LaffahPrivacy Policy — Laffah (لفّة)
Last updated and effective: 4 November 2026 · For ages 13 and over.
1. Who we are
Laffah (AF.APPS) is a party-game app published by Ali Al Shahat Ali, Cairo, Egypt ("we"). We are responsible for your data as described here. Privacy contact: 4fdev.company@gmail.com.
2. The short version
- You can play without an account and without internet, on one phone or on the same Wi-Fi. Then your data stays on your phone and never reaches us.
- Same-Wi-Fi play is not encrypted: player names and game state travel between phones on the local network and any device on that network can see them. None of it reaches our servers.
- When you use online features, our servers receive your IP address and derive an approximate country and city from it; the full IP address is deleted after 7 days.
- We do not sell your data and we do not use your advertising ID to track you.
- Anyone under 13 plays the offline modes (one phone or the same Wi-Fi): no account, no ads, no statistics and no crash reports (section 11).
- You can delete your account and data and ask for a copy (section 9).
3. Data that stays on your phone
The name you type to play, avatar colour, settings (language, family or 16+ audience), play history and scores, names of people you played with, favourites, question decks you made, and downloaded content. This is not sent to us. If you clear the app's data or uninstall it, it is deleted and we cannot restore it. Pictures added to a deck have location and camera metadata removed before they are saved.
4. Data we collect when you use online features
| Data | Why | How long |
|---|---|---|
| Random install identifier (a UUID created on your phone) | link requests to the install, prevent duplicates and abuse | life of the account/install |
| Guest account: id, the name you chose, language, time zone | run the app | until you delete the account |
| App and device information: version, platform, store, OS version, device class (phone/tablet) | support, fixing crashes, the "update required" screen | request log 30 days |
| IP address | security, abuse prevention, investigating reports | full IP 7 days; then a truncated prefix (/24 or /48) and a keyed hash rotated monthly for 30 days |
| Approximate country and city (derived on our server from the IP, never from GPS) | default content language, consent rules, aggregated statistics, fraud prevention | 30 days |
| Device fingerprint (a keyed HMAC of ANDROID_ID / IDFV, not the advertising ID) | prevent cheating on invites and rewards | life of the account; de-identified on deletion |
| Online play history: game, duration, result | history, statistics, anti-cheating | life of the account; detailed match logs 30 days |
| Push token (via Firebase Cloud Messaging, Google) and notification language. We collect both only if you allow notifications, and never for users under 13 or of unknown age | deliver notifications in your language | until you turn notifications off or delete the account |
We do not collect: precise (GPS) location, contacts, messages outside the game, audio, or the advertising ID for tracking.
Phone permissions: Camera only to scan a QR code (the image is not stored or sent). Nearby devices / Wi-Fi (and, on Android 12 and older, "Location", which the system requires for Wi-Fi) to find rooms and create a hotspot; we do not read your location. Local network on iOS for same-Wi-Fi play.
5. Your account
For users aged 13 and over only: when online features are on, the app creates a guest account automatically, and you can also sign in with your Google account (through Firebase Authentication) so your account stays with you. If you sign in with Google, Google handles the sign-in and we receive the account identifier (and possibly the email and name Google provides) and keep them until you delete the account. When you delete the account or sign out, the app signs you out of Firebase on your phone. The sign-in record that Firebase keeps at Google is not removed automatically: email us and we remove it from our Firebase project. Users under 13 or of unknown age have no sign-in of any kind. If you clear the app's data or uninstall it, a guest account is lost and cannot be recovered. You may choose a handle that friends and rooms can see.
6. Same-Wi-Fi and hotspot play
Phones talk to each other directly, not through our servers. What is sent: player names, avatar colour, game state and scores, reactions (only the meme number), short messages (up to 60 characters), and the room code and name. Invite links and QR codes contain the host phone's local network address. This data is sent without encryption. Any device on the same network can read it. Do not put anything in your name or messages that you would not want people around you to see, and play on a network you trust. None of this data reaches us.
6A. Online rooms
In online rooms our servers relay between players: names and short preset or typed lines (short messages). This is ephemeral: it is kept only while the room is open and is not stored afterwards. Age limits: private rooms 13+, public rooms 16+.
7. Crashes and usage statistics
Crash reports and usage statistics are off until you turn them on in Settings, in all regions.
- Crash reports (error type, screen, app and OS version, device class) help us fix problems. They are sent only after you turn them on in Settings, and names and typed text are scrubbed on your phone before anything leaves it. The Google Play version uses Firebase Crashlytics (Google) to send these reports, only if you turned them on and are 13 or over; they are never sent for a user under 13 or of unknown age. When you sign out or delete the account, the app clears the identifier attached to reports on your phone; reports already sent stay with Google for up to 90 days.
- Usage statistics (screens, games) contain no names and no text you type. Off until you turn them on in Settings (all regions); you can turn them off again at any time.
- Under 13: no statistics, no crash reports, no install identifier.
- Retention: crash reports 90 days.
8. Advertising
- Ads may appear for users aged 13 and over, served through Google AdMob (banners, an ad between rounds, a native ad, and optional rewarded video). The provider collects data such as IP address, device type and ad interactions under its own policy, and it may use the device advertising ID. We do not use it to track you.
- Ads are non-personalised by default. In the EU/UK we ask for consent before any personalised ad. We show no ads at all to users under 13 or of unknown age.
- Rewarded video is optional: you tap to watch and can close it.
9. Your rights
- Delete: in the app's Settings, or email us at the address above (how to request deletion). We wait 30 days during which you can cancel, then delete or anonymise your data.
- Get a copy of your data, correct it, or object to its processing: write to us and we reply within 30 days.
- You may complain to the data-protection authority in your country.
10. Who we share data with
We do not sell your data. We use service providers that act on our behalf: server and database hosting, Cloudflare for backups (encrypted before they leave our server), and Google (Firebase Authentication, Cloud Messaging, Crashlytics / Analytics in the Google Play version, and AdMob for ads).
11. Age
Laffah is for ages 13 and over. If the app learns that a user is under 13, it limits itself to offline play and collects nothing. The first time you open the app we ask for your birth year (without hinting at an answer); we keep only the age band, not the year. Anyone who has not answered yet is treated like a user aged 16 and over. People under 13 use the offline modes only (one phone or the same Wi-Fi). For them there is no account sign-in, no ads, no statistics, no crash reports, no purchases, no online play and no install identifier, and their data stays on the phone and never reaches us. Ages 13 to 15 can use the online features and private online rooms (not public rooms), and see ads (non-personalised, flagged as for users under the age of consent); statistics and crash reports only if they turn them on in Settings. Ages 16 and over: the same, plus public rooms. We do not knowingly collect personal data from a child under 13 and delete it if we learn we have. A parent can contact us at the address above at any time.
12. Security and international transfers
Connections to our servers use HTTPS. Some providers (such as Google and Cloudflare) process data in other countries under appropriate safeguards.
13. Changes
Features that are not available yet (payments, coins) will be added to this policy before they launch. We show the last-updated date above and tell you in the app about material changes.