Privacy Policy

Last updated: 12 October 2026

1. Who operates Biriba

Biriba is operated by Ricardo Sierra, an individual based in Taipei, Taiwan, under the name Black Swan Apps. Ricardo Sierra is responsible for the personal data described in this policy.

For privacy questions or requests, email users_questions@blackswanapps.com. Include “Biriba” in the subject so we can identify the app your request concerns.

2. Information Biriba collects

• Account information: your email address, internal user ID, account creation and verification records, a password hash, and records used to manage sign-in, email verification and password recovery.
• Profile information you choose to provide: first name, last name and nationality. These profile fields are optional.
• Gameplay information: games you create or join, player seats, moves and other game events, saved game state, scores, results and timestamps. Games against the bot also produce records of the bot’s decisions.
• Security and diagnostic information: sign-in and account events, IP addresses, browser or client information, request details and error records. Some records are associated with your account or email address.
• Support correspondence: your email address, message and any information you send when contacting us. Please avoid sending passwords or unrelated sensitive information.

Gameplay information needed to play a multiplayer match is communicated to the other participant, including the shared game state, player seat, scores and results.

3. Why the information is used

We use account and gameplay information to provide Biriba: create and authenticate accounts, verify email addresses, recover access, run multiplayer and bot games, and maintain game state. Optional profile information lets you maintain your profile.

Security and diagnostic records help protect accounts, investigate failures and abuse, and keep the service working. We use support messages to respond to your requests.

Where European data-protection law applies, processing necessary to provide the service is based on performing our agreement with you. Security, troubleshooting and support are based on legitimate interests in operating and protecting the service, subject to your rights. Processing required by law is based on that legal obligation. Any processing requiring consent will need that consent.

An email address and password are required for an account. Without them, account-based features cannot be provided. You can leave the optional profile fields blank.

4. Service providers and disclosures

Biriba uses the following services to operate:

• Hetzner: hosts Biriba’s main application server and database in Helsinki, Finland.
• Cloudflare: handles network delivery and protection, and forwards messages sent to our support address.
• Resend: is the app’s provider for account-related emails, such as email verification and password recovery.
• Microsoft Outlook/Hotmail: receives support messages forwarded to the operator’s inbox.

We may also disclose information where legally required, or where necessary to investigate abuse, protect users and the service, or establish or defend legal claims.

Biriba does not sell personal information or share it for cross-context behavioural advertising. The current app does not include advertising or cross-app advertising tracking. Sentry reporting is disabled in the reviewed iOS build and production backend.

5. Storage and international processing

The main application server and database are hosted in Finland. Ricardo Sierra administers the service from Taiwan. Support correspondence and information processed by network and email providers may be handled in other countries.

The countries involved may have different data-protection laws from your country. Where applicable law requires safeguards for an international transfer, those safeguards must be in place. Contact us for information about the arrangements that apply to your data and how to obtain details of applicable safeguards.

6. How long information is kept

• Verified account and profile information: kept while your account remains open and removed when you delete it. Unverified accounts are removed after 30 days.
• Game records, saved state and bot-decision records: removed 90 days after the game finishes or is abandoned. Unfinished games with no activity for 90 days are also removed; a game with a currently connected player is not treated as abandoned.
• Security and error records in the app database: removed after 90 days. Records directly linked to a deleted account are removed with that account.
• Verification and password-reset records: removed after their tokens expire. Sign-in refresh-token records are removed after expiry or with account deletion.
• Support messages: kept for up to 12 months after the request is resolved, unless needed for an ongoing issue or legal obligation. This inbox is reviewed manually.
• Scheduled database backups: created daily and rotated daily; a copy containing deleted data can remain for up to nine days before rotation removes it. Backups are for recovery, not normal account access.

Database cleanup is scheduled every six hours, so records are normally removed on the next run after their retention period ends. If service is interrupted, cleanup resumes when service is restored. Account deletion removes the live account immediately after confirmation. A legal obligation or specific dispute may require limited information to be retained longer; any such exception must be limited to what is necessary.

Server-console logs are rotated by size, with a limit of about 30 MB per app container. The operator reviews these operational logs monthly and removes unneeded records; the database’s automatic 90-day rule does not delete console logs. Network and email providers also maintain technical records under their service arrangements. Contact us for details about records relevant to your request.

7. Your choices and privacy rights

You can update optional profile information in the app. To ask about access, correction, deletion or another privacy right, contact users_questions@blackswanapps.com. We may need to verify your identity before responding, and applicable legal exceptions may affect a request.

Depending on the law that applies to you, you may also have rights to obtain a copy of your data, restrict or object to processing, withdraw consent where processing relies on consent, or complain to your local data-protection authority. Withdrawing consent does not affect processing already carried out lawfully.

In app versions that include account deletion, open Profile → Delete account, read the confirmation and enter your password. This permanently removes your account, profile, sign-in tokens, linked security records and all games involving your account, including shared matches. If you are using an older app version or cannot access your account, contact us to request deletion. Support correspondence is handled separately as described above. Backup copies expire through the rotation described above.

8. Information stored on your device

The iOS app stores sign-in tokens and your email address using device secure storage. It also uses local preferences for app settings. These support sign-in and app operation; the current app does not use them for advertising tracking.

9. Children and younger users

Biriba is a general-audience card game and does not currently verify users’ ages. Where local law requires parental permission for a younger user’s personal data, that permission is required. A parent or guardian who believes a child has provided information without the required permission can contact us to request investigation and deletion. The App Store’s age rating describes content suitability and does not replace local privacy requirements.

10. Changes to this policy

Changes will be reflected on this page with an updated date. Where required, material changes will be communicated separately.