Forbidden!

Privacy Policy

Last updated: 2026-10-07

Forbidden! is a party word game. Most of it runs entirely on your device. A limited amount of information leaves your device when you play Online with friends, when you buy something, when the app checks for updates, when the app crashes, and as usage statistics that show us how the app is used. This page explains exactly what, and why.

Forbidden! has no ads. We don't sell your data, and we don't track you across other companies' apps or websites.

What stays on your device

These are saved on your device using Apple's standard storage:

• Round length, number of passes, and whether the forbidden-word penalty is on
• Sound and haptics
• App language, card language, and light/dark appearance
• Team and player names you type in Team mode
• Your game stats: games played, wins, best scores, and streaks
• The online display name you last used, so you don't have to type it again
• Whether you have seen the tutorial, the card-language tip, and an update reminder
• Which word-pack version you have downloaded
• Whether you share usage statistics

Deleting the app deletes all of it.

We don't receive these saved settings, names, or stats. The usage statistics described below are separate: they include a few facts about a game while you play it, such as its mode, topic, round length, and score, and never a name you type.

Online play — only if you use it

Online play is optional. If you never open it, nothing in this section happens.

When you first use Online, the app signs in to our backend anonymously. This creates a random user ID. It is not an account. There is no sign-up, no password, and no email address or phone number. The ID exists so the game knows which player is which and who is allowed to change a room.

When you create or join a room, this is shared with our backend and with the other players in your room:

• The display name you type. You can use a nickname — it doesn't have to be your real name.
• Your anonymous user ID.
• The room code, who is in the room, and which team they are on.
• Game state: the current card and its forbidden words, whose turn it is, scores, and turn timing.
• The language the host is playing cards in.

To keep that anonymous sign-in working, our backend also records the IP address and device type (the standard "user agent" every app sends) of the sign-in. Other players never see these. Our hosting provider, Supabase, also keeps short-lived technical logs of requests to the backend.

How long we keep it:

• Rooms are deleted when the last player leaves. Any room that has been idle for 24 hours is deleted automatically within the following hour.
• Your anonymous user ID and its sign-in record (IP address and device type) are deleted automatically after 90 days of inactivity — that is, 90 days after you last used Online play. To have them deleted sooner, email us with the display name you used and roughly when you played.

Purchases

Forbidden+ is optional. You can subscribe monthly or annually, or buy a one-time lifetime unlock, and you can leave a tip. Every purchase goes through Apple's App Store (or Google Play, where we offer purchases there), under their terms.

• We never see your card or payment details, and we never see your Apple ID.
• The app checks what you have bought on your device, using Apple's StoreKit. Your purchases are not sent to our own servers.
• The usage statistics described below record that a purchase was started or finished and which product it was (monthly, annual, or lifetime), and Google Firebase may record the purchase itself, including its price. Neither includes your payment details or your Apple ID.
• Apple gives us sales and subscription reports in App Store Connect.
• You can manage or cancel a subscription at any time in your Apple ID settings.

Update check

Each time the app starts, it asks our server whether your app version is still supported, so we can ask you to update when an old version stops working. The request carries no ID, no name, and no game data — only what every internet request carries: your IP address and your device's user agent (which includes the app and iOS version).

We use these only to run the service. We never link them to you or to your online user ID, and the server keeps these logs for no more than 30 days. If the check fails, the app simply carries on.

Crash reports and app configuration

We use two Google Firebase services:

• Crashlytics — when the app crashes, it sends a crash report: what the app was doing when it stopped, your device model, iOS version, app version, and an anonymous per-install identifier. It is not connected to your name or your online user ID.
• Remote Config — the app checks with Google for settings that let us turn features on or off without shipping an update. This sends an anonymous per-install identifier.

Neither is used to track you or for advertising.

Usage statistics

The App Store version of the app uses a third Google Firebase service, Firebase Analytics, so we can understand how the app is used — which screens people open and how far they get through a game — and decide what to improve. It is on by default, and you can turn it off (see "Turning it off" below).

What it sends:

• Which screen you open, from a fixed list (for example Home, Settings, or the topic list).
• Steps of a game: the cards of the opening introduction, the topic and game mode you pick, the difficulty and round length, how many teams and players there are, and how a round and a game end (score, cards guessed, forbidden words said, cards passed).
• That the Forbidden+ screen was shown, which product was chosen, and how it ended (for example bought, cancelled, restored, or closed).
• That creating or joining an online room worked or failed, and how many players were in the room.
• That new cards were offered, and that they were downloaded.
• An anonymous per-install identifier created by Firebase, and general information that Firebase adds by itself: device brand and model, iOS version, app version and the store it came from, the device's language, and an approximate location (country, region, and city) that Google works out from the IP address of the upload.
• Firebase's own basic events, such as the first time the app is opened, the start of a session, time the app is in use, an app or iOS update, a crash, and a purchase.

What it never sends:

• Anything you type: no team name, no player name, no online display name, and no room code.
• Your anonymous online user ID, or any other identifier of ours.
• An advertising identifier or your device's vendor identifier. The app uses the version of Firebase Analytics without advertising support, and it never asks for permission to track you.

Kid Mode (Picture Mode and the Kids word game) is covered in the same way as the rest of the app: the app sends that Kid Mode was opened and which of the two it was, the screens opened in it, and the steps of its games. Nothing typed is sent, and the same "Share usage statistics" switch turns it off.

Turning it off: in the app's Settings, turn off "Share usage statistics". From that moment nothing is recorded, anything recorded but not yet uploaded is deleted from your device, and nothing is sent to Firebase Analytics. If you turn it on again, recording starts from that moment. The switch does not change crash reports or Remote Config, described above.

How long we keep it: usage statistics are kept for 14 months after your last use.

Usage statistics are not used to track you across other companies' apps or websites, or for advertising.

What we never collect

• Your contacts, photos, microphone, or camera
• Your precise location
• Your email address, phone number, or home address
• Health, fitness, or financial data
• Your payment details or Apple ID — purchases go through Apple, and we never see your card
• Your browsing or search history
• An advertising identifier — the app contains no advertising

Children

Forbidden! is rated 4+ and made for families. We don't ask children for personal information. Picture Mode, made for younger players, is played entirely on the device; the usage statistics described above cover it in the same way as the rest of the app, and the same switch turns them off. The only place anyone can type personal information is the online display name, and we suggest using a nickname there.

If you believe a child has entered personal information through Online play, email us and we will delete it.

Your choices

• Don't use Online play, and nothing leaves your device for it.
• Use a nickname instead of your real name.
• Turn off "Share usage statistics" in the app's Settings to stop usage statistics.
• Delete the app to remove everything stored on your device.
• Email us to have a room, or your anonymous user ID and its sign-in record, deleted.
• Manage or cancel a subscription in your Apple ID settings.

Services we use

• Google Firebase (Crashlytics, Remote Config, Analytics) — firebase.google.com/support/privacy
• Supabase — our backend for online play: anonymous sign-in and rooms — supabase.com/privacy
• Apple — the App Store and Apple's payment system for purchases
• Our update-check server — the version check described above

Changes to this policy

If this policy changes, we will update the "Last updated" date above and post the changes on this page.

Contact

Questions about this privacy policy: support@iocar.app