Privacy Policy

1. Introduction

Welcome to BridgeDummy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our bridge training platform. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

The data controller is Nir Khutorsky, sole proprietor, trading as BridgeDummy (Israel). You can reach us at bridgedummy.com@gmail.com. A postal address is available on request.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last updated" date of this Privacy Policy.

2. Information We Collect

Personal Information

When you create an account through Google Sign-In or Sign in with Apple, we collect:

• The email address of the Google or Apple account you sign in with. If you choose Apple's Hide My Email option, this is an Apple private relay address that forwards to your inbox, and we never see your real address
• Your display name (if provided)
• The username you choose, which other users can see

You are not legally required to provide this information, but we cannot create an account without it.

Usage Information

We automatically collect information about your use of our platform:

• Puzzle solving history and performance statistics
• Progress tracking data and achievements
• Diamond balance and transaction history
• Session duration and interaction patterns
• Device information and browser type
• Approximate location (such as country and city) that our analytics providers derive from your IP address. We do not collect precise location

Content You Create

We store content you create in the service so it can be shown back to you and, where stated, to other users:

• Your username (visible to other users on leaderboards, friend lists, chat, Community and puzzle discussions)
• Board chat messages (visible to your partner at that table)
• Community posts, replies, votes and attached hands, and puzzle discussion comments (visible to signed-in members)
• Saved bidding situations, saved simulations, and hand bookmarks with your titles, notes and tags (private to you unless you share them)
• Reports you submit about other users' content, and moderation records, which admins use to review abuse

Push Notifications

If you allow notifications in the mobile app, we store your device's push token (Firebase Cloud Messaging on Android, Apple Push Notification service on iOS) and your device's time zone offset, so reminders arrive at a sensible local time. You can turn notifications off in your device settings at any time. The token is removed when you sign out, when you delete your account, or when the push service reports it is no longer valid.

3. How We Use Your Information

We use the information we collect to:

• Create and maintain your user account
• Provide personalized bridge training experiences
• Track your learning progress and performance
• Generate appropriate difficulty levels for puzzles
• Maintain leaderboards and competitive features
• Send important account and service notifications
• Improve our platform and develop new features
• Provide customer support and respond to inquiries

Legal bases for processing

If you are in the EEA, the United Kingdom or Switzerland, we process your data on the following legal bases:

• Performance of a contract: creating and running your account, puzzles, progress, diamonds, subscriptions and purchases, friend challenges and board chat.
• Consent: analytics cookies (Google Analytics, Microsoft Clarity and PostHog on the website) and advertising cookies. You can withdraw consent at any time in Cookie Settings.
• Legitimate interests: error and crash monitoring (Sentry), security, abuse and fraud prevention, and rate limiting. Our interest is keeping the service working and safe, and we limit the data to what these purposes need.
• Legal obligation: keeping purchase and tax records and answering lawful requests from authorities.

4. Third-Party Services

BridgeDummy uses the following third-party services:

5. Data Storage and Security

We implement appropriate security measures to protect your personal information:

• Data is encrypted in transit using HTTPS
• Authentication is handled securely through Google Firebase
• Database access is restricted and monitored
• Regular security updates and monitoring

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

6. Your Privacy Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate personal information
• Request deletion of your personal information
• Object to processing of your personal information
• Request portability of your data
• Withdraw consent at any time
• Lodge a complaint with a data protection authority (your national authority in the EEA, the ICO in the UK, or the Privacy Protection Authority in Israel)

To exercise these rights, use our account deletion page or contact us at bridgedummy.com@gmail.com

To receive a copy of your data in a portable, machine-readable format, email us from your account email address. We answer access and portability requests within 30 days.

7. Data Retention

We retain your personal information for as long as necessary to:

• Provide you with our services
• Comply with legal obligations
• Resolve disputes and enforce agreements

Typical retention periods:

• Account, profile, puzzle answers, progress and board chat messages: until you delete your account. Deletion starts after a 7-day grace period in which you can cancel it, and completes within 30 days.
• Online status: shown only to your friends, only while you are connected. To do this, a copy of your friend list is kept by Cloudflare while you have friends. Friend changes normally apply within seconds; during a service outage they can take up to about 12 hours. When you delete your account, this copy is removed when deletion starts (or, if our service is unavailable then, as soon as it recovers), and the last presence record is removed within a day after deletion completes, inside the 30-day deletion period.
• Rating (ELO) change history: 7 days
• Puzzle session security tokens: 48 hours
• Simulation job records: 24 hours
• Push notification device tokens: removed when you sign out or after 270 days without use
• Community posts, replies and puzzle discussion comments: until you or a moderator deletes them. When your account is deleted, they remain but are attributed to "Deleted user", and your votes, follows and notifications are removed
• Purchase, refund and subscription records: as long as tax and accounting law requires, also after account deletion
• Analytics and error data held by Google Analytics, Microsoft Clarity, PostHog and Sentry: according to each provider's retention settings (Google Analytics up to 14 months, Sentry 90 days)

When you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal purposes. You can start that process from the Delete Account page.

8. Cookies and Tracking

We use cookies and similar tracking technologies for two purposes:

Essential Cookies

These cookies are required for the platform to function and cannot be disabled:

• Maintaining your login session (Firebase Authentication)
• Remembering your cookie consent preferences

Analytics Cookies (Opt-in)

These cookies are only set after you provide consent through our cookie banner:

• Google Analytics cookies (_ga, _gid) for traffic and usage analysis
• Microsoft Clarity cookies for session recordings and heatmaps

Advertising Cookies (Opt-in)

If you are a free-tier user and have granted advertising consent, we may display ads via Google AdSense. These cookies help deliver personalized advertisements and measure ad performance:

• Google AdSense cookies (__gads, __gpi) for ad delivery and frequency capping
• Google conversion cookies (_gcl_*) for measuring ad effectiveness

Paid subscribers (Basic, Pro, Premium) never see ads regardless of this setting. You can opt out of personalized ads at any time through the cookie preferences modal or by upgrading your plan.

Do Not Track and Global Privacy Control

We honor the Global Privacy Control (GPC) signal: when your browser sends it, analytics and advertising cookies stay off unless you turn them on yourself in Cookie Settings. We do not respond to the older Do Not Track (DNT) browser signal, because there is no accepted standard for it.

You can change your cookie preferences at any time by clicking "Cookie settings" in the website footer or "Manage Cookie Settings" at the bottom of this page, or through your browser settings. Disabling essential cookies may affect the functionality of our platform.

9. Children's Privacy

Our platform is not intended for children under 13, or under 16 where local law sets a higher age of digital consent (for example, most EEA countries). We do not knowingly collect personal information from children below these ages. If you are a parent or guardian and believe your child has provided us with personal information, contact us and we will delete it.

10. International Users and Data Transfers

BridgeDummy is operated from Israel. Our servers and service providers are located mainly in the United States (Google Cloud and Firebase in us-central1, Cloudflare, Sentry) and in the European Union (PostHog, Frankfurt). Israel is recognized by the European Commission as providing adequate data protection. When your data is transferred from the EEA, the United Kingdom or Switzerland to the United States, we rely on the EU-US Data Privacy Framework (with its UK and Swiss extensions) where the provider is certified, and otherwise on Standard Contractual Clauses included in each provider's data processing terms. You can ask us for details of these safeguards at any time.

11. Contact Information