Legal
Privacy Policy
Last updated: 30 July 2026
This policy describes the MINUS mobile game ("MINUS", "the app", "we"). It is written against what the app's code actually does, not against a template — where the app deliberately avoids collecting something, this policy says so plainly.
The short version.
- You can play the entire single-player game without an account and without a network connection.
- Your phone's contact list is read on your device only, and only for its numbers — the app never reads your contacts' names at all. Nothing is uploaded but irreversible SHA-256 hashes of numbers, purely to match you with friends who already play.
- We do not sell your data, we do not share it with advertisers, and there is no advertising or tracking SDK in the app.
- The website you are reading sets no cookies and loads nothing from any third party.
1. Who we are
MINUS is published by the developer of playminus.com. For any privacy question, correction or deletion request, write to privacy@playminus.com. We aim to answer within 30 days.
2. What the app collects
What we hold depends entirely on how you use the app. Single-player is self-contained; everything below applies to the online multiplayer side.
| Data | Why | When |
|---|---|---|
| Account identifier — a Firebase user ID, plus the name and email address from your Google account if you sign in with Google | To give you one identity across devices, so your username, friends and games follow you | Only if you sign in. Guest sign-in creates an anonymous ID with no name or email attached. |
| Username and display name | So other players can find you and see who is at the table | When you choose one |
| Profile photo (optional, downscaled on your device before it is sent) | Shown on your seat at the table | Only if you pick one |
| Phone number | To let friends who already have your number find you | Only if you verify a number. See section 3 — the number itself is not stored in our database. |
| Hashed contact numbers (SHA-256) | To tell you which of your contacts already play | Only when you tap "search contacts" and grant permission. Used for the lookup and dropped, unless you tick "tell me when a contact joins" — see section 3. |
| Game data — room codes, seats, bids, cards played, scores, and the emoji/short taunts you send | To run a shared game across four devices | While you are in an online room |
| Presence heartbeats — a timestamp saying your device is still at the table | So a bot can cover your seat if you disappear, instead of freezing the game for everyone | While you are in an online room |
| Friends, invites and direct messages | To let you call people to a table | When you add a friend or send an invite/message |
| Push notification tokens | To tell you when a friend invites you to a game, somebody joins your room, a hand is waiting on your card, or a friend comes online — each kind can be switched off separately in the app | Only if you allow notifications |
3. Contacts and your phone number — how this actually works
This is the part of the app most worth being precise about, because "the app read my contacts" usually means something much worse than what happens here.
- The contact scan runs only when you tap it and only after Android/iOS grants permission. It is never automatic.
- The app asks the address book for phone numbers only. Your contacts' names, emails and photos are never read — not uploaded, not stored, not even loaded into memory. Anyone the scan finds is shown to you under the name and picture they chose in MINUS, not under whatever you have them saved as.
- Each contact's phone number is converted on your device into an irreversible SHA-256 hash. Only those hashes are sent, and only to ask "does a player exist with this hash?". We cannot turn a hash back into a phone number. The hashes are used to answer that question and then dropped — unless you tick the one box described next.
- "Tell me when a contact joins" is optional and off by default. Answering "does this person play?" needs the hashes only for as long as the question takes. Answering "tell me if they ever start" needs them to be kept — so it is a separate tick-box in the same dialog, and ticking it is the only thing that stores those hashes on our server. They are stored against your user ID, no client can read them (only our own server code can), and unticking the box — or switching the notification off — deletes them.
- Your own number is stored on your device only. What our database holds is the hash of it, mapped to your user ID, so that a friend hashing their address book can find you. (Your number is also held by Google Firebase Authentication, which is what actually sends and checks the verification SMS.)
- You can revoke contacts permission in your phone's settings at any time, and remove your number from the app at any time.
4. What we never collect
- No advertising identifiers, ad networks, or third-party analytics or tracking SDKs.
- No location data of any kind.
- No recording or storage of voice chat. Voice runs peer-to-peer between players' devices (WebRTC); only the connection setup passes through our servers, and no audio is written down.
- No photo library access beyond the single image you choose as an avatar.
- No camera images. The camera is used solely to scan a room QR code, decoded on your device; nothing is captured or uploaded.
- No payment or financial information. The game is free and does not take payments.
5. Device permissions
Each of these is optional, requested in context, and refusing it only disables that one feature:
- Contacts — to find friends who already play.
- Microphone — for voice chat during a game.
- Camera — to scan a room's QR code.
- Photos — to pick a profile picture.
- Notifications — to be told when a friend invites you.
6. Who else touches this data
MINUS runs on Google Firebase (Authentication, Realtime Database, Cloud Messaging and Cloud Functions), and offers Google Sign-In. Google processes this data on our behalf as our infrastructure provider, under Firebase's privacy terms and Google's own privacy policy.
That is the complete list. We do not sell personal data, we do not share it with advertisers or data brokers, and we do not disclose it to anyone else except where we are legally required to.
7. Other players
Things you choose to make public in a game are visible to the people you play with: your username, your profile picture, your bids and cards as they are played, your scores, and any taunts or messages you send. Do not put anything in a username or message that you would not want the table to see.
8. How long we keep it
- Live game data (room state, presence, reactions) exists only for that room, and is removed when the host closes it or opens a new one.
- Your profile, friends and username are kept while your account exists, so your identity survives reinstalling the app.
- Push tokens are removed when you sign out or the token expires.
- Everything is removed when you delete your account — see Your Data & Deletion.
9. Security
All traffic between the app and our servers is encrypted in transit (TLS). Access to the database is constrained by server-side security rules, so a player's device can only read and write the data that its own account and current room entitle it to. No system is perfect, and we do not claim otherwise — but we do not hold payment details or plaintext phone numbers, which is the most effective security measure available.
10. Children
MINUS is a card game for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, write to privacy@playminus.com and we will delete it.
11. Your rights
Depending on where you live (including under the GDPR in the EU/UK and the DPDP Act in India), you may have the right to access, correct, export, restrict or delete the personal data we hold about you, and to withdraw consent you previously gave. The app itself lets you do most of this directly — change your username or photo, remove your phone number, revoke a permission, or delete your account. For anything else, write to privacy@playminus.com.
Where we rely on a legal basis under the GDPR: providing the game to you is performance of a contract; contact matching, voice chat and notifications are based on your consent, which you can withdraw at any time.
12. International transfers
Firebase stores data on Google's infrastructure, which may be located outside your country. Google maintains standard contractual clauses and other safeguards for such transfers.
13. Changes to this policy
If we change what the app collects, we will update this page and move the "last updated" date. Material changes will also be announced in the app.