Privacy Policy — BAZAS

Last updated: August 21, 2026 · Version: 1.2

1. Who we are (Data Controller)

The owner of the BAZAS application (“BAZAS”, “we”) is responsible for the processing of the personal data collected through the Service. BAZAS is a real-time multiplayer card game.

This Policy explains what data we process, for what purpose, on what legal basis, who we share it with, and what rights you have. It is complemented by the Terms and Conditions.

Processing is governed by Uruguay’s Personal Data Protection Act (Law No. 18.331) and its implementing Decree No. 414/009, under the oversight of the Regulatory and Data Protection Control Unit (URCDP / AGESIC). Where applicable, we also observe the LGPD (Law 13.709, Brazil) and the GDPR (EU).

2. What data we collect

a) Account data

  • Email and password (the password is stored hashed, never in plain text).
  • Player name and language (locale).
  • If you sign in with Google: your Google identifier, email, name, and, if available, profile picture (avatar).
  • If you sign in with Sign in with Apple: Apple’s stable identifier, the email —which may be an Apple private relay address— and the name, which Apple sends only the first time. We also store an Apple token used for a single purpose: revoking access if you delete your account (see §7).

BAZAS is a social game, but an account is not always required: you can play a quick match against the computer and join a table by invitation from the browser without installing, providing just a name (see “Playing as a guest” below).

b) Optional demographic data (for rankings)

  • Country and year of birth. These are optional; they are used only for country and age-bracket rankings. You may choose not to provide them, or delete them.

c) Activity and social data

  • Games played, results, scores, ranking positions.
  • Groups and tables you create or join, and invitations.

d) Voice audio (in-table micro-audios)

  • During a game you can send micro-audios (“push-to-talk”) to the other players at your table. This audio is ephemeral: the server relays it live to the table and does not store it; the receiving device plays it and discards it. The microphone is used solely for this feature and only after your permission.

e) Purchase data

  • If you buy any of the cosmetic items in the store: which product you bought, when, and the transaction identifier, reported to us by the store (App Store / Google Play) and RevenueCat. On our side we only store which items are unlocked for you. We never receive or store your card or payment method details.

f) Moderation data

  • If you report someone —or someone reports you— we store who reported whom, the table, the reason, and the date; and, if we apply a suspension, its reason and end date. This is used only to review the case, enforce our rules, and prevent repeat offences. The mutes and blocks you set from your seat are your own preference and are not shared with the person you blocked.

g) Playing as a guest

  • If you join a table from an invitation link without creating an account, we do not build a profile: a temporary identifier is generated for that game session, which stops being valid when the session ends, along with the nickname you chose. We do not store an email address or statistics for guest sessions, and they do not appear in the leaderboard. Conduct and moderation rules apply to guests just the same.

h) Technical, security, and advertising data

  • Session and refresh tokens (the refresh token is stored hashed).
  • A record of your acceptance of these terms (version and date).
  • Notifications (optional): if you opt in to alerts, we store a notification identifier (“push token”) tied to your device and the platform (Android or iOS). It is used only to let you know when a table opens in a group you belong to. You can turn it off in Settings or on your device; the identifier is unregistered when you sign out and deleted with your account. You can play without accepting notifications.
  • Advertising (Google AdMob): the app displays ads served by Google AdMob (never during a game). In the apps, advertising is NOT personalised: we request non-personalised ads only from AdMob, so your device advertising identifier is not used to profile you or track you across apps and sites, and we do not ask for Apple’s tracking permission (ATT). Google may still use limited data to measure the ad, cap its frequency, and prevent fraud (see sections 5 and 10).

We do not intentionally collect special categories of data. Please do not provide them through free-text fields (group name, player name) or through voice.

3. Purposes of processing

We process your data to:

  1. Provide the Service: create and authenticate your account, manage tables and games in real time.
  2. Social features: rankings, groups, invitations, and voice communication between players at the same table.
  3. Security: prevent fraud, cheating, and unauthorized access; the game state is authoritative on the server (anti-cheat).
  4. Support and improvement of the Service.
  5. Advertising and monetization: show Google AdMob ads that keep the Service free.
  6. Legal compliance.

Under Law 18.331 (and, where applicable, the LGPD/GDPR), we process data on the basis of:

  • Your consent — free, prior, express, and informed — to create the account, for the optional demographic data, to display your name and score in the rankings and at the table, for the use of the microphone (voice), for notifications, and, on the web, for advertising cookies where the law requires it. You may withdraw it at any time.
  • The performance of the relationship when you use the Service.
  • Our legitimate interest in the security and integrity of the Service.
  • Compliance with legal obligations.

5. Who we share data with

5.1. With other users at your table/ranking: your player name, score, medals, and position are visible to other users within the same scope. During a game, the voice micro-audios you send are heard by the other players at your table live (they are not stored). Your email and password are never shared.

5.2. With providers (data processors) under our instructions and a duty of confidentiality: hosting and infrastructure (servers, database, and Redis for the state of the tables); Google (Google Sign-In/OAuth when you choose it, and Google AdMob in the apps / Google AdSense on the web for advertising); Apple (Sign in with Apple when you choose it); RevenueCat together with the Apple App Store and Google Play (purchase processing and validation); and Expo with Google (FCM) or Apple (APNs) to deliver notifications.

5.3. Under legal obligation: in response to valid requests from competent authorities.

5.4. Reorganization: in the event the Service is transferred, subject to the same obligations of this Policy.

We do not sell your personal data.

6. International transfers

Some providers may host or process data outside Uruguay. When this occurs, we will adopt appropriate safeguards in line with Law 18.331 and URCDP regulations. Uruguay is recognized by the EU as a country with an adequate level of data protection.

7. Data retention

We keep your data while your account is active and for the period necessary to fulfill the purposes described and applicable legal obligations.

You can delete your account yourself, at any time, from Profile → Delete account, or by following the steps in Delete your account and your data. When you do, we remove your profile, your statistics, your results, your groups, and your sessions; if you had signed up with Sign in with Apple, we also revoke BAZAS access to your Apple account. Anything not deleted immediately is erased or anonymized within the following 30 to 90 days, except for data we must retain for legal or security reasons. Deleting your account means losing access to any items you purchased, and that deletion does not entitle you to a refund.

Voice audio is not retained (it is ephemeral). Data stored locally on your device is removed when you uninstall the app or clear its data.

8. Security

We apply reasonable technical and organizational measures: passwords with hashing (bcrypt), signed tokens (JWT) and hashed refresh tokens, per-user access control, encrypted transport (HTTPS/WSS), and server-side game validation. No system is 100% secure; we work to protect it and to notify incidents in line with applicable regulations.

9. Your rights

Under Law 18.331 (and the LGPD/GDPR where applicable), you may exercise the rights of access, rectification, erasure/deletion, update, inclusion, objection, withdrawal of consent, and portability (where applicable).

Some of these can be managed from within the app (editing your profile, leaving groups, deleting your account). For the rest, write to us through the contact channel published on BAZAS’s listing on the App Store or Google Play. We will respond within the legal timeframes (in Uruguay, generally 5 business days for access requests). You may file a complaint with the URCDP (AGESIC), the supervisory authority in Uruguay.

10. Cookies, SDKs, and identifiers

The app uses local device storage to function (theme, language, avatar, and sound settings stay on the device, not on our servers). It integrates the Google AdMob SDK for advertising, configured to serve non-personalised ads only: we do not use the device advertising identifier for personalised advertising or to track you outside the app, which is why we do not ask for Apple’s ATT permission. On Android we still show Google’s consent form (UMP) where regulations require it.

On the web we use Google AdSense, which may use cookies and identifiers —including the DART/DoubleClick cookie— to serve ads; where the law requires it, your consent is requested first. You can manage Google advertising at google.com/settings/ads and third-party cookies at aboutads.info/choices and youronlinechoices.eu.

To deliver notifications we use the Expo push service and, depending on the device, Google (FCM) or Apple (APNs), which process the token as processors and only to deliver the message. The token is not used for advertising purposes and is not shared with advertisers.

11. Minors

The Service is intended for people 13 years of age or older. As it is a game with interaction and voice between users, minors under 18 require the consent and supervision of a parent or legal guardian. We do not knowingly collect data from children under 13; if we become aware of this, we will delete the account and its data.

12. Changes to this Policy

We may update this Policy. We will publish the current version with its date and, in the event of material changes, we will make reasonable efforts to notify you.

13. Contact

For privacy inquiries or to exercise your rights, write to us through the contact channel published on BAZAS’s listing on the App Store or Google Play. Supervisory authority: URCDP — Regulatory and Data Protection Control Unit (AGESIC), Uruguay.