Privacy Policy

Effective date: 4 October 2026

1. Who we are

Meryas is a Saudi Baloot card game. It is made and operated by the Meryas developer (“we”, “us”). For any question about this policy or your data, write to support@meryas.app.

2. What we collect and why

2.1 Playing online (everyone, guests included)

• Player identity. When the app first connects, our server creates a random player id and a random secret token for it. The app keeps the token on your device so it can bring you back to your seat after a disconnect. The server keeps both in its game save file.
• Display name and avatar. The name you type in the app (up to 20 characters) and the number of the built-in avatar you pick. They are shown to the other players at your table.
• Game state. Room code, seats, cards, bids, scores and room options, so that a game survives a disconnect or a server restart.
• Table chat. Short text messages are delivered to the players at your table and are not saved on our server.

A room is removed when it closes, or when all its players have been away for 15 minutes. A player identity that is not in a room is removed from the server 6 hours after it was last seen.

2.2 Your account (Sign in with Apple, optional)

• Apple user identifier. The stable identifier that Apple gives Meryas for your Apple ID, so we can recognise your account when you sign in again.
• Name. Only if you choose to share it in Apple’s sign-in sheet (Apple shares it on the first sign-in only). We ask Apple for your name only. We never ask for your e-mail address and we do not store one.
• Account record. A random account id and the times the account was created and last updated.
• Sessions. After you sign in, the server gives the app a random session token, which the app keeps in your device’s Keychain. The server stores only a one-way hash (SHA-256) of that token, with the times it was created, last used and expires. A session expires 90 days after it was last used (each use extends it), and signing out deletes it.

2.3 Ranked play and levels (accounts only)

For ranked matches we store your rating values, level points and tier, wins, losses and matches left, with their dates, and one rating record per ranked match (match id, team, result, and your values before and after). They are used to compute your level, which other players can see at your table.

2.4 Voice chat (optional)

• Your microphone is off until you turn it on, and the app asks for the device’s microphone permission the first time.
• Voice is relayed in real time by our voice provider, LiveKit, to the players in the same room. We do not record it, and we do not ask LiveKit to record it.
• To connect you, our server gives your app a short-lived voice token with a random voice identity, created for each room and kept only in the server’s memory. The token carries no name, account id or other personal details.
• The first time you use voice, the app turns on a setting on your device, Listen automatically in private rooms, so that in private rooms it joins the table’s voice by itself to listen. You can turn it off in Settings. Your microphone still starts off.

2.5 Reports, blocks and voice bans

• Reports. Any seated player can report another player at the table. We store who reported and who was reported (as an account id or a guest player id), the room code, the reason, whether the reported player was in voice, and the time. We use reports to review abuse and act on it.
• Automatic mute. When three different players at a table report the same player during one match, that player’s microphone is turned off for the rest of the match (they can still listen). This is kept only in the server’s memory.
• Blocks (between signed-in accounts). We store your account, the blocked account, the name shown at the table when you blocked it, and the time.
• Voice bans. If we ban an account from voice after reviewing reports, we store the end date of the ban with the account.

2.6 Network (IP) addresses

• The game server uses your connection’s IP address only in its memory, to limit how many connections one address can open at once. The game server does not save or log it.
• The web server in front of the game (Caddy, on play.meryas.app) writes an access log line for each request: IP address, time, requested path, request headers such as the app or browser identifier (User-Agent), and the response status. We use it to diagnose faults and abuse. The log is rotated automatically by size (at most five files of 10 MB), so the oldest lines are deleted as new ones arrive.
• This website (meryas.app) keeps no access log.

2.7 Kept only on your device

Your settings (language, theme, sound and similar), your device statistics and practice points, and a saved offline match against bots stay on your device and are not sent to us.

2.8 E-mail to support

If you write to us, we receive your e-mail address and your message, and use them only to answer you.

3. What we do not do

• No advertising, no advertising identifier, and no tracking across other apps or websites.
• No selling or renting of personal data, and no sharing of it for advertising.
• No analytics, advertising or crash-reporting SDKs in the app.

4. Where your data is processed

• Hetzner Online GmbH hosts our server in Nuremberg, Germany. The game server, its database, the logs and the backups are on that server. Hetzner’s backup service also keeps a daily image of the server’s whole disk, in storage separate from the server, for 7 days, so the game can be recovered if the server is lost (see section 5).
• LiveKit (LiveKit Cloud) relays voice chat. Our LiveKit project is set up in its EU region (Frankfurt), but LiveKit may carry the audio through its servers nearest to each player, which can be outside the EU. It handles the audio, the random voice identity, the voice room id and the network address your device connects from. When the app connects to voice, the LiveKit library in the app also sends LiveKit technical details about your device: the device model, the operating system and its version, the network type and the library version.
• Apple provides Sign in with Apple and distributes the app through the App Store and TestFlight, under Apple’s own privacy policy. If you test through TestFlight, Apple may share with us the crash reports and the feedback you send there.
• Cloudflare provides DNS for meryas.app (it turns the name into our server’s address); game and website traffic does not pass through Cloudflare. E-mail sent to support@meryas.app is forwarded to our mailbox by Cloudflare Email Routing.
• Let’s Encrypt issues the certificates that encrypt connections to our server; no player data is involved.

We do not share your data with anyone else unless the law requires it.

5. How long we keep it

• Guest player identity on the server: 6 hours after it was last seen, once it is not in a room.
• Rooms and games: until the room closes, or 15 minutes after all its players left.
• Account, name, ratings and rating records: until you delete the account.
• Sessions: 90 days after the last use, or earlier when you sign out or delete the account.
• Reports: 180 days after they were filed, then deleted automatically.
• Blocks: until you unblock, or until either account is deleted.
• Voice identities, the automatic mute and IP addresses used for connection limits: server memory only.
• Web server access log for the game host: rotated by size as described in 2.6.
• Backups: one backup of the database and the game save file each day. On the server only the newest 14 are kept. Hetzner’s daily disk images (which include these backups) are deleted after 7 days. Every backup copy is deleted within 21 days. A safety copy taken on the server before a manual restore is deleted once the restore is confirmed, and within 21 days at most.
• E-mails to support: as long as needed to handle your request.

6. Deleting your account

In the app: Settings, Account, Delete account, then Delete permanently. This deletes at once, from the live server: your account, Apple user identifier and name, your sessions, your ratings and rating records, and your blocks (yours and other players’ blocks of you). You can keep playing as a guest.

• Reports you filed or received stay until their 180 days end, but your identity in them is replaced with “deleted”.
• If a voice ban is running on the account, we keep only a one-way hash of your Apple user identifier with the ban’s end date, until the ban ends, so the ban comes back if the same Apple ID signs up again. Nothing else is kept.
• If you are in a ranked match that has not ended, the saved state of that room keeps your account id and your rating values from the start of the match until the room closes. The match result is not applied to the deleted account.
• Copies in backups are deleted as old backups rotate out, within 21 days (section 5). If we ever have to restore the server from a backup, an account deleted after that backup was made comes back with it, and we delete it again.

By e-mail: if you cannot use the app, write to support@meryas.app. We will ask for details to confirm the account is yours before deleting it.

Guests have no account to delete: guest data on the server is removed automatically as described above, and deleting the app removes what is on your device.

7. Your choices

You can ask us for a copy of the data we hold about you, or ask us to correct or delete it, by writing to support@meryas.app. You may also have the right to complain to a data protection authority.

8. Children

Meryas does not ask for your age and collects nothing more from anyone than what is described here. Voice and table chat connect players with other players, including strangers in quick matches. If you believe a child is using an account and want it deleted, write to us and we will delete it.

9. Security

Connections between the app and our server are encrypted (TLS). Session tokens are stored only as hashes. The database and the game save file are stored with owner-only file permissions, and the backups in a folder that only the server’s administrator can open.

10. Changes to this policy

When this policy changes, we will publish the new version on this page with a new effective date.

11. Contact

support@meryas.app