Privacy policy

Last updated: 12 October 2026

YallaTawla ("we", "us") is an online game of Lebanese tawla, at yallatawla.app and in the YallaTawla apps for iPhone and Android, run by Omar Alameddine, in Spain. For anything about your data, write to [email protected].

We collect as little as we can to run the game. We don't sell your data, and we don't use it to follow you around the internet.

What we store

When you play, with or without an account:

• The name you play under and the character you pick. Other players see them.
• Your games: who played, the moves' outcome, the dice (so any game can be checked for fairness), the result and when it was played.
• Your progress: rating, wins and losses, XP and level, story progress, stars, daily goals, streaks, the days you opened the app this week, the fortune cups you turned, and the items you won or chose.
• Your connection: a random code that keeps you signed in on this device (we keep only a scrambled version of it), your language, the kind of browser, and a scrambled, salted version of your IP address. We use the IP version only to stop abuse, such as someone creating thousands of players, and erase it after a day. We don't store your IP address itself.
• Your country. It's worked out once from your connection, using DB-IP's free country list on our own server (your address isn't sent anywhere to look it up), and never more precisely than the country. Other players see it only if you choose to show it.

How the game is used, so we can make it better (you can turn this off in Settings → Share usage data):

• What happens in the game: the screens you open, the tutorial step you reach, the story levels you start, win, lose or leave, how long a game or a visit lasts, what you share or invite friends with (not who to), the settings you change, and whether a notification was opened.
• How the game runs on your device: the kind of phone or computer and its system, browser, screen size, language and time zone, the app's version, how long the table takes to load, how smoothly it plays, and error messages when something breaks.
• How you found us: the website that sent you, if any (only its name, not the page), or an invite link or campaign tag in the address.

It's tied to your player (the same random ID as your progress), never to an advertising ID, and never sold or shared for advertising. We use it to see where the game is confusing, too hard, too slow or broken. With usage data off, the app sends none of it; the game itself, and what we must keep to run it (above), works the same.

If you turn notifications on in the YallaTawla app:

• The code Apple (on an iPhone) or Google (on Android) gives the app for your phone, which is what's needed to send you one. It names a device, not you. The website doesn't send notifications.
• Your time zone, your language and which kinds you want (your fortune cup, a streak about to break, a friend at your table, new challenges and events), so they come in your evening, in your words, and only the ones you chose. At most one a day, never at night, and only about the game.

When you sign in:

• With Google: your Google account's ID, email address and first name. The first name only becomes your player name if you hadn't chosen one; a name you chose is never changed. Not your photo.
• With Apple (in the iPhone app): Apple's ID for you, and the email address you let Apple share, which may be a private address Apple makes for you ("Hide My Email"). Apple gives your first name only the first time, and it only becomes your player name if you hadn't chosen one. Apple also gives the server a token for your sign-in, which we keep only so that, when you delete your account, we can tell Apple to remove YallaTawla from "Apps using Apple ID" in your settings.
• With an email code: your email address.

We use these only to sign you in and to reach you about your account. No newsletters unless you ask for one.

What we don't store:

• Chat. Messages are passed to your opponent and not kept, with one exception: if your opponent reports you, what you said in that game is kept with the report, along with the reason and any note they add, so we can look into it. Reports, and anyone you block, are deleted with your account. Nobody is told who reported or blocked them. You can also block a player without reporting them: their chat never reaches you again. Muting a player only hides their messages on your own device and is not sent to us. An automatic filter replaces offensive words in typed messages (so what is passed on, and kept with a report, may have asterisks in place of them) and checks names; it looks at the text as it goes past and keeps nothing.
• Precise location, contacts or photos.
• Anything else from your device beyond the few settings the app keeps in your browser: language, sound on or off, board view, the tutorial's progress and the code that keeps you signed in. In the apps, the same, and the games you finished while offline until the app can send them. These are strictly needed for the game to work, and they never leave your device except the sign-in code and those finished games. With usage data on, the app also keeps the events above on your device for a moment, until it can send them.

We don't use cookies, advertising trackers or third-party analytics. If you choose to sign in with Google, Google's own sign-in window uses its cookies, under Google's privacy policy; Apple's sign-in sheet in the iPhone app is Apple's, under Apple's privacy policy.

Why we use it (and the legal basis)

• To run the game you asked to play: matchmaking, games, ratings, story progress, rewards, leaderboards. This is performance of our agreement with you (the terms).
• To know where players are, by country: how many play from each country, so we know which languages, places and times to build for. This is our legitimate interest, counted in aggregate.
• To keep it fair and safe: limits against abuse, checking the dice, looking into reports of cheating or bad behaviour. This is our legitimate interest in a fair game.
• To send the notifications you turned on: your consent, which you can take back at any time in Settings, or in your phone's settings.
• To improve the game: the usage data above, to see where people stop in the tutorial, which levels are too hard, what is slow or broken on which phones, and whether people come back. This is our legitimate interest in a game that works and is worth playing; it's never used for advertising or to decide anything about you, and you can object at any time by turning it off in Settings.

Ads. In the future, the game may show ads on objects inside the game (like the phone on the table, or branded items in a scene). They will be chosen for the place and moment, not by profiling you. If that ever changes, we'll ask for your consent first.

Who else handles it

• Railway hosts the game and its database.
• Google, only if you sign in with Google.
• Apple, only if you sign in with Apple, to check the sign-in and to remove the link when you delete your account.
• Resend, only to send sign-in codes.
• Apple's or Google's notification service, whichever your phone uses, only to carry notifications you turned on in the app. They see the notification and the device it goes to.

Countries come from the IP to Country Lite list by DB-IP, under CC BY 4.0. It's a file on our server: no one at DB-IP sees anything about you.

Where these are outside the European Economic Area, the transfer is covered by the provider's standard contractual clauses or an adequacy decision.

How long we keep it

• Playing without an account: your progress is kept while you keep playing. If you haven't opened the game for 12 months, we delete your player: name, progress, rating history and the code that kept you signed in.
• With an account: kept until you delete it. You can delete it yourself at any time, in the app, under You → Account → Delete my account: your player, progress, rating history and sign-ins go at once, and if you signed in with Apple, we tell Apple to remove the link.
• The scrambled IP address: erased a day after you start playing.
• Usage data: 13 months, so one year can be compared with the one before, then deleted. It also goes with your player, whenever your player is deleted.
• Notifications: forgotten as soon as you turn them off, when Apple or Google says the code no longer works, or with your player.
• Apple's sign-in token: deleted with your account, after it is handed back to Apple.
• Finished games: kept for ratings and fairness checks, so your opponents' history stays whole. When your player is deleted, the games no longer show your name or anything that identifies you.

Your rights

You can ask to see, correct, download or delete your data, or object to how we use it, by writing to [email protected]. To stop usage data, you don't need to write: turn off Settings → Share usage data. We answer within a month. If you're unhappy with our answer, you can complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es) or the one where you live.

Children

YallaTawla is for people aged 14 and over. If you believe a younger child has signed up, tell us and we'll delete their data.

Changes

If this policy changes in a way that matters, we'll say so in the app before it takes effect.