سياسة الخصوصية
ملخص بالعربية (النص العربي هو الملزِم، والنص الإنجليزي ترجمة للتيسير؛ ويسود النص العربي عند أي اختلاف)
عند تفعيل تقارير الأعطال عبر Firebase Crashlytics من Google، نجمع لإصلاح الأعطال أثر الاستدعاءات، وطراز الجهاز، ونظام التشغيل وإصداره، وإصدار التطبيق، ووقت العطل، وعلامات حالة التطبيق وقت العطل، ومعرّفًا مستعارًا لتثبيت التطبيق؛ وقد تُعالَج لقطة ذاكرة مؤقتة عند أعطال NDK. لا نرسل أسماء المستخدمين أو أرقام الهواتف أو عناوين البريد الإلكتروني أو محتوى المحادثات أو بيانات الدفع، ولا نضيف معرّفات الحساب أو السجلات أو المفاتيح المخصصة إلى التقارير. يحتفظ Crashlytics بهذه البيانات افتراضيًا 90 يومًا قبل بدء إزالتها من الأنظمة الحية والنسخ الاحتياطية. للتواصل بشأن تقارير الأعطال أو لطلب المساعدة: support@elaabha.app.
إلعبها منصّة ألعاب (وأول ألعابها البلوت). نجمع فقط ما يلزم لتشغيل حسابك والألعاب: بريدك الإلكتروني واسم العرض (والدخول الأساسي عبر البريد وكلمة المرور)، وكلمة مرورك (تُخزَّن كقيمة مشفّرة لا يمكن عكسها فقط، وليست كنص ظاهر)، ورموز الدخول لمرّة واحدة (OTP) المُرسلة إلى بريدك (مع تخزين رموز الجلسة على خوادمنا كقيم مشفّرة لا يمكن عكسها)، وبيانات اللعب (المباريات والأكلات والنقاط)، وعنوان الـ IP أثناء اتصالك بخدمة اللعب الآني. وتُخزَّن بياناتك لدى مزوّد الاستضافة (Railway) ومزوّد قاعدة البيانات المُدارة (PostgreSQL مثل Supabase). لا إعلانات، ولا متتبّعات طرف ثالث، ولا بيع للبيانات، ولا مقامرة بأموال حقيقية. إلعبها غير موجّهة للأطفال دون 13 عامًا. يمكنك حذف حسابك من داخل التطبيق في أي وقت فتُحذف بياناتك الشخصية. تُحذف جلسات الدخول المنتهية أو الملغاة (سجلات الجلسة ورمز التحديث على خوادمنا) تلقائيًا عبر مهمة يومية على الخادم بعد 30 يومًا من انتهائها أو إلغائها، وتبقى الجلسة المرتبطة بسجل لعب مع ذلك السجل. ولا يخزّن التطبيق بنفسه سجلات طلبات HTTP أو الاتصال الآني (WebSocket)؛ فهي تبقى فقط في سجلات مزوّد الاستضافة (Railway) طوال مدة الاحتفاظ بالسجلات لديه. الاختصاص القضائي: المملكة العربية السعودية. للتواصل: support@elaabha.app. (يُنصح بمراجعة قانونية وترجمة عربية معتمدة قبل النشر.)
Privacy Policy — Elaabha (إلعبها)
Owner decisions applied; professional legal review and a certified Arabic legal translation are recommended before publication. This is the engineering-maintained source for the privacy policy hosted at
https://legal.elaabha.app/privacyand linked from the in‑app account screen (M‑COMP‑001). It describes the data the Elaabha platform actually collects, based on the current backend data model.
- Document version: privacy-v1
- Effective date: 2026-06-27
- Who we are: Elaabha (“إلعبها”) is a games platform; Baloot is its first game. This policy applies to the Elaabha mobile app and its backend services.
- Contact:
support@elaabha.app. - Governing jurisdiction: Kingdom of Saudi Arabia.
- Binding language: Arabic. The English text is a translation provided for convenience; if the two differ, the Arabic text prevails.
1. Data we collect
We collect only what is needed to run your account and the games.
| Category | Examples | Why |
|---|---|---|
| Account identity | Email address and display name | Create and sign in to your account (email + password is the standard sign‑in) |
| Authentication | Your password (stored only as an irreversible hash, never in plain text) for email sign‑in; one‑time codes (OTP) sent to your email; session tokens stored only as irreversible hashes on our servers; the app stores your session token on‑device in the platform secure storage | Sign you in and keep you signed in securely |
| Gameplay data | Matches, hands, scores, and game actions tied to your account | Run multiplayer games, scoring, and reconnection |
| Connection/technical | IP address and basic connection metadata while connected to the realtime game service | Operate the realtime service and protect against abuse |
| Crash diagnostics (when Crashlytics is enabled) | Stack traces, app version, device model, operating system name and version, crash timestamp, crash-time state flags (including root/jailbreak status), and a pseudonymous installation identifier. A temporary minidump may be processed for an NDK crash | Diagnose and fix crashes |
We do not collect: precise location, contacts, photos, or device identifiers for advertising.
2. What we do NOT do
- No advertising and no ad/marketing trackers.
- No third‑party analytics SDKs.
- Crash reporting. We plan to use Firebase Crashlytics, a Google service. When enabled, it will receive the crash diagnostics listed in §1 to help us diagnose and fix crashes. We do not send names, phone numbers, email addresses, chat content or payment data in crash reports, and we do not add account identifiers, custom logs or keys. This policy update comes before SDK integration; the current release may not send crash reports yet.
- No selling or renting of personal data to anyone.
- No real‑money gambling; the games are for entertainment and do not involve wagering real money.
3. How we use data
To provide and secure your account; to run matches, scoring, reconnection, and matchmaking; to maintain service integrity and prevent abuse; and to comply with legal obligations; and to diagnose and fix app crashes. We do not use your data for advertising or profiling.
4. Sharing
We share personal data only with: (a) infrastructure providers that run the service on our behalf under confidentiality obligations — our application‑hosting provider (Railway) and a managed PostgreSQL database provider (Supabase, or a Railway‑compatible PostgreSQL service) that stores your account and gameplay data; (b) Google, through Firebase Crashlytics, as a processor of crash diagnostics described in §1; and (c) authorities where required by law. We do not share data with advertisers.
5. Retention
We keep account data while your account is active. Gameplay records are retained to operate matches and history. When you delete your account (see §7), we delete or irreversibly anonymize your personal data within 30 days, except where retention is required by law.
Expired or revoked sign‑in sessions (the session and refresh‑token records on our servers) are deleted automatically by a daily server job 30 days after they expire or are revoked. A session record that is still linked to a gameplay record is kept with that record. The app does not store HTTP or realtime (WebSocket) request logs itself; they remain only in our hosting provider's (Railway) logs for that provider's log‑retention period.
Crashlytics' default retention is 90 days: Google keeps crash stack traces, extracted minidump data and associated identifiers for 90 days before starting removal from its live and backup systems.
6. Security
Session tokens are stored on our servers only as irreversible hashes and are single‑use/rotated; transport is over HTTPS/secure WebSocket; the mobile app keeps your session token in the platform secure storage (Keychain/Keystore). No system is perfectly secure, but we apply reasonable safeguards.
7. Your rights & account deletion
You can delete your account at any time from within the app (Account & Settings → Delete account), which permanently removes your account and personal data per §5. You may also request access to or correction of your data by contacting support@elaabha.app; contact us there with questions or requests about crash reports as well. Depending on your region you may have additional rights (access, deletion, objection); we honor applicable rights.
8. Children
Elaabha is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
9. International users
Your data may be processed in the data‑center region(s) operated by our hosting and database providers (Railway and our managed PostgreSQL provider). By using Elaabha you consent to such processing, subject to applicable law.
10. Changes
We may update this policy. Material changes will be reflected here with a new effective date and, where appropriate, surfaced in the app.