Privacy Policy

1. Introduction

Welcome to BridgeDummy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our bridge training platform. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

The data controller is Nir Khutorsky, sole proprietor, trading as BridgeDummy (Israel). You can reach us at [email protected]. A postal address is available on request.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last updated" date of this Privacy Policy.

2. Information We Collect

Personal Information

When you create an account through Google Sign-In, we collect:

• Your Google account email address
• Your display name (if provided)

You are not legally required to provide this information, but we cannot create an account without it.

Usage Information

We automatically collect information about your use of our platform:

• Puzzle solving history and performance statistics
• Progress tracking data and achievements
• Diamond balance and transaction history
• Session duration and interaction patterns
• Device information and browser type

3. How We Use Your Information

We use the information we collect to:

• Create and maintain your user account
• Provide personalized bridge training experiences
• Track your learning progress and performance
• Generate appropriate difficulty levels for puzzles
• Maintain leaderboards and competitive features
• Send important account and service notifications
• Improve our platform and develop new features
• Provide customer support and respond to inquiries

Legal bases for processing

If you are in the EEA, the United Kingdom or Switzerland, we process your data on the following legal bases:

• Performance of a contract: creating and running your account, puzzles, progress, diamonds, subscriptions and purchases, friend challenges and board chat.
• Consent: analytics cookies (Google Analytics, Microsoft Clarity and PostHog on the website) and advertising cookies. You can withdraw consent at any time in Cookie Settings.
• Legitimate interests: error and crash monitoring (Sentry), security, abuse and fraud prevention, and rate limiting. Our interest is keeping the service working and safe, and we limit the data to what these purposes need.
• Legal obligation: keeping purchase and tax records and answering lawful requests from authorities.

4. Third-Party Services

BridgeDummy uses the following third-party services:

5. Data Storage and Security

We implement appropriate security measures to protect your personal information:

• Data is encrypted in transit using HTTPS
• Authentication is handled securely through Google Firebase
• Database access is restricted and monitored
• Regular security updates and monitoring

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

6. Your Privacy Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate personal information
• Request deletion of your personal information
• Object to processing of your personal information
• Request portability of your data
• Withdraw consent at any time
• Lodge a complaint with a data protection authority (your national authority in the EEA, the ICO in the UK, or the Privacy Protection Authority in Israel)

To exercise these rights, use our account deletion page or contact us at [email protected]

To receive a copy of your data in a portable, machine-readable format, email us from your account email address. We answer access and portability requests within 30 days.

7. Data Retention

We retain your personal information for as long as necessary to:

• Provide you with our services
• Comply with legal obligations
• Resolve disputes and enforce agreements

Typical retention periods:

• Account, profile, puzzle answers, progress and board chat messages: until you delete your account. Deletion starts after a 7-day grace period in which you can cancel it, and completes within 30 days.
• Rating (ELO) change history: 7 days
• Puzzle session security tokens: 48 hours
• Simulation job records: 24 hours
• Push notification device tokens: removed when you sign out or after 270 days without use
• Purchase, refund and subscription records: as long as tax and accounting law requires, also after account deletion
• Analytics and error data held by Google Analytics, Microsoft Clarity, PostHog and Sentry: according to each provider's retention settings (Google Analytics up to 14 months, Sentry 90 days)

When you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal purposes. You can start that process from the Delete Account page.

8. Cookies and Tracking

We use cookies and similar tracking technologies for two purposes:

Essential Cookies

These cookies are required for the platform to function and cannot be disabled:

• Maintaining your login session (Firebase Authentication)
• Remembering your cookie consent preferences

Analytics Cookies (Opt-in)

These cookies are only set after you provide consent through our cookie banner:

• Google Analytics cookies (_ga, _gid) for traffic and usage analysis
• Microsoft Clarity cookies for session recordings and heatmaps

Advertising Cookies (Opt-in)

If you are a free-tier user and have granted advertising consent, we may display ads via Google AdSense. These cookies help deliver personalized advertisements and measure ad performance:

• Google AdSense cookies (__gads, __gpi) for ad delivery and frequency capping
• Google conversion cookies (_gcl_*) for measuring ad effectiveness

Paid subscribers (Basic, Pro, Premium) never see ads regardless of this setting. You can opt out of personalized ads at any time through the cookie preferences modal or by upgrading your plan.

Do Not Track and Global Privacy Control

We honor the Global Privacy Control (GPC) signal: when your browser sends it, analytics and advertising cookies stay off unless you turn them on yourself in Cookie Settings. We do not respond to the older Do Not Track (DNT) browser signal, because there is no accepted standard for it.

You can change your cookie preferences at any time by clicking "Cookie settings" in the website footer or "Manage Cookie Settings" at the bottom of this page, or through your browser settings. Disabling essential cookies may affect the functionality of our platform.

9. Children's Privacy

Our platform is not intended for children under 13, or under 16 where local law sets a higher age of digital consent (for example, most EEA countries). We do not knowingly collect personal information from children below these ages. If you are a parent or guardian and believe your child has provided us with personal information, contact us and we will delete it.

10. International Users and Data Transfers

BridgeDummy is operated from Israel. Our servers and service providers are located mainly in the United States (Google Cloud and Firebase in us-central1, Cloudflare, Sentry) and in the European Union (PostHog, Frankfurt). Israel is recognized by the European Commission as providing adequate data protection. When your data is transferred from the EEA, the United Kingdom or Switzerland to the United States, we rely on the EU-US Data Privacy Framework (with its UK and Swiss extensions) where the provider is certified, and otherwise on Standard Contractual Clauses included in each provider's data processing terms. You can ask us for details of these safeguards at any time.

11. Contact Information