Privacy policy

Who we are

PlayZoo is operated by Otwo AI (OPC) Private Limited, a One Person Company registered in India. We are the data controller for the information described on this page. You can reach us at support@otwo.io, and we will give you our registered address on request.

What we store about you

• Your account. Signing in creates a Firebase account. If you use Google we receive your name, email address and profile picture from Google. If you use Apple, on an iPhone, we receive the name and email address you agree to share, and that email can be a private address from Apple that forwards to yours. If you play as a guest, the account is anonymous and holds nothing but a random id.
• Your display name and picture. Whatever you set in your profile. Other players in your room see it.
• Online rooms. Some games let several phones join one shared room. While one is running, the room holds the players' display names and pictures, who is sitting where, and what each person did that round, so every phone can follow the same game. Anything a player is meant to keep to themselves, such as their role in Mafia, is stored separately, where only that player can read it. Nothing from a room is used for anything else.
• Feedback you send. The message itself, your display name, your email address if you signed in with Google or Apple, which screen you sent it from, and your app version.
• Premium, if you buy it. Google Play or the App Store takes the payment, and we never see your card, bank or UPI details. When you buy, the app sends us the proof of purchase the store gave it, and we check it with Google or Apple. We then keep a record that your account has Premium and until when, and for each purchase, which store it came from, when it was bought and which account it belongs to. That is what lets Premium unlock on any phone you sign in on, and what stops a second account using the same purchase.
• Free rooms you host. If you host online rooms on the free monthly allowance, we count how many your account has used that month in each game, and note the most recent one, so the allowance can be applied.

What never leaves your phone

Forbidden Words, Mr. Imposter, Act It Out and Three Monkeys are played on one device and do not send us anything, and neither does Bingo Night when one phone calls the numbers for paper cards. Nor do these, whichever game they come from: the player roster and leaderboard (the names you type at setup and their win records), the setup a game remembers between sittings, any house rules you write yourself, your music and language settings, and the note of which cards this device has already been dealt. All of it stays on the phone. It is never uploaded and it is not tied to your account. Clearing the leaderboard removes the roster and its scores, and uninstalling the app removes the rest for good.

Analytics, if you said yes

In the UK, the EEA and Switzerland we ask before any of this happens, and nothing is collected unless you say yes. Everywhere else it runs from first launch. Either way it is Google Analytics for Firebase, and it receives these things from us: that you signed in, how (Google, Apple or as a guest) and whether the account is new; that a game was opened, started or closed, with the name of the game, which card decks were in play, how many games were played and for how long; that you joined a room; that somebody tapped a deck they have not unlocked, with the name of that deck; that the Premium screen was opened, where from, and whether a purchase went through, was cancelled or is still pending; and that an account was deleted, with how many free rooms it had hosted that month.

Google also records what it collects for any app that uses it: your device model and system version, language, app version, rough region, when the app was opened and for how long, how it was installed, and purchases made through the store. All of that is tied to an anonymous id for this install, so that two evenings are not counted as two people, and a reinstall starts a new one. Your phone's advertising ID is switched off: on Android and on iPhone, analytics never reads it, so nothing here can be matched with what you do in other apps.

It never receives the names at your table, what anyone said or guessed, who won, or how many of you were playing. We use it to see which games and decks people enjoy, so we know what to make next. Nothing is sold and there are no adverts.

What we never collect

The app never asks you for a permission. It uses the internet, and on Android the permission Google Play needs to take a payment, and nothing else of note. It has no access to your location, your contacts, your camera, your microphone, your photos or your files, and it does not read anything else on the device. Payments for Premium are taken by Google Play or the App Store, so we never see or store your card, bank or UPI details.

Why we are allowed to use it

If you are in the UK, the EEA or Switzerland, the law asks us to name a legal basis for each thing we do.

Running the game

Performance of a contract. We cannot show six phones the same room without storing the room.

Premium and free rooms

Performance of a contract. We cannot give you what you paid for on every phone you sign in on, or count the free rooms you are allowed, without keeping a record of them.

Analytics

Your consent, given in the app and withdrawable at any time by writing to us.

Answering your feedback

Our legitimate interest in fixing what you tell us is broken.

Keeping the service secure

Our legitimate interest in stopping abuse, such as people writing themselves into a game they are not part of.

How long we keep it

• Rooms are transient. A room is deleted the moment the last player leaves. One left behind by a phone that died mid-game is deleted automatically once it has sat idle for a day, by a job that runs every night, so at the outside it is gone within two days.
• Your account lasts until you delete it, which you can do from inside the app at any time.
• Premium records last as long as your account, including after a pass has run out, so the same purchase cannot later be claimed by another account. Deleting your account deletes them.
• The free-room count only ever holds the latest month you used a free room in. Deleting your account deletes it.
• Feedback is kept for up to two years, so we can see whether a problem somebody reported ever got fixed.
• Analytics is retained by Google for up to fourteen months.

Who else handles your data

• Google Firebase handles sign-in, stores the data for online rooms, and serves a small settings file the app fetches when it starts. Your device's IP address reaches Google as part of that, as it does with any connection.
• Google Analytics for Firebase receives the events described above, if you agreed to it.
• Google Sign-In, only if you choose it instead of playing as a guest.
• Sign in with Apple, on an iPhone, only if you choose it.
• DiceBear draws the cartoon profile pictures. They load from DiceBear's servers, so DiceBear sees your device's IP address, and for the picture you start with, the random id of your account. It means nothing to them and is not linked to your name.
• Google Cloud Functions receives your feedback and stores it, then posts it to a private staff space on Google Chat so that a person reads it. It also checks a Premium purchase with Google or Apple before unlocking it.
• Google Play or the App Store takes the payment if you buy Premium, under their own terms and privacy policy. They tell us whether the purchase went through, what was bought and until when. They never pass us your card, bank or UPI details.

That is the whole list. No advertising networks, no data brokers, and nothing that follows you to other apps.

Where your data goes

Our service providers are Google companies, and their servers may sit outside your country, including in the United States. Where that happens for someone in the UK, the EEA or Switzerland, the transfer relies on the European Commission's Standard Contractual Clauses (with the UK and Swiss additions to them), which Google publishes as part of its terms.

Your rights

Wherever you live, you can write to us and ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. If you are in the UK, the EEA or Switzerland you can also ask us to restrict what we do with it, object to it, receive it in a portable format, and withdraw your analytics consent at any time without it affecting what came before.

If you are in India, the Digital Personal Data Protection Act gives you rights of access, correction, erasure and grievance redressal, and the right to nominate somebody to act for you if you cannot.

If you are in California or another US state with its own privacy law: we do not sell your personal information, we do not share it for advertising that follows you across apps or sites, and we do not use it to profile you, in the sense those laws give the words. You can ask to know what we hold, and to have it corrected or deleted, and asking will not change how the app treats you.

If you are in Brazil, the LGPD gives you the same rights of access, correction, deletion and portability, and the right to know who we share your data with, which is the list above.

Write to support@otwo.io from the address you signed in with and we will deal with it within thirty days. If you think we have handled your data badly, you can complain to your local data protection authority. In the UK that is the Information Commissioner's Office, in the EU it is the authority in your country, in India it is the Data Protection Board, and in Brazil it is the ANPD.

Children

PlayZoo is not aimed at children under 13, and we do not knowingly collect anything from them. If you believe a child has created an account, write to us and we will delete it.

Deleting your account and data

You can delete your account from inside the app. Open the profile menu, scroll to the bottom, and tap Delete my account underneath Sign out. There is a screen that says what will happen and asks you to confirm. Once you do, it happens immediately and it cannot be undone.

Deleting your account removes your profile, your sign-in record, any feedback tied to it, our record of any Premium purchase and your free-room count. If you signed in with Apple, it also ends PlayZoo's access to your Apple ID. A room you are hosting on your own is deleted with it; in a room other people are still playing in, your seat is given up and your name, picture and any role are removed, and the room itself is deleted on the timetable above. It does not touch the roster and leaderboard on your phone, because we never had them. Uninstalling handles that.

Deleting your account does not refund a Premium pass. Google Play or the App Store keeps its own record of the purchase, so while the pass lasts you can restore it onto a new PlayZoo account from the same Google Play or Apple account.

If the button will not go through, or you would rather we did it, email support@otwo.io from the address you signed in with, with "delete my account" as the subject. We will confirm and remove it within thirty days.

Changes

If this policy changes, the date at the top changes with it, and a material change will be announced in the app before it takes effect.

Contact

Questions, or anything you want removed: support@otwo.io

Grievance Officer (India): Seema Jain, support@otwo.io. Appointed under the Digital Personal Data Protection Act 2023 and the Information Technology Rules.

You can also read our Terms & Conditions and Refund Policy.