Mattis
Language: EN
Get the app

Privacy policy for Mattis

This policy explains what personal data the Mattis apps for iOS and Android and the website playmattis.app collect, why, who we share it with, how long we keep it, and the choices and rights you have.

Last updated:

1. Who we are

Mattis is made by Strange Utvikling, a sole proprietorship owned by Stian Strange and registered in Norway under organisation number 935 912 032. Strange Utvikling is the data controller for the personal data described in this policy ("we", "us").

Contact us about privacy at stianstrange@gmail.com.

2. Summary

WhatWhyLegal basisHow long
App usage and device data (Google Analytics for Firebase) Understand how the game is played and improve it Consent Events 2 months; user-level data 14 months
Advertising identifiers and ad interactions (Google AdMob) Show ads that keep the game free, and measure them Consent for personalised ads; legitimate interest for non-personalised ads Set by Google
App install and launch events on iPhone (Meta SDK) Measure installs from our ads on Facebook and Instagram Consent; the advertising identifier only if you also allow tracking Set by Meta
Display name and match records (online multiplayer) Run online tables with your friends Contract (providing the game) Live match: hours. Match summary: 90 days
Hint wallet and purchase records Deliver hints and purchases, restore them, handle refunds Contract Until you delete the hint account; purchase records 180 days after that
Network address (IP) and request logs Keep the service running and protect it from abuse Legitimate interest At most 7 days
Website analytics (playmattis.app) Understand visits and which store links lead to installs Consent (Google Analytics); legitimate interest (Cloudflare Web Analytics) Events 2 months; user-level data 14 months
Emails you send us Answer your questions and requests Legitimate interest; legal obligation for rights requests Until the request and any follow-up are resolved

3. Information we collect in the app

Usage and device data

The first time you open Mattis, it asks whether you allow usage analytics. Analytics stays off until you allow it, and you can turn it off again in Settings. On iPhone the same answer covers Meta app events (section 5). If you allow it, the app sends Google Analytics for Firebase information about how the game is used: game started and completed, player count, game length, phase changes, Wars, hints requested and shown, ads shown, purchases started and completed, and the card theme you choose. Firebase also records device information such as model, operating system version, app version, country and an app instance identifier. This data is pseudonymous: it does not include your name or email address.

Advertising

The free version of Mattis shows ads from Google AdMob. AdMob uses your device's advertising identifier (the Android advertising ID, or Apple's IDFA if you allow tracking), your IP address and information about ad interactions to show, limit and measure ads, and, if you consent, to personalise them. Google may let other ad buyers bid for ad space through its own network; the consent form in the app lists Google's ad partners. Mattis Plus is ad-free.

Online multiplayer

When you create or join an online table, our server (run on Cloudflare) receives the display name you chose (up to 24 characters), a random player identifier, the table code, whether the table is public, your seat, connection status and the moves of the game, so every player sees the same game. Other players at your table see your display name.

Hint wallet, sign-in and purchases

When the app is online it registers a hint wallet with our server, even if you never sign in. The wallet holds a random wallet identifier, a random device identifier, your hint balance, and when you received and used hints.

If you sign in with Apple or Google to buy hints or restore remaining purchased hints, the app sends a signed identity token to our server. The token can include your name and email address; we use it only to verify the sign-in and do not store it, your name or your email. We derive a wallet identifier from the provider's account ID, and the app keeps that account ID on your device to remember that you are signed in. Our server stores the wallet and device identifiers, hint balance and activity, purchase transaction identifiers, and the dates needed to deliver purchases, restore remaining hints and handle refunds.

The App Store and Google Play process all payments, including Mattis Plus subscriptions; we never receive your payment card details. RevenueCat delivers purchases and subscriptions to the app and reports them to us, using your wallet identifier, purchase tokens and product identifiers.

Notifications

On iPhone, streak reminders are local notifications scheduled on your device, shown only if you allow notifications. On Android, the app uses Firebase Cloud Messaging: Firebase creates an installation identifier and a messaging token when the app starts, and the app subscribes to game-update announcements once notifications are allowed (Android 13 and later ask you first). You can turn notifications off at any time in your phone's settings.

Game Center and Google Play Games

If you are signed in to Apple Game Center or Google Play Games, the app reports achievements and your total wins to them, and they show your player name and picture inside the app. Apple and Google handle this data under their own privacy policies.

Data kept on your device

The app stores your settings, display name, XP, level, streak and game progress on your device. Uninstalling the app removes them.

4. How we use data, and our legal bases

  • To provide the game (online tables, the hint wallet, purchases, restoring hints): necessary for our contract with you (GDPR Article 6(1)(b)).
  • Analytics, Meta app events on iPhone and personalised ads: your consent (Article 6(1)(a)).
  • Non-personalised ads, security and abuse prevention: our legitimate interest in keeping the game free and keeping the service safe (Article 6(1)(f)). You can object at any time (section 10).
  • Refunds, accounting and answering rights requests: legal obligations (Article 6(1)(c)).

We do not sell your personal data, and we do not use it to make decisions about you that have legal or similarly significant effects.

5. Advertising, tracking and your choices

  • Ads consent. In the EEA, the UK and Switzerland, the app asks for your consent with Google's consent form before it requests personalised ads. You can change your choice at any time in the app's Settings under privacy options.
  • Analytics. The app asks the first time you open it. You can change your answer at any time with the Usage Analytics switch in the app's Settings, under Privacy.
  • Tracking on iPhone. The app asks for permission to track through Apple's App Tracking Transparency prompt. If you decline, the app and its ad and Meta SDKs cannot read your IDFA. You can change this in iOS Settings → Privacy & Security → Tracking.
  • Meta (Facebook) SDK on iPhone. The iPhone app includes Meta's SDK, but does not start it until you allow analytics. After that, it sends Meta app events such as the install and app opens, with device and app information, so we can measure our ads on Facebook and Instagram. It sends the advertising identifier only if you also allow tracking. If you say no, or later turn off Usage Analytics in Settings, the app does not start Meta's SDK. The Android app does not include Meta's SDK.
  • Android advertising ID. You can reset or delete it in Android Settings → Privacy → Ads.

6. Service providers and other recipients

We share data only with these providers, who process it for the purposes above:

We may also disclose data if the law requires it.

7. International transfers

Some providers process data outside the EEA, mainly in the United States. Google, Meta and Cloudflare are certified under the EU–US Data Privacy Framework. RevenueCat transfers data under the European Commission's Standard Contractual Clauses in its data processing agreement.

8. How long we keep data

  • Multiplayer: the live match, including display names, is removed 5 minutes after every player has left, and at the latest 6 hours after the game ends. A match summary with display names is kept for 90 days after that, and match events for 30 days, to run and troubleshoot the service.
  • Hint wallet: kept until you delete the hint account. After deletion we keep minimal, pseudonymous purchase transaction records for 180 days to prevent duplicate claims and handle refunds, then delete them.
  • Analytics: Google Analytics keeps event-level data for 2 months and user-level data for 14 months from your last activity.
  • Request logs: Cloudflare keeps our servers' request logs, which can include your IP address, for at most 7 days. We use IP addresses for short-lived rate limiting and do not store them with your game data.
  • Emails: until your request and any follow-up are resolved.

9. Data deletion

If you signed in to the hint account, you can delete it and its data in the app: Settings → Hint account → Delete hint account and data. Uninstalling Mattis does not automatically remove server-held hint wallet records. To ask us to delete other data, including a wallet you never signed in to, see the account and data deletion page. An email is a request, not confirmation that data has been removed. Never email a wallet recovery code or other account secret.

10. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time without affecting earlier processing. To use these rights, email stianstrange@gmail.com. We answer within one month. Most data we hold is pseudonymous, so we may ask for details that let us find it, such as your display name, a table code or the date of a purchase.

You can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the authority where you live or work.

11. Children

Mattis is a card game for a general audience. It is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has given us personal data, contact us and we will delete it.

12. Security

Data is sent over encrypted connections (HTTPS). Sign-in tokens from Apple and Google are verified on our server and not stored. Wallet and player identifiers are random and pseudonymous, secrets are removed from our server logs, and access to our servers is limited to us.

13. Our website, playmattis.app

The website uses Google Analytics. Until you accept cookies in the banner, Google's consent mode sets no analytics or advertising cookies; Google may still receive basic, cookieless signals such as the page visited. With your consent, it measures visits and which App Store and Google Play links are clicked. The website and the apps share one Google Analytics property, with the retention described in section 8. The site also uses Cloudflare Web Analytics, which does not use cookies or track you across sites. Your cookie choice is saved in your browser's local storage; clear the site data for playmattis.app to choose again.

14. Changes to this policy

We update this page when the apps or the website change how they use personal data, and change the date at the top.

15. Contact

Questions about this policy or your data: stianstrange@gmail.com.