Privacy Policy – «مين الجاني؟» (Who's the Culprit?)

Last updated: October 8, 2026

«مين الجاني؟» is a party detective game played offline on one phone, or with everyone on their own phone. Playing needs no account, and we do not collect personal data while you play. The only part with an account and a server is "Friends", and it is optional (see "Game account and friends" below).

Data stored only on your device

Player names, the scoreboard, settings, the court cases you save to your library, any game in progress, and your in-game coin balance («بصمات») and daily-gift streak are stored locally inside the app on your phone. They are never sent to us or anyone else, and they are deleted when you uninstall the app or clear its data.

Playing on several phones

Same Wi-Fi: one phone opens a room and the others join it over the same Wi-Fi network or hotspot. Player names and game actions travel only between the phones on that local network; they are never sent to an internet server and we never receive or store them. The room and its data are discarded when the host closes it or closes the app.

Online: the phones meet through free public MQTT message brokers that we do not operate (such as broker.emqx.io, broker.hivemq.com and test.mosquitto.org). All game messages (names, roles, votes and actions) are end-to-end encrypted between the host's phone and each player, so the broker relays them without being able to read them, and we never receive or store them. The only unencrypted item is the room's card in the "find a room" list: the room name, the host's name, the player count and what the room is playing, so friends can find it. The card is removed when the host closes the room. A private room's password is never sent; it is only mixed into the encryption key on the phones.

Microphone and voice in online rooms

Online rooms include in-game voice. The app asks for microphone permission only when you choose to turn the mic on; you can refuse and listen only, or mute the mic at any time. Voice goes directly from phone to phone (WebRTC), encrypted, and only the players in the room hear it. Voice is never recorded or stored on any phone or server, and it never passes through us. To let the phones reach each other, the app asks public STUN servers (such as Google's and Cloudflare's) for the phone's internet address; these servers never receive the audio. Because voice goes straight from phone to phone, the other players' phones in the room can see your phone's IP address.

Chat in online rooms

Online rooms have a chat with emoji and ready-made lines; free typing is available only in private rooms. Chat messages are end-to-end encrypted like all other game messages, only the players in the room can read them, they are not kept after the room closes, and we never receive them. Any player can mute another player (chat and voice) or report them (see below).

Data you choose to send: "Suggest a case"

If you use the "Suggest a case" feature and tap Send, the app sends us the case title, description, type, suggested player count, and your name if you typed one (optional). Submissions are sent over HTTPS through Google Forms and stored in our form responses. We use them only to choose new cases for the game. We do not sell or share them. To have a suggestion deleted, email us at the address below.

If you use "Report a problem" and tap Send, the app sends what you typed, the part of the game you were in, the game version, your device type, system and screen size, the language, the last error message the game caught (if any), and your email only if you type it (optional, used only to reply to you). It is sent the same way through Google Forms and used only to fix the problem.

The same channel (Google Forms over HTTPS) is used for the following, and again only when you tap them:

• Case studio: when you submit a case you wrote for the players' gallery, the case text and the author name you typed are sent.
• Hearts in the players' gallery: the id of the case you liked and the month are sent.
• Reporting a player: the room code, the game, the reason, the reported player's name and their latest chat lines, and your name in the room are sent so we can review the report.

Anonymous play statistics

When a game ends, the app notes one short line on your phone: the kind of game, the case, story or riddle that was played, the script, the number of players, whether it was on one phone, on Wi-Fi or online, the hour and weekday, and the result. At most once a day these lines are sent to us through Google Forms (HTTPS), so we can see which cases and games get played most and when. They contain no player names, nothing anyone typed, and no device ID or anything else that identifies you. You can turn this off in Settings ("Anonymous statistics"); turning it off also deletes anything not yet sent.

Crash reports (Android version)

If the app crashes or hits an error, the Android version sends a report through Firebase Crashlytics (by Google): where in the code it happened, the app version, the phone model and Android version, and a random ID for this installation so we can tell how many phones see the same error. It contains no names, nothing anyone typed, and no email. Google keeps the reports for 90 days. Turning off "Anonymous statistics" in Settings turns crash reports off too.

Game account and friends (optional)

If you make a player card to add friends, message them and invite them, you sign in with your Google (Gmail) account, the same account on Android, the website and iPhone. The account and its data are stored on Google Firebase (Google's servers in Europe, region europe-west1), which Google runs on our behalf. The data travels encrypted, and we do not sell or share it.

What is stored: the name you choose, your user ID, your account numbers (Firebase ID and Google account ID), your email (Google keeps it for sign-in only; no player can see it), your Google picture link (shown by default; you can turn it off), your friends and blocked players, your messages with friends, your recent matches, whether you are online and in which public room, and the reports you send.

Who sees what: your profile (name, user ID, title, and picture unless you turned it off) is visible to players with an account. Whether you are online is visible to your friends only, and you can hide it. Your match history is visible to your friends, and you can make it visible to everyone or to no one. Messages are seen only by the two of you.

How long we keep it: messages 30 days (60 at most), the last 50 matches, and the account until you delete it. After deletion, the sign-in record, usage counters and your user ID are kept for 30 days (up to a month more) so no one can take your user ID right away. Reports are kept for 12 months.

How to delete it: in the game, Me → Your game account → Delete my account. This deletes your profile, user ID, friends, messages and matches; your games, coins and looks on the phone stay. Or email us at the address below.

Kids' mode has no account, no friends and no messages.

Reminders

If you turn on the daily gift reminder, your phone itself shows one notification a day. It is scheduled on the phone, and nothing is sent for it.

If you have a friends account on Android, your phone checks the friends server about every 15 minutes for a new message, invite or gift and shows a notification. It reads the same data the game reads and collects nothing new, and the sign-in key it uses stays on your phone. You can turn each kind off in Settings.

Ads (optional, Android version)

The game has rewarded ads only, and they show only when you tap "Watch an ad" or "Double it with an ad" to get prints. There are no ads during play and none in kids' mode. Ads come from Google AdMob, which uses your phone's advertising ID, IP address (for approximate country), and device and crash information to show and measure ads and to prevent fraud. In the EEA and UK we ask for your consent first, and you can change it in Settings ("Ad privacy"). You can reset or turn off the advertising ID in your phone's settings. Google's policy: https://policies.google.com/technologies/ads

Buying بصمات (in-app purchases, when switched on in the Android version)

Buying بصمات with real money happens entirely through Google Play Billing (in-app purchases). Google handles your payment and card details; we never see them and they never reach us. Google sends us only proof of the purchase: the purchase token, the order ID, the pack, the quantity, the purchase time and a random wallet ID (not linked to your name or email) so the بصمات land in the right wallet. Our server (Firebase Cloud Functions, by Google) checks each purchase with Google Play before any بصمات are added, and keeps a small record: the random wallet ID, the pack, the quantity, the number of بصمات, the order ID, the purchase time and whether it was refunded. The purchase token itself is not stored, only a one-way hash of it, so one purchase can never count twice. If Google refunds a purchase, its بصمات are taken back from your wallet. If a purchase was paid but its بصمات never arrived, Google refunds it by itself within 3 days. The record is kept for as long as purchases are offered, to stop a purchase counting twice; to have yours deleted, email us at the address below.

Google account save (optional, Android version)

If you sign in to Google Play Games, the game saves a copy of its data (prints, looks, scores, settings and the cases you wrote) to your Google account so you can restore it on another phone. It is stored by Google, not by us; delete it from Google Play Games settings (delete game data).

If you sign in to the game with your Google account (Android or the website), a copy of the same data is also kept on Google Firebase (the same servers as the friends account above), so you find the same things on every device where you use that account. Only you can read it; it is deleted when you delete your account with "Delete my account", and the data on your phone stays as it is.

What the app does not include

No third-party analytics or tracking SDKs (only the anonymous statistics, the crash reports and the ads above), no accounts on our side except the optional friends account above, and no access to contacts, photos, location or camera. The microphone is used only in online rooms and only with your permission, as described above.

Children

The game is made for families and friends and is intended for ages 13 and up. We do not knowingly collect data from children under 13, and kids' mode has no account, no friends and no messages.

Contact

Privacy questions: twisterivx@gmail.com