Privacy Policy
Effective date: 1 October 2026
This policy explains what Qahwa (the "app") collects, why, who can see it, where it is stored, how long it is kept and how you can delete it. The app is made and run by Itani, the trading name of Ahmed Itani, an individual developer in Ontario, Canada ("I", "me", "we"). I am responsible for your personal information (the "controller").
- General contact: support@playqahwa.com
- Privacy officer (privacy questions and requests): Ahmed Itani, privacy@playqahwa.com
- Postal address: available on request by email.
1. The short version
- You can play every game offline against the computer without an account. Offline play sends nothing to me.
- Before you go online, the app asks for your year of birth. Players under 13 can only play offline: no account is created for them, and they see no store and no ads. Your year of birth stays on your device.
- When you first use an online feature, the app creates an anonymous account. There is no email, phone number or password. Linking a Google account (when available) is optional.
- I collect only what the online game needs: an account identifier, the name and avatar you choose, your progress, your coin and bean balances and their history, your purchases, and what you do at online tables and in clans.
- Purchases go through Google Play. I never see your card or bank details.
- There are no banner, pop-up or video ads that interrupt play. When rewarded ads are enabled, they are optional videos you choose to watch for a reward, served by Google AdMob, with your consent where the law requires it.
- No analytics or tracking tools. I do not sell your personal information.
- There is no free-text chat. Clan chat uses preset phrases and stickers only.
- Your online data is stored by Google Firebase in the European Union (Belgium).
- You can delete your online account in the app or on the web at playqahwa.com/delete-account.
2. What I collect
On your device only: your profile (name and avatar), settings (language, sound, music), your year of birth and your answer to the Terms, offline progress, and, once you go online, your sign-in session and a queue of rewards waiting to be sent to the server. This stays in the app's private storage and is deleted when you uninstall the app. Your year of birth is never sent to me; the app may tell the server only your age group (for example "13 to 17") so that the right settings apply.
When you use online features:
| Data | Examples | Who can see it |
|---|---|---|
| Account identifier | A random user ID created by Firebase Authentication, a sign-in token stored on your device, and a Player ID derived from it | Players at your table and in your clan can see your user ID inside the app's data. Your Player ID: only you |
| Linked Google account (optional, when available) | If you choose to link a Google account: its email address and Google account ID, stored by Firebase Authentication to let you sign back in on a new phone | Only you and me |
| Profile | Display name (2 to 20 characters, checked by a word filter), avatar, frame, level and the country flag you choose (optional) | Any signed-in player |
| Terms acceptance | Which version of the Terms of Use and this policy you accepted, and when | Only you |
| Wallet and items | Your balances of coins, beans and Karam points, your XP and level, and the items you own | Only you (your level and equipped items are shown on your profile) |
| Wallet history (ledger) | One line for every change to your balances: the amount, the reason (for example a daily reward, a game, a purchase, a gift), the time and the balance after it; your reward claims (which game, how long it lasted, when) | Only you, as a summary in the app |
| Purchases | For each Google Play purchase: the product, the Google Play order ID, a one-way code of the purchase token, the date, the status (pending, completed, refunded, charged back) and, for subscriptions, the plan, renewal status and expiry date | Only you and me |
| Gifts | Gifts you send or receive at a table (which gift, from whom, when) | You, the other player and the table |
| Ad rewards (when ads are enabled) | The reward you chose, a transaction ID from AdMob and the time | Only you and me |
| Online table data | Your seat, your moves, your cards (only you and the table host's device see your hand), reactions, stickers and throwables | Players at the same table |
| Diwaniya (clan) data | Clan name, crest, tags and region; your membership, role, weekly points and join requests; the preset phrases and stickers you send; the clan activity log and announcements | Clan members. The clan's name, crest, tags, region and ranking are visible to all signed-in players |
| Country Cup | The country you choose and the points your games earn for it each week | Weekly leaderboards (display name, avatar and points of the top players) |
| Safety data | Players you block; reports you send (what was reported, the reason, your optional note, the time and the reactions or preset messages attached as evidence); warnings, mutes, suspensions and bans | Blocks: only you. Reports: only me (the moderator). Your own sanctions: you and me |
| Technical data | Your IP address and device and app information sent with every network request | Processed by Google to run the service and protect it against abuse. I do not use it to locate you |
Purchases: Google Play takes your payment. I receive only the order details listed above, never your name, card number or billing address. To link a purchase to your Qahwa account, the app gives Google Play a one-way code of your user ID, not the ID itself.
Rewarded ads (when ads are enabled): if you choose to watch a rewarded ad, Google AdMob collects your device's advertising ID, your IP address (from which an approximate location is derived), device information and how you interact with the ad. AdMob uses this to show and measure ads and to prevent fraud. In the EEA, the UK, Switzerland and wherever else the law requires it, the app asks for your consent through Google's consent form (UMP) before any ad is requested. Players aged 13 to 17 only receive non-personalised ads. Players under 13 never see ads, and the ads code is not started for them.
I do not collect your real name, phone number, contacts, photos, microphone, precise location or payment card details. If you type your real name as your display name, other players will see it, so please choose a nickname.
3. Why I use it (purposes and legal bases)
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Provide the online game: accounts, tables, clans, leaderboards, rewards, wallet | Performance of our agreement (the Terms of Use) |
| Sell and deliver purchases and subscriptions, restore them, handle refunds and chargebacks | Performance of our agreement; legal obligation (tax and accounting records) |
| Keep the game safe and fair: name filter, limits, anti-cheat checks, reports, blocks, bans | Legitimate interest (a safe community) and legal obligations |
| Rewarded ads, when enabled | Your consent where required (personalised ads); otherwise legitimate interest, and our agreement for the reward |
| Answer you when you contact me | Legitimate interest and your request |
| Comply with the law, and establish or defend legal claims | Legal obligation; legitimate interest |
In Canada I rely on your consent, given by using the online features after reading this policy. You can withdraw it at any time by deleting your account (see section 6). I do not use your data for profiling or for automated decisions with legal or similar effects. Moderation decisions are made by a person.
4. Service providers and where data is stored
- Google Firebase (Google LLC and Google Ireland Limited) runs the online service as my processor under the Google Cloud / Firebase data processing terms. The Realtime Database and Cloud Functions are hosted in Belgium (europe-west1, European Union). Firebase Authentication and Firebase Hosting (this website) are global Google services and may process your user ID and IP address in the United States and other countries where Google operates.
- Google Play processes your payment as an independent company under its own terms and the Google Privacy Policy.
- Google AdMob (when ads are enabled) acts under Google's own terms; for personalised ads Google is an independent controller. See how Google uses data at policies.google.com/technologies/partner-sites.
- Email: messages to the @playqahwa.com addresses are forwarded by my domain host (Hostinger) to a Google mailbox.
Transfers outside Canada. Your information is stored and processed outside Canada, mainly in the European Union and also in the United States and other countries where Google operates. While it is there, it may be accessible to the courts, law enforcement and national security authorities of those countries under their laws. Transfers are made under written agreements that require the providers to protect it. For residents of Quebec, I assess the protection the information receives before any transfer outside Quebec, as Quebec's Law 25 requires.
Transfers for other regions. Google uses Standard Contractual Clauses and other safeguards for transfers out of the EU and the UK. If you live in Saudi Arabia, the UAE, Egypt, Jordan, Lebanon, Kuwait, Morocco or elsewhere outside the EU, your data is transferred to and stored in the EU and processed by Google as described above. I rely on the safeguards in Google's terms and on this disclosure for these transfers.
I do not sell or rent your personal information, and I share it with nobody else, except when the law requires it (for example a valid order from a court or authority), to protect players' safety, or to report child sexual abuse material to the authorities (see the Child Safety Standards page).
5. How long I keep data
| Data | Kept |
|---|---|
| Account, profile, progress, wallet, items, wallet history and blocks | Until you delete your account. Accounts with no sign-in for 12 months are deleted automatically |
| Purchase records (order ID, product, price, date, status, refunds) and their wallet-history lines | Up to 7 years after the purchase, for tax, accounting and disputes. When you delete your account they are pseudonymised: your user ID is replaced by a random code and no profile data is kept with them |
| Ad reward records (when ads are enabled) | Up to 90 days; the reward itself stays in your wallet history |
| Reward claim keys (so that a reward is never paid twice) | 30 days |
| Online table data | Deleted automatically, usually within 25 hours of the table's last activity |
| Clan chat | The latest 200 messages per clan; older ones are deleted automatically |
| Clan activity log and announcements | Up to 90 days, or until the clan is deleted |
| Country Cup weekly boards | About 4 weeks. The weekly hall of fame keeps each country's champion (display name, avatar, points) until that player deletes their account |
| Reports and moderation records | Up to 12 months after the case is closed, to handle appeals and repeat abuse. If the reporter or the reported player deletes their account, their user ID in the report is replaced by a random code and their name and note are removed |
| Mutes and suspensions | Until they expire (a permanent ban until the account is deleted) |
| Web deletion requests | 12 months (request ID, date, status). An email address you gave is deleted with the request record |
| Server logs (Google Cloud) | About 30 days |
| Support emails | Up to 24 months after the conversation ends |
| Information that the law requires me to keep, or that is part of a report to the authorities | As long as the law requires |
6. Your choices and rights
- Play offline without any account.
- Change your name, avatar or country in the app (names once a day, country once every 30 days).
- Block a player and report content or players in the app.
- Ads (when enabled): you choose each ad. Change your ad consent at any time in the app's Settings (Ad privacy options). You can also reset or delete your advertising ID in your phone's settings (Android: Settings > Privacy > Ads).
- Delete your account: in the app (Settings > Account > Delete account) or on the web at playqahwa.com/delete-account.
- Access, correct, export, restrict or object: email privacy@playqahwa.com with your Player ID (Settings > Account). I answer within 30 days.
- Withdraw consent at any time: for ads in the ad privacy options, for the online service by deleting your account. This does not affect what was done before.
Because accounts are anonymous, I can only find your data with your Player ID. Keep it private: it works like a key to your account for deletion requests.
Complaints. Please contact me first at privacy@playqahwa.com; I would like the chance to fix the problem. You also have the right to complain to a data protection authority:
- Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca); in Quebec, the Commission d'accès à l'information du Québec.
- EU and UK: your national data protection authority (in the UK, the ICO).
- Saudi Arabia: the Saudi Data & AI Authority (SDAIA); UAE: the UAE Data Office; or the authority of your own country.
7. Canadian privacy law
I follow the ten fair information principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA):
- Accountability: Ahmed Itani is the privacy officer (privacy@playqahwa.com).
- Purposes and consent: this policy explains the purposes before you go online, and you can withdraw consent at any time.
- Limiting collection, use, disclosure and retention: only what the game needs, used only for the purposes above, and deleted on the schedule in section 5.
- Accuracy: you can correct your profile in the app, or ask me to.
- Safeguards: see section 9.
- Openness, access and challenging compliance: this policy is public; you can ask what I hold about you and complain as described in section 6.
Quebec residents (Law 25): you have the rights above, plus the right to receive your information in a structured, commonly used technological format (portability) and the right to be told about any decision made only by automated processing (there is none). The person in charge of the protection of personal information is Ahmed Itani (privacy@playqahwa.com). The settings that protect privacy are on by default.
If a breach of security creates a real risk of significant harm to you, I will notify you and report it to the Privacy Commissioner of Canada (and, for Quebec residents, to the Commission d'accès à l'information) as the law requires, and I keep a record of every breach.
8. Children and teens
The app is not directed at children. Online features are for players aged 13 and over. Before the first online action the app asks for your year of birth. Players under 13 can only play offline against the computer: no account or online data is created for them, and they see no store, no purchases and no ads. Players aged 13 to 17 get safer defaults (for example, throwables from other players are off) and, when ads are enabled, only non-personalised ads. If you are under 18, ask a parent or guardian before buying anything; Google Play's family settings can require approval for purchases. If you believe a child under 13 has an online account, email safety@playqahwa.com and I will delete it.
In some countries a higher age applies for consent to online services (up to 16 in parts of the EU). Where that applies, players below that age should use online features only with a parent's or guardian's permission.
9. Security
All traffic uses encrypted connections (HTTPS/TLS). Database rules limit who can read each piece of data. Your balances, items, purchases and wallet history can be changed only by server functions, which validate every request and check each purchase with Google Play. Only I have access to the admin tools. No system is perfectly secure; if a breach affects your data I will act as described in section 7.
10. Changes
If I change this policy I will update the date at the top and, for important changes, show a notice in the app and ask you to accept the new version. Previous versions are available on request.
11. Contact
Itani (Ahmed Itani, an individual trading as Itani), Ontario, Canada. Email: support@playqahwa.com. Privacy officer: privacy@playqahwa.com. Postal address available on request. Web: playqahwa.com/support.
© 2026 Itani · Ontario, Canada · support@playqahwa.com