Whot Legends: Privacy Policy
Effective date: May 24, 2026
Last updated: October 15, 2026
Whot Legends is made and operated by Arotec Digital Inc. (“Whot Legends”, “we”, “us”). This policy explains what happens with your data when you play. Short version: we collect the minimum needed to run accounts, matches and tournaments, we don’t sell it, and there are no ads or analytics trackers in the app.
Summary
Whot Legends is an online card game for iPhone and Android. Your account, wallet, stats, matches and tournament entries live on our servers, so the app needs an internet connection to play, whether you’re up against Roboto (the AI opponent) or another player. We don’t run analytics or advertising SDKs, and nothing in the app tracks you across other apps or websites.
What we collect when you sign up
You can create an account with email and password (we’ll email you a one-time code to confirm it), or sign in with Google, or with Apple on iPhone. We receive:
- Your email address
- If you use Apple or Google: the account identifier and email that service shares with us (with Apple you can choose to hide your email)
Your email is stored in the app’s authentication database. It isn’t end-to-end encrypted: our team can view it for support and account management. We never use it for marketing and never share it with anyone.
We also ask you to pick:
- A nickname (3–11 characters, lowercase letters, numbers and underscores; must be unique; visible to other players)
- A profile picture, which you can upload from your camera or photo library
We don’t ask for your date of birth, location, contacts, phone number or any government ID.
What we store about your gameplay
Once you’re signed in, our servers keep:
- Stats: games played, wins, win rate, current and best win streak, rank, total earned and leaderboard position
- Match history: who played whom, the mode (vs. Roboto, a challenge, a game room or a tournament), the stake, the result, the duration and timestamps
- Move log: the cards dealt and played in each match against another player, so you can review it later in the match breakdown
- Game state: the live state of a match in progress (deck, hands, pile) so it can resume if your connection drops
- Tournaments: the events you enter, your bracket results and any prizes
- Game rules: the custom rules you choose in “Customise rules”, so they follow your account
- Wallet: your in-game currency (KOBO) balance and a record of in-game transactions (stakes, winnings, entry fees, prizes and transfers between players)
- Online status: whether you’re online, in a game or away, and when you were last seen, so other players know who’s around to play
KOBO is an in-game currency only. Today there is no real-money deposit, withdrawal or payout, and no payment processor is connected to the app. If that changes, we’ll update this policy first.
If you browse without an account
You can look around the app before signing up. To count how many people visit each day, the app creates a random ID on your device and sends it to our servers once a day. It isn’t linked to you, your phone’s advertising ID, or anything else.
What gets stored on your device
The app keeps a few small things on your phone, separate from our servers:
- Your sign-in session, so you stay signed in between launches
- Your sound settings and a copy of your game rules
- When you last opened your challenge requests (for the unread badge) and which tournaments you’ve already seen
- Whether you’ve ticked “Don’t show me again” on tournament rules, and whether you’ve already been asked to leave a review
- The random visitor ID described above
Signing out or deleting the app removes these. The server copy is separate (see “Deleting your account”).
Permissions the app asks for
The app asks before it uses any of these, on iPhone and Android. You can say no to all of them and still play; you just can’t upload a profile picture without allowing at least one of the first two:
- Camera: only if you choose to take a new profile picture
- Photo library: only if you choose an existing photo
- Notifications: only if you want alerts, for example when someone challenges you
The app doesn’t ask for location, contacts or microphone, and doesn’t use App Tracking Transparency because it doesn’t track you.
Who else gets your data
- Supabase runs our backend: database, sign-in, profile picture storage and the realtime connection used for live matches. Your account, matches, wallet and photos are stored there.
- Expo delivers push notifications and app updates. To send you a notification, Expo receives your device’s push token and the notification text.
- Apple and Google: only if you choose to sign in with one of them. They handle that sign-in and share your account ID and email with us, under their own privacy policies.
That’s the whole list. No analytics, no crash reporting SDK, no advertising network, no data brokers.
What other players can see
Your nickname, profile picture, rank, stats, online status and tournament results are visible to other players. That’s how the leaderboard, challenges and brackets work. Profile pictures are stored in a publicly readable bucket, so anyone with the link can view one. Don’t upload anything you wouldn’t want other players to see.
Push notifications
If you allow them, you may get alerts when a player challenges you, when a tournament you entered is about to start or your next match is ready, and for app updates. A notification can include the other player’s nickname. You can turn notifications off at any time in your phone’s settings.
Retention and deletion
We keep your account data for as long as your account exists. If you stop playing but don’t delete your account, the data stays on our servers so you can come back to it later.
Deleting your account
You can delete your account from Profile → Profile settings → Delete account. That removes your profile, stats, match history, wallet balance, profile picture, game rules and any matches in progress. Past matches and tournament brackets you played in with other people may keep a reference to your old account ID so their history still makes sense, but it won’t be linked to anything that identifies you.
There’s one exception. If you hold a place in the Hall of Fame, which records who was first to reach a milestone, we keep your username and profile photo on that award, and nothing else. Everything above is still deleted: your stats, wallet, match history and any linked accounts are gone for good. We keep those two things because the Hall of Fame is a record of who got there first, and that doesn’t stop being true when someone closes their account. You’ll be asked to confirm this before the account is deleted, and if you don’t hold an award, nothing is kept.
If you can’t reach the in-app delete option for any reason, email us (see Contact below) and we’ll delete the account manually.
Your rights
You can do any of the following at any time:
- See and edit your profile: your nickname and profile picture are editable in Profile settings
- Delete your account: from in-app settings, which removes your data from our servers
- Delete local data: sign out and delete the app to wipe everything stored locally on your device
Regional rights
EEA, UK, and Switzerland (GDPR)
If you’re in the European Economic Area, the UK, or Switzerland, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, plus the right to data portability. Most of these are available directly in the app’s settings (you can view and edit your profile, and you can delete your account). For anything else, including a data export, email us and we’ll handle it. You can also lodge a complaint with your local data protection authority.
The legal basis for processing your data is our contract with you: you can’t have an account or play online without the data listed above. Data is processed on Supabase and Expo infrastructure, which may include servers outside your region.
California, USA (CCPA / CPRA)
If you’re a California resident, you have the right to know what personal information is collected, to delete it, to correct it, and to opt out of the “sale” or “sharing” of personal information. The categories of personal information we collect are listed in this policy (“What we collect when you sign up” and “What we store about your gameplay”). We don’t sell or share any of it. You can exercise these rights from in-app settings or by emailing us.
Children’s privacy
Whot Legends isn’t aimed at children under 13, and we don’t knowingly collect personal information from children under 13. If you believe a child has signed up, email us and we’ll delete the account.
Changes to this policy
We may update this policy from time to time. Updates will be reflected by a new “Last updated” date at the top. For meaningful changes (for example, adding a new third-party service or real-money payments) we’ll flag it in the app before the change takes effect. Continuing to use the app after an update means you accept the new version.
Contact
Questions about this policy? Contact Arotec Digital Inc. at: