Privacy Policy
Never Have I Ever: Cards
Controller
Never Have I Ever: Cards is provided by Adrian Anton Gruber under the guba.studio brand. guba.studio is a business designation and not a separate legal entity.
Postal address: see the Legal Notice.
Privacy contact: hello@guba.studio
Short Version
- Core gameplay runs on your device. New builds offer optional usage analytics that are off by default; older builds may send usage metrics automatically.
- You do not need an account to play.
- We do not use third-party advertising.
- We use PostHog for usage analytics with randomly generated app identifiers. How analytics starts and how these identifiers are stored depends on your app build, as explained below.
- We use RevenueCat to manage purchases and subscription access when paid products are enabled.
- We do not sell personal data and do not use data for cross-app tracking.
App Data
The app lets you pick a deck, play a local card round, remember app preferences, and restore purchase access. The playable cards, preferences, and local round state stay on your device. Analytics separately records deck selections, card positions, and round completion metrics as described below. The app does not ask you to enter player names or answers and does not send your spoken answers to analytics. Information you choose to email to support is handled separately.
Usage Analytics
We use PostHog to understand app use and improve the game and purchase flow. Events include app lifecycle and screen views, deck IDs, card positions, round counts and completion reasons, paywall views and chosen plans, product and package identifiers, purchase and restore outcomes, Pro access status, and review-prompt eligibility or attempt metrics. Technical event properties may include app version, operating system, device type, and session identifiers.
These events are pseudonymous: they are not associated with a named account, but a random app identifier can connect events. In Android 1.4 (build 23) and iOS 1.4 (build 27), the PostHog identifier and event queue are held in app-process memory rather than persisted to disk. The saved analytics choice remains on your device. Earlier builds, including Android 1.4 (22) and iOS 1.4 (26), may persist PostHog identifiers and queued events locally. Events that have been sent are also stored by PostHog.
Android 1.4 (build 23) and iOS 1.4 (build 27) start optional PostHog usage analytics only after you enable it in Settings and the choice is saved. It is off by default when no valid saved choice exists. You can turn it off in Settings: this stops optional analytics, discards pending app-process events and resets the analytics identifier. If saving your choice fails, the app reports the problem. Turning it off does not delete events already sent to PostHog. Earlier builds, including Android 1.4 (22) and iOS 1.4 (26), enable usage analytics when configured and connected and do not offer this setting. The setting controls PostHog usage analytics; necessary store and RevenueCat purchase processing continues when you buy or restore access. The default analytics endpoint is PostHog's EU ingestion service, eu.i.posthog.com, using HTTPS. IP addresses are involved in delivering network requests; geolocation enrichment is disabled. We do not use session replay, touch autocapture, identified person profiles, or automatic exception capture. We remove device model, manufacturer, device name, emulator, and timezone properties before sending events. Player answers, player names, and card text are not included in the app's analytics event fields.
Purchases
If you buy or restore Pro access, purchases are processed by Apple App Store or Google Play. RevenueCat helps manage subscription status and purchase entitlements. Purchase-related data may include anonymous app user IDs, product IDs, receipt or transaction data, entitlement status, platform, app version, locale, and metadata needed for purchase support.
Support And Reports
If you contact support or report a card, your email app sends the information you choose to include. This may include your email address, message content, screenshots, device platform, app version, purchase identifiers, deck name, or card text. We use this data to answer your request, fix purchase issues, and review content.
Website Logs
When you visit pages on guba.studio, the hosting provider may process technical log data such as IP address, date and time of access, requested page, browser or device metadata, referrer URL, and error or security logs. This is used to deliver the site, keep it secure, diagnose errors, and prevent abuse.
Legal Bases
Where the GDPR applies, we process data to provide the app and support, manage purchases, keep the app and website secure, prevent fraud or abuse, comply with legal duties, and respond to your requests.
Recipients
Data may be processed by Apple and Google for app distribution and store purchases; RevenueCat for purchase history, entitlement management and purchase analytics; PostHog for the usage analytics described above; and Vercel and email providers for hosting, support, security, and legal compliance. RevenueCat uses a randomly generated app user identifier cached on your device when no account ID is supplied.
Retention And Deletion
Retention depends on the data and service: local data remains until cleared, while analytics, purchase, and support records are retained for the purposes described here, subject to service retention settings and legal obligations. We do not claim a single fixed retention period for every record. Deleting the app or clearing app data removes local files where supported; it does not automatically delete analytics or purchase records already held by PostHog, RevenueCat, or the app stores.
To request access, objection, or deletion relating to analytics, support, or app-side purchase data, contact hello@guba.studio. Include the app name and any relevant app or purchase support identifier you already have; do not send passwords or payment card details. We may need further information to match a request to a random identifier, and an email address alone may not identify pseudonymous analytics records. Records subject to legal retention requirements or controlled by Apple or Google may need separate handling. A request does not imply that provider-side deletion has already been completed.
Your Rights
Where the GDPR applies, you may have rights to access, correction, deletion, restriction, objection, portability, withdrawal of consent, and complaint to a data protection supervisory authority.
Children
The app is not directed to children. Users should meet the age rating shown in the app store. We do not knowingly collect personal data from children below the minimum age required by applicable law.
Changes
We may update this Privacy Policy when the app, services, SDKs, store requirements, or legal requirements change. The current version will be available at this page.