Privacy Policy

Last updated: June 27, 2026

This page explains what information we collect when you use the Pikaro website or the Pikaro app, what we do with it, and the choices and rights you have.

1. Who we are

Pikaro is operated by Pikaro LLC, a limited liability company organized under the laws of the State of Minnesota, United States. You can reach us any time at info@pikaro.app.

For the purposes of the EU General Data Protection Regulation (GDPR), the data controller is Pikaro LLC, contactable at info@pikaro.app.

2. Scope

This policy covers:

• The Pikaro website at pikaro.app
• The Pikaro mobile and web apps for Doppelkopf (and, in the future, Skat)

If we link out to a third-party service (such as the Apple App Store or Google Play), that service's own privacy policy applies once you leave Pikaro.

3. Information we collect

Information you provide

• Account information (when you sign in): email address and password.
• Profile information (optional): display name, avatar / profile photo, language preference, gameplay settings.
• Friend connections: friend codes and the friend relationships you create. Friend codes connect players on a mutual opt-in basis.
• Contact form submissions: when you message us through the contact form on our website, the name, email address, and message content you provide.

Information generated through play

• Game state: cards played, tricks won, announcements made, scores. In multiplayer mode this state is synced in real time so the other players at your table can see it.
• Match results and statistics: aggregate stats per round and per session.

Technical information

• Device and connection data required to deliver real-time multiplayer (transient connection identifiers, presence state).
• IP address: processed transiently to secure the service and prevent abuse (for example, rate limiting and bot protection). We do not store it for tracking or build profiles from it.
• Local browser / device storage: small entries stored on your device — your language choice on the website (pikaro-locale), and your language and game settings within the app (doko-locale, doko-game-state). These entries stay on your device so the website and app can remember your preferences; they are not used for tracking. The website does not use analytics, advertising, or third-party tracking cookies.

We do not knowingly collect any other categories of personal data, and we do not collect "special categories" of data (health, biometrics, religious or political views, etc.).

4. How we use your information

We use the information described above only to:

• Run the game (deal cards, score tricks, sync multiplayer)
• Maintain your account and profile
• Let you find and play with your friends
• Track your own statistics and history
• Keep the service secure and prevent abuse (for example, rate limiting and bot protection)
• Respond to you when you contact us by email or through the contact form on our website

We do not sell your data. We do not share it for advertising. We do not build profiles for marketing purposes. Within the game itself, your display name and avatar are visible to other players in multiplayer games and to people you connect with as friends.

5. Legal basis (for users in the EU/EEA/UK)

Under the GDPR our processing rests on:

• Performance of a contract (Art. 6(1)(b)) — for everything required to provide the game and your account.
• Legitimate interests (Art. 6(1)(f)) — for keeping the service secure, debugging, and preventing abuse.
• Consent (Art. 6(1)(a)) — only where we explicitly ask for it (for example, before processing additional optional data we add later).

You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Service providers we use

We use the following third-party services to operate Pikaro. They process some of the data described above on our behalf:

• Google Firebase (Firebase Authentication) — operated by Google LLC. Used only to create and sign in to your account (your email address and password).
• Fly.io — operated by Fly.io, Inc. Runs our game server in Frankfurt, Germany, where your profile (display name, settings), statistics, friend connections, and live game state are stored.
• Ably — operated by Ably Real-time Ltd (United Kingdom). Provides the real-time channel that delivers live game data (cards played, actions, presence, and your own hand) between the players at your table during multiplayer games. Ably routes this traffic through global edge infrastructure.
• Cloudflare — operated by Cloudflare, Inc. Delivers the Pikaro app, stores profile photos and encrypted backups of our database (Cloudflare R2), and provides bot protection via Cloudflare Turnstile, which receives your IP address to tell human visitors apart from automated traffic.
• Hostinger — operated by Hostinger International Ltd. (EU). Hosts the Pikaro marketing website, processes contact-form submissions, and provides the email service for info@pikaro.app, where contact messages are delivered and stored.
• Apple App Store and Google Play — used to distribute the apps. App-store-side data (downloads, ratings, payment if introduced later) is governed by Apple's and Google's own policies.

We have data-processing agreements with these providers where required and select them in part because they offer GDPR-compliant data-handling commitments.

7. International data transfers

Although Pikaro is operated by Pikaro LLC in the United States, your main game data is hosted in the European Union: your profile, statistics, friend connections, and game state are stored on a game server located in Frankfurt, Germany (EU).

Some data is processed outside the EU/EEA: account authentication is handled by Google Firebase, which may process your email address in the United States; real-time multiplayer data is delivered through Ably's global edge network, which may process it outside the EU/EEA; and profile photos and encrypted database backups are stored on Cloudflare's infrastructure, which may process data in multiple regions. For any such transfers outside the EU/EEA or UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) and the EU–U.S. Data Privacy Framework (where applicable to a given provider) as legal mechanisms.

8. How long we keep your data

• Account data: as long as your account exists.
• Profile and friend data: as long as your account exists.
• Game state: live state during a session is deleted shortly after the session ends; aggregate per-round results are retained as part of your stats history.
• Local browser storage (pikaro-locale): until you clear your browser storage.

If you delete your account (through the in-app settings), we delete the associated personal data within a reasonable period, except where retention is required by law.

9. Your rights

Wherever you are, you can ask us to:

• Tell you what data we hold about you (right of access)
• Correct inaccurate or incomplete data (right of rectification)
• Delete your data (right of erasure / "right to be forgotten")
• Restrict or object to processing
• Receive a copy of your data in a portable format (data portability)
• Withdraw any consent you've given

To exercise any of these rights, email us at info@pikaro.app. We will respond within 30 days.

If you are in the EU/EEA or UK and believe we have not handled your data properly, you also have the right to lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en.

10. Children

Pikaro is not directed at children under 13 (or under 16 in some EU/EEA jurisdictions where required). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at info@pikaro.app and we will delete it.

11. Security

We rely on industry-standard security measures provided by our hosting providers (encrypted transport, hashed passwords, access controls). No system is perfectly secure, and we cannot guarantee absolute protection of your data.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. If a change is material, we will surface it inside the app or on the website before it takes effect.

13. Contact

For any privacy-related question or request, write to: info@pikaro.app