Privacy policy
Last updated October 2, 2026 (crash reports added)
This policy explains what the DUMB app and its servers collect, why, and how long we keep it. The short version: you play as an anonymous guest, we keep what we need to run matches and decide who won, and we don’t sell your data. The app shows ads from Google during matches (not for DUMB Pass holders); personalized ads only if you allow them.
What we collect
| Data | What it is | Why |
|---|---|---|
| Guest account | A random player ID created when you first open the app, and a session key stored securely on your phone (iOS Keychain / Android Keystore). | To recognise your device between matches without asking for your name or email. |
| Email address (only if you sign in) | If you choose to save your progress, the email address you enter, and the one-time sign-in codes we send to it (stored only in scrambled form, and useless after 10 minutes). | To send you sign-in codes, so your account can be restored on another phone. We don’t send marketing email, and we don’t share your address. Our email providers (Resend, and Amazon Web Services as a backup) deliver the codes. |
| Player name and avatar | A made-up display name (“Adjective Noun”, such as “Wobbly Pickle”) and a cartoon avatar, both picked from preset lists. You get a random one to start and can change it in the app. | To show other players in your match who they’re playing against. Other players in your matches see it. |
| Custom name and photo (only if you unlock them) | A name you type, and a photo you choose from your library. We shrink the photo to a small square picture, which removes its hidden details (such as where it was taken), and check it with automated image moderation before anyone sees it. Names pass a word filter. | To show other players who they’re playing against. Other players see your name and photo, and can report them; we review reports and may reset a name or remove a photo. |
| Purchases | What you bought (the DUMB Pass or the custom name and photo unlock), and when a subscription renews or ends. Apple or Google take the payment; we never see your card or billing details. | To unlock what you paid for. RevenueCat keeps track of App Store and Google Play purchases for us. |
| Tournament alerts | If you allow notifications: a push token for your phone (from Apple or Google, delivered through Google Firebase Cloud Messaging), and a copy of each tournament alert we send you, shown on your profile page. | To tell you when check-in opens, your room is ready, or how you did. Only for tournaments you entered; never marketing. |
| Ads | DUMB shows ads from Google AdMob during matches, unless you have a DUMB Pass. Google receives your IP address and basic device information to serve them. Only if you allow tracking (Apple’s “Allow tracking?” prompt) and, in the EU and UK, consent in Google’s consent form, Google may use your device’s advertising identifier to personalize ads and measure them. | To keep DUMB free. You can say no to tracking and still play; you’ll see non-personalized ads. |
| Friends and private games | Your invite code, the players you are friends with and when you became friends, who invited you (if you joined through someone’s link), and the private games you opened or joined. Your friends see your player name, avatar or photo, whether you are online now, and when you last used the app. | To let you play with people you know, and to give the invite reward (days of the DUMB Pass) to the player who invited you. |
| Live page | While a public match is on (casual, quick table or tournament), trydumb.net/live shows each player’s player name (or custom name), avatar or uploaded photo, and whether they are still holding, and recent winners. Never your player ID or email. Private games with friends appear there only as “Private game”, without names. | So anyone can watch DUMB being played. |
| Support email | If you email support@trydumb.net: your message, email address, name as your mail app sends it, any attachments, and our replies. | To answer you and keep a record of the conversation. |
| Reports | Reports you make about another player’s name or photo, and reports about yours. | To keep names and photos friendly. |
| Gameplay | Which matches you played, when you pressed and released, when your phone connected, disconnected and was last heard from, and the result. | To run matches fairly, decide results, and review disputes. |
| Technical data | Your IP address and the requests your app makes (time, address requested, response), in server logs. | To keep the service running, prevent abuse (for example, limiting how fast new accounts can be created), and fix problems. |
We do not collect your real name, phone number, contacts, location, or camera or microphone input, and we only ever receive the one photo you choose to upload. Apart from Google’s ads (above), the app has no third-party analytics or tracking.
Who processes it
Our servers run on Amazon Web Services (United States) and Cloudflare, which host the API, the database, uploaded photos and the live game rooms on our behalf; Amazon Rekognition checks uploaded photos. Google Firebase Cloud Messaging delivers push notifications, Google Firebase Crashlytics receives crash reports (the device model, system version and what the app was doing when it crashed; never your player ID, name or email), Google AdMob serves ads (under Google’s privacy policy), RevenueCat tracks purchases, Google Analytics measures visits to this website (pages viewed, rough location and device, using cookies; only if you agree in the cookie banner; cookie settings) and, through Google Analytics for Firebase, how the app is used (screens and events such as a game started or won, the device model, system version and rough location; never your player ID, name or email, and never the advertising ID), and Apple and Google process payments. We don’t sell or share your data with anyone else, except where the law requires it.
How long we keep it
- Accounts (guest or signed in) and match results: while DUMB operates, or until you delete your account.
- Photos: until you replace or remove the photo, a reviewer removes it, or you delete your account.
- Tournament alerts on your profile and push tokens: until you delete your account (push tokens also go when you sign out or uninstall).
- Live game room records on Cloudflare: 7 days after the match.
- Database backups: 35 days.
- Server request logs: about 10 days.
Your choices
Delete your account in the app: Home → About → Delete account. This works for guest and signed-in accounts and takes effect immediately:
- We delete your email address and sign-in codes, your player name, avatar and photo, your alerts and push tokens, your invite code and friends list, our record of your purchases, and your tournament registrations. To stop a subscription, cancel it in your phone’s subscription settings (Apple or Google bill it, so deleting your DUMB account doesn’t cancel it).
- Your player ID is permanently retired and can’t sign in again.
- Results of matches you played stay in other players’ match and tournament records under that retired ID, with nothing that identifies you, so their results and any disputes still add up.
- Deleted data can remain in our encrypted database backups for up to 35 days, until they expire.
If you can’t use the app, or want to know what we hold about you, email support@trydumb.net from the address you sign in with, or with the player ID shown in the app (Home → About). You can also just stop using DUMB and uninstall the app; that removes the session stored on your phone.
Age
DUMB is intended for adults (18+). We don’t knowingly collect data from children; if you believe a child has used DUMB, contact us and we’ll delete their data.
Changes
If we change what we collect (for example, adding accounts, cosmetics or crash reporting), we’ll update this page and its date before the change reaches the app.