- Live match data (game state and matchmaking entries) is temporary: a scheduled job removes it within 12 hours of the last move. Your online status is cleared automatically after you leave the App.
- Crash reports are kept by Firebase Crashlytics for 90 days.
- Analytics event data is kept for no more than 14 months.
11. Account deletion
You can delete your account and the data linked to it at any time:
- In the App: open Settings, tap Delete account, and type DELETE to confirm. Your account is deleted immediately.
- By email: send a deletion request to support@iocodo.com with the subject "CribDuel Account Deletion". We will complete the deletion within 30 days and confirm by reply.
After deletion, your profile, game statistics, match records, and push tokens are removed from our active systems within 30 days. Aggregated analytics data may be retained in de-identified form as permitted by Google's data processing terms.
12. Your choices
- You can play as a guest without giving an email address or any other contact details.
- You can turn push notifications on or off in Settings, or in your device's system settings.
- You can remove locally stored App data by uninstalling the App, subject to any device backup behavior controlled by Apple or Google.
- You can delete your account at any time, as described in section 11.
13. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the App after changes are posted constitutes your acceptance of the updated policy.
14. Contact
If you have questions about this Privacy Policy, please contact:
IOCODO LLC
Email: support@iocodo.com
Website: iocodo.com