Truco Mineiro Privacy Policy

1. Who we are

Truco Mineiro (TrucoMineiro) is a card game developed and maintained by WJF Developer, the public developer name used by the individual responsible for the app. This policy explains how we handle the data of people who play.

Privacy contact: suporte@wjfdeveloper.com.br.

2. Scope

This policy applies to the Truco Mineiro app for Android and iPhone, to the game's servers, and to the public share links created by the app. It does not apply to other WJF Developer products, which have their own policies, or to third-party services you access from the game (such as social networks when you share a card).

The same policy can be read inside the app under “Mais” (More) > “Política de Privacidade” (Privacy Policy).

3. Summary of the data we handle

Data you provide: phone number, nickname, avatar (chosen from in-game options), names and descriptions of groups you create, reports.
Data generated by the game: level, XP, league, statistics, match history, friends, invites, blocks, missions, achievements, tournament participation.
Technical data: user ID, device and app identifiers, notification token, usage, performance, and crash data.
Advertising: advertising ID (when allowed), IP address, and ad interactions, handled by Google AdMob.
Contacts: phone numbers from your address book, only if you sync, used temporarily to find friends.

We do not collect email, real name, photos, audio, camera, precise location, health data, financial data, or free-text messages between players. The app has no purchases.

4. Data you provide

Nickname: 3 to 16 characters, visible to other players. It goes through a filter for offensive words and reserved names.
Avatar: chosen from the game's own illustrations. The app does not access your photo gallery.
Groups (“turmas”): the name and description you create, visible to members and checked by the same filter.
Reports: a reason and optional text of up to 500 characters, seen only by moderation.
Messages to support: whatever you write to suporte@wjfdeveloper.com.br.

5. Phone sign-in

Sign-in uses Firebase Authentication: you enter your number and receive a code by SMS. On Android, the code may be read automatically from the message. The code is not stored by the app or by our servers, and we never ask for a password.

Your number is kept in Firebase Authentication so you can sign in. On our servers it is stored only as an encrypted code (HMAC), used to identify the account and for finding friends via your contacts. Your phone number is never shown to other players.

The app also uses Firebase App Check (Play Integrity on Android, App Attest/DeviceCheck on iPhone) to verify that requests come from the original app.

6. Profile and what other players see

Other players see your nickname, avatar, level, and league. Only your friends can see whether you are online or in a match, and you can hide this from them under Settings (“Configurações”) > “Mostrar quando estou online” (Show when I’m online).

You can change your nickname and avatar at any time under “Perfil” (Profile) > “Editar” (Edit).

7. Contacts (optional)

Your address book is only accessed if you tap “Sincronizar contatos” (Sync contacts) on the “Amigos” (Friends) tab, after an explanation, and allow access in the system prompt. Declining doesn't block anything in the game.

How it works: numbers are normalized to international format and sent over an encrypted connection to our server, which compares them in encrypted form against registered phone numbers and returns only people who already play.
Suggestions, not automatic friendship: people who already play appear as suggestions. You choose whom to send a friend request to, and the friendship only exists if the other person accepts.
Being found: if you don't want people who have your number to see that you play, turn off Settings (“Configurações”) > “Me encontrar pelo telefone” (Find me by phone).
What we don't do: names and photos from your contacts never leave the device; numbers are not stored on the server or shared; no one sees your phone number.
On the device: the sync result is stored locally and can be deleted under Settings (“Configurações”) > “Sincronização de contatos” (Contact sync). It is also deleted when you sign out.
Revoking the permission (in system settings) prevents new syncs. Friendships you have already accepted remain; to undo them, remove or block the friend on the “Amigos” (Friends) tab.

There are daily sync limits to prevent abuse.

8. Game data

We store matches, plays, results, statistics, level, XP, league, ranked rating, missions, achievements, seasons, and tournaments. Online matches are validated on the server, which is the official source for scoring, league, and rewards.

We store your friends list (including how each friendship was created: by invite, QR code, link, nickname, or contacts), requests, room invites, groups you belong to, blocked players, and reports you have made.

10. Technical and device data

User ID (Firebase UID) and Firebase installation identifiers.
Notification token (Firebase Cloud Messaging), device model and operating system, app version.
App settings stored on the device (sound, music, vibration, card preferences).
Security logs (for example, fraud attempts) and usage limits.

11. Usage statistics (Firebase Analytics)

We log usage events (such as screens opened, matches started and finished, and feature usage) to understand and improve the game. Events use categories and counts, without the content of your matches or contact data, and are associated with your user ID. Firebase Remote Config is also used to adjust features and run A/B tests, and your test variant is associated with you in Analytics.

Firebase Analytics uses Google Consent Mode: where the law requires consent (for example, in the European Economic Area and the United Kingdom), analytics storage and advertising signals follow the choices you made in the consent form. You can turn statistics off at any time under Settings (“Configurações”) > “Estatísticas de uso e falhas” (Usage and crash statistics); when off, the app stops sending data to Analytics, Crashlytics, and Performance Monitoring from this device. Google handles data already sent according to the retention periods configured in Google Analytics.

12. Crashes and performance (Crashlytics and Performance Monitoring)

When the app crashes or hits an error, Firebase Crashlytics sends a technical report (error trace, screen, device and match information) associated with your user ID. Firebase Performance Monitoring measures loading times and network response times. Crashlytics reports are kept by Google for up to 90 days. Both can be turned off under Settings (“Configurações”) > “Estatísticas de uso e falhas” (Usage and crash statistics); when you turn them off, crash reports not yet sent are discarded.

13. Advertising and privacy

Truco Mineiro is free and supported by Google AdMob ads. Formats used:

Between-match ad (full screen), shown only at the end of a match and with frequency limits.
Native ads on screens such as Home, League, Friends, and Profile.
Rewarded ad, always optional, to unlock match analysis or a truco tip.

There are no ads during play. No ad gives a competitive advantage, and players are never charged.

To show and measure ads and prevent fraud, Google AdMob may collect the device advertising ID (AAID on Android, IDFA on iPhone when authorized), the IP address (from which it may infer an approximate region), device information, and ad interactions. Ads may be personalized when your consent and the law allow; otherwise, non-personalized or limited ads are shown. Learn more at How Google uses information from sites or apps that use its services .

Once ads are enabled by consent (where required), we also log ad events linked to your account on our server (request, impression, click, reward, and estimated revenue) to limit frequency and measure the game’s revenue. Without that consent, the ads SDK is not started and none of these events are logged.

14. Ad consent (UMP)

We use Google's User Messaging Platform (UMP). Where the law requires it (in the European Economic Area, the United Kingdom and Switzerland), the app shows a consent form before any ad: the ads SDK only starts after consent allows it. If the form cannot load, the app does not show ads. The same choices are passed to Firebase Analytics through Google Consent Mode.

In US states with privacy laws, you can opt out of the sale or sharing of your data for ads through the same path; after opting out, ads continue without personalization based on that data.

When this option is required in your region, you can review or withdraw consent at any time under Settings (“Configurações”) > “Privacidade de anúncios” (Ad privacy). See also Privacy choices.

15. Tracking on iPhone (ATT)

On iPhone, after ad consent, the system asks once whether Truco Mineiro may track your activity across other companies' apps and websites. Only with your permission is the IDFA shared with Google AdMob for personalized ads and measurement. Declining changes nothing in the game; ads continue without the IDFA.

You can change this choice in iPhone Settings > Privacy & Security > Tracking.

16. Notifications

The app only asks for notification permission after explaining what notifications are for (invites, friends, league, tournaments), and only if you tap “Ativar notificações” (Turn on notifications). Declining or choosing “Agora não” (Not now) doesn't block the game. We store the device's notification token to deliver messages; it is removed when you sign out or delete your account.

You can turn notifications off under Settings (“Configurações”) > “Notificações” (Notifications) > “Receber notificações” (Receive notifications), or in system settings. In-app notifications are deleted after 90 days.

17. Share cards and links

You can share cards for wins, achievements, league, tournaments, rematches, rivalries, and your profile. Sharing is always started by you and gives no reward. A card never shows your phone number, identifiers, or the cards played in matches.

You control what appears: Settings (“Configurações”) > “Meu nome nos cards” (My name on cards), “Meu avatar nos cards” (My avatar on cards), and “Aparecer nos cards dos outros” (Appear on other players’ cards).
Each card creates a public link that expires (24 hours for rematch, 180 days for profile and rivalry, and 365 days for the others) and that you can revoke.
To measure views, we log link visits with encrypted codes for the visitor and the IP address (never the IP itself).

What happens after you share to another app (WhatsApp, Instagram, etc.) is governed by that service’s policy.

18. Invites and referrals

When someone installs the game from an invite link, we record the originating invite to connect friends and credit the referral. On Android, this uses the Google Play Install Referrer.

19. What we use data for

Creating and authenticating your account and keeping your progress.
Running online matches, ranked play, tournaments, leagues, rankings, friends, and groups.
Sending the notifications you allowed.
Moderating nicknames, groups, and reports; preventing fraud, cheating, and abuse; protecting the service.
Showing and measuring ads and limiting their frequency.
Understanding usage, fixing crashes, and improving performance.
Handling support and privacy requests.

20. Legal bases (LGPD)

Under Brazil's General Data Protection Law (LGPD), we rely on:

Performance of a contract (Terms of Use, expressly accepted at sign-up): account, profile, matches, friends, and notifications you turned on.
Legitimate interest: security, fraud prevention, moderation, usage statistics, and crash fixing.
Consent: personalized ads where required (UMP), tracking on iPhone (ATT), and contact sync.
Compliance with a legal obligation: records the law requires us to keep.

21. Who we share data with

We don't sell personal data. We work with:

Google Firebase (Authentication, Cloud Messaging, Analytics, Crashlytics, Performance Monitoring, Remote Config, and App Check): a service provider that processes data on our behalf. Firebase privacy .
Google Cloud: hosting for the game's API. The game database runs on a dedicated server contracted by WJF Developer.
Google AdMob and UMP: advertising network. For ads, device and interaction data are shared with Google, which also uses them under the Google Privacy Policy .
Google Play and the Apple App Store: app distribution; the stores handle data under their own policies.

We require these providers to offer protection consistent with this policy, under their contracts and public policies. We may disclose data if required by law or by an order from a competent authority.

22. International transfers

Google services may process data on servers outside Brazil. These transfers follow the contractual safeguards offered by Google and applicable law.

23. Security

We use encrypted connections (HTTPS/TLS) between the app, our servers, and Google services; we store phone numbers only in encrypted form in our database; we verify app integrity (App Check); we limit attempts and usage; and we keep match results under server control. No system is completely immune to failures; if a relevant incident occurs, we will notify those affected as required by law.

24. How long we keep data

Account, profile, progress, friends, and groups: for as long as the account exists.
Address book numbers: not stored; used only during matching.
In-app notifications: 90 days.
Technical usage-control logs: 1 to 30 days.
Crash reports (Crashlytics): up to 90 days, by Google.
Statistics (Analytics): according to the retention period configured in Google Analytics.
Share links: until the link expires or you revoke it; view logs for these links: 90 days.
Security and anti-fraud analysis logs: 12 months.
Ad events linked to the account (daily summary): 13 months.
Records of privacy requests (deletion and data copy), as proof that they were handled: 5 years.
These periods are enforced by an automatic cleanup on our servers. After account deletion, some records may be kept within these periods; see the “Deleting your account” section.

25. Your rights

Under Brazil's General Data Protection Law (LGPD), you can request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, and withdrawal of consent.

Copy of your data: Settings (“Configurações”) > “Cópia dos meus dados” (Copy of my data). The request goes to support, which responds within 15 days.
Correction: change your nickname and avatar under “Perfil” (Profile) > “Editar” (Edit); for other data, contact support.
Other requests: suporte@wjfdeveloper.com.br. We may ask you to confirm that you are the account holder before handling your request.

You can also file a complaint with Brazil's National Data Protection Authority (ANPD).

26. How to withdraw consent

Ads (UMP): Settings (“Configurações”) > “Privacidade de anúncios” (Ad privacy), when available in your region.
Tracking (iPhone): Settings > Privacy & Security > Tracking.
Contacts: system settings; and Settings (“Configurações”) > “Sincronização de contatos” (Contact sync) to delete the result stored on the device.
Notifications: Settings (“Configurações”) > “Notificações” (Notifications), or system settings.
Usage and crash statistics: Settings (“Configurações”) > “Estatísticas de uso e falhas” (Usage and crash statistics).

Withdrawing consent doesn't affect what was done before and doesn't block the game. Details in Privacy choices.

27. Deleting your account

You can delete your account in the app under Settings (“Configurações”) > “Excluir Conta” (Delete Account), or on the web, without the app, at Account deletion, by confirming your number with an SMS code.

Deletion is immediate and permanent: we delete your Firebase Authentication login, profile, progress, league, friends, requests, blocks, groups you are a member of, share cards and links, invites, ad events linked to the account, and the notification token. If you are in a match, it is abandoned.

What may remain, without your phone number:

your nickname in other players' match history, so their results stay correct;
security and anti-fraud logs, for up to 12 months, to protect the service;
reports you made, without identifying who reported;
a record of the deletion request (ID and nickname), for 5 years, as proof it was handled;
crash reports already sent to Crashlytics, kept by Google for up to 90 days. For Google Analytics, we automatically ask Google to delete the data linked to your account, and statistics data stored on the device is deleted.

28. Children and teens

Truco Mineiro is intended for people aged 13 or older. It is not directed at children and shows ads that may use the advertising ID. If you are the parent or guardian of a child who created an account, contact us to delete it.

29. Changes to this policy

We may update this policy when the game changes. The current version is always available at this address and in the app, with the date of the update. We will notify you in the app about significant changes.

Version: 2026-10-01.

30. Contact

WJF Developer: suporte@wjfdeveloper.com.br. You can also reach us in the app under “Mais” (More) > “Ajuda e Suporte” (Help & Support), or through the Truco Mineiro Support Center.