Privacy policy

Effective November 1, 2026

Rummage is a free card game for Android and Windows. It plays Hoffpauir Rummy, a family rummy game. This page explains what the app keeps, what it sends, and who can see it. If anything here is unclear, email [email protected].

What stays on your device

The app saves these on your phone or computer, so they're there next time:

• Your settings: sounds, vibration, trash talk, the table and card looks, and where cards played on someone else's meld show up.
• Your stats: games played and won, rounds played, times you went out, your best round and your biggest pickup.
• A game in progress against the computer, so you can pick it up later.
• For online play: the name you use, the server's address, and the seat to go back to if you get cut off. That seat is the table's code and a rejoin code, and the app clears it once the game is over or the seat is gone. It also keeps whether you've bought the full table, the names of the people you've played with lately (up to 20, so you can start a table for them again), the names you've hidden or reported, so they stay hidden, and that you agreed to the rules for playing online.

The app doesn't send any of this to us, apart from what online play sends (below). To delete it, clear the app's storage in your phone's settings, or uninstall the app. The stats screen also has a Start over button.

If your phone backs up its apps to your Google account, Android may include this data in that backup. That's between you and Google, and we can't see it.

Online play

When you play online, the app connects to our game server at rummy.hoffbase.uk. It sends:

• The name you type, up to 20 characters. Everyone at your table sees it, so pick one you're happy to share. If you leave it blank, you're "Player".
• The table's settings, if you start a table: how many seats, the score to play to, and the computer players' level.
• The table's code, if you join a friend's table.
• Your moves and your rat scratches.
• A report, if you report a player: which seat, and why, picked from a short list.
• Your reactions, if you send any: an emoji or a few set words, like "Nice play!", picked from a list. The server passes each one to everyone at your table and doesn't keep it. Nobody can type a message to anyone.
• Your rejoin code, if your connection drops and the app asks for your seat back.
• The app's version and your device's operating system, such as "android". The app names itself this way on every connection. The server doesn't keep it.

The server sends back your own cards, what everyone can see on the table, and the names of the other players.

What the server keeps:

• Each table lives only in the server's memory: the players' names, the cards, the moves, the scores, and a rejoin code for each seat.
• There's no database. The server writes none of this to disk.
• A table is deleted about half an hour after the last player disconnects.
• When the server restarts, for an update for example, every table is gone.
• So that no one address can open too many connections at once, the server counts the open connections from each IP address. The count is dropped as soon as those connections close.
• The server's log notes when it starts and stops, and any errors in the game. It doesn't log IP addresses or moves.
• If someone reports a player, the log notes the table's code, the seats, the reported player's name and the reason, so we can act on it. That's the only time the server writes down a name. The log clears out its oldest entries as it fills.

Your connection is encrypted on its way across the internet. If you change the server address in the app to someone else's server, what you send goes to them instead, and this policy doesn't cover it.

Cloudflare

Our game server sits behind Cloudflare, which carries the traffic between the app and the server. Cloudflare also hosts this website.

Everything online play sends passes through Cloudflare on the way, including your name and your moves, along with your IP address and the details of each connection. Cloudflare uses the connection details to protect the server, for example by limiting how often one address can connect. Cloudflare handles all of it under its own privacy policy.

This website has no cookies and no analytics.

What we don't do

• No accounts or sign-in.
• No ads.
• No analytics, tracking or crash reporting.
• No location, contacts, camera, microphone or photos. On Android, the app asks only for internet access, for online play, and for Google Play's billing, for the one purchase.
• We don't sell, rent or share your information with anyone.

On Windows, the About screen can show a Support Tom button. It opens a donation page in your web browser, and the app sends nothing to that site. The Google Play version doesn't have it.

Buying the full table

On Android, one purchase unlocks the full table. Google Play handles it from start to finish: your payment details go to Google, never to us or to the app. Play tells the app the purchase went through, and the app remembers that on your device. Google tells us about each sale what it tells every developer, under Google's privacy policy, and we use that only to keep our accounts.

Children

Rummage isn't directed at children. The computer players' trash talk has a Salty setting that swears. It's off unless you choose it: the app starts on Clean, and you can also turn trash talk off.

We don't knowingly collect personal information from children. The app never asks anyone's age or real name. If you think a child has shared personal information through online play, email us.

Changes

If this policy changes, we'll update this page and the date at the top.

Contact

Questions or requests: [email protected]