Privacy Policy

Last updated 27 September 2026

Chhakkadi is a free online card game. You can play without an account at all. If you create one, it stores your email, display name, game statistics and friends so the game can show them to you and to the people you play with. Nothing is sold, nothing is advertised, voice chat is never recorded, and deleting your account deletes all of it.

What this covers

Chhakkadi is an online card game, playable at chhakkadi.endra.in and as an Android app. This policy describes what the game stores, why, and how to get rid of it. It applies to the website and the Android app equally — they are the same game and the same servers.

Playing without an account

You can play as a guest. A guest is identified only by a random id kept in your own browser or app storage, used to reconnect you to a room if your connection drops. Guest games are not recorded and no profile is created.

If you create an account

An account stores only what the game shows back to you or to the people you play with:

• Email address — to sign you in, verify the address and let you reset a password. Not used for marketing.
• Display name and profile picture — shown to other players you play with or add as friends.
• Password — stored only as a bcrypt hash. It cannot be read back, by us or anyone else.
• Google account id — if you sign in with Google, so we can recognise you next time. We receive your name, email and profile picture from Google, and nothing else. We do not ask for, and cannot see, anything else in your Google account.
• Game statistics — games played, won, and per-game figures, so your profile can show them.
• Friends and friend requests — who you are connected to.
• Messages — friend-to-friend chat is stored on our server so it is still there when you come back.
• Device notification token — if you enable notifications, so messages and invites can reach you when the app is closed.

Signing in with Google

Signing in with Google is optional — an email address and password work just as well. If you do use it, Google tells us your name, email address and profile picture, and we use them for exactly one thing: to create your account and recognise you the next time you sign in. We request no other access to your Google account, and we cannot read your Gmail, Drive, Contacts or Calendar. Your Google data is never sold, never shared with anyone else, and never used for advertising or to train any model. You can disconnect the game at any time from your Google account permissions page, or delete the account outright from your profile in the game.

Voice chat

Voice is optional and off until you join it. When you do, audio travels directly between players’ devices (WebRTC, peer-to-peer). It is never recorded and never reaches our servers. The microphone is used only while you are in a voice call, and you can leave it at any time.

What we do not do

• We do not sell or rent your data.
• We do not show third-party advertising.
• We do not track you across other apps or websites.
• We do not use your data to train machine-learning models.
• We do not read your friend-to-friend messages, except where one is attached to an abuse report you or another player sends us.

Who else is involved

• Cloudflare — hosts the website and the game servers.
• Render — hosts the accounts and friends service.
• Supabase — stores profile pictures.
• Google Firebase (FCM) — delivers push notifications.
• Google Sign-In — only if you choose to use it.

Each receives only what it needs to do that job. None of them is given your data for their own purposes.

How it is kept safe

Everything travels over HTTPS and encrypted WebSocket connections. Passwords are stored only as bcrypt hashes, sign-in sessions are short-lived tokens that expire on their own, and the servers above are reached over authenticated connections.

Reporting and moderation

You can report a player from a chat, and block them. A report records who reported whom, the reason you chose, anything you wrote, and when, and it is emailed to us so it is actually seen and reviewed by a person. Screenshots you attach are sent in that email and stored nowhere — they are held in memory only long enough to send it. Blocking stops messages, friend requests and game invites in both directions, and it is reversible: open the Friends panel and expand Blocked accounts to unblock someone.

Deleting your account and data

In the app or on the website: open your profile and choose Delete account. This immediately and permanently deletes your account, stats, friends, messages, stored profile pictures and notification tokens. It cannot be undone.

If you cannot get into your account, email support@endra.in from the address on the account and we will delete it for you.

How long things are kept

Account data is kept while your account exists, and is removed when you delete it. Sign-in sessions expire on their own. Abuse reports are kept while they are being reviewed, and are removed when either account involved is deleted.

Your choices

• Play as a guest and create no account at all.
• Change your display name or profile picture from your profile at any time.
• Turn notifications off in your device settings; the stored token stops being used.
• Disconnect Google Sign-In from your Google account permissions page.
• Ask for a copy of what the game holds about you, by emailing support@endra.in.
• Delete the account and everything in it, from your profile.

Children

The game is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has an account, email us and we will remove it.

Changes

If this policy changes, the date at the top changes with it. Significant changes will be announced in the app.

Contact

Questions, or anything you want removed: support@endra.in