Privacy
Your cards stay yours.
shuffl is a card game, not a data business. There are no accounts, no ads and no tracking. This page explains the little that does leave your phone, and why.
Last updated 21 September 2026
You never sign up. The app makes up a random ID on your phone the first time it opens.
No advertising, no analytics, and nothing that follows you across other apps or websites.
Online tables live on a server in Frankfurt and are deleted once they have expired.
Apple handles every purchase. We never see your card or bank details.
1. Who is responsible
The controller for the processing described here is:
Hinrich Bomsdorf
Mainaustrasse 27
8008 Zürich
Switzerland
Email: hinrichbomsdorf@gmail.com
2. What stays on your phone
Your name and picture, your settings, your card designs, your favourite games, the games you played last and your statistics are stored only on your device. They are not sent to us. Deleting the app deletes them.
Motion
If you turn on the foil deck, the app reads your phone’s motion sensor so the cards catch the light as you tilt it. The readings are used on the device, in the moment, and are never recorded or sent anywhere.
Live Activities
While a round is going on, the app can show it on your Lock Screen. That is drawn on your phone from the round in progress. No push server is involved.
3. Playing online with friends
When you open a table or join one with a code, the app sends the following to our database so that every phone at the table can play the same round:
- a random player ID created on your phone (not linked to your name, Apple ID or phone number),
- the display name and character picture you chose,
- the table code, the game, and the house rules and deck the host picked,
- the moves made during the round, such as which card was played,
- the time your phone last checked in, so the table can show who is still there.
Everybody at the same table sees each other’s names, pictures and moves, as they would at a real table. Anybody who knows a table’s code can read that table while it exists, which is how joining works.
Purpose and legal basis: to provide online play when you ask for it (Art. 6(1)(b) GDPR).
Where: the database is run for us by Supabase, Inc. as a processor, on servers in Frankfurt am Main, Germany.
How long: a table is deleted when its host closes it, and otherwise expires two hours after it is opened if no round starts, or twelve hours after a round starts. Expired tables are deleted together with their players and moves.
4. Buying shuffl Pro
All purchases are made through Apple’s App Store and are subject to Apple’s privacy policy. We never receive your payment details.
To check whether you have Pro, and to restore it on a new phone, the app uses RevenueCat (RevenueCat, Inc., USA) as a processor. RevenueCat receives an anonymous ID created by the app, the purchase receipts Apple issues for shuffl, the app version, your device model and system version, and the App Store country. Your IP address is transmitted as a technical necessity of the connection.
Purpose and legal basis: to provide what you bought (Art. 6(1)(b) GDPR). Where data is transferred to the United States, this happens under the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
How long: purchase records are kept for as long as you might restore a purchase, and as required by tax and commercial law.
5. This website
This website is hosted by Vercel Inc. When you visit it, the server records technical information such as your IP address, the date and time, the page requested and your browser, to deliver the site and keep it secure (Art. 6(1)(f) GDPR). These logs are deleted after a short period.
The site sets no cookies, runs no analytics, and loads no fonts, scripts or images from anybody else.
6. Children
shuffl has no chat, no public profiles and no accounts. It collects nothing from children beyond what is described above, and we do not knowingly collect personal data from children under the age of 16 for any other purpose.
7. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interests (Art. 21).
Because there are no accounts, we can only find data that belongs to a particular table. Online tables are deleted within hours anyway; if you would like one removed sooner, write to us with its code.
You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.
If you live in Switzerland, the Federal Act on Data Protection (FADP) gives you the same rights, and you can complain to the Federal Data Protection and Information Commissioner (FDPIC).
8. Changes
If the app starts doing something new with your data, this page will say so before it does. The date at the top shows when it last changed.