AafatPublisher: Arcas Logic (an individual developer, not a registered company)
App: Aafat (Android; iOS when it is released)
Effective date: 2026-11-11
Contact: support@aafat.app (privacy questions and requests)
Grievance Officer: the developer (Arcas Logic), at support@aafat.app
Summary
Aafat is a collection of games. You can play all of them offline, with no account. If you choose to use the online features (friends, invites, online matches including public rated chess, progress sync, notifications), Aafat creates an account for you on our server, a guest account by default. There are no ads. The app sends usage statistics and crash reports unless you turn that off in Settings. You can delete your account in the app at any time.
Offline play: what stays on your device
Game progress, scores, time played, daily challenge and tutorial state, favourites, reminders and settings are saved on your device. If you never use the online features and never create an account, this data never leaves your device. It is deleted when you uninstall the app or clear its storage.
Usage statistics and crash reports (Firebase)
On by default; turn off in Settings > Privacy > “Share usage and crash reports”. Off stops all collection at once. This applies whether or not you have an account.
- Usage statistics (Google Analytics for Firebase): which games you open, levels started, completed, failed or left (level, difficulty, time taken, hints, undos), daily challenge and tutorial progress, settings changes (sound, music, vibration, theme), the number of search results (not what you typed), invites you create or open (game and kind only, no code), load and start-up times, and app and device information (app version, device model, OS version, and an app-instance identifier generated by Firebase).
- Crash reports (Firebase Crashlytics): the technical details of a crash or game error, the last screens and game steps before it, the game, level and game seed (the number that generates a board), the same app and device information, and an installation identifier generated by Firebase.
- Approximate location (country, region or city) is derived by Firebase from your IP address. We never collect precise location (GPS).
- We do not use the advertising ID, and these reports do not carry your name, your account, your handle or anything you typed. They are not linked to your Aafat account.
- Kept 14 months (statistics) and 90 days (crash reports).
Online features: the account data we keep
We keep this on our server only if you use the online features. Using them is optional.
| What | Why | Details |
|---|---|---|
| Account | To run your account | Holds: user ID, whether the account is a guest, your answer to the age question (a yes/no box for “13 or older”; no date of birth is asked or stored), created and last-active times. A guest account is made on first online use. Guests inactive for 180 days are deleted; accounts with a linked Google or Apple sign-in are never deleted for inactivity. |
| Device record | To keep you signed in on this phone | Holds: device ID, a secret stored as a hash, platform (Android, iOS), created and last-used times. You can remove devices in the app. |
| Sign-in link (optional) | To sign in again and keep your account if you change phone | Holds: the Google or Apple account identifier (subject) only. We do not store your email, name or photo. For Apple we store an encrypted token needed to revoke access. |
| Profile | To show you to other players | Holds: handle (generated, or chosen by signed-in users), preset avatar, friend code, whether friends see your presence. Your handle and avatar are visible to your friends, to anyone who looks up your friend code, and to your opponent in an online match. |
| Player card | To show who you are playing | Holds: your level, medal, badge count, up to three badges you show, and per-game played, won and drawn counts. Visible to your friends and to your opponent in an online match. It is built from your synced progress. |
| Friends | Friends and safety | Holds: requests, friendships, blocks. Declined requests are kept 30 days. Blocks are silent: the blocked person is not told. |
| Presence | To show friends when you are around | Holds: online, in a match, and coarse last seen (now, today, this week, earlier). Only to friends; you can turn it off in the app. |
| Matches | Online play | Holds: moves and results of online matches, per-game stats, head-to-head record against friends (wins, time played, last played), chess rating per time control and its change after each public game. Public chess matches are matched by rating against other players and are rated; invite matches are not. Matches can include a computer player. In a public match you can only send preset emotes. A public match left early counts as a resignation and repeated leaving can pause your matchmaking for up to 24 hours (a counter and a time are kept). After deletion your seat in old match records shows as “Deleted player”. |
| Invites | To start matches with friends | Holds: invite codes you create, accept or decline. Invite codes and referrer strings are not logged. |
| Progress sync | To carry progress to a new phone | Holds: completed levels and stars, XP, wins, dailies, best scores, achievements, badges, daily streaks and the app streak, per game. The exact in-progress state of a game, settings and favourites are not uploaded. Sync runs whenever you are signed in to an account. It is not a backup service. |
| Chat | Friend chat | Applies when chat is available in your version of the app. Holds: messages and preset phrases. Guests send preset phrases only; free text needs a linked Google or Apple account. Text goes through a word filter. Messages are kept 90 days on the server; the app deletes its local copies older than 90 days. |
| Reports | Safety and moderation | Holds: if someone reports you, a message or a player, the reporter, the reason, the note and a snapshot of up to 20 messages around the report where chat is involved. Kept 180 days, including after the account is deleted, so we can act on abuse and repeat offenders. |
| Push notifications | Alerts for friend requests, invites, messages and your turn | Android only, and only if you grant the permission. Holds: a push token for this device, language, which kinds you enabled, the previews setting. Tokens unused for 60 days are deleted. A message preview (first 60 characters) passes through Google (Firebase Cloud Messaging); turn previews off in the app. |
| IP address | Rate limits and abuse prevention | Kept as short-lived counters in our database cache; also seen by Cloudflare (see Sharing). Server logs record your user ID, the route and timing, never message text, tokens or invite codes, and are rotated automatically; we do not keep them as a long-term archive. |
Reminders you set up in Settings are scheduled on your device and use no server.
If you join through a link, Google Play passes an install referrer to the app on first launch; the app reads it on the device and uses it only to open the invite or friend code. It is sent nowhere unless you then join online.
How we use data
To run the app and the features you use, keep accounts and matches working, match you with other players, keep users safe (rate limits, filtering, reports, bans), understand which games work well and fix crashes (statistics and crash reports). We do not sell data, show ads or build advertising profiles.
Sharing and processors
We share data only with service providers acting for us: Google (Firebase Analytics and Crashlytics, Google Sign-In, Firebase Cloud Messaging), Apple (Sign in with Apple), Cloudflare (it proxies and terminates the encrypted connection for all online-feature traffic, so it technically handles that traffic as our processor; it also hosts our website), an email service provider that sends our daily moderation digest, which contains report content (reporter, reason, note and possibly message text), and the hosting provider of our server. Alerts sent to our operations chat contain metrics only, no user data. Other users see what the table above says they see. We may disclose data to authorities where the law requires.
Where data is stored and transferred
Our server runs on infrastructure operated by us. Firebase, Cloudflare and the other providers above process data in several countries, which can include countries other than your own. By using the online features you agree to this transfer; offline play and the usage and crash reports (which you can turn off) do not need it.
Security
Account credentials are stored as hashes or encrypted, access tokens are short-lived, and message text is not logged. Traffic between the app and our server is encrypted in transit. No server backups exist: a server failure can lose accounts, and deleted data does not linger in backups.
Your choices and rights
- Turn off usage and crash reports: Settings > Privacy.
- Delete your account and data: Settings > Account > Delete account in the app, or by email. How and when: Delete your account (
/delete-account). - Access or export your data, correct it, withdraw consent, or complain: email support@aafat.app; we answer by hand. You have the rights your local law gives you (for example under India’s Digital Personal Data Protection Act, or the GDPR in the EU and UK), including the right to complain to your data protection authority.
- Block or report any user in the app. Turn presence and push previews off in the app.
Children
Aafat is for people aged 13 and over. The first time you use online features the app asks if you are 13 or older and does not offer them if you say no; this is a self-declaration, not verification. Offline play collects no personal information. We do not knowingly keep accounts of children under 13, and if we learn of one we delete it. If you are under 18, you may use the online features only with the consent of a parent or guardian. Where your law sets a higher age for consent (for example 16 in parts of the EU), that age applies.
Third parties and links
Aafat contains no advertising software. If you use “Privacy policy” or “Share app”, your phone’s browser or share sheet opens under its own policy. Google Play and the App Store may collect install and crash information under their own policies.
Changes
If we change how data is handled we update this policy and its effective date before the new version is released.
Contact
support@aafat.app (Arcas Logic, an individual developer). Governing law: India. Grievance Officer (India): the developer, at support@aafat.app.