Bridgefolk privacy policy
Updated 30 October 2026. Bridgefolk for iOS and Android is provided by Lattice Labs Pte. Ltd., Singapore. Our developer name on Google Play is “Lattice Inc”.
Your account
We collect your chosen display name, unique username, avatar and a random player ID to identify you, let you sign in and show your profile to other players. You do not need to give your real name, email address or phone number. We do not access your address book.
Your six-digit PIN is sent over an encrypted connection for account creation, sign-in and PIN changes. The server stores only a salted hash of the PIN. Signed-in devices use separate random session credentials; the server stores their hashes. Sessions do not expire automatically. Signing out revokes that device's session. Deleting the account revokes all its sessions.
Games, friends and table chat
Cloudflare hosts our website, account service and online games. To run tables and reconnect players, the game service stores player IDs, display names, avatars, table membership, cards, bids, plays, results and table chat messages with sender details and times. Online traffic uses HTTPS and secure WebSockets. The service can read this data to run the game.
Players at your table see your display name, avatar, messages and public play. Each online player receives their own hand; dummy becomes public after the opening lead. Participants can review completed hands and keep them in their own history.
We store friendships, removed friendships, blocks, invitations, presence preferences, multiplayer ratings and rating history. These support friends, invitations, rankings and reconnection across devices. Friends can see your online or table status unless you turn it off in Settings. Players who share a table can become friends automatically; removing a friend prevents automatic re-adding.
We also store the streak count, last qualifying day and streak badge shared with friends. Daily Ten submissions include your player ID, day, board, contract, score and accuracy when available. These provide comparisons and rankings. Other players can see your profile and results in leaderboards. Your detailed streak calendar, learning progress and local game history do not sync through your account.
Block and Report
You can block a player or report a message from table chat where these controls are available in your app version. Blocking removes the friendship, hides your online status and last-seen time from each other, cancels pending invitations, and stops friend re-adding, invitations and nudges in both directions. It does not remove either player from a table, cancel the game or delete chat already shared. Hiding blocked players' chat requires support in your app version; older versions may still display their messages.
Blocks belong to your account and persist across sign-in and reinstalling the app. They have no automatic expiry. Unblocking does not restore the friendship or old invitations. Deleting your account removes blocks you created; blocks other people placed against your player ID remain until they remove them or delete their accounts.
When you report, we store your account ID, the reported player's ID, reason, and device and server timestamps. We also store any explanation, message ID, message text or table code included in the report. We use these details to investigate abuse. Reports are stored on Cloudflare for review by authorised team members and are not shown to other players. Reporting does not automatically block a player. Reports have no automatic expiry and remain after either account is deleted.
You can also report chat or ask about deleting a report by emailing team@latticelabs.app. Include the player's username, the table code if available, and the message or a screenshot. Do not send your PIN or session credentials. Email reports include your email address. In-app reports are not automatically emailed to this address.
Nearby play and QR scanning
On iOS, nearby play uses Apple's MultipeerConnectivity over Bluetooth and Wi-Fi, with local network permission. Android uses Google Play services Nearby Connections over Bluetooth and Wi-Fi. Android 12 and below, including Android 12L, require location permission for discovery. We do not use that permission to determine your geographic location. Newer Android versions request Nearby devices permissions; Android 17 and later also request local network permission.
Nearby discovery advertises the table name, host's display name and avatar, game variant and available seats. Devices exchange player identities, seats, game state and chat. Current nearby connections are encrypted. The host can access the full game state and, when relaying an online connection, the relayed player's table credential and hand. Play nearby with people you trust. A nearby table can move to Cloudflare automatically when the host has internet access, carrying its game and chat data with it.
The camera is used when you choose Scan QR to add a friend. QR recognition runs on your device, using Apple's camera framework on iOS and CameraX with Google ML Kit on Android. Bridgefolk does not save or upload the camera frames. The decoded username is used to look up and add the friend. You can enter a username without using the camera.
Google's Nearby and ML Kit SDKs may send Google device and app information, installation or other device identifiers, usage, performance and diagnostic data. ML Kit telemetry can include image format and resolution, but not the camera images. This SDK telemetry is separate from our PostHog setting.
Product analytics and crash reports
Release builds on both platforms use PostHog, hosted in the US, to understand use and fix faults. We send events such as screen visits, game and Daily Ten results, streak changes, lesson and practice activity, friend and table actions, and use of chat. Crash reports include exception types and stack traces. Exception messages and breadcrumbs are removed.
Events are tied to your random player ID, which can be linked to your account. They are not anonymous. PostHog also receives installation and session identifiers, device model, operating system, app version and network information such as your IP address. We disable IP-based location enrichment, session replay and automatic interaction capture. We do not add your display name, username, PIN, credentials, chat text or card contents to analytics events.
Sharing is on by default. On either platform, open Settings using the avatar and gear button on the home screen, then turn off “Share anonymous usage analytics”. This stops subsequent PostHog collection on that device, including crash reporting. It does not delete earlier data or control Google or Apple diagnostics. Your choice is saved on the device. A fresh Android install or backup restore returns this setting to its default. Debug and automated test builds do not send PostHog analytics.
We have no adverts, do not use an advertising ID, and do not sell personal data or share it for advertising.
Notifications, local storage and backups
With permission on iOS, we store your Apple Push Notification service (APNs) token and notification preference to send friend nudges. The notification includes the sender's display name. You can turn nudges off in Settings or disable notifications in iOS settings. Android does not currently register a push token or receive friend push notifications. Daily Ten reminders are scheduled locally on both platforms.
Games, history, settings, learning and practice progress, and detailed streak records stay in the app's storage on your device. They can include other players' names and IDs. History remains until you remove it or it reaches the app's history limit. Exports can include names, cards, bids, plays and results; the recipient you choose receives the file.
On iOS, session and table credentials are stored in Keychain. Keychain data can survive uninstalling the app. Local app data may be included in iCloud or computer backups, depending on your settings.
On Android, credentials are encrypted using Android Keystore and stored outside backups. Only the app's local game, history, settings, learning, practice and streak files are allowed in backups and device transfers. Account caches, shared preferences, analytics identifiers and queues are excluded. Restoring a backup does not restore a signed-in session. Backup availability depends on your device and provider settings. Android 12 and later require encryption capabilities for cloud backup.
Retention and account deletion
Your account remains until deleted. Delete your Bridgefolk account explains the in-app steps and how to request deletion by email without the app. Successful in-app deletion removes the online profile, username, PIN hash, active sessions, friendships, blocks you created, invitations, push token, shared streak, multiplayer ratings and your rating history. It also erases local game data and settings on that device.
In-app deletion does not erase PostHog data. To delete your PostHog person profile and events, email team@latticelabs.app with your Bridgefolk username before erasing the account. Wait for us to confirm analytics deletion. We need the existing account to match your username to the player ID used for analytics; a former username alone cannot reliably identify those records after account deletion. Do not send your PIN. You can also request deletion of both analytics and the online account by email without the app. We delete the analytics first, then the account, within 30 days. Turning analytics off does not erase earlier events. PostHog data otherwise follows our project's retention settings; there is no automatic expiry set by the app.
Table records, including game state and chat, expire after seven days without a retention-extending game action or seat change. Continued play can extend this period. Chat and reconnection alone do not extend it. Account deletion does not immediately erase these shared table records. Daily Ten submissions remain until 32 days after midnight UTC at the start of the relevant game day; deleted accounts are removed from public rankings immediately.
Invitations expire after ten minutes. Nudge cooldown records expire after 15 minutes and are removed during subsequent server housekeeping. We retain the deleted account's random ID and revoked credential hashes without automatic expiry to reject old credentials. These are session credential hashes, not the PIN hash. Rating event IDs and one-way event fingerprints also remain without automatic expiry to prevent duplicate scoring. Other players' rating history is not undone.
In-app deletion does not remove other devices' local data, recipients' exports or existing backups. Anonymised aggregate statistics may remain. Server logs are kept for up to 30 days. Google and Apple SDK records follow their providers' retention policies; the app's table expiry does not apply to them. Contact us about earlier deletion of table data, analytics, support correspondence or abuse reports. Include the table code where relevant, never credentials.
Service providers and support
Cloudflare processes hosting, account and online game data for us. PostHog processes product analytics and crash reports. Apple provides iOS networking, camera, Keychain, backups, APNs, the App Store and TestFlight. Google provides Android services, Nearby Connections, ML Kit and Google Play. Providers may process data outside Singapore or your home country. Their policies explain their own processing: Cloudflare, PostHog, Apple and Google.
Apple and Google may provide store, testing and diagnostic information according to your settings and their services. TestFlight can share crash logs, device details and feedback or screenshots you submit. We use these to fix problems. If you email support, we receive your email address, message and attachments and use them to answer your request. Contact us to ask for access, correction or deletion of your data.
Children and earlier versions
Bridgefolk is for people aged 13 and over. It is not directed at children under 13. If you believe a child under 13 has provided personal data, contact us so we can investigate and delete it.
Older versions may lack the features described here. The contract-only iOS version 1.0 (build 2) had no online accounts or analytics and used unencrypted nearby connections. Its behaviour is described in the 18 October policy. We update this policy when our handling of data changes.
Contact
Lattice Labs Pte. Ltd., 51 Penjuru Road, #4-00, Singapore 609143. Google Play developer name: Lattice Inc. Email team@latticelabs.app.