Privacy Policy

Updated: October 27, 2026 · Applies to Stealr No Mercy at dealnomercy.com on the web and as a PWA.

Who is responsible?

What we process and why

• Playing as a guest: Firebase Authentication creates an anonymous user ID. We use it to operate lobbies and games, save game state and results, and reconnect a session. Your guest name and settings are also saved on your device. Guest data is not automatically available on another device.
• Optional account: Google sign-in is available on the web and in the PWA. Firebase receives the Google account identifier and the information Google supplies, which may include your name and email address. We do not receive your Google password. When you sign in, we link or merge your previous guest progress.
• Game and profile: We process player IDs and names, lobby membership, the chosen deck mode, moves, cards, match results, XP, level, wins, win rate, streaks, bot/multiplayer statistics, chosen avatar and cosmetic frame. Account names are checked and reserved so another account or guest cannot use them. Level rewards are cosmetic and do not change game rules or winning chances.
• Online display: While the game is open, it records about once a minute that your player ID is online, with the time, whether you play as a guest or with an account, and whether you are in a game. We only use these records for counts: everyone sees how many players are online, and the operator also sees totals such as accounts, all players, new players and games per day.
• Safety and support: Reports, blocks, relevant player IDs and the reason given in a report are processed to investigate abuse and keep the game usable. If you contact us, we process your message and contact details to answer you.

We process the data needed to provide the game and the optional account under Article 6(1)(b) GDPR where applicable. We use Article 6(1)(f) GDPR for security, abuse prevention, handling reports and the online counts, based on our interest in a safe, reliable and lively game. Legal duties may require processing under Article 6(1)(c) GDPR.

What other players can see

Players, including guests with an anonymous Firebase sign-in, can see names and shared lobby/game information needed for discovery and play. Your public account profile contains your name, level, frame and selected illustrated avatar. Your detailed account statistics and email address are not in the public profile. Shared game records can include your player name and actions. The number of players online is shown without names.

The global leaderboard displays your public player name, avatar, level, confirmed multiplayer wins and rank. Detailed statistics remain private. Rematch scores are stored separately and visible only to the participants of that game; they are removed when a participating account is deleted. We review reports about player names.

Services, analytics and device storage

• Google Firebase / Google Cloud: Authentication, Firestore, Cloud Functions and Hosting support sign-in, game data, profiles, online counts and hosting. Firebase Authentication processes data in US data centers; other services can process data in different regions. For international transfers, Google describes its EU–US Data Privacy Framework certification and standard contractual clauses in its Firebase privacy information and contractual terms.
• Google Analytics: The website loads Google Analytics when a page opens. It measures page visits and interactions, such as starting and finishing a game, the chosen mode, lobbies and sign-ins, using browser/device information, approximate location and identifiers such as the first-party _ga cookie. Google says it does not log or store individual IP addresses in Google Analytics. How Google Analytics handles data.
• On-device storage: Firebase keeps sign-in state and a Firestore cache in browser storage. We also save your guest name, language, chosen deck mode, audio/haptic choices and active-game recovery information locally. Clearing browser data can remove these settings and access to a guest account. Fonts are served from this website, not from a third party.

Retention and deletion

Account progress and profile data remain until the account is deleted. You can delete a registered account in the profile; this removes the Firebase authentication account, profile, progress, account result records and your online record. Online records are otherwise deleted automatically, usually within a day after you close the game. Guest and shared game documents can remain after a match for reconnection, rematches and game integrity; there is currently no fixed automatic deletion period for all shared game records. Such records may still contain a name or player ID after account deletion. Contact us if you want access to or deletion of remaining personal data. Provider-side records are governed by the providers' own policies.

Your choices and rights

You can play as a guest, change your name and avatar, sign out, or delete a registered account from your profile. You may request access, correction, deletion, restriction or a copy of your data, and object to processing where applicable, by emailing canyuezer@icloud.com. You may also complain to a competent data-protection authority. We may ask for information needed to verify that a request concerns your account.

We update this page when our data practices change. The date above identifies the current version.