Privacy by design.

Private multiplayer data

When you create, join, play, or resume a private multiplayer table, the app sends the display name you choose, an invite code, random participant, table, and command identifiers, connection status, table settings, game actions, receipts, and game state to the Pegs & Jokers Rally multiplayer service.

Other people at the private table can see your chosen display name and the shared game state. A display name is user-provided, so do not use a name that reveals information you do not want the other table participants to see.

The current public app has no free-text chat and does not send chat messages. Legacy chat fields returned by an older service response are ignored by the app.

How the service uses data

Private multiplayer communicates by HTTPS with a service hosted on Netlify and backed by PostgreSQL. The data is used to operate tables, reconnect participants, synchronize gameplay, enforce service limits, prevent abuse, and return fixed service error codes.

The app does not include advertising, analytics, cross-app tracking, account registration, or in-app purchases, and the developer does not sell this data.

Reconnect credentials and network information

A random reconnect token is stored in the device Keychain and transmitted only over HTTPS. The service stores a SHA-256 verifier rather than the raw token.

The hosting platform processes network information such as an IP address. Application code stores a stable SHA-256 hash of the client IP address, not the raw address, for private-table creation quotas and abuse prevention. This pseudonymous bucket is stored with a created table and in a creation-event record with a timestamp; shared networks can share the same bucket. It is not used for advertising or tracking.

The service does not intentionally log request bodies, reconnect credentials, hands, decks, or table snapshots. Platform-level network and operational logs are controlled by Netlify.

Retention

Lobby tables expire after 24 hours of authenticated inactivity, active games after seven days of authenticated inactivity, and finished or closed games after 24 hours. Closing a table does not delete it immediately.

Expired tables are inaccessible and are removed in bounded cleanup triggered by later table creation. Creation-event records older than 24 hours are removed through the same bounded cleanup process. Older chat data created by a previous client follows the table's normal expiry and cleanup lifecycle. Hosting-platform backups can have separate retention.

Solo play and data on your device

Solo game state stays on the device. Under Advanced, Game Lab can run four-computer Watch games and can optionally record supported local Individual, Team, and Watch games. Recording is off by default.

The app stores at most ten completed recordings on the device and displays the number of occupied slots. When storage is full, gameplay continues without starting another recording. You can explicitly export a completed recording using the system file/share interface or delete all saved recordings from Game Lab. Nothing is uploaded automatically.

A recording contains the deterministic game state needed for replay, including player seats, card hands, deck order, moves, outcomes, and computer-decision diagnostics when applicable. Exports do not include reconnect tokens, invite codes, multiplayer table identifiers, device identifiers, contacts, or account secrets.

The app does not request access to the camera, microphone, photos, contacts, location, Bluetooth, health data, or other privacy-sensitive device services.

Support email

If you contact support by email, you voluntarily provide the information in your message, such as your email address and any issue details you include. That information is used to respond to your support request. The app itself does not collect or transmit that email.

Your choices

You can play solo without using the multiplayer service. There is no account profile or self-service data-deletion control. Private tables expire under the schedule above. Requests may be limited by what can be verified without an account system, and expired data may already be inaccessible or removed.