Plasta Privacy Policy

Effective: 31 July 2026 · Last updated: 31 July 2026 · Applies to Plasta for iPhone, version 1.0

This policy explains what information Plasta collects, why, who else processes it, and what you can do about it. It describes what the app actually does — not what a game like it might do.

1. Who operates Plasta and how to contact us

Plasta is an independent iPhone game published on the App Store. It is operated by Chaz Mitchell, an individual developer based in California, United States, who is responsible for the information described in this policy.

For any privacy question, request or complaint — including access and deletion requests — write to realplastaapp@gmail.com. This is the same address used for general support, and it is the only contact channel for Plasta.

2. What information we collect

2.1 Account identity

• An account identifier. Plasta signs you in automatically the first time you open the app, before you choose anything, so the game works straight away. This creates an account with a random identifier. Every other record described here is linked to that identifier.
• Your email address, if you sign in with Apple or Google. It is stored in a private record that only your own account can read; it is not part of your public profile and other players cannot see it. If you use Apple’s Hide My Email, we receive and store the private relay address Apple gives us instead of your real one.
• Which sign-in methods are linked to your account — that is, whether the account uses Apple, Google, or neither.
• Your name from Apple, if you sign in with Apple and choose to share it. If your profile does not already have a name, the name Apple provides may be used as your starting display name, which is visible to other players. You can change it at any time.

2.2 Profile you create

• A display name, or a unique username if you are signed in with Apple or Google.
• Avatar initials derived from your name.
• A short player code used so friends can find you.
• The date your account was created, and a last-seen timestamp refreshed while you have the app open, which is how the game shows whether a player is online.

2.3 Gameplay and progress

• Your level, XP and lifetime XP.
• Your balances of the two in-game currencies, Bucks and Diamonds, and lifetime totals earned and spent.
• Match statistics — games played, wins and losses, win rate, streaks, and a range of Plasta-specific counters such as cards and clubs captured and highest match score.
• Achievements you have unlocked and your progress towards them.
• Ranked play data — your rating, rank, wins and losses, and a short history of your most recent ranked results.
• Cosmetics you own and the items you have equipped.

2.4 Friends and social

• Friendships and friend requests you send or receive, stored as links between account identifiers.
• Match invitations you send or receive, which include the sender’s display name and the lobby code.

2.5 Online match data

While you are in an online lobby or match, the state of that game is stored so it can be shared with the other players in it. This includes the lobby code, the players seated in it and their display names, and the live state of the game — the board, the deck, moves, scores and each player’s hand. It exists so the match can be played, and is removed when the match ends and the players leave.

2.6 Purchases

If you buy Diamonds, we record which pack was purchased, how many Diamonds were granted, the quantity, Apple’s transaction references, whether the purchase came from Apple’s live or test environment, the purchase date, when it was fulfilled, and whether you were signed in or playing as a guest at the time. Your profile also holds a running total of Diamonds purchased and the date of your most recent purchase. This information is linked to your account.

If you bought as a guest, the account it is linked to is a guest account — a random identifier with no email address, name or Apple ID attached (see section 9). We do not ask you to identify yourself in order to buy, and we do not learn who you are by your buying.

We never receive your payment card details, your billing address, or your Apple ID. See section 10.

2.7 Technical and diagnostic information

• Server logs. Our purchase-processing service records events such as a granted or duplicate purchase, including the account identifier and Apple’s transaction reference. These logs are held by our hosting provider.
• Network information seen by our providers. When the app connects to a service described in section 6, that provider necessarily sees your device’s IP address and request details in order to answer. We do not store IP addresses ourselves.
• Local diagnostic snapshots. The app keeps a small technical snapshot of recent online-play activity on the device to help diagnose connection problems. It stays on your device — the app does not transmit it anywhere.

3. How the information reaches us

• Automatically, when you first open the app — the account identifier described in 2.1.
• From you — the name you choose, the friends you add, and the matches you play.
• From Apple or Google, if you choose to sign in with them — your email address, and from Apple your name if you share it. We only ever receive what that sign-in provides; Plasta cannot read anything else in your Apple or Google account.
• From Apple, when you make a purchase — the signed confirmation of the transaction, which we check to decide how many Diamonds to grant.
• Generated by playing — your statistics, achievements, level and match results.

4. Why we use each kind of information

We do not use any of this for advertising, for profiling, or to track you across other apps or websites.

5. What other players can see

Plasta has friends, leaderboards and online play, so parts of your profile are readable by other people using the app. We would rather be specific about this than leave you to assume.

Any signed-in Plasta player can see the following about your account, whether or not they are your friend:

• your display name or username, and your avatar initials;
• your player code;
• your level and XP;
• your match statistics and your ranked rating, rank and recent ranked results;
• your achievements;
• your cosmetics and equipped items;
• your Bucks and Diamonds balances, and the total number of Diamonds the account has purchased and when it last made a purchase;
• whether the account signs in with Apple or Google, or is a guest account;
• when the account was created, and when it was last online.

Your email address is not visible to other players. It is held in a private record that only your own account can read. Neither is anything else not listed above.

Players in the same online match additionally see the match itself — the display names of everyone seated, and the state of the game as it is played.

If you would prefer not to have this information visible, do not sign in and do not use the online features, or delete your account.

6. Service providers who process data

Plasta has no servers of its own. It relies on these providers, which act as processors for us:

Google (Firebase and Google Cloud)

• Firebase Authentication — creates and manages your account and sign-in, and holds the email address associated with your Apple or Google sign-in.
• Cloud Firestore — the database holding your profile, progress, friends, match data and purchase records.
• Cloud Functions and Cloud Logging — verifies Apple purchase confirmations and grants Diamonds, and records the operational logs described in 2.7.
• Google’s content network. The app loads the Firebase software libraries and its fonts from Google-operated addresses each time it starts. This means Google receives your device’s IP address and basic request information when you open Plasta, before you do anything in the game. We do not receive that information, and it is not used by us for any purpose.
• Google Sign-In — only if you choose to sign in with Google.

See Firebase’s privacy information and the Google Privacy Policy. Google retains technical information such as request logs according to its own practices, which we do not control.

Apple

• Sign in with Apple — only if you choose it. Apple tells us your account identifier and, depending on your choice, your email (real or private relay) and name.
• The App Store and StoreKit — distributes the app and processes every purchase. Apple, not Plasta, handles your payment. Apple keeps its own transaction and billing records, which it controls and which are governed by Apple’s Privacy Policy.

We do not sell your personal information, and we do not share it with anyone other than the providers above and the other players described in section 5. We may disclose information if we are legally required to.

7. What Plasta does not do

All of the following are true of the app as published:

• No analytics. Plasta contains no analytics software and sends no usage or event data anywhere.
• No advertising. There are no ads and no advertising software in the app.
• No tracking. Plasta does not track you across other companies’ apps or websites, does not use the device advertising identifier, and never asks for tracking permission because it has nothing to track you with.
• No crash-reporting or monitoring service.
• No cookies.
• No location, contacts, photos, camera, microphone, health or calendar access. The app requests none of these permissions.
• No selling or renting of personal information, and no sharing for advertising purposes.

8. Information stored on your device

Plasta stores the following in the app’s own storage on your device, so the game works and starts quickly:

• Your sign-in record, kept by Firebase Authentication so that you stay signed in between sessions. It holds your account identifier, the tokens that keep you signed in, and — for accounts signed in with Apple or Google — the email address and name that provider gave us. It is removed when you sign out.
• A cached copy of your own profile — name, level, currencies, avatar initials and ranked record — so the game can display it before it has reloaded from the network.
• Your settings, such as volume.
• Progress that is only kept on the device: daily challenge progress, achievement progress, unlocked and selected cosmetics, tutorial and onboarding state, and unclaimed match rewards.
• A note of a purchase that has been made but not yet credited, so that it can be recovered.
• The local diagnostic snapshot described in 2.7, which holds recent online-play events, connection state and any error messages from the last session.

None of this is transmitted other than as described elsewhere in this policy. Deleting the app removes it from the device.

Note that signing out clears the progress that is only kept on the device — daily challenge progress in particular is not stored in the cloud and is not restored when you sign back in.

9. Guest accounts

Plasta signs you in automatically as a guest the first time you open the app, so you can play without creating anything. Please note what that does and does not mean:

• A guest account is a real account with a random identifier and a profile stored in the cloud, not purely local play. Its name, level, statistics and other profile fields are visible to other players in the same way as any other account — see section 5.
• A guest account has no email address attached, and we hold no contact information for it.
• Guest accounts cannot claim a unique username. They can buy Diamonds — we do not ask you to register, or to give us a name or an email address, in order to make a purchase.
• Guest progress cannot be recovered. The only thing that identifies a guest account is the sign-in state stored in the app on that device. If you delete Plasta, move to another device, or the app’s stored data is cleared, that account becomes unreachable — by you and by us. We cannot restore it, and we do not promise otherwise. This applies to Diamonds bought as a guest as well as to progress.
• A purchase made on a guest account is recorded against that account’s random identifier, and against no other identity: there is no email address, name or Apple ID attached to it, and we have no way to connect it to you as a person.
• You can turn a guest account into a permanent one by signing in with Apple or Google from your Player Profile, which keeps your existing progress. If you sign in to a Plasta account you already had, the Diamonds remaining on the guest account are added to it once, and the guest account’s balance is emptied.

Guest accounts can be deleted in the app in the same way as any other account.

10. Purchases

• Apple processes all payments. Purchases are made through your App Store account using Apple’s purchase sheet, inside Apple’s system.
• Plasta never receives your full payment card details, your billing address, or your Apple ID, and cannot see them.
• What we receive is Apple’s cryptographically signed confirmation that a specific purchase took place. We check it and record the fields listed in 2.6.
• Your account is identified to Apple only by a one-way scrambled reference, not by your Plasta identifier.
• Purchase records are linked to your Plasta account — a registered one if you are signed in, or a guest one if you are not — and are used to grant what you bought and to make sure the same purchase is never credited twice.
• If you later sign in to a Plasta account you already had, we record that the guest account’s Diamonds were moved to it, so that they can never be moved a second time. That record holds the two account identifiers and the amount, and nothing else.
• Apple keeps its own separate record of your transaction and billing history, which it controls. Deleting your Plasta account does not change Apple’s records.
• We cannot see the price you paid — it is not recorded in our records. Refunds are handled by Apple, as explained under Purchases on the Plasta support site.

11. How long we keep information

We keep your account information for as long as your account exists. When you delete your account, the information described in Account and Data Deletion is removed immediately.

Some records are kept beyond that point:

• Purchase records are retained after account deletion. They are what prevents a purchase being credited twice, and are the kind of financial record ordinarily kept for tax and fraud-prevention purposes. They contain an account reference, product and transaction identifiers, and dates — no payment details.
• A claimed username may remain reserved, so it does not become available to someone else.
• Server logs are held by our hosting provider for a limited period under that provider’s own retention settings.
• Online lobby and invitation records that include your name are cleared as matches finish and invitations lapse, rather than at the moment you delete your account.

We have not adopted a single fixed retention period for every category. Where information is no longer needed for the purpose it was collected for, we remove it or it is removed by the process that created it. If you want to know what is held about you, write to realplastaapp@gmail.com.

12. Deleting your account and data

You can delete your account and its data yourself, from inside the app, at any time:

Player Profile (tap your player name or level badge at the top of any menu screen) › ACCOUNT › Delete Account › type DELETE › Delete Forever.

This is available for guest accounts as well as signed-in ones, and you do not need to contact us first. Deletion is immediate and permanent.

If you signed in with Apple or Google, you will be asked to confirm with that same service first — before anything is removed, so cancelling costs you nothing. For Sign in with Apple, that confirmation also lets Plasta release your Apple authorization, so the app is disconnected from your Apple Account as part of the deletion rather than being left attached.

If you cannot complete it in the app, email realplastaapp@gmail.com and we will do it for you.

Our Account and Data Deletion page on the Plasta support site sets out exactly what is removed and what is kept.

13. Your choices

• Play without signing in. If you do not sign in with Apple or Google, we never receive an email address or a name from a provider.
• Change your name at any time from your Player Profile.
• Do not use the online features. Plasta can be played against the computer; if you never enter an online lobby, no match data about you is shared with other players.
• Use Apple’s Hide My Email when signing in with Apple, so we never receive your real address.
• Delete your account, which removes the information described above.

Plasta has no optional data collection to switch off, because there is no analytics, advertising or tracking to consent to in the first place. The information described in this policy is what the game needs in order to work.

14. Your privacy rights

Depending on where you live, you may have rights to access the personal information we hold about you, to have it corrected, to have it deleted, to object to or restrict certain processing, and to receive a copy of it. Residents of the European Economic Area and the United Kingdom, and residents of certain US states including California, have rights of this kind under their local law.

You can exercise deletion directly in the app. For anything else, write to realplastaapp@gmail.com and tell us what you would like. We will need enough information to identify your account — normally your username and the sign-in method you used. Please do not send passwords or payment details.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for you to opt out of in that respect. If you believe we have not handled your information properly, please contact us first; you also have the right to complain to your local data protection authority.

15. Where information is processed

Plasta is operated from California, United States. Its data is stored and processed on infrastructure operated by Google, and purchases are processed by Apple. Both operate internationally, so your information may be processed in countries other than your own, including the United States. Those transfers are governed by the safeguards those providers put in place, described in their own privacy documentation linked in section 6.

If you are outside the United States, please be aware that your information will be transferred to and processed in the United States, where data protection law may differ from that of your own country.

16. Children

Plasta is not directed to children. You must be at least 13 years old to use Plasta, or older if the law where you live sets a higher minimum age for using an online service of this kind.

We do not knowingly collect personal information from anyone below that age. If you believe a child has created a Plasta account, write to realplastaapp@gmail.com and we will delete the account and its information.

17. Security

Access to account data is controlled by server-enforced database rules, so that a player can only modify their own account, and can only read match data for a game they are part of. Your email address is held in a private record that only your own account can read. Sign-in is handled by Apple, Google and Firebase Authentication — Plasta never sees or stores a password. Purchase confirmations are cryptographically verified against Apple’s certificate before any purchase is granted, and connections to our providers use encrypted transport.

No service can promise perfect security, and we do not. If you become aware of a security problem in Plasta, please tell us at realplastaapp@gmail.com.

18. Changes to this policy

We may update this policy as Plasta changes. The date at the top always reflects the current version. If a change materially affects how we handle your information, we will make that clear rather than relying on the date alone. Continuing to use Plasta after a change means the updated policy applies to you.

Plasta is operated by Chaz Mitchell, California, United States.

Questions about this policy: realplastaapp@gmail.com

See also the Terms of Service and Account and Data Deletion.

Plasta © 2026 Chaz Mitchell. All rights reserved.