FIVE / Privacy
Privacy
FIVE has no accounts, no email sign-up, no ads, no tracking and no cookies. Most of what FIVE remembers stays in your own browser.
Who runs FIVE
FIVE is a free hobby project run by Lesley Voogel in the Netherlands. Questions about your data, or anything else: [email protected].
What we use, and why
| What | Why | How long |
|---|---|---|
| Your name | Shown to the other players and watchers in your room. Needed to play. | Until the room closes |
| Device ID | A random code your browser makes once. While you’re connected, the server uses it to count people online (not tabs) and to give your seat back. | On your device until you delete it. Our server: only while you’re connected |
| Seat token and rejoin PIN | Get you back into your seat and stop others from taking it. | Our server: until the room closes. A rejoin code you set yourself stays on your device until you delete it |
| Your moves | To run the game. | Until the room closes |
| Your IP address | Comes with every connection. Cloudflare sees it and keeps it in its visit statistics. Our server only holds it in memory, to limit wrong PINs (10 in 15 minutes from one address), wrong room codes (10 in 10 minutes), transfer codes (10 wrong or 5 new in 10 minutes) and report spam; our own logs only see Cloudflare’s addresses. Our server logs hold no names or player addresses and are deleted after 30 days. | Cloudflare: 30 days. Our server: 15 minutes |
| Profile you transfer | When you use Transfer profile with a code: your profile, stats and achievements, and your settings if you choose. Never your photos. Your device locks (encrypts) it for your other device before it leaves, so we can’t read it. It is only sent after you tap Send it on the first device. We also see the code, a one-time key and a rough device type (like “iPhone · Safari”) to show on the first device. | Our server: in memory only, until your other device picks it up and at most 5 minutes. Never on disk or in logs |
| Reports you send | What you write, the category, room code, your name, the app version, your browser description and screen size (this can show your device type and system version), and, only if you add them, your email address and screenshots or files. Used to fix bugs, deal with abuse and, if you gave an email, to reply. | Up to 12 months |
| Reports about you | If another player reports you, we get the name they report, the reason, what they wrote and the room code. Used only to deal with abuse. We don’t tell you who reported you. | Up to 12 months |
We use this because you ask to play or to transfer your profile (GDPR article 6(1)(b)) and to keep FIVE safe and working (our legitimate interest, article 6(1)(f)). We don’t sell it, don’t build profiles and don’t use it for ads.
Stored on your device
| What | Why |
|---|---|
| Your name and avatar | So you don’t have to type it every time |
| Settings | Light or Dark, cards, sound, text size and the other settings |
| Table photo | The picture you picked for the table, if you set one. It is never sent to us or shown to other players |
| Avatar picture | The picture you picked as your avatar, if you set one. It is never sent to us; other players see your symbol or initial |
| Profile and stats | Your games, wins and tutorial progress. Only on this device, unless you transfer them to another device yourself |
| Device ID | A random code, so the server counts people online and can give your seat back |
| Seat and room | Gets you back into your seat after a reload |
| Rejoin code | Your own 4 digits, if you set one in Settings |
| Terms agreement | Which version of the Terms of use you agreed to, and when |
| Watching and this tab | Which room this tab is watching, and that this tab plays your seat. Gone when you close the tab |
FIVE keeps these in your browser’s storage (not cookies). A few only last until you close the tab, such as which room you’re watching. To start faster, the browser also keeps a copy of FIVE’s own app files; that copy holds nothing about you. They are all needed for the game, so there is no cookie banner. Download them in Settings › Privacy › Download my data, and delete them any time in Settings › Privacy › Delete my data on this device, or by clearing this site’s data in your browser.
Who else sees it
- Other players and watchers in your room see your name and your moves. Players who are already out see every hand and the face-down cards (a house rule, off unless the host turns it on). If the host turns on “Watchers see cards”, watchers see them too.
- Cloudflare, which carries the traffic to five.cards and protects it against attacks. It keeps visit statistics (IP address, country, device type, operating system, browser, pages viewed) for 30 days. It works for us under its data processing agreement and the EU-US Data Privacy Framework.
- Hostinger, our email provider in the EU, which delivers your reports to us and keeps them in our mailbox.
- Nobody else. FIVE loads no outside fonts, analytics, ads or social buttons.
Your rights
You can ask to see, correct or delete what we have about you, to limit how we use it, or to get it in a file you can take elsewhere. Email [email protected] and we answer within a month. Most data lives only on your device: Settings › Privacy › Download my data gives it to you as a file, and Delete my data removes it.
If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Your right to object
Some of what we do is based on our legitimate interest in keeping FIVE safe: using your IP address to limit wrong PINs, wrong room codes, transfer codes and report spam, and handling reports, including reports about you. You can object to this at any time, for reasons that have to do with your own situation. Email [email protected]. We then stop, unless we have strong reasons to carry on that outweigh yours, such as stopping abuse, or we need the data for a legal claim.
Children
FIVE is for all ages. It needs no account and never asks for a real name or an age, and it doesn’t profile anyone. Report has an optional email field for a reply; if you’re under 16, leave it empty. Parents can email us with any question.
Security
Everything goes over HTTPS. The server checks every move and every name, seats are protected by a PIN (after 5 wrong tries on a seat, from any device, PIN entry for that seat pauses), and the server keeps as little as it can.
Changes
Last updated 6 November 2026. When this page changes, What’s new in Settings says so.