Privacy Policy

Last updated: 24 October 2026

El Hara is a card game, not an advertising company. We keep the things the game cannot work without — your account, your cards and your friends — and a few plain numbers about how the game is used, so we can make it better. The only ads are the ones you choose to watch for a reward, and we do not sell your data to anyone.

What we keep

Your account

• Email address — so you can sign in, so we can send you the activation link and a password reset link, and so we can reach you about your account.
• Display name and username — what other players see and search for.
• Profile picture — entirely optional.
• Password — never stored. We store a scrypt hash of it, which cannot be turned back into the password. We do not know your password.

You can play without an account at all. Your progress then stays on your phone only, and no email or name reaches us.

Signing in with Google or Apple

Choosing Google or Apple gives us your permanent identifier with that provider, your email address, and your name. Your Google or Apple password never passes through us. If you use Apple's Hide My Email, we receive the relay address Apple gives you, not your real one. If that email already has an account with us, we ask you first before linking the two.

Your game progress

The cards you have collected, the decks you have built, your packs, the trips you have finished, your in-game coins, and your trophies and rank. This is tied to your account so a new phone picks up exactly where the old one left off.

Your friends and matches

• Friends — who you added, who added you, and who you blocked.
• Reports — if you report a player, or someone reports you: who reported whom, the reason, and the date. Only our team sees these.
• Match history — who you played, who won, and when.

Notifications

If you allow notifications, the app gets a device token from Firebase (Google) that identifies the app on this phone, and sends it to us with the phone's platform (iPhone or Android) and its time zone, so we can send at a sensible hour. The token says nothing about you or your phone. Each kind of notification has its own switch in Settings, and you can turn them all off from your phone's settings. If you do not allow them, nothing is sent.

Purchases

If you buy جنيه or the Alley Pass, the payment happens at Apple (App Store) or Google (Google Play), not with us. We never see your card or payment details. What reaches us from them is the transaction number, what you bought, when, and its state (paid or refunded). We keep that on your account so you get what you bought exactly once, and get it back if you change phones.

Ads

The game only has ads you choose: you tap to watch an ad and get a reward. No ad ever shows on its own. The ads come from Google AdMob. Before the first ad, Google asks for your consent if you are in a place where the law asks for it (like the EU and the UK), and on iPhone, Apple asks whether you allow tracking for ads.

If you allow it, AdMob may use your phone's advertising ID (IDFA on iPhone, Advertising ID on Android) to pick the ad. If you decline, you still see ads, just less matched to you. We send Google a random number for each ad so we can check you watched it to the end and pay the reward. We do not send it your email or your name. You can change your mind any time in your phone's settings (Privacy → Tracking on iPhone).

To show and measure ads, AdMob also collects from your phone: your IP address, from which it estimates your rough area such as your country or city (not your exact location), whether you watched or tapped an ad, and basic crash and performance data about the ad. This goes straight to Google, not to us. Google explains what it does with it on its page about how Google uses information from apps that use its services.

Your session

When you sign in, your device holds a token. We do not store the token itself, only a hash of it — so even someone with our database could not sign in as you.

Usage statistics

The game sends our own server — and no other company — a few simple events: the game opened, the tutorial finished, a match ended (its mode, result and length), a pack was opened, a screen was opened, and whether you allowed notifications. They are tied to a random id created on your phone the first time you open the game, and to your account id if you are signed in. They contain no name, email or location. We use them to see whether players come back, and what stops them.

If you write to us

When you report a problem or contact us for business from inside the game or from the website, what you typed and your email address are sent as an email to our inbox so we can reply. They are not stored in our database.

Server logs

• Sign-in times and your account id, so we can trace a problem after the fact.
• Your IP address is held in the server's memory for a few minutes only, to stop password guessing and message flooding. It is never written to disk and never attached to your account.

What other players see

In matches and in the friends list, players see your name, username, picture and rank. That is all. Your email address is never shown to anyone.

There is no chat in the game. In a match there are only a few fixed emotes you can send to your opponent. If someone bothers you with their name, picture or emotes, you can block or report them from their profile, and our team reviews reports.

Camera and photos

Choosing a profile picture opens your photo library or camera. Only the picture you pick is uploaded. We do not read your library and we do not open the camera on our own.

Emails we send

Only three: the activation link when you create an account, a password reset link if you forget it, and a reply if you wrote to us. No marketing emails.

What we do not do

• No ads that show on their own, no banners, no ads between matches. Only the ones you choose to watch.
• No third-party analytics. The usage statistics above go to our own server only. The only outside piece is the AdMob ads described above.
• We do not sell, rent, or trade your data with anyone.
• We do not collect your location, your contacts, or anything else off your phone. (AdMob estimates your rough area from your IP, as described above.)

Who else your data touches

• Google Cloud — our server runs there.
• Cloudflare — sits in front of the site and the game, and stores card art and profile pictures (R2).
• Firebase Cloud Messaging (Google) — delivers notifications to your phone. It sees the app's device token and the text of the notification, nothing more. If you decline notifications, nothing goes to it.
• The email service (Resend or Gmail) — delivers the activation and password emails, so it sees your email address and the message.
• Google and Apple — only if you choose to sign in with them.
• App Store and Google Play — take the payment if you buy something, and send us only the transaction number.
• Google AdMob — shows the ads you choose to watch, with the consent described above. It sees the advertising ID if you allow it, your IP, and how you interact with the ad.
• Google Fonts — this page loads its fonts from them, so they see your IP. The game itself loads no fonts from outside.

How long we keep it

For as long as your account exists. You can delete it yourself from inside the game: Settings → Delete my account. It goes immediately: your account, email, name, picture, cards, friends, and your phone's notification token. If you signed in with Apple, we also ask Apple to remove the link between your Apple ID and the game. If you cannot reach the app, see the account deletion page.

A few things remain after deletion. Match history keeps that a match happened and who won, under the name you had at the time, because it is the other player's record too. Reports made about you are kept so our team can review them. Usage statistics stay under the phone's random id, with no name or email. Logs age out on their own after a short period. An activation link stops working after 48 hours, a password link after one hour.

Your rights

You can ask to see the data we hold about you, correct anything wrong in it, and delete your account entirely. Deleting is in your own hands inside the game; the other two take one email.

Children

The game is not directed at children under 3, and we do not knowingly collect data from anyone we know to be under that age. If you are a parent and believe your child has made an account, email us and we will remove it.

If this changes

We will update the date at the top. If the change is significant, we will say so inside the game.

Contact

Any question about this page, or to request account deletion: [email protected]