Privacy Policy
This Privacy Policy explains how Heart in a Cart (“Heart in a Cart,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use our mobile games and apps, including Prisoner’s Dilemma, and our website at heartinacart.com (together, the “Services”).
The short version. We collect only what the game needs to run: an account ID, your display name and game record, and, if you choose to sign in or buy something, the details Apple or Google share with us to make that work. Your display name and game record are visible to other players. Free players see ads, which are served by Google AdMob, and AdMob collects some device information. Ads are only personalized, and you are only tracked across other companies’ apps, if you say yes to Apple’s “Allow Tracking” prompt. Subscribers see no ads. We do not sell your data. You can delete your account and data at any time from the Profile tab in the app.
- Information we collect
- How we use information
- What other players can see
- How we share information
- Advertising and tracking
- How long we keep data
- Deleting your account and data
- Your privacy rights
- Children
- Security
- Where data is processed
- Changes to this policy
- Contact us
1. Information we collect
Information created when you start playing
- Account identifier. When you first open Prisoner’s Dilemma, we automatically create a guest account with a random user ID so you can play without signing up. This ID is not linked to your name or email unless you choose to sign in.
- Display name. We assign you a randomly generated player name. You can change it to a name of your choice (3–20 characters).
Information from optional sign-in
You can link your account to Sign in with Apple (iPhone and iPad) or Google Sign-In (Android) so you can keep your progress across devices. When you do, Apple or Google sends us an identity token, and may share your name and email address. With Sign in with Apple you can choose “Hide My Email,” in which case we receive a private relay address instead of your real email. We use this information only to sign you in and to contact you about your account if you ask us to.
Gameplay information
To run the game we record your daily moves (cooperate or betray), wagers, match results and opponents, coin balance and coin history, cooperation rate, reputation tier, play streak, and the dates you played. If you report another player’s display name, we record who made the report, which player was reported, and the reported name, so we can review it.
Purchase information
In-app purchases and subscriptions are processed by Apple through the App Store. We never receive your payment card or billing details. We use RevenueCat, a purchase-management service, to confirm what you bought. We receive the product purchased, the App Store transaction ID, the purchase date, whether a subscription is active and when it expires, and whether a purchase was refunded.
Information stored on your device
The app stores a sign-in session token and a few settings (such as whether you have already seen the introduction) in your device’s local storage so you stay signed in. This data stays on your device and is removed when you delete the app.
Technical and log information
When the app talks to our servers, our hosting and database providers automatically log basic technical information such as IP address, request time, and error details. We use these logs to keep the Services running, secure, and free of abuse.
Information collected for ads
If you don’t subscribe, the app shows ads (see section 5). The Google Mobile Ads SDK (Google AdMob) in the app collects information to show ads, measure them, and prevent ad fraud: device type and model, operating system version, IP address (which can indicate your approximate location), app and ad interactions such as which ads you saw or tapped, and diagnostic data. The device’s advertising identifier (IDFA) is collected only if you allow tracking in Apple’s App Tracking Transparency prompt. We also record how many ads you watched each day so we can apply ad limits and give you rewards for the ads you choose to watch.
When you contact us
If you email us, we receive your email address and whatever you include in your message, and we use it to respond to you.
What we do not collect
We do not collect your precise location, contacts, photos, microphone or camera data, health data, or browsing history. We do not collect your advertising identifier (IDFA) unless you allow tracking.
At a glance
| Data | Why we use it | Linked to you | Used to track you |
|---|---|---|---|
| User ID | Run your account and game | Yes | No |
| Name and email (only if you sign in) | Sign-in, account recovery, support | Yes | No |
| Display name and gameplay record | Gameplay, matching, leaderboards | Yes | No |
| Purchase history | Deliver coins and subscription perks | Yes | No |
| Technical logs | Reliability, security, fraud prevention | Yes | No |
| Device info, IP-based approximate location, ad interactions (collected by Google AdMob) | Showing and measuring ads, ad fraud prevention | Yes | Only if you allow tracking |
| Advertising identifier (IDFA) | Personalized ads and ad measurement | Yes | Only if you allow tracking |
2. How we use information
- To create and maintain your account and sign you in.
- To run the game: matching you with other players, resolving rounds, updating coins, reputation, and leaderboards.
- To deliver purchases and subscription benefits, handle refunds, and prevent purchase fraud.
- To keep the Services secure, prevent cheating and abuse, and enforce our Terms of Use.
- To show ads to free players, give coin rewards for ads you choose to watch, and limit how often ads appear.
- To fix bugs, balance the game economy, and improve the Services using aggregated gameplay statistics.
- To respond to your questions and support requests.
- To comply with legal obligations.
We do not use your information for personalized advertising unless you allow tracking, and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
3. What other players can see
Prisoner’s Dilemma is a social game, and your reputation is part of the game. The following is visible to other players:
- Your display name and subscriber badge (if any)
- Your cooperation and betrayal record, cooperation rate, and reputation tier
- Your coin vault and leaderboard ranking
- Your choice in rounds you play against another player, shown to that player after the round
Your email address, real name, sign-in provider, and purchase history are never shown to other players. Choose a display name that doesn’t reveal personal information you want to keep private.
4. How we share information
We do not sell your personal information. We share it for personalized (cross-context behavioral) advertising only if you allow tracking, and you can turn that off at any time (see section 5). We share information only in these cases:
- Service providers who process data on our behalf and under contract, only to provide their service to us:
- Supabase: account authentication and database hosting
- RevenueCat: in-app purchase and subscription management
- Our cloud hosting provider, which runs our game servers
- Google AdMob: serves and measures the ads shown to free players (see section 5)
- Apple and Google, when you use Sign in with Apple, Google Sign-In, or make an App Store purchase. Their handling of your data is governed by the Apple Privacy Policy and the Google Privacy Policy.
- Other players, limited to the game information described in section 3.
- Legal reasons, if required by law, subpoena, or court order, or to protect the rights, safety, or property of our players, the public, or Heart in a Cart.
- Business transfers, if Heart in a Cart is involved in a merger, acquisition, or sale of assets. We will notify you before your information becomes subject to a different privacy policy.
Every third party we share data with is required to protect it at a level consistent with this policy.
5. Advertising and tracking
Prisoner’s Dilemma is free to play and supported by ads. Here is how ads work in the app:
- One ad a day after you play. Free players see one full-screen ad a day, when they tap Done after a round’s reveal. New players don’t see this ad during their first 3 days.
- Optional rewarded ads. You can choose to watch an ad for bonus coins in the Store (up to 5 a day), or to boost a winning round’s payout on the reveal screen. Watching these ads is always optional.
- No ads for subscribers. Prisoner’s Dilemma+ subscribers don’t see ads.
Tracking and your choices
Ads in our app are served by Google AdMob, an advertising service provided by Google LLC. Before any tracking happens, the app asks your permission through Apple’s App Tracking Transparency prompt. If you tap Allow, Google may use your device’s advertising identifier to show ads based on your activity in other companies’ apps and websites, and to measure ad performance. If you tap Ask App Not to Track, the advertising identifier isn’t shared and you’ll see ads that aren’t based on tracking. Ads may still be chosen based on information like your device type or general region, and they may be less relevant to you.
You can change your choice at any time in your device’s Settings → Privacy & Security → Tracking. You can also manage the ads Google shows you at My Ad Center.
If you’re in the European Economic Area, the United Kingdom, or Switzerland, the app also shows a consent message from Google before ads load. It lets you choose whether your data can be used for personalized ads, and you can change that choice later.
Google handles the data it collects under the Google Privacy Policy. To learn more, see How Google uses information from sites or apps that use its services.
We do not use third-party analytics SDKs.
6. How long we keep data
- Account and gameplay data: for as long as your account exists. When you delete your account in the app, it is deleted or anonymized immediately (see section 7).
- Records of rounds against other players: after deletion, your side of past rounds is kept only in anonymized form, as “Deleted player,” so other players’ histories stay accurate without identifying you.
- Purchase records: kept for up to 7 years where needed for tax, accounting, refund, and fraud-prevention obligations, then deleted.
- Server logs: typically kept for no more than 90 days.
- Guest accounts that haven’t been used for 24 months may be deleted.
7. Deleting your account and data
Delete your account in the app
You can delete your account at any time, right from the app: open Prisoner’s Dilemma, go to the Profile tab, tap Delete account, and confirm. If your account is linked to Sign in with Apple, you’ll be asked to confirm with Apple so we can also revoke the app’s access to your Apple ID. Deletion happens immediately. Afterward, the app starts you fresh as a new guest player.
What happens when you delete your account
- Deleted right away: your sign-in account, including any name, email address, and Apple or Google identity linked to it; your coin balance and coin history; your play streak; any move still waiting to be matched; reports you made or that were made about you; and your customer record at RevenueCat.
- Anonymized: rounds you already played stay in your opponents’ histories so their records remain accurate, but your name is replaced with “Deleted player.” This anonymized record can’t be linked back to you, can’t be signed into, and doesn’t appear on leaderboards.
- Kept as financial records: App Store transaction IDs for past purchases, which contain no personal details, are kept for tax, accounting, and refund purposes (see section 6).
Deletion is permanent. Your coins, record, and progress can’t be restored.
Have a subscription? Deleting your account does not cancel a Prisoner’s Dilemma+ subscription, because Apple handles the billing. Cancel it first in your device’s Settings → [your name] → Subscriptions, or Apple will keep charging you.
Other ways to delete your data
If you can’t access the app, or you only played as a guest on a device you no longer have, email info@heartinacart.com with the subject “Delete my account.” Include your display name and, if you signed in, the email address on your Apple or Google account so we can find you. We’ll confirm the deletion within 30 days.
If you used Sign in with Apple, you can also stop using it with our app at any time in Settings → [your name] → Sign-In & Security → Sign in with Apple.
8. Your privacy rights
Depending on where you live (including California, other U.S. states, the European Economic Area, the United Kingdom, and similar jurisdictions), you may have the right to:
- Access the personal information we hold about you and get a copy of it
- Correct inaccurate information
- Delete your information
- Object to or restrict certain processing, or withdraw consent where we rely on it
- Receive your data in a portable format
- Opt out of the sale or sharing of personal information (we don’t sell or share it)
- Not be discriminated against for exercising these rights
To make a request, email info@heartinacart.com. We may need to verify that the account is yours before we act, and we will respond within 30 days (or sooner if your local law requires). If you are in the EEA or UK, you may also complain to your local data protection authority.
Where the GDPR applies, we process your information to perform our contract with you (running the game and delivering purchases), for our legitimate interests (security, fraud prevention, and improving the game), to comply with legal obligations, and with your consent where we ask for it.
9. Children
Our Services are not directed to children under 13 (or the higher minimum age where you live), and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email info@heartinacart.com and we will delete it.
10. Security
We protect your information with industry-standard safeguards, including encryption in transit (HTTPS/TLS), access controls on our database, and server-side verification of purchases. No system is perfectly secure, so we can’t guarantee absolute security, but we will notify you and the relevant authorities of a breach as required by law.
11. Where data is processed
Heart in a Cart is based in the United States, and our service providers may process data in the United States and other countries. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
12. Changes to this policy
We may update this policy as our Services change. We will post the new version on this page and update the “Last updated” date. If a change is significant, we will also notify you in the app before it takes effect.
13. Contact us
Questions about this policy or your data? Email info@heartinacart.com.
Heart in a Cart
Texas, United States