Hearts Unleashed privacy policy
Last updated 25 September 2026.
Playing Hearts Unleashed on your own collects nothing at all and shows no adverts. The daily competition is optional. If you enter it we collect four things, listed below, and it shows a small number of adverts served by Google.
- 1. Who we are
- 2. Ordinary play collects nothing
- 3. The daily competition
- 4. Advertising in the daily competition
- 5. Why we are allowed to hold it
- 6. Information stored on your device
- 7. What is published, and what is shared
- 8. How long we keep information
- 9. The app stores
- 10. This website
- 11. Children's privacy
- 12. Your rights
- 13. Changes to this policy
- 14. Contact us
1. Who we are
This policy applies to the mobile app Hearts Unleashed and to this website. Both are published by Blackfire, which is the data controller for the purposes of UK and EU data protection law. You can contact us at [email protected].
2. Ordinary play collects nothing
If you play Hearts on your own, against the computer opponents, we collect nothing. No account, no sign in, no name, no email address, no location, no device identifiers, no advertising identifier. Ordinary play shows no adverts, and the app asks for no device permissions and contains no analytics or tracking of any kind.
Ordinary play does not use the network at all. Your games, your settings and your statistics stay on your device. Nothing about them reaches us.
This is the whole of the app for anyone who does not enter the daily competition, and you do not have to enter it. The daily is where the network, the adverts and everything in the rest of this policy live.
3. The daily competition
The daily competition is a shared game. Everyone gets the same cards on the same day, and scores are ranked against each other on a public table. Entering it means sending us something, and this is all of it.
| What | Why |
|---|---|
| A random identifier | To recognise your second submission for the same day and refuse it, so nobody can enter twice. |
| A display name | To put a name beside your score on the table. You choose it, and it is published. |
| The moves of your finished game | To check the score is real. See below: this is the reason the competition can be trusted at all. |
| The day and competition you are entering | To put the result on the right table. |
Nothing else. No email address, no password, no account, no third-party sign in, no contacts, no location, no device identifiers beyond the one described below, no advertising identifier, no analytics, no telemetry, no third-party crash reporting, no cookies, and nothing at all about the games you play on your own.
The identifier
A random value your device generates the first time you open the daily competition, and never before. It is not derived from your device, your Apple or Google account, your advertising identifier, or anything else. It cannot be connected to you outside this app, because it is not connected to anything inside it either.
We still treat it as personal data. It stays the same across your submissions, which is what makes the competition work and is also what makes it personal data under UK and EU law. Calling it anonymous would be wrong.
You can erase it from the app whenever you like. That is described under your rights below.
Why we need the moves
A game played on your own device could report any score it liked, and a leaderboard that took scores on trust would be worth nothing. So your app sends the cards played, and our server plays the game again to check the score is one that game actually produced.
This is the largest thing we receive and the shortest thing we keep. It is deleted after 30 days.
4. Advertising in the daily competition
The daily competition shows adverts. Ordinary play does not, and will not. The reason for the difference is money: playing on your own runs entirely on your phone and costs us nothing to keep running, while the daily runs on a server that costs money every day it is up.
Where they appear. One when you enter a daily competition, and one after every other hand while you play it, up to four. That is five for a competition, and there are two a day, so at most ten if you play both and none at all if you play neither. Nowhere else in the game. The app enforces those limits, Google enforces its own on top, and Settings states them.
Who serves them. Google, through AdMob. Google is a separate data controller for what it collects in order to deliver an advert, not a processor acting on our instructions, so what it does with it is governed by Google's own policies.
What Google collects. Google publishes this itself, and what follows is its list rather than our summary of it: your IP address, which gives a rough idea of what country or region you are in; device and advertising identifiers; a record of which adverts you were shown and whether you interacted with them; diagnostic information such as crashes and how long the app took to start; and signals about app launches and views. It is collected for advertising and for Google's own measurement of how its advertising performs. The current list is on Google's disclosure page.
What we do not send Google. Your display name, your identifier for the competition, your scores, your move lists, and anything about how you played. The advert and the competition do not meet: the server that runs the competition has nothing to do with Google, and Google is told nothing about your results.
We ask Google for adverts that are not personalised. That means an advert is chosen by what this app is rather than by a profile built from what you do elsewhere. Where the law requires your consent before adverts can be served, you are asked before the first one appears, and Settings has a way to change your answer afterwards.
We are not paid for anything else about you. Nothing in this app is sold, and your competition results are not shared with Google or with anybody else.
5. Why we are allowed to hold it
Our lawful basis is that the processing is necessary to provide a service you asked for. You chose to enter a competition, and a competition cannot be run without recording who scored what.
We have deliberately not relied on consent for that, because consent implies you could refuse the processing and still have the thing, and here you could not. What you can do is not enter, and ordinary play is unaffected either way.
Advertising is different, and there consent is the basis. You can refuse it and still play the competition. Where the law requires your consent before adverts can be served, you will be asked before the first one appears, and Settings has a way to change your answer afterwards.
6. Information stored on your device
The app saves your settings, the game you are playing and your own statistics. This stays on your device, is read only by the app, and is not sent anywhere.
If you enter the daily competition, the app also stores a private key in your device's keychain and a record of your own attempts. The private key never leaves your device. It is used to sign your submissions so that nobody else can submit in your name.
Your own record of past attempts is kept in detail for 90 days and as running totals after that, along with the run of consecutive days you have entered. Deleting the app deletes all of it.
When you look at a day's table, the app keeps a copy of it on your device rather than asking for it again. A table is final once its day is over and cannot change afterwards, so the copy stays correct. It holds the display names and scores already published on that table, which are the same ones anybody reading it can see. It is deleted when you erase your daily competition data or delete the app.
7. What is published, and what is shared
Published: if you enter the daily competition, the display name you choose and the score you achieve appear on a public table that any other player can see. That is the point of a competition, and the app tells you so before you enter.
Not sold: we do not sell anything about you, and nothing you do in this app is passed to a data broker. There are no analytics companies involved, and no tracking across other apps or websites.
Shared, and with whom. Two parties, and only these two:
- Cloudflare hosts the competition server and processes what it holds on our instructions, in order to run it. It is a processor, not a controller.
- Google collects the information described in section 4 in order to serve adverts in the daily competition, and is a controller in its own right for it rather than a processor acting for us. It does not receive your display name, your competition identifier, your scores, or anything about how you played.
If you think a display name on the table should not be there, you can report it and we will remove it. Removing a name does not remove the score it was attached to.
8. How long we keep information
| What | How long |
|---|---|
| The moves of a submitted game | 30 days. Long enough to check the result, to check it again if it is disputed, and to look into a suspected forgery. Then deleted. |
| Results: your identifier, display name, the day, the competition, your score and where you placed | For as long as that season's table is published. After that they are deleted, or reduced to anonymous totals that cannot be connected to anyone. |
| If you ask us to erase you | Your identifier and display name go immediately, and your scores go with them. |
The data the app saves on your own device stays there for as long as the app is installed. Deleting the app deletes it.
If your device is backed up to iCloud or to Google, that backup is made by your operating system and is covered by Apple's or Google's terms rather than ours. We have no access to it.
9. The app stores
Apple and Google give us anonymous, aggregated figures for sales, downloads and crashes. We cannot connect these to any individual. This is collected by them, not by us, and is covered by Apple's privacy policy and Google's privacy policy.
10. This website
This website sets no cookies, runs no analytics, and loads no fonts, scripts or anything else from a third party. It is hosted by Cloudflare, which keeps request logs for security and reliability in the same way as any web host.
11. Children's privacy
The app is suitable for all ages, and playing on your own collects nothing from anyone of any age.
The daily competition is different in one way that parents should know about: the display name you choose is published where other players can see it. Choose something that is not your full name, and the app says so before you enter. We do not ask for anything else, and there is no chat, no messaging and no way for players to contact each other.
If you believe a child has entered a name that should not be published, tell us and we will remove it.
12. Your rights
Data protection law in your country may give you the right to ask for a copy of the personal data held about you, to have it corrected or erased, to have it sent to another provider, and to object to how it is used. In the UK and the EU those rights are set out in the UK GDPR and the EU GDPR, and similar rights exist in many other countries.
If you have never entered the daily competition, we hold nothing about you, and there is nothing for us to give you, correct or erase. If you would like that confirmed in writing, ask us and we will confirm it.
If you have entered, here is how each right works.
- Erasure
- There is a button in the app that erases your identity. It deletes the key on your device and tells our server to delete your identifier, your display name and your scores. This is deletion rather than a reset: your past results disappear from the tables, and they cannot be brought back. You can start again afterwards with a new identity, which will have no connection to the old one. You can also email us and we will do it.
- Access and portability
- Email us with your identifier, which the app can show you, and we will send you everything we hold against it in a machine-readable file.
- Rectification
- You can change your display name in the app at any time. Changing it does not change a name already shown on a past day's table. If you need one of those changed or removed, ask us.
- Objection
- If you object to the processing, the remedy is erasure, because the processing is what the competition is. Ordinary play is not affected.
You can also complain to a data protection regulator. Blackfire is based in the United Kingdom, so ours is the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113. If you live elsewhere, you can complain to the data protection authority for your own country instead.
13. Changes to this policy
If the app or this website starts doing something that this policy does not describe, we will update this page before that version is released, and change the date at the top.
14. Contact us
Blackfire, [email protected]. There is more on the support page.