Cascade

Privacy Policy

Last updated: June 16, 2026

This Privacy Policy describes how Cascade (the "App") collects, uses, and protects information when you play the game on the web at cascade.buildingrome.dev or on iOS / Android via Capacitor.

Cascade is operated by an individual developer for hobby and small-scale distribution. There are no employees, no advertising partners, and no data sold or shared for marketing.

1. Information We Collect

1.1 Information you provide

Display name. The name you type on the setup screen ("You", "Alex", etc.). Used inside the game to label your seat. Stored in your browser's localStorage and, during a multiplayer session, in Firebase Realtime Database under your room's seat record.
Selected character. Which of the six in-game characters you choose. Stored locally and synced to your seat during multiplayer.
Game preferences. Sound toggle and color-blind mode. Stored in localStorage on your device only.

1.2 Information generated by gameplay

Single-player game state. If you start a solo game, your hand, score, and round are saved to localStorage on your device so you can resume later. This data never leaves your device. It is cleared automatically on game over or when starting a new game, and after 24 hours of inactivity.
Multiplayer game state. During an active multiplayer room, the full game state (cards in play, scores, turn order, seat occupancy, heartbeat timestamps) is written to Firebase Realtime Database under a randomly generated 8-character room code. Rooms are deleted automatically when the game ends or after 24 hours of inactivity.
Room codes. The 8-character code identifying a multiplayer session is shareable by you to invite friends. It contains no information about you.

1.3 Information collected automatically

Anonymous usage events. Vercel Web Analytics records anonymous event names (e.g. game_start, quest_completed, mp_room_created) and aggregate device class. No IP address, no advertising ID, no cross-site tracking. See Vercel Analytics privacy.
Device crash diagnostics (native builds only). On iOS, Apple may collect anonymous crash reports per your device's "Share With App Developers" setting. On Android, Google Play may do the same. Cascade itself does not integrate Crashlytics or Sentry.

1.4 Information we do NOT collect

Email addresses, phone numbers, or other contact information.
Account credentials. Cascade has no sign-up or login.
Location data.
Camera, microphone, or contacts access.
Advertising identifiers (IDFA, AAID) or any cross-app tracking.
Payment information. Future in-app purchases will be processed entirely by Apple's App Store or Google Play; Cascade never sees your payment details.

2. How We Use Information

To run the game (deal cards, validate quests, score rounds, sync state across players in a multiplayer room).
To resume your single-player game when you reopen the app.
To understand aggregate usage patterns (how many people start a game, how many complete a quest) so we can improve gameplay.

3. Third-Party Services

Firebase Realtime Database (Google) — stores multiplayer room state. Firebase privacy.
Vercel — hosts the web build and collects anonymous analytics events. Vercel privacy.
Apple App Store / Google Play — distribute the native app and process any in-app purchases. Their privacy policies apply to their respective platforms.

4. Data Retention & Deletion

Automatic deletion

Single-player save data — lives only on your device (localStorage). Cleared automatically on game over, when you start a new game, or after 24 hours of inactivity. You can also clear it at any time by clearing the app's storage or uninstalling.
Multiplayer room data — deleted from Firebase automatically when the game ends or after 24 hours of inactivity.
Push notification tokens (FCM) — stored under your room's seat record and deleted with the room.
Anonymous analytics events — retained per Vercel's retention policy. These contain no personally identifying information.

Requesting deletion

Because Cascade has no accounts, most data is either on your device (clear it yourself) or automatically purged with the room. If you would like us to manually delete data associated with a display name you used, follow these steps:

Email privacy@buildingrome.dev with the subject line "Data Deletion Request — Cascade".
Include the display name you used and approximately when you played (date / room code if you have it).
We will confirm deletion within 30 days.

What gets deleted: any lingering multiplayer room record in Firebase that contains your display name.
What cannot be deleted: anonymous Vercel Analytics events, which contain no name or identifier and cannot be traced back to you.

5. Children

Cascade is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, please contact us so we can delete it.

6. Your Rights

Depending on your jurisdiction (GDPR for the EU/UK, CCPA for California, and similar laws elsewhere), you may have the right to:

Access information we hold about you.
Request correction or deletion.
Object to or restrict processing.
Request data portability.

Because Cascade does not require accounts and stores no personally identifying information beyond a self-chosen display name and ephemeral game state, most rights are satisfied by clearing your local data or leaving a multiplayer room. For anything else, contact us.

7. Security

Data in transit between your device and Firebase is encrypted via TLS. Multiplayer room data is protected by Firebase Realtime Database security rules that scope access to validated 8-character room codes. Cascade does not currently use authentication; the room code is the access token for a room. Do not share room codes you want to keep private.

8. International Transfers

Firebase Realtime Database and Vercel Analytics may store data on servers in the United States or other jurisdictions. By using the App, you consent to such transfers.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page. Continued use of the App after changes constitutes acceptance.

10. Contact

Questions, deletion requests, or other privacy concerns:
privacy@buildingrome.dev