355Privacy policy
This policy explains what personal data 355 (the mobile app and the website at play355.app) collects, why, who receives it, how long we keep it and what rights you have. We have tried to write it plainly and to describe exactly what the app does, nothing more and nothing less.
The short version. We keep what we need to run your account, the games, the leaderboards and prize delivery. The app shows ads between hands through Google AdMob, which may use your phone's advertising identifier if you allow it, and an optional purchase removes them. We do not sell your data. The app uses Google Firebase to report crashes and errors (Crashlytics) and to count how the app is used, such as which screens are opened and which game is played (Google Analytics for Firebase), linked to our internal user identifier for your account but without your name, email address or username. You can delete your account from inside the app at any time.
1. Who is responsible
The controller of your personal data is Software Kit SRL, Rapsodiei nr. 1, Timișoara, Romania ("we", "us"). You can reach us at admin@markosoft.ro about anything in this policy. We have not appointed a data protection officer; privacy requests are handled directly at that address.
2. What we collect
Account and sign-in
You sign in with Google, with Apple or with a link sent to your email address. Sign-in is handled by Google Firebase Authentication, which holds the email address and name that your Google or Apple account shares with it, or the email address you typed for an email link. Our servers receive a signed token from Firebase, which includes your email address, check it, and keep only your Firebase user identifier; they do not store your email address or your name.
Profile
The username you choose and the country you select. The country is pre-filled from your phone's region setting, and you confirm or change it before you play.
Gameplay
Every hand you play in either game: the cards you were dealt, where and when you placed each card, discards, automatic placements when a clock ran out, results and scores, the sets each hand counted toward, your leaderboard positions and your skill rating. Hands are stored so they can be scored, ranked, shown in your history and replayed.
Coins and prizes
A ledger of the coins you earn and spend. When you redeem a prize: the prize, its value, the country, the provider's reference and the delivery status, plus the mobile phone number (for an airtime top-up) or the email address (for a digital gift card) that you type at that moment for delivery.
Device and network
A random identifier that the app creates when it is first installed (not your phone's hardware or advertising identifier), and the IP addresses you play from, each with the time it was first and last seen. We use them to keep two accounts on the same device or network from being paired against each other, and to protect the service against abuse.
Fair-play signals
Automated checks run over finished hands and can mark a pattern of play for a person on our team to review (for example, play that matches what a solver would choose far more often than is plausible).
Messages to us
If you email us, we keep the correspondence and whatever you choose to include.
Crashes and errors
When the app crashes or meets an error it did not expect, it sends a crash report to Google Firebase Crashlytics: the place in the app's code where it happened, the kind of error, the app version, details of your phone and its state at the time (including whether the app was in the background, the phone's model, operating system version, processor type, free memory and storage, and whether it is jailbroken or rooted), random identifiers Firebase creates for this installation, and our internal user identifier for your account. A report can also carry a short list of the app's recent events, such as a refused move or a lost connection, without their content, and the most recent usage events described under "How the app is used" below, with their details (for example a screen name, the game, or a hand's result), which Firebase attaches automatically. We do not put your name, email address, username, phone number, the cards you were dealt or what you typed in a report, and the reporting is designed not to contain them. Like any connection to a server, sending a report shows Google your phone's IP address.
So that crash-free rates can be counted, Firebase also records the start of every app session, crash or not: each time the app is opened, and each time you return to it after it has been in the background for about 30 minutes. A session record holds a random session identifier, the installation identifier, the app version and your phone's model and operating system.
Crash reports and session records are sent only from the release builds we distribute, including test builds, never from development builds.
How the app is used
To see which parts of 355 are used and where players get stuck, the app sends usage events to Google Analytics for Firebase: the name of each screen you open (for example "home" or "leaderboard") and which game it belongs to, and a short list of actions, each with the game it belongs to where there is one: signing in or creating an account (and whether with Google, Apple or an email link), signing out, deleting an account, choosing a game, starting and finishing the tutorial, joining the queue, leaving it (with how long you waited), starting a hand, submitting a Pusoy hand (whether you set it, declared a natural or surrendered), leaving a hand, reaching a hand's result (win, loss or draw, or still waiting for other players, the points, and in OFC whether you fouled, scooped or were scooped), choosing a leaderboard tier, opening a replay (and from which screen), redeeming coins (the number of coins and the prize brand) and the status a redemption reached (sent, pending or failed). While you are signed in, Google Analytics links these events to our internal user identifier for your account: the same random identifier that crash reports carry, which is not your username, email address or sign-in identity. The events themselves carry no username, email address or phone number, no match or table identifier, nothing you typed and nothing about your opponents.
The app also keeps two settings with Google Analytics for this installation: the game currently chosen in the app and how you signed in (Google, Apple or an email link). The sign-in method and your user identifier are cleared when you sign out or delete your account.
Google Analytics also records some events on its own: when the app is first opened, when a session starts and how long the app is in use, when the app or your phone's operating system is updated, on Android when the app is removed or its data is cleared and when an in-app purchase is made (see "Purchases" below), and when the app crashes (Crashlytics reports the crash to Analytics as an event). With them it records a random identifier it creates for this installation (the "app instance ID"), the app version, your phone's model, operating system and language, and the country, region and city it derives from your IP address; Google does not store the IP address itself. While you are signed in, these events are linked to your user identifier too. When you sign out or delete your account, the next account that signs in on that phone starts with a new app instance ID, and its events are linked to its own user identifier, so two accounts that share a phone are kept apart.
Usage events are sent only from the release builds we distribute, including test builds, never from development builds. Google Analytics' advertising features are turned off for 355: Analytics collects no advertising identifier, its data is not used to personalise ads, and it is not shared with other Google products. Google AdMob, which shows the ads (below), is not linked to Google Analytics.
Ads
The app shows full-screen ads between hands, never during a hand, through Google AdMob. To choose, show and measure ads, and to limit how often you see them, AdMob receives from your phone its advertising identifier (on iOS only if you allow tracking when the app asks; on Android the advertising ID, which you can reset or delete in your phone's settings), your IP address, information about your phone and the app (such as the model, operating system, language and app version) and how you interact with the ads. The app sends AdMob nothing about your 355 account, your username, your hands or your scores.
In the European Economic Area, the United Kingdom and Switzerland, Google's consent form asks for your choice before any ad is requested, and ads are personalised only with your consent. On iOS, the App Tracking Transparency prompt decides whether AdMob may read the advertising identifier; the app asks just before an ad is shown, never when it opens. Once the app knows you bought Remove ads (after the purchase, or after it restores your purchase), it shows you no ads, never requests one for you, and never shows you the consent form or the tracking prompt for ads.
Purchases
The one purchase in 355, Remove ads, is made through the App Store or Google Play. Apple or Google handle the payment; we never receive your card details. The app keeps on your phone only whether Remove ads was bought, and nothing about a purchase reaches our servers. On Android, Google Analytics for Firebase records on its own that an in-app purchase was made (the product, its price and the currency) with the usage events described above. Each time the app starts on Android it asks Google Play whether Remove ads was bought, and Google Play's billing library sends Google diagnostic data about that check.
What we do not collect
Our servers and our usage analytics never receive an advertising identifier (only AdMob does, as described under "Ads"). We collect no precise location, no contacts, photos or microphone and no payment card details, and the app uses no push notification SDK.
3. Why, and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Creating your account and signing you in | Sign-in data, profile | Performance of our contract with you (the Terms) |
| Running matches, scoring hands, sets, leaderboards, history and replays | Gameplay, profile | Performance of contract |
| Running the contest, crediting coins and delivering prizes | Coins and prizes, profile | Performance of contract |
| Keeping two accounts on one device or network from playing each other, preventing multiple accounts, cheating and fraud | Device and network, fair-play signals, gameplay | Our legitimate interest in a fair contest and in protecting other players |
| Operating, securing and troubleshooting the service, and restoring it from backups | All of the above, technical logs, crash reports and session records | Our legitimate interest in a secure, working service |
| Understanding how the app is used so we can improve it (which screens and games are used, and where players stop) | Usage events, the two Analytics settings, your user identifier and installation data (section 2, "How the app is used") | Our legitimate interest in improving the game |
| Showing ads between hands, measuring them and limiting how often they appear | The data AdMob receives (section 2, "Ads") and the ad counters kept on your phone | Your consent for personalised ads, given in Google's consent form in the EEA, the UK and Switzerland; our legitimate interest in funding a free game for non-personalised ads and for limiting how often ads appear |
| Selling and restoring Remove ads | Whether Remove ads was bought, kept on your phone | Performance of contract |
| Keeping finished hands and leaderboards intact after an account is deleted (in pseudonymised form) | Gameplay | Our legitimate interest, and other players', in accurate histories and final results |
| Accounting, tax and sanctions compliance for prizes | Coins and prizes, country | Legal obligation |
| Answering your messages | Correspondence | Performance of contract, or our legitimate interest in answering you |
Where we rely on legitimate interests, you can object (see your rights). The advertising in 355 is AdMob's, as described in section 2 ("Ads"), and is personalised only as your choices there allow; we do no profiling of our own for marketing, and we make no decision that has legal or similarly significant effects on you solely by automated means: fair-play flags are reviewed by a person before anything is done.
4. What other players see
355 is a competitive game, so some of your data is visible to other players by design: your username, your country, your scores, your leaderboard positions and the coins they earned, and, for hands you played with someone, your boards and results in their hand history and replays. Choose a username that does not identify you if you prefer to stay anonymous. Never put your real name, phone number or email address in your username.
5. Who receives your data
We never sell your personal data. Google receives data for ads as described in section 2 ("Ads"). We share your data only with the recipients below, each of which acts on our behalf, provides the specific service you use or, for AdMob, acts as its entry describes:
- Google (Firebase Authentication, Google Sign-In): signing you in. Google processes your sign-in data under its own terms and privacy policy.
- Google (Firebase Crashlytics): receives the crash reports and session records described in section 2, to show us where and how often the app fails. Google processes them on our behalf.
- Google (Google Analytics for Firebase): receives the usage events, settings and user identifier described in section 2, to show us how the app is used. Google processes them on our behalf; we do not share them with other Google products or use them for advertising. AdMob is not linked to Analytics.
- Google (AdMob): shows the ads between hands and receives the data described in section 2, "Ads". For personalised advertising Google acts as an independent controller under its own terms and how Google uses information from apps that use its services.
- Apple (App Store) and Google (Google Play): process the Remove ads purchase if you make it, under their own terms and privacy policies.
- Apple (Sign in with Apple): signing you in, if you choose Apple.
- Akamai Technologies (Linode): hosts our servers, database and backups.
- Reloadly: our prize-delivery provider. It receives only what a delivery needs: for an airtime top-up, the phone number, its country and the operator and amount; for a gift card, the product, the country, the amount and the email address to send it to. Reloadly passes the top-up to your mobile operator or the gift card to its issuer.
- Our email provider: stores messages you send us.
- Authorities and advisers: when the law requires it, to establish or defend legal claims, or to our accountants and lawyers under confidentiality.
- A successor: if 355 or Software Kit SRL is sold or merged, your data would transfer to the new operator, who would remain bound by this policy.
6. International transfers
Our servers are located in the United States, and some of the providers above are based or process data outside the European Economic Area. Where data leaves the EEA, the transfer is protected by an adequacy decision (including the EU–U.S. Data Privacy Framework, where the recipient is certified) or by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
| Data | Kept |
|---|---|
| Sign-in identifier, username, country | Until you delete your account |
| Device identifier and IP addresses | Until you delete your account |
| Phone number or email address entered for a prize | Until you delete your account; we do not reuse it for anything else |
| Records of prizes (value, provider reference, status, without the phone or email) | As long as accounting and tax law require (in Romania, generally up to 10 years) |
| Hands, scores, sets, leaderboard results | For as long as 355 runs. After you delete your account they are kept only in pseudonymised form, shown as "Former player" |
| Fair-play flags | For as long as the hands they relate to, pseudonymised after account deletion |
| Database backups | About 15 days, then deleted (longer only if nightly backups fail) |
| Technical server logs | Only as long as needed for security and troubleshooting |
| Crash reports | 90 days, then deleted by Firebase |
| Usage events (Google Analytics), with the user identifier they are linked to | Up to 14 months after the last use of the app, then deleted by Google |
| Data received by Google AdMob | As Google decides under its own policy (how Google retains data) |
| Your ad consent choice, stored on your phone by Google's consent form | Until you change it or remove the app |
| The ad counters and the Remove ads flag, on your phone | Until you remove the app; they stay when you sign out or delete your account |
| Emails to us | As long as needed to deal with your request, and up to 3 years after |
8. Deleting your account
You can delete your account at any time in Settings → Delete account. It takes effect at once and cannot be undone:
- Your username, country, sign-in identity, device identifiers and IP addresses are erased, and your username becomes free for anyone to take.
- Your sign-in record at Google Firebase is deleted as well.
- Crash reports already sent keep our internal user identifier until Firebase deletes them, at most 90 days after they were sent. The identifier no longer leads to you once your account is gone.
- Usage events already sent to Google Analytics stay linked to our internal user identifier until Google deletes them, up to 14 months after the last use of the app. As with crash reports, the identifier no longer leads to you once your account is gone. The app clears the user identifier and the sign-in method it keeps with Google Analytics, and the next account that signs in on the same phone starts with a new app instance ID.
- The phone numbers and email addresses you entered for prizes are erased; the prize records themselves are kept, without them, as described above.
- The hands you played remain, with no link to you, in other players' histories and on finished leaderboards, shown as "Former player".
- Your coins are forfeited. An account cannot be deleted while a prize is still on its way; wait for it to arrive first.
- Remove ads, if you bought it, is not refunded and stays with the App Store or Google Play account that bought it. The ad counters and the Remove ads flag on your phone stay too: they belong to the phone, not to your 355 account.
Backups are kept for about 15 days, so your data can remain in a backup for that long after deletion. Backups are used only to restore the service after a failure. If you can no longer sign in, email us and we will delete the account for you after confirming it is yours.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- rectify inaccurate data;
- erase your data (most simply, by deleting your account);
- restrict how we use your data in certain cases;
- data portability: receive the data you gave us in a machine-readable format;
- object to processing based on our legitimate interests;
- lodge a complaint with a supervisory authority. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), dataprotection.ro. You can also complain to the authority where you live or work.
To exercise a right, email admin@markosoft.ro. We may ask you to confirm the request from inside the app, or from the email address linked to your account, so that we only ever hand data to its owner. We reply within one month, extendable by two months for complex requests, in which case we will tell you why. Exercising your rights is free.
You can change or withdraw your consent for personalised ads at any time in the app under Settings → Ad privacy choices (shown where the law requires it). On iOS you can allow or stop tracking in your phone's Settings → Privacy & Security → Tracking; on Android you can reset or delete the advertising ID in your phone's settings.
10. Storage on your device and cookies
The app stores on your phone: your sign-in session tokens (in the system keychain or encrypted storage), the random device identifier, the email address an email sign-in link was sent to until you complete sign-in, the last game you opened, the match or table you are seated at, and an unfinished arrangement so it survives the app closing. This is strictly necessary for the app to work. It is removed when you uninstall the app, except that iOS may keep the sign-in tokens in its keychain until 355 is next installed and opened, when the app clears them. Firebase Authentication also keeps its own sign-in state on your device. Firebase Crashlytics keeps a random installation identifier on your device until you uninstall the app, and keeps a crash report it has not yet sent only until it can send it. Google Analytics for Firebase keeps its random app instance ID, the two settings above and the usage events it has not yet sent on your device until you uninstall the app, and your user identifier until you sign out or delete your account; a new app instance ID is created when the next account signs in after a sign-out.
For ads, Google's consent form keeps your choice on your phone (where it applies, as the industry-standard IAB Transparency and Consent Framework values), and the ads SDK keeps its own identifiers and settings there. The app keeps counters that pace the ads between hands and, if you bought it, a flag that Remove ads was bought. These stay when you sign out or delete your account, because they belong to the phone and the store account, and are removed when you uninstall the app; Remove ads is restored from your store account when you install the app again.
The website sets no cookies, uses no analytics or tracking, and loads nothing from third parties: fonts and images are served from play355.app itself. Our web server does not keep access logs of visits to these pages.
11. Security
All traffic between the app and our servers is encrypted with TLS. Sign-in tokens are kept in your phone's secure storage. Our database and internal services are not reachable from the internet, access to production systems is limited to the people who run 355 and protected by key-based authentication, and backups are kept on the same protected host. No system is perfectly secure; if a breach affecting your data occurs, we will notify the supervisory authority and, where required, you.
12. Age
355 is intended for adults. You must be at least 18 years old, or the age of majority where you live if that is higher, to use it (see the Terms). We do not knowingly collect data from anyone younger; if you believe a minor has created an account, tell us and we will delete it. The ads in 355 are not directed at children.
13. For residents of the United States
We do not sell personal information for money. Showing personalised ads through Google AdMob may count as "sharing" personal information for cross-context behavioural advertising, or as a "sale" or "targeted advertising", under some state laws; you can opt out in the app under Settings → Ad privacy choices, where Google's US states message offers it. We do not use sensitive personal information to infer characteristics about you. Residents of states with consumer privacy laws (such as California) may request access to, correction of or deletion of their personal information by emailing us, and we will not discriminate against you for doing so. The categories we collect, their sources and purposes, and the recipients are listed in sections 2 to 5.
14. Changes to this policy
We will update this policy when what we collect or how we use it changes, and change the date at the top. If a change is significant, we will tell you in the app or on this website before it takes effect.
15. Contact
Software Kit SRL, Rapsodiei nr. 1, Timișoara, Romania · admin@markosoft.ro · Contact page