Privacy Policy
Hearts & Ladders (the "App") is developed by Livales ("we", "us"). This policy explains what data we collect, what we use it for, who we share it with, and the rights you have. It was written with reference to Indonesia's Personal Data Protection Law (Law No. 27 of 2022).
In short: we only collect the data the game needs to work. We do not sell your personal data, we do not show ads, and we do not access your device's location (GPS), contacts, or microphone.
1. Data we collect
Account data
- If you use the App as a guest ("Start now"): a random account ID from Firebase Authentication. Guest accounts do not use an email address or your real name.
- If you create an account or save your guest account: your email address.
- If you sign in with Google: the name, email address, and profile photo of your Google account.
- Passwords are handled by Firebase Authentication. We can never see your password.
Profile data
- Your nickname and profile photo (if you upload one).
- The relationship status you choose.
- The link to your partner's account.
Game data
- Pawn positions, turns, special cards, and Love Points in each session.
- Statistics: number of sessions, streak, and challenges completed.
- Challenges you create yourself (Custom Deck).
- The second player's name you enter when playing on one device.
Content you create
- Challenge and Deep Talk answers saved to the Vault.
- Photos you take or choose for photo challenges and Memory Prompts.
Device and usage data
- A push notification token, so we can send game invites and turn notifications.
- Usage data through Firebase Analytics, such as which modes are played or which sessions are completed. This data does not include your answers, photos, or challenge content.
- Approximate location (country or city), which Firebase Analytics estimates from your IP address for overall usage statistics. We never read your device's GPS or precise location.
Purchase data
- Your premium subscription status and the challenge packs you have bought.
- Payments are processed entirely by Google Play or the Apple App Store. We never receive your card number or payment details.
What we do not collect
Your precise location (GPS), contact list, voice recordings, or the contents of your photo gallery other than the photos you choose yourself.
2. Device permissions
| Permission | Used for |
|---|---|
| Camera | Taking photos for photo challenges, only when you tap the take-photo button. |
| Photos / gallery | Choosing a profile photo or challenge photo. Only the photos you choose are uploaded. |
| Notifications | Game invites and turn notifications from your partner. |
| Vibration | Vibration effects while playing. |
You can revoke any permission at any time in your device settings. The related feature will stop working, but the rest of the App remains usable.
3. How we use data
- To run the core features: accounts, playing with your partner, the Vault, and the Love Book.
- To send notifications related to the game.
- To verify purchases and unlock premium features.
- To understand how the App is used overall so we can improve it.
- To keep the App secure and prevent abuse.
We do not sell your personal data and we do not show ads.
4. Data other people can see
- Your partner can see your nickname, profile photo, and relationship status.
- Someone who enters your invite code can see your nickname while the accounts are being linked.
- Both players in a session can see that session's data, including the answers and photos saved to the Vault during it.
Account data is not shown to the public.
5. Service providers we use
We use the following third-party services to run the App. They process data on our behalf and are bound by their own privacy policies.
| Service | Purpose |
|---|---|
| Google Firebase | Sign-in, database, photo storage, and usage analytics. |
| Expo | Delivering push notifications to your device. |
| Google Sign-In | Signing in with a Google account. |
| Google Play / Apple App Store | Processing subscription and purchase payments. |
6. Where data is stored
Data is stored on Google Cloud servers that may be located outside Indonesia, including in the United States. By using the App, you understand that your data may be transferred outside your country. We only use providers that apply an equal or higher standard of data protection.
7. Security
- All data is sent over encrypted connections (HTTPS/TLS).
- Database access rules limit data to its owner and their linked partner.
- Photos can only be uploaded by the account owner.
No system is completely secure. If a data protection failure affects you, we will notify you as required by applicable law.
8. How long data is kept
- Your account, profile, game data, and content are kept for as long as your account is active.
- A guest account can only be opened on the device where it was created. If the App is uninstalled or its data is cleared before the account is saved with an email or Google, the guest account can no longer be opened, and guest accounts that are no longer used may be deleted along with their data.
- After you request account deletion, we delete that data within 30 days at the latest. Copies in our service providers' backup systems may remain for a short time before they are deleted automatically.
- Sessions played together also hold your partner's memories. The answers and photos you created are deleted, while game records that no longer identify you may remain in your partner's account.
- Analytics data is kept in aggregate form according to Firebase Analytics retention settings.
9. Your rights
Depending on the law that applies to you, including Indonesia's Personal Data Protection Law and, where applicable, the EU/UK GDPR, you have the right to:
- Access your personal data and request a copy of it.
- Correct inaccurate data. Your nickname and profile photo can be changed directly in the Profile menu.
- Request deletion of your account and personal data. See the Delete Account page for how.
- Withdraw consent, for example by turning off notifications or by stopping use of the App.
- Object to the processing of your data.
- Lodge a complaint with the data protection authority in your country.
Send your request to admin@livales.com from the email address registered in the App. For a guest account, include the guest code shown under Profile → Delete account. We will respond within 3 × 24 hours of receiving your request.
10. Age limit
The App is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we will delete it.
11. Changes to this policy
We may update this policy from time to time. The date at the top of this page will be updated as well. For important changes, we will notify you in the App.
12. Contact us
Livales
Email: admin@livales.com