Legal · Laylet Waraq

Privacy Policy

Business mailing address: StambaAI LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States.

Last updated: 22 October 2026

Developer: StambaAI LLC ("we", "us")

Contact: support@stamba.ai

This policy explains what data Laylet Waraq (ليلة ورق, the "App") uses, where it goes, and your choices. The standard private-table mode needs no email login. Some versions may enable the optional account features described below. The App shows no advertising and contains no third-party usage analytics or cross-app tracking.

On your device

Playing against the App's bots works entirely offline. Your saved game, settings, the name you choose for the table, lesson progress, and the table and accessories you have selected are stored only on your device. We cannot see them, and deleting the App deletes them.

The App also creates a random install identifier on first launch. It is not derived from your device, your Apple Account or any advertising identifier, and it resets if you delete and reinstall the App. It is only ever sent to our game server when you play online (see below).

Playing online

When you create or join a private table with friends, the App connects to our game server and sends:

  • The name you chose for the table, which the other players at that table can see
  • The random install identifier, used only to limit how many tables one install can open at once
  • Your moves (bids, cards played, reactions you tap) and a reconnection token so you can return to your seat after a dropped connection

The server deals the cards and sends each player only their own hand. Your IP address is used to protect the service from abuse (limits on connections and on how many tables can be opened). If you open a table, your IP address is kept with that table's encrypted record for the same purpose and deleted with it.

Invitations are links you choose to share yourself, through whatever app you pick. Anyone with the link can view that table's name and join a free seat.

Optional accounts

Account-enabled versions can create a guest identity secured on the device, choose a display name or handle, manage friends and invitations, and restore an account where recovery is offered. These features send account/session and relationship records to the same hosted service. Email sign-in or recovery is not available unless specifically enabled and explained in the app. Do not assume that optional source features are active in every release. Account deletion removes active identity/session and relationship records and initiates linked room and purchase-binding cleanup; failed cleanup is retried. Records required to prevent handle reuse or meet legal obligations may need limited retention. Contact support for details.

Purchases

Optional table designs and accessories are one-time purchases processed by Apple. The App uses RevenueCat to confirm and restore them. RevenueCat receives an anonymous app user ID and your purchase history (which items you bought, prices, transaction identifiers). Payment details (card numbers, billing address) are handled entirely by Apple — we never see them. RevenueCat privacy policy: https://www.revenuecat.com/privacy

Sharing a bot review

After a solo hand you can open a review of a bot's decisions and share it. Nothing is sent automatically: sharing opens your device's share sheet, and the review goes only where you send it. It contains the bot's own cards and the public table — never the other hands or the shuffle.

What we do NOT collect

  • No phone number or contacts. An optional account rollout may process a chosen name, handle, account/session identifiers, friend relationships and an email if email recovery is offered.
  • No location, photos, files, microphone or camera data
  • No advertising identifiers, no ads, no analytics and no tracking across apps or websites
  • No free-text chat — table talk is limited to preset reactions
  • No data sold to anyone

How data is shared

Your table name and moves are shared with the other players at your table, because that is how the game is played. Otherwise, data is handled only by the service providers that run the App for us: RevenueCat (purchases) and Railway (hosting the game server and Postgres database), acting as processors on our behalf. We do not sell or rent personal data.

Children

Laylet Waraq is not directed at children under 13 (or the applicable age of digital consent in your region), and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact support@stamba.ai and we will delete it.

Your rights

EEA/UK (GDPR): You have the right to access, correct, delete, restrict, or object to processing of your personal data, and the right to data portability. Legal bases: contract (running the tables you join and delivering purchases) and legitimate interest (protecting the service from abuse). You may lodge a complaint with your supervisory authority.

California (CCPA/CPRA): You have the right to know, delete and correct personal information. We do not sell or share personal information for cross-context behavioral advertising. We do not discriminate for exercising rights.

Everyone: Deleting the App removes its local data but does not erase server accounts, provider records or independent backups. If account features are offered, use the in-app account deletion action; otherwise contact support for server-data requests. To exercise any right, email support@stamba.ai. We respond within 30 days.

Data retention & security

A live table's state (including player names, and the install identifier and IP address of whoever opened it) is stored on our server encrypted with AES-256-GCM, so a server restart does not end your game. Empty lobbies normally expire after five minutes without a connected player; an empty game table after fifteen minutes. Removed rooms are deleted from active storage on the next successful persistence cycle. The next server release also sweeps stale orphan records at least hourly while healthy; records older than one day and not belonging to an active game are eligible. Provider backups, outages and legally required records need separate handling and are not erased by deleting the app. Purchase records are kept by Apple and RevenueCat as required for delivering purchases and for accounting. The release app uses HTTPS/WSS for connections to the hosted game service. Database transport and backup safeguards are managed separately in the hosting account; ask support for the safeguards applicable to your request.

Changes

We may update this policy; material changes will be reflected by a new effective date on this page.

Contact

StambaAI LLC — support@stamba.ai — https://stamba.ai

← Back to Laylet Waraq