Privacy Policy
This Policy explains how we collect, use, store, share, and delete information related to PokiFish - Cardcha (the “App”). By using the App or this website, you acknowledge this Policy. If you do not agree, please stop using the services.
1. Controller & contact
The App and this website are operated by Chun Wa Creative Limited (Hong Kong).
- Privacy / support contact: WhatsApp +852 5639 8929
- Website: https://pokifishcard.youroldbest.com/
2. Scope
This Policy applies to:
- the PokiFish - Cardcha iOS App;
- the official website at
pokifishcard.youroldbest.com; - cloud services used directly for App features (account sync, media storage, AI identification, and content moderation).
It does not cover third-party websites you may open from the App (for example external encyclopedia links) or their separate policies.
3. Information we process
3.1 Account & identifiers
- Firebase user ID (UID);
- display name and 7-digit friend code;
- sign-in method: Sign in with Apple, Google Sign-In, or anonymous Traveler mode;
- Apple/Google sign-in flows may request name and email scopes from the identity provider; the App’s profile model primarily stores UID, display name, and gameplay settings.
3.2 Gameplay & user-generated content
- fish-card data (nickname, story, stars, rarity, preferences);
- photos you capture or upload (primary images, attachments, custom body references, swim art);
- PokeOcean layouts, inventory, coin balance, and progress;
- public or semi-public social content in the Public Ocean / friend oceans (released spirits, likes, traps, treasure interactions).
3.3 Permission-related data
- Camera: to capture ocean-creature photos and, on supported devices, optional LiDAR/AR length measurement;
- Photo Library read: to choose attachments or custom-body references;
- Photo Library write: to save physical-card exports;
- Local notifications: for example custom-body job completion or failure alerts.
The App does not request location permission and does not implement App Tracking Transparency (ATT) advertising tracking.
3.4 Purchases & subscriptions
- App Store / StoreKit transaction identifiers, product IDs, and subscription status;
- server-side purchase/subscription records used to grant entitlements (for example Pro+, coin packs, physical-card products).
3.5 Physical-card order contact details
If you request physical-card printing support, you may provide recipient name, phone number, and address. These details may be sent through WhatsApp so our support channel can fulfill the order conversation. Please avoid sharing unnecessary personal data.
3.6 Technical & security data
- Firebase App Check / device attestation signals used to reduce abuse;
- basic service logs and error records required to operate cloud features (processed by infrastructure providers).
4. Sources
- information you provide directly (sign-in, card creation, uploads, order support);
- device data after you grant permission (camera, photos, notifications);
- identity providers (Apple, Google) and App Store commerce systems;
- data generated by our backend to operate features (friend codes, moderation status, sync manifests).
5. Purposes
- create and maintain accounts, sessions, and cross-device sync;
- deliver core gameplay: cards, oceans, store, friends, and Public Ocean;
- run optional AI fish identification and upload moderation (for example aquatic-content checks);
- process in-app purchases, subscription entitlements, and anti-abuse controls;
- respond to support requests, physical-card printing communication, and security incidents;
- comply with law, enforce terms, and protect users and the operator.
6. Sharing & processors
We do not sell your personal information. To operate the App, we may share necessary data with the following processors, who may use it only to provide their services:
- Apple: Sign in with Apple, App Store / StoreKit purchases, and related device services;
- Google: Google Sign-In; Google Cloud Vertex AI / Gemini for optional fish identification and image moderation;
- Firebase (Google): Authentication, Cloud Firestore, Cloud Functions, App Check;
- Cloudflare: R2 object storage and related Worker/CDN delivery for private and public media;
- WhatsApp (Meta): when you contact support or submit physical-card order details via WhatsApp.
These providers have their own privacy policies and processing terms. We use them only as needed to deliver App features.
7. Public & social content
- M79 Public Ocean: content you release publicly may be visible to other signed-in users (for example nicknames, stories, card details, moderated images).
- Friend oceans: mutual friends may see friend-ocean content and related interactions you share.
- Moderation: public uploads may first pass AI content checks; rejected media is not shown as approved public content.
Do not post personal information in public fields that you do not want other players to see.
8. International transfers
The App relies on cloud services that may operate in multiple regions (including Firebase / Google Cloud and Cloudflare). Your information may therefore be processed or stored outside Hong Kong. We use provider contracts and access controls to keep processing limited to what is needed for the service.
9. Retention
- account and cloud gameplay data: retained while your account remains active, or until a valid deletion request is completed;
- Traveler mode: primarily stored on-device; if an anonymous cloud session is created, related server records are handled as needed for operations and security;
- Public Ocean and social content: may persist while content remains public or linked to other players’ records;
- purchase and accounting records: may be retained longer where required by law or for fraud prevention / support;
- support / WhatsApp correspondence: retained as needed to complete your request.
10. Security
We use reasonable technical and organizational measures such as cloud access controls, App Check, authorized access to private media, and HTTPS in transit. No method of transmission or electronic storage is completely secure.
11. Your rights, consent withdrawal & deletion
Subject to applicable law, you may request access, correction, deletion, restriction, or withdrawal of consent (for example by disabling camera/photo permissions or stopping use of cloud/AI features).
How to request deletion
In the App, open Account → Privacy & Account → Delete Account to permanently delete your account and associated cloud gameplay data, public content, and private media. After deletion, the App also removes that account’s local data from the device and signs out.
Deleting an account does not automatically cancel an App Store subscription. If you have an active subscription, cancel it first in Apple subscription settings. Transaction records required by law or needed to complete pending transactions or prevent fraud may be retained without direct account identifiers. If you cannot use the in-app option, contact us on WhatsApp at +852 5639 8929.
12. Children
The App is not directed at children. If you are a parent or guardian and believe a minor provided personal information without appropriate consent, contact us and we will take reasonable steps to address the request.
13. Purchases & subscriptions
Paid features (such as Pro+ subscriptions, coin packs, and physical-card related products) are processed by the Apple App Store / StoreKit. We do not receive your full payment card number. Subscription management, cancellation, and refunds follow Apple’s rules and your Apple ID settings.
14. Features not currently enabled in app code
Based on the current implementation, we do not enable the following as product features:
- precise / background location;
- third-party ad networks or ATT tracking prompts;
- Firebase Analytics or Crashlytics initialization in the App;
- remote push notifications (APNs / FCM).
If we enable any of these later, we will update this Policy and obtain permission or provide choices where required.
15. Changes
We may update this Policy from time to time. The updated version will be posted on this page with a revised effective date. For material changes, we may also provide a reasonable in-app or website notice.
Questions about this Policy can be sent via WhatsApp +852 5639 8929 to Chun Wa Creative Limited.