Flower War is a Korean flower card game. We collect what we need to run online games and rooms, plus a record of how people play so we can find bugs and improve the game. We keep it no longer than we need to. We never sell it or use it for ads.
- You can play as a guest with no email, no name and no sign-up.
- No ads, no advertising ID, no tracking across other apps or sites, no location, no contacts, no real-money purchases.
- By default the app sends us usage data: what you tap through and how your games go, never who you are. Turn it off in Settings › About › Share usage data.
- Raw usage data is deleted after about 90 days; full match records after 180 days.
- You can delete your account in the app, or ask us by email to delete your data.
01 Who we are and what this covers
This policy covers the Flower War app for iOS and Android (named FL.WR on your home screen), the game's online service, and the websites flowerwar.com and flwr.cards. “We” means the Flower War developer. Questions go to privacy@flowerwar.com.
02 What we collect
When your phone is online, the app quietly creates a guest account the first time it needs one: to check for notices and updates, to send usage data (if Share usage data is on), and when you play online, create or join a room, or sign in. Playing against the bots with no connection sends nothing at the time; usage data from that play waits on your phone and is sent later. We store the following.
| What | Details | Why |
|---|---|---|
| Guest account | A random account ID, and whether a test, beta or store build of the app created it. No email or name. | To seat you at tables, keep your games, coins and rooms yours, and tie your usage data together; the build tells our own test accounts apart from players. |
| Email (optional) | Only if you choose to sign in with email, to keep your progress across phones. We send a one-time code; there is no password. | To sign you in and let you recover your account. |
| Display name | The name you pick (up to 16 characters), shown to the players at your table and in your rooms. | So other players know who they are playing. |
| Game records | Online hands: the deal, every move, scores, who won, and coin balances. Coins are points only and have no money value. | To run the game fairly, settle hands, replay a hand, and fix bugs. |
| Coins and card sets | Your coin balance and its history, and the card sets and effects you have unlocked and chosen. They are earned in play; none of them can be bought with money. | To keep your progress and show your choices to the players at your table. |
| Rooms | Room names, the room code, who is a member, balances, the room ledger and daily-run results. | To keep a room's standings for its members. |
| Usage data and match records | Which screens you open, tutorial steps, your Go and Stop choices, how each hand and match ends, errors the app runs into, and a full record of each match. See section 03. | To find bugs, balance the game and the bots, and see what to improve. |
| Device and app details | Sent with usage data, once per play session: a random install ID, the app version and build, platform, OS version, device model (such as “iPhone15,2”), language and region setting, and time zone. | To tell which devices and versions a bug or layout problem affects. |
| Notices | Which in-app notices you have seen, and your platform and app version when the app checks for them. | So a notice isn't shown twice, and so you're told when an update is needed. |
| Sign-in sessions | Each time the app signs in, including as a guest, our sign-in provider records the IP address and the app's technical name and engine version (its user agent). | To keep accounts secure, and to tell our own test devices apart from players. |
| Sign-in safety | When you request an email code: a one-way hash of your email and of your IP address, and how many tries you made. Your IP address is also passed to our sign-in provider to limit abuse. | To stop spam and guessing of sign-in codes. |
On your phone only
Your settings (rules, sound, haptics), your current offline game, your last 20 offline game records, your display name and a sign-in token are saved on your device. Apart from the match records described in section 03, they are not sent to us, and deleting the app deletes them. “Report a problem” in Settings › About copies your last match to your clipboard; it is only sent if you choose to send it to us.
What we don't collect
No advertising identifier, no location, no contacts or photos, no payment details (there is nothing to buy with money), and no chat. The app contains no ad or tracking SDKs, and does not ask to track you across other companies' apps and websites. Usage data is collected by our own code and stored only with the providers in section 05; apart from the Unity engine's own technical reporting (see section 05), the app has no third-party analytics or crash-reporting SDKs.
03 Usage data and match records
What it is
- Usage events: small notes the app makes as you play, such as a menu screen opening, a tutorial step finished, a Go or Stop decision with the score at that moment, and how a hand or match ended (win, loss, points, coins won or lost). When the app hits an unexpected error, an event records the kind of error and where in the code it happened, never the error's message. Events never contain your email, your display name, anything you type, or invite codes.
- Match records: one file per match with the rules, the deals, every move and the result, the same record the game already keeps for replays. Pass-and-play matches are recorded under the phone owner's account. Records of online matches also list the other players at the table by account ID and display name, as the game showed them.
- Device and app details as listed in section 02, once per play session.
What it's for
Finding and fixing bugs (a match record lets us replay exactly what went wrong), balancing the rules, scoring and bots, and seeing which parts of the game, such as the tutorial, people finish or get stuck on. We look at it mostly as daily totals, and per account when we need to, for example to see which device and app version a player who hit a problem was using, or when an account last used the app. We don't use it for ads, sell it, or share it with anyone to market to you.
The Share usage data switch
Settings › About › Share usage data is on when you install the app. Turn it off and the app stops sending usage events and stops sending match records of games played on your phone (against the bots, pass-and-play and tutorials); events and records still waiting on your phone are deleted. Data already sent is kept on the schedule in section 06; to remove it, delete your account (section 07).
The switch does not stop what the online game needs to run: our server keeps the record of every online game and room as it is played, and also files a match record of it for each player, whatever the switch says. The app also still checks for notices and updates.
Guests and accounts
As a guest, your usage data is tied to a random account ID with no email or name. If you add an email, your guest account becomes your signed-in account, and its usage data and match records stay with it. Signing out, or reinstalling the app, starts a new guest with a new ID and a new install ID.
04 How we use it
- To run online games, rooms and daily runs, and show you your results.
- To sign you in and keep your account secure.
- To find and fix bugs, for example by replaying a hand that went wrong.
- To balance the game and its bots and decide what to improve, from usage data.
We do not sell or rent your data, share it for advertising, or use it to build a profile of you for anyone else. Usage data is never used to track you across other companies' apps or websites.
05 Who else handles it
A few service providers help us run the game. They process data only on our behalf.
- Supabase runs our database, file storage (including match records and usage data) and sign-in, on servers in the United States.
- Fly.io runs the game server, in the United States.
- Vercel hosts this website and the invite links.
- Resend, in the United States, sends sign-in codes if you use email sign-in, and delivers mail sent to our support and privacy addresses.
Like any web service, these providers may keep short-lived technical logs (such as IP addresses and request times) to operate and secure their systems. The app is built with the Unity engine, which may send Unity basic technical information about your device and the app's performance under Unity's own privacy policy.
We may also disclose data if the law requires it, or to protect players and the service from fraud or abuse.
06 How long we keep it
| Data | Kept for |
|---|---|
| Online games | Deleted 30 days after the game ends. A game with no move for 7 days is ended. |
| Rooms | A room with no play for 30 days expires, and is deleted with everything in it 30 days later. |
| Usage events | About 90 days. They are deleted a calendar month at a time, so the oldest may be kept a few weeks longer. |
| Device and app details (per play session) | 13 months. |
| Match record files | 180 days, unless a record is kept as part of a bug report, in which case it is kept until the bug is dealt with or you delete your account. |
| Match summaries and days played | A one-line summary of each match (mode, rules, start and end time, hands played, result, coins won or lost) and which days you played. Until you delete your account. |
| Daily totals | Counts across all players (such as how many matches were played that day). They contain no account or device and are kept indefinitely. |
| Sign-in sessions (IP address and user agent) | While that sign-in stays active: until you sign out or delete your account. |
| Sign-in codes | Deleted after 1 day. |
| Your account, display name, coins and card sets | Until you delete your account. |
07 Deleting your data
In the app: signed-in players can delete their account from the Account page. That deletes your account, email, display name, sign-in sessions, coins and card sets, room memberships, room ledger entries and daily runs, and all of your usage data: your usage events, device and app details, days played, match summaries and match record files. A room you created passes to another member, or is deleted if no one is left.
Your past moves stay in other players' game records so their history still adds up, but your name and account are removed and the seat is shown as “Deleted player.” Those records are then deleted on the schedule above. Match record files that belong to the other players at your online tables may still list your account ID and display name until they expire after 180 days.
By email: guests, or anyone who can't use the app, can email privacy@flowerwar.com and we will delete your data. Deleting the app removes everything stored on your phone, including usage data not yet sent, but not what was already sent to us.
08 Your rights
Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have the right to access, correct, delete or export your data, and to object to or restrict how we use it. We honor these requests for everyone, wherever you live. Email privacy@flowerwar.com and we will answer within 30 days. We may need to confirm the request comes from you. You can also complain to your local data protection authority.
Where the GDPR applies, we process your data to provide the game you asked for (contract) and, for security, bug fixing and improving the game from usage data, in our legitimate interest in running a fair, working and well-made service. You can object to usage data at any time by turning off Share usage data.
09 Children
Flower War is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email us and we will delete it.
10 Security and where data lives
Data is sent over encrypted connections (HTTPS) and stored with our providers in the United States. The app can send usage events but cannot read them back, and it can reach only its own account's match records; no other player can see them. Access is limited to what is needed to run and improve the game. No system is perfectly secure, but we keep what we hold small, and delete it on the schedule above.
11 This website
flowerwar.com and flwr.cards use no analytics or ads. Invite pages show the code from the link and offer to open the app; they don't store anything about you. The only cookie is a sign-in cookie, set if you sign in on the site with your game email to see your own player page; it only keeps you signed in.
12 Changes
If we change what we collect or how we use it, we will update this page and the date at the top. For significant changes we will also tell you in the app.