Last updated August 25, 2026
Privacy without mystery.
Short version: there are no advertising or analytics trackers in the current app and no intentional recording of voice chat. A player name, room state, and a private reconnect token run a game; an email, profile, memberships, and messages support the optional persistent Communities area. An optional, explicit setting can contribute anonymous gameplay decisions from completed human-versus-bot matches.
Information the game processes
- Your chosen player name, room code, connection status, and game actions.
- The current room state: players, hands, deck, discard pile, choices, and recent table events.
- A private reconnect token that identifies your seat after a refresh or short disconnect.
- Technical request information normally handled by hosting providers, such as an IP address, browser type, timestamps, and error logs.
- Your community account email, username, session, memberships, channels, messages, and read state when you choose to register.
- Community invite codes and basic moderation data such as membership role.
Do not use a player name containing sensitive personal information. Room codes are meant to be shared only with the people you want at your table.
Optional anonymous bot improvement
Before creating or joining a game, you can choose whether to help improve server-owned bots. The choice is stored on your device and can be changed before your next room. It is off until you enable it.
For a completed match containing a bot, the server can store your aggregate hand composition, legal actions, selected action, public opponent card counts, public table state, and final outcome. Training records exclude player names, emails, account IDs, room codes, IP addresses, reconnect or device tokens, chat, voice, exact card IDs, exact timestamps, and opponents' hidden cards. Bot decisions are not treated as human examples.
Eligible decisions are submitted as one completed-match batch to a private Supabase table. A storage failure never blocks gameplay. Records carry a 90-day expiry and the server performs periodic expired-row cleanup. This release does not automatically train or deploy a machine-learning model.
Storage and retention
On your device
The browser stores the reconnect token in local storage. The Android app stores it in app storage. This keeps your seat available after a refresh. Clear site data or uninstall the app to remove it from your device.
On the game server
When persistent storage is configured, a room snapshot expires after roughly six hours without a state change. Activity refreshes that expiry. The live server may also hold the room in memory while it is running. Hosting providers can retain technical logs under their own operational policies.
Disconnected players
A disconnected player normally has 100 seconds to reclaim the same seat before the game resolves the absence. This countdown is gameplay state, not a public presence history.
Community accounts and messages
Supabase stores community profiles, memberships, channels, messages, and read state until they are deleted under the project's retention or moderation process. Passwords and verification tokens are handled by Supabase Auth rather than the game server. The browser uses local storage and Android uses app storage for the community session. Signing out removes that saved session from the device.
Voice and reactions
Browser and Android voice use WebRTC peer connections. The realtime server helps players exchange connection signals but the application does not intentionally record or save the audio. Audio still travels through the network and, depending on connectivity, may use relay infrastructure. Emoji reactions and their sender are briefly broadcast to the room.
Feedback messages
If you use the feedback form, Mercyless processes the message and any optional name or reply email you provide. The website sends that information through Resend to the maintainer's private inbox. Resend and the inbox provider may retain the delivered email under their own policies. The public form never receives the private recipient address or email API credentials.
Service providers
The project currently relies on:
- Vercel for the website;
- Render for the realtime game server;
- Upstash for expiring room snapshots when production persistence is enabled;
- Expo for preview Android build distribution;
- Resend for feedback email delivery; and
- Supabase for community authentication and durable Postgres storage;
- Brevo for delivery of Supabase account-verification and recovery email;
- GitHub for source hosting, issue reports, and maintainer contact.
These providers process technical data under their own terms. Mercyless does not sell player data.
Children, security, and choices
Mercyless is not directed to children under 13. Younger players should use it only with a parent or guardian where applicable. No internet service can promise perfect security: protect room codes and never publish a reconnect token.
To stop further game-room processing, leave the room and allow it to expire. Disable the bot-improvement checkbox before your next room to stop contributing new training decisions. You can sign out of Communities on each device at any time. To request deletion of community account data or report a privacy or security concern, contact the maintainer through the links below. Do not post email addresses, private tokens, or other sensitive information in a public issue.