Privacy policy

Last updated 25 September 2026

This policy explains what the Bluff & Barrel mobile game collects, why, and what you can do about it. It applies to the Android app published under the package name com.taabish.bluffandbarrel and to this website. You can open this page, and the terms of service, from the Settings panel inside the game.

1. Who we are

Bluff & Barrel is made and operated by Taabish Irfan, based in India, who is the data controller — and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 — for the information described here. For anything in this policy, write to taabishirfan99@gmail.com.

2. What the game collects

A game profile, created on first launch

The first time you open the game it creates a profile for you through Epic Online Services. The profile is identified by a randomly generated identifier, and on a device where you have not signed in it is unlocked by a credential stored on that device. It contains no name, no email address, and nothing that identifies you personally. It exists so the game can remember your nickname and your friends list between sessions, and so the ad-free purchase can be recorded against you.

Google account information, only if you choose to sign in

Signing in with Google is optional, and the game is fully playable without it. If you do sign in, Google gives the game a sign-in token containing your Google account identifier, your name, your email address, and a link to your profile picture. Section 3 explains exactly what happens to that information.

Your nickname

You choose a nickname. It is shown to other players at your table, in the friends list of anyone who adds you, and in lobby listings. Until you choose one, the game shows a generic guest name. Do not use your real name or anything else you would not want other players to see.

Your friends list

When you add another player as a friend, the game stores their profile identifier and their nickname, and stores yours in their copy. Friend requests, table invitations and their responses pass between devices through Epic Online Services.

Voice chat

Voice chat at a table is carried in real time by Epic Online Services. Your microphone is only active while you are at a table and have not muted yourself. We do not record, store, transcribe or listen to voice chat, and we have no way to retrieve it after it has been spoken. Other players at your table can hear you, and we cannot control what they do with what they hear.

Text chat

The waiting room has a text chat panel. Messages are relayed between the players at your table by Epic Online Services and shown alongside the nickname of whoever sent them. The chat log is held in memory for the length of the session only, keeps the most recent messages, and is discarded when the table closes or you leave the menu. It is never written to your phone, never uploaded to us, and we have no way to read it afterwards. As with voice, anyone at your table can see what you send and may keep a copy of it themselves.

Multiplayer session information

While you are playing online, the game exchanges the state of the table, lobby membership, private table codes and connection details with the other players and with Epic Online Services. This lasts for the length of the session and is not kept afterwards.

Muting, reports and restrictions

You can mute any other player at your table. Muting only changes what you hear on your own phone, is not sent to anyone, and is cleared when you leave the table.

You can also report a player from their row at the table. A report is sent to Epic Online Services and contains your profile identifier, the profile identifier of the player you reported, a report category and the time. It contains no written message and no voice or chat content, because none is ever recorded. We review reports ourselves.

If a player breaks the rules in section 5 of the terms of service, we can place a restriction on their profile through Epic, such as turning off their voice chat for a period. Epic holds the restriction record against that profile: what the restriction is, when it ends, and a reference number. The game checks for a restriction each time it connects, and a restricted player is told so in the game, with the reference number, and can contest it by email as the terms describe.

Advertising information

Unless you have bought the ad-free upgrade, the game shows ads: a panel on the waiting screen while a table fills, and a full-screen ad between matches. Serving them involves your device's advertising ID, your IP address and the approximate region inferred from it, and technical details about your device. Section 4 covers this in full, including how to limit it.

Purchase information

If you buy the ad-free upgrade, Google Play processes the payment, and a purchase management service records that the upgrade belongs to your profile so the game can restore it later. Section 5 covers what is involved and what we never see.

Settings stored on your device

Volume levels, graphics quality, a copy of your nickname, a note of whether you signed in with Google, and the Google display name shown to you in the Account panel are saved on your phone only. They are never uploaded and we never see them.

3. How we handle Google account data

This section describes our use of Google user data obtained through Sign in with Google, and it is the whole of that use.

What we receive. When you tap the sign-in button, Google asks you to choose an account and then returns a sign-in token to the game. That token carries your Google account identifier, your name, your email address, and a profile picture URL. The game requests no other permissions and has no access to your Gmail, contacts, calendar, files, photos or any other Google service.

What we do with it. The token is passed to Epic Online Services, which uses it to attach your Google account to your game profile. If your Google account has not been used with the game before, it is linked to the profile you already have on this device — your identifier, nickname and friends list stay exactly as they were. If your Google account is already linked to a profile, for example because you played on another phone, the game offers to switch this device to that profile so your nickname, friends and ad-free upgrade come with you. That is the only purpose: making your profile survive a reinstall or a new phone.

What we store. We store the profile identifier that Epic returns. Your email address and your profile picture URL are used during sign-in only and are not written to our cloud storage or shown to other players. Your name is kept on your phone so the Account panel can show you which account you signed in with; it is not uploaded and other players never see it. Your nickname, which you choose yourself, is what other players see.

What we never do. We do not sell Google user data. We do not use it for advertising, marketing, profiling or analytics, and it is never passed to the advertising service or to any advertising network. We do not transfer it to anyone other than Epic Online Services for the sign-in purpose described above. The purchase management service in section 5 receives only your profile identifier, never your Google details. We do not use it to build a profile of you or to contact you.

Signing out. The Account panel has a Sign Out button. Signing out detaches this device from your Google-linked profile and gives the device a fresh, empty profile. Nothing is deleted from the cloud: sign in with the same Google account again, on any device, and your profile returns.

Turning it off. You can revoke the game's access at any time from your Google Account permissions page at myaccount.google.com/permissions. Doing so stops future sign-ins. To delete the game data held against that account, see section 10.

4. Advertising

The free version of the game shows ads in two places: a panel on the waiting screen while a table fills, and a full-screen ad between matches, shown from the result screen when you return to the menu — never during a hand and never over the revolver. They are supplied through Yodo1 MAS, a mediation service operated by Yodo1 Ltd that chooses between several advertising networks each time an ad is shown.

Who actually serves the ad

Because Yodo1 MAS is a mediator, the company supplying any particular ad varies. The networks in the current version of the game include Google AdMob and Google Ad Manager, AppLovin, Unity Ads and Unity LevelPlay, Liftoff (Vungle), InMobi, Moloco, Digital Turbine (Fyber), Meta Audience Network, Mintegral, Pangle, BidMachine, Bigo Ads and TopOn. The set changes over time as Yodo1 adds and removes partners. Yodo1 also runs an ad-quality service, AppHarbr, which inspects ads before they are shown to block malicious or inappropriate creatives. Each network handles the information it collects under its own privacy policy, and we do not control that beyond what Yodo1 documents.

Yodo1's privacy policy is at policy.yodo1.com and they can be reached at privacy@yodo1.com. Google's is at policies.google.com/privacy.

What is collected to show you an ad

• Your device's advertising ID — a resettable identifier Android provides for advertising, which you can reset or delete from your device settings.
• Your IP address, and the approximate region inferred from it. The game does not request or use precise or GPS location.
• Device and app information — device model, operating system version, app version and language.
• Ad interaction data — whether an ad was requested, shown, viewed or tapped.

We do not receive any of this ourselves. We see only aggregate reporting from Yodo1, such as how many ads were shown and what they earned. We do not send your nickname, your friends list, your profile identifier or your Google sign-in details to Yodo1 or to any advertising network.

Personalised and non-personalised ads

Personalised ads are chosen using information about your interests. Non-personalised ads are chosen using only general context and your approximate region, and still involve limited data use for frequency capping, measurement and fraud prevention.

If you are in the European Economic Area, the United Kingdom or Switzerland, the game shows a consent form built on Google's User Messaging Platform before personalised ads are used. You can decline and still play the game in full, and you will be shown non-personalised ads instead. You can change your answer at any time from the privacy option in the game's Settings panel.

If you live in a US state with a privacy law that gives you the right to opt out of the sale or sharing of personal information for advertising, the same privacy option lets you turn that off for this game.

Age and regional settings

The game is for players aged 16 and over, and it tells the advertising service that its players are not children before any ad is requested. Players who decline personalised ads through the consent form are shown non-personalised ads, as described above.

Limiting ads without paying

• Open your Android settings and find Privacy → Ads. Reset your advertising ID to break the link with earlier ad data, or delete it to stop personalised advertising across every app on the device.
• Change your Google ad settings at myadcenter.google.com.
• Where the consent form applies to you, decline personalised ads, or reopen the form from the privacy option in the game's Settings panel.

Removing ads entirely

The one-time ad-free purchase stops the game requesting ads at all. Once it is active, the advertising service is not started and no advertising ID is passed to it by this game.

5. Purchases

The game offers a single one-time purchase that permanently removes ads. There is nothing else to buy, there is no in-game currency, and buying it does not change how the game plays or give any advantage over other players.

You must be signed in to buy it

The purchase is only offered after you have signed in with Google. This is deliberate: it means the game can check your purchase and restore it for you from the moment you pay for it, rather than leaving it tied to a device-only profile that could be lost with the phone.

Google Play handles the payment

Your card, UPI, wallet or other payment details go to Google and never pass through the game or reach us. We never see your payment method, your card number, or your billing address. The price shown at the moment of purchase, in your local currency and including any applicable tax, is what you pay.

RevenueCat records and restores the purchase

We use RevenueCat, a purchase management service operated by RevenueCat, Inc. in the United States, to confirm that a purchase is genuine and to remember that it belongs to you. When you buy the upgrade, the following is sent to RevenueCat:

• The purchase receipt issued by Google Play, which RevenueCat checks with Google to confirm the purchase is real.
• Your profile identifier, so the upgrade can be matched back to you when you reinstall the game or move to a new phone. This is the same anonymous identifier described in section 2, not your name or your email address.
• Device and app information — device model, operating system version, app version, country and the time of purchase.
• Your device's advertising ID, where the game supplies it, used by RevenueCat for fraud prevention and to match a purchase to its source. This is separate from advertising and can apply even after you have removed ads. You can reset or delete this identifier from your Android settings as described in section 4.

We do not send RevenueCat your name, your email address, your nickname, your friends list or anything you say in voice chat. RevenueCat's privacy policy is at revenuecat.com/privacy.

Where the upgrade applies

The purchase itself belongs to the Google Play account that paid for it — the account signed in to the Play Store on your phone, which is not necessarily the same Google account you sign in to the game with. Google Play keeps that purchase permanently.

Each time you sign in to the game, it asks Google Play whether that Play account owns the upgrade, and restores it if so. In practice this means the upgrade survives reinstalling the game, deleting your account, signing out and back in, and moving to a new phone signed in to the same Google Play account. If a different person signs in to the game on your phone, they will also see the game as ad-free, because the phone's Play account owns the purchase.

The upgrade is not transferable to another person and cannot be moved to a different Google Play account. If you change the Play account on your phone, or buy a phone from someone else, the upgrade does not come with you.

Refunds

Refunds are handled by Google Play under its own refund policy, and requests should go to Google in the first instance. Section 8 of the terms of service explains this further.

6. What the game does not collect

• No precise or GPS location
• No contacts, photos, files or messages
• No payment card details — Google Play handles payment entirely
• No recordings of voice chat, and no stored copy of text chat
• No behavioural analytics or tracking software of our own
• No health, financial or biometric information of any kind

7. Who else handles your information

Epic Games provides Epic Online Services, which handles profiles and sign-in, matchmaking, voice and text chat, player reports, restrictions and cloud storage. Your profile identifier, nickname and friends list, and any reports or restrictions involving your profile, are held on their infrastructure. Their privacy policy is at epicgames.com/site/en-US/privacypolicy.

Yodo1 Ltd operates the advertising mediation service, and the advertising networks it selects between handle information as described in section 4.

RevenueCat, Inc. confirms and records purchases as described in section 5.

Google handles Sign in with Google if you choose to use it, payment and distribution through Google Play, the consent form through the User Messaging Platform, and advertising when AdMob or Ad Manager is the network that serves an ad. Google's privacy policy is at policies.google.com/privacy.

We do not sell or rent your information, and we do not share it with any company other than those named above and in section 4. We would only disclose it if a court or law required us to.

8. Where it is kept, and for how long

Your nickname and friends list are stored in Epic Online Services cloud storage against your profile, and mirrored on your phone so the game works offline. Purchase records are held by RevenueCat and by Google Play. Advertising information is held by Yodo1 and the advertising networks.

Epic's and RevenueCat's servers are located outside India, and the advertising networks operate internationally, so your information is transferred and stored outside the country you play in. Each of these companies applies its own safeguards to those transfers, described in the privacy policies linked above.

We keep your profile data for as long as your profile exists. Delete it and it is gone, as described in section 10. Purchase records are kept for as long as the law requires them to be, since they are financial records. Session information is discarded when the session ends. Reports and restriction records are kept by Epic for as long as we need them to deal with the report or to enforce and review the restriction, and are removed if you delete your profile record as described in section 10. Voice is never stored at all.

9. Your choices and your rights

• Play without signing in. Sign-in is optional and everything except cross-device recovery and the ad-free purchase works without it.
• Change your nickname at any time from the Settings panel in the game.
• Remove a friend from the friends panel. This removes the link on both sides.
• Mute your microphone at any time at the table, or mute any other player so you no longer hear them.
• Report a player who breaks the rules, from their row at the table.
• Limit or remove advertising as described in section 4.
• Sign out to detach a device from your Google-linked profile, as described in section 3.
• Delete your account from inside the game, as described in section 10.
• Uninstall the game to remove everything stored on your phone.

Depending on where you live, you may also have the right to ask what we hold about you, to receive a copy of it, to have it corrected, to object to how we use it, to withdraw a consent you previously gave, or to nominate someone to exercise these rights on your behalf. These rights include those under India's Digital Personal Data Protection Act, 2023, and under the UK and EU General Data Protection Regulation for players in those regions. Write to the address in section 14 and we will respond within one month. If you are not satisfied with our response, you may complain to your local data protection authority, or in India to the Data Protection Board.

Information held by Yodo1, the advertising networks, RevenueCat and Google must be requested from them directly, using the contacts and privacy policies linked in sections 4, 5 and 7.

10. Deleting your account

There are two layers to your account, and you can delete both.

Your game data — from inside the game. Open the Account panel and tap Delete Account. Your nickname and friends list are erased from Epic Online Services cloud storage, any Google account is detached, and the device starts again with a fresh, empty profile. This cannot be undone. Deleting your data does not automatically refund a purchase, and Google Play and RevenueCat keep the minimum record of a purchase that the law requires. If you had bought the ad-free upgrade, it is not lost: the next time you sign in with Google on that device the game checks your Google Play account and restores it automatically, because the purchase belongs to the Google Play account that paid for it rather than to the profile you deleted.

The profile record itself — by request. After the step above, the empty profile identifier still exists in Epic's systems, with nothing personal attached to it. If you want that record removed as well, write to taabishirfan99@gmail.com with the subject "delete my account record". Send it from the email address of the Google account you signed in with; if you never signed in, tell us the nickname you used and roughly when you last played. We will ask Epic to remove the record, confirm to you once it is done, and we aim to complete it within thirty days.

If you switched a device to a Google-linked profile, the profile that device was using before the switch is no longer reachable from it. If you want that earlier profile erased too, say so in the same message.

11. Children

Bluff & Barrel is not intended for children. It depicts firearms in a fictional setting and includes open voice chat with strangers. You must be at least 16 years old to play, or older if the law where you live sets a higher age for agreeing to terms like these or for consenting to the use of your personal data.

We do not knowingly collect information from anyone under 16, and the game is not directed to children in the sense used by Google Play's Families policy. If you believe a child has been playing, write to taabishirfan99@gmail.com and we will delete the account.

12. Security

Profile data is held by Epic Online Services and travels over encrypted connections. No system is perfectly secure, and we cannot promise otherwise. Because sign-in is handled by Google and payment by Google Play, we never see or store your Google password or your payment details.

13. Changes to this policy

If we change what the game collects or what we do with it, we will update this page and change the date at the top. Substantial changes will be announced in the game before they take effect.

14. Contact and grievances

For any question about this policy, to exercise any of the rights in section 9, to request deletion under section 10, or to raise a complaint about how your information has been handled:

Taabish Irfan
taabishirfan99@gmail.com
India

The same contact serves as the point of contact for questions under India's Digital Personal Data Protection Act, 2023. We aim to answer every complaint within thirty days.