Privacy Policy

Last updated: 6 October 2026

Balls Bean is a card game, not a data business. We keep what we need to run your bean and nothing more. Here’s exactly what that is.

Who we are

Balls Bean is run by René Jongsma in the Netherlands, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Questions, requests or complaints: info@ballsbean.com.

What we collect

When you first open the game

• A guest account, created automatically so your progress can be saved: a random id and a session cookie that keeps you signed in. No name or email is needed.

If you create an account

• With email: your email address and a hashed password (we never store the password itself).
• With Google or Apple: your Google or Apple account id, and the name and email address they share with us. Apple may give us a private relay address instead of your real email.

While you play

• Profile: username (accounts only; permanent once chosen), display name, tag line, bean look, friend code and badges. Other players can find you by your username or friend code and see your display name, bean look and level.
• Game progress: XP, level, prestige, the XP awarded each round, and records of your solo matches (seats and scores).
• Friends: your friends list and friend requests you send or receive.
• Settings: sound and game options, and your table choice.
• Sessions: each sign-in session records your IP address and browser user agent, for security and to keep you signed in.
• Rate-limit counters keyed by your account id, so nobody can hammer the servers or guess passwords.
• Emails we send you: transactional messages only, such as verifying your address and resetting your password.

On your device

• Local storage holds a cached copy of your game and your options, so the game loads fast and works offline.
• A service worker cache stores the game’s files so you can play offline.

That’s it. No ads, no analytics, no tracking cookies, and we never sell your data.

Why we use it (legal bases)

• Contract: to provide the game and your account, save your progress, and run features like friends.
• Legitimate interests: to keep the game secure, prevent abuse and cheating, and rate-limit requests.
• Consent: where the law requires it, for example when you choose to sign in with Google or Apple.

Who helps us run it

We use a few service providers (processors) who handle data only on our behalf:

• Vercel hosts the website and game servers (USA).
• Neon runs our Postgres database, on AWS in Frankfurt (Germany).
• Upstash stores the rate-limit counters, on AWS in Frankfurt (Germany).
• Resend delivers our emails.
• Google and Apple, only if you choose to sign in with them.

Some of these providers store data in the USA. Those transfers are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

How long we keep it

• Account data is kept for as long as your account exists.
• Guest accounts that are never used may be deleted after a period of inactivity.
• Sign-in sessions expire on their own.
• Email delivery logs are kept according to Resend’s retention.

Deleting your account

In the game, open Options → Delete my account and confirm. This works on the web and in the app, and deletes your account straight away: your sign-in, username, bean, level, crew, settings and the phones registered for notifications. If you signed in with Apple, we also revoke our access at Apple. Your seats in past games stay in the other players’ history as “A departed bean”, with nothing linking them to you.

Can’t get into the game? Email info@ballsbean.com from the address on your account and ask us to delete it. We’ll delete your account and its data within 30 days. Clearing your browser’s site data removes what is stored on your device.

Your rights

Under the GDPR you can ask to access your data, correct it, have it erased, restrict how we use it, get a portable copy, and object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time. Email info@ballsbean.com and we’ll respond within one month.

You also have the right to complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Age

You must be 16 or older to play Balls Bean, or have permission from a parent or guardian. If you think a child under 16 has given us data without that permission, email info@ballsbean.com and we’ll delete it.

Changes

If this policy changes, we’ll post the new version here and update the date at the top. See also our Terms of Service.