varaq
Privacy at Varaq
Varaq uses information to run card games, keep account access working, save results and provide the social features you choose. You can play as a guest without an account.
Information used to run games
We process your chosen player name and avatar, room membership, game actions, connection state and results. Other people at your table can see your game profile and public play. Invitations and room addresses let other people find a table, so share private invitation links deliberately. Opponents' unplayed cards stay hidden during ordinary matches.
Accounts and social features
If you sign in, you do so with Google or an email code through WorkOS, our sign-in provider. We receive the identity and profile information that provider supplies, including your name, email address and profile image. We store the sign-in association and session records. Your Google password is entered with Google, never with Varaq.
Account features store your Varaq name and avatar, saved results, ratings, rewards and equipped items. Friends features store connections, invitations, blocks and mutes. Competitive features store entries, pairings, results and standings. Public leaderboards and event listings can show your game profile and results; leaderboard preferences control whether you appear and an optional country.
The coming-soon ballot stores which games you picked, under your account or a random key your browser makes. If you ask to hear when a game is ready, Varaq keeps that request and sends one email to your sign-in address on release; turning the bell off, or deleting your account, removes it. Country-level request information can also help choose the initial language.
Varaq's administrators can see account data to run the service: your profile, sign-in methods, matches, ratings and friends count. Email addresses stay hidden unless an administrator deliberately reveals one. Every reveal, export and account change is recorded in an audit log that cannot be edited.
Browser storage
Cookies keep you signed in and remember your language. Browser storage keeps preferences such as sound, appearance and guest player settings, a room reconnect token and, after a deletion request, its private receipt. Cached app files help Varaq load quickly and work offline; live multiplayer still needs a connection. Clearing browser data can remove these, but it does not cancel a deletion request on the server.
Service providers
Cloudflare hosts the app, game connections and databases. Requests pass through its infrastructure, which processes connection information such as IP addresses and request metadata. WorkOS and Google handle their own sign-in flows, and Resend delivers the emails Varaq sends. Short-lived security and rate-limit records help stop abuse. These providers have their own privacy practices; signing out of Varaq does not delete an account you hold with them.
Google Analytics measures visits on varaq.app: pages viewed, approximate location (country and city), device and browser type, and how far a visit gets, from choosing a game mode and waiting for an opponent to starting, playing and finishing a match, leaving early, connection problems, signing in or creating an account. It also measures page-load speed and which share channel an invite link came from. It records the game, mode, interface language, table size, how many seats are people or bots, the bot level, the Hokm suit, points, the score, durations and how a match ended. It never records cards, names or chat. It also notes whether a visit comes from an automated browser, so that traffic can be kept apart. Google Analytics sets its own cookies; for visitors in the EEA, the UK and Switzerland those cookies stay off and Google receives only cookieless measurements. Varaq keeps Analytics data for 14 months and does not use it for advertising.
Varaq also counts finished Hokm and Dirty Seven table matches, including practice against bots, on its own server by UTC day, game, mode and table size. These totals contain no player or match identifiers and are kept for 28 days.
When the app or its server fails, an error report goes to the error monitor Varaq's operator runs for their own projects: the error message and stack, and the page path with room codes and record ids removed. It does not store IP addresses, and it removes email addresses. Reports are kept for 90 days.
How long we keep it
Saved game records are available to their participants for 90 days after the game ends, and a daily cleanup removes expired records. Sign-in sessions expire after 30 days, or earlier when revoked. Short-lived login and rate-limit records expire on their own.
Account, social, competition and numerical result data are not all limited to 90 days. After an account is deleted, shared results, ratings and tournament outcomes may remain without your name and avatar, so other players' records stay consistent. Hosting logs and recovery copies have their own retention windows at the provider.
Your choices
You can edit your game profile, manage friends, change leaderboard visibility or sign out from your account settings. Signing out does not delete saved data. Self-service account deletion is not yet enabled; to delete your account or ask about your data, email us. Please don't post personal information in public GitHub issues.
When we change this notice, the date below changes with it, and the notice describes only features that are actually released.
Last updated: