LAST UPDATED 26 SEPTEMBER 2026

Your people.
Your data.

Bluffli is operated by Neuralway Technologies Private Limited. This page describes the account-enabled game, saved-game sync, private rooms and optional features. Older installed versions may offer fewer features.

Your account

The account-enabled game requires Apple or Google sign-in. We store a provider-specific identifier, your chosen display name, language and script, connected providers, optional topic and generation interests, onboarding status, account creation time and security/session information. Generation choices are interests, not a date of birth or an inferred age. We verify provider-issued tokens and do not receive your Apple or Google password. We receive and check provider email claims during sign-in, process them in memory, and do not store them in your player profile. Matching email addresses do not automatically merge accounts.

Website sessions use a Secure, HttpOnly first-party cookie. Native sessions use the device’s protected storage. Sessions last up to 30 days unless revoked sooner. Sign-in attempts expire after ten minutes and native handoff codes after 90 seconds. Short-lived hashed rate-limit keys expire after two hours. Encrypted Apple refresh credentials are retained while connected so authorization can be revoked when the account is deleted. These credentials support sign-in and are separate from optional analytics.

Saved games and cloud sync

Your account’s save is stored on this device and uploaded to Bluffli’s account service so it can be restored on another signed-in device. It includes group and player names, each player’s card language, game preferences, scores, word history, custom words, settings and play counters. In-progress one-phone Imposter and Double Take games are also included: this can contain secret card assignments, votes, choices and predictions. This information is game storage; it is not included in usage analytics. Keep access to your signed-in devices private.

A saved group is a reusable roster. Adding a person’s name does not create an account for them or automatically add them to an online room. Saves are separated by signed-in account. Signing out stops that account’s sync but retains its isolated device copy for a later sign-in. Older guest saves, where present, are kept separately and are not automatically uploaded into a new account.

Changes save on the device first. Sync needs a network connection and a valid account session; an upload failure or storage limit leaves the device copy in place. If device and cloud copies conflict, the app asks which to keep, preserving the displaced save as a local recovery copy. A device save alone does not sign you in. When an already verified session remains available, existing games can continue during a temporary connection loss; first sign-in and renewed verification need a connection.

Reset saved games replaces the current save and can sync that change to your other devices. It does not delete your account or necessarily remove a recovery copy or older device backup. Browser storage can be removed by the browser. iOS backups follow operating-system settings; Android cloud backup is disabled for the native app. Clearing a device’s storage does not delete the account’s cloud copy.

Private online rooms

Rooms process display names, language preferences, clues, messages, votes, Double Take picks and predictions, and game actions. The room server holds secret roles and returns only your own private card until the result. Account-linked membership and the original invitation can restore your existing seat on another device; recovery replaces the earlier device’s room credential. Room credentials and private drafts are stored separately from the cloud saved-game document, in storage scoped to your account.

Share invitation links only with intended players. Rooms stop accepting access after two hours; expired records are deleted asynchronously. Closing a room clears its current game, picks, predictions, clues, votes, chat and voice signals. “Step out · Save my seat” retains a seat for reconnection. Between games, “Leave room · Free my seat” removes it. Deleting your account does not automatically close a room or erase messages already sent there.

Room safety lets a signed-in player privately report another member, with an optional recent message or clue as evidence. We store the room code, reporter and reported account/seat identifiers, reason, optional details and up to 240 characters of the selected server-verified content for owner review. Voice is not recorded. Safety reports are kept for up to 90 days, including if either account is deleted during that period, then expire asynchronously. Reports are separate from optional usage analytics.

Blocking someone removes your own seat from the current room and prevents those two signed-in accounts from joining or reclaiming seats together in future rooms. The block remains until you ask support to remove it or your account is deleted. Older app versions that can enter as guests may not be covered by account-based blocking until account sign-in is required for all online joins. You can contact support about a report or block.

Microphones are optional

Joining voice requests microphone permission. Bluffli does not record audio. Audio is encrypted in transit between participants, directly when possible or through Cloudflare’s TURN relay. The relay processes connection information, and direct connections may reveal network addresses to invited peers. Muting stops outgoing audio while you can still hear friends. Leaving voice stops capture; native backgrounding pauses capture, and returning reconnects with the previous mute choice if you had left voice enabled. Speaking indicators are calculated on the device and are not sent to analytics. Text play remains available with the microphone off.

Operational room statistics

Saved server events count room creation, joins, game starts, completions, aborts and expiries. Authenticated room heartbeats support recent connection counts. Operational statistics include game type, selected packs, language/script, broad browser/device category and IP-derived approximate country or region, not GPS. Raw IP addresses are not retained in the analytics database. Infrastructure providers process connection information to deliver and protect the service. Names, custom words, secret cards, guesses, votes, chat, invitation links and audio are excluded from these statistics.

Account service statistics

We count sign-in attempts, successes and failures, account creation, onboarding completion and account deletion to operate and improve the account service. Daily and weekly active-account counts use purpose-specific account hashes retained for eight days. They measure authenticated account-service activity, not every person looking at a screen. Aggregate counters exclude names, emails, provider tokens and private game content. These operational counts do not depend on the optional device-analytics choice.

Optional usage analytics

Usage analytics are off until you allow them in Privacy choices. On the website and browser game, Global Privacy Control and Do Not Track also disable this reporting. You can decline analytics and still sign in and play. Analytics consent is separate from required account and game storage.

With permission, a random browser or installation identifier measures visits/app opens, recent activity, sign-in and onboarding completion, and one-phone game starts, completions and aborts. Reports can include game type, selected topic/pack and generation-interest IDs, language IDs, app version, broad device/operating-system category and approximate connection country/region. Ad-enabled versions can report ad request, loading, impression, opening, closing and failure events under the same usage choice. These events exclude names, custom words, cards, picks, messages and audio.

When you are signed in, consented reports may also verify your account to count recently active reporting accounts across devices. The analytics database uses a purpose-specific pseudonym for this short-lived account presence, rather than storing provider identities or your display name. The implementation does not maintain a per-account behaviour history or an account advertising profile. Sign-in alone does not enable these reports. Switching accounts discards queued reports from a different account rather than assigning them to the new one.

Browser/installation identifiers rotate or expire after 90 days. Website privacy choices are remembered for one year. Queued reports remain on the device for up to seven days; declining later clears the identifier and queued reports and stops future optional reports. Live counts exclude records older than 90 seconds, and their records are scheduled for deletion after ten minutes. Duplicate-protection records expire after 90 days; aggregate counts after 400 days. Expiry deletion is asynchronous. Previously combined totals are not removed by turning analytics off.

Deleting your account and retention

Account profiles and their cloud saves remain until you delete the account. Open Settings → Delete my account. Recent sign-in is required. Deletion first revokes connected Apple authorization, removes account-linked analytics presence, and then removes the profile, linked identities and cloud save. A failed cleanup remains unfinished and can be retried; contact support if needed. Removing the profile invalidates account sessions on other devices.

The deleting device also attempts to clear that account’s saved games, recovery copy, room credentials and drafts. Other accounts’ saves and older guest storage are separate. Other devices and operating-system backups can retain local copies; remove those devices’ app/site storage separately if needed. Signing out is not account deletion.

Hash-only session records expire within their 30-day lifetime, followed by asynchronous database deletion. Account and analytics recovery backups can retain deleted records for up to 35 days. Infrastructure logs are retained for seven days. Aggregate analytics and duplicate-protection records follow the retention periods above; they do not retain your account pseudonym. Google advertising systems have their own retention, described below.

Advertising and privacy choices

Version 1.3 introduces ad privacy setup after sign-in. A broad under-18 or adult choice is remembered on this device for the signed-in account; it is separate from generation interests and is not a birth date. Google’s consent service checks applicable requirements on each launch, remembers its own choices, and displays a privacy form where required. Ads are requested only when that service permits them. You can revisit applicable choices in Settings. Older installed versions use their original Settings-based setup.

Version 1.3 may show an interstitial between completed one-phone games or online games on the viewer’s own device. It never shows one over active cards, clues, chat or votes. The first break requires two completed games and three minutes of use; there are at least three minutes between interstitials and at most six an hour. A new game does not wait for an ad to download. In compatible online rooms, a ready check prevents the host dealing while another player is finishing a break. Older compatible rooms do not use online ad breaks.

A voluntary rewarded video can provide one hour without interstitials for this account on this device. The reward is granted only when the ad service confirms it was earned. Reward expiry and pacing timestamps are stored on-device. Premium removes ads on the purchaser’s signed-in devices; a host’s shared premium packs do not remove other players’ ads.

Google Mobile Ads and its advertising partners may collect or share IP addresses and approximate location, device or app identifiers, ad impressions and interactions, and crash, diagnostic and performance information. They use this information to deliver and measure advertising, operate the service and prevent fraud. Bluffli requests non-personalized, general-audience ads and applies child-safe treatment to under-18 players. Version 1.3 permits Android’s advertising identifier where the operating system and age treatment allow it. Bluffli does not request Apple’s tracking permission or access IDFA. Non-personalized advertising still processes data.

We do not send player names, secret words, chat, audio, guesses or custom decks to the ad service. Google’s processing and retention follow Google’s privacy policy; our account deletion schedules do not apply to Google’s systems. See how Google uses information for advertising and the in-app privacy controls.

Premium and gift access

When enabled in your version, Premium is verified through the app store and RevenueCat using your Bluffli account identifier, product and entitlement identifiers, transaction status and purchase history. RevenueCat and the stores process transaction and device information under their own policies. We do not receive your payment-card details. A web checkout, where offered, may request a billing email directly for receipts. See RevenueCat’s privacy policy.

Bluffli stores verified entitlement status and the time it was checked so access follows your account. Native devices may retain account-bound purchase evidence for temporary offline use. Web gift codes are stored as hashes with redemption status, expiry and the claiming account; a code may be redeemed only as allowed by its terms. The host can share access to selected premium packs within a game. Purchases, refunds and native offer-code redemption follow the store’s rules.

Crash diagnostics

Versions configured for crash reporting send technical failure information to Sentry: app version, operating-system version, error category and sanitized stack/symbol information. Names, account identifiers, emails, tokens, room invitations, messages, secret cards, audio, screenshots and replay recordings are excluded. Error-message text is removed before upload. Crash reporting is a reliability function, separate from optional usage measurement. See Sentry’s privacy policy. Reporting is inactive in builds without a configured reporting endpoint.

App updates

From version 1.3, the iPhone and Android apps check play.bluffli.lol for signed app updates when they open, and occasionally while they stay open. Each check sends the platform, app version, update channel, the running update’s identifier and a random installation identifier that the update system creates for delivering updates. Checks carry no account, name, room or gameplay information. Updates are signed by Bluffli, and the app refuses anything else.

Hosting, questions and requests

Amazon Web Services and Cloudflare provide hosting and delivery. Apple, Google, app stores and external sites apply their own policies to their services. Avoid adding sensitive information to player names, custom words or room messages.

See data-deletion steps and Help & rules. Contact Neuralway Technologies Private Limited at zero@neuralway.ai for privacy, deletion or support requests.