Privacy policy

Who runs Podlink

One person: Aaron Binner, an independent developer in the United States. I am responsible for what Podlink does with your data. Write to support@getpodlink.app.

What stays on your device

• The name you typed, and a random ID the app makes up the first time it opens. The ID is not your advertising ID and is not read from your device or your account. It stays the same at every table until you delete the app.
• Your style, your last lineup, your saved pods and a few settings.
• The game in progress. On a device that hosts a table itself, that is the whole table.
• A record of each game played: the names, the totals, the log and, for a linked game, the table code. Up to 1000 games, the oldest dropped first. No screen shows them yet.
• Whether your Apple Account has bought Foil, and this device’s free-night record.

None of it is sent, except what a linked table needs. Deleting the app deletes it all but one thing: on an iPhone or iPad the free-night record sits in the Keychain, which outlives the app, so that reinstalling does not hand out new nights. The record holds how many nights are used and when the current one ends. Podlink does not send it to anyone.

The app’s data, that record included, is in your own iPhone or iPad backup if you keep one. On Android it is kept out of Google’s backup; a transfer straight to a new device can still carry it.

What a linked table sends

At a linked table each player uses their own device, and the table runs on the relay: a small server Podlink runs on Cloudflare’s network. It answers at getpodlink.app and at podlink.pocketfoundry.workers.dev, its first address, which older versions of the app still use.

Your device connects to it, encrypted, only for a linked table: when you open, join or reconnect to one, or reopen the app while you are at one. It sends:

• The name you typed, the table’s four-letter code, and the version of Podlink’s protocol your device speaks.
• Your random ID, so the table can give you your seat back if your device drops off.
• Everything you do in the game: life, hits, counters and tokens, commander damage and a second commander, monarch, initiative, day and night, dice and picks, passing the turn, handing a seat’s totals to the table, undo.
• If you opened the table: its settings, the names you type for other seats, and a key made from your random ID and the code. The key travels in the connection’s address and tells the relay the table is yours when you come back.

Podlink’s own messages carry nothing else: no location, no contacts, no Wi-Fi name, no device model, and nothing about purchases beyond whether the game began on a free Foil night. They are used for one thing: running your table.

The connection itself also carries the headers your system or browser adds to any connection. From an iPhone or iPad: the app’s name and build number, the version of the system’s networking software, which gives away the system’s own version, and the languages your device is set to. From a browser: its name and version, your operating system, your languages and, in some browsers, the device’s model. From the Android test build: the name and version of its networking library. Podlink’s code reads none of them.

What the relay keeps, and for how long

What the table needs: the seats (names, colours, teams), the settings, the game with its log and undo steps, which random ID holds which seat, the opener’s key and the code. Because your ID is the same at every table, the tables it sat at can be matched for as long as the relay keeps them. The relay writes no logs, and Podlink’s code does not read your IP address.

• The relay deletes a table the moment the device that opened it closes it, while that device is connected.
• Otherwise it deletes the table 24 hours after the last activity there: any message from a device that holds a seat, a device taking a seat, leaving, dropping off or reconnecting, or the table taking over the seat of a device that went off a minute before. A connection that has the code and no seat does not count.
• If a device that holds a seat is still connected when those 24 hours are up, it waits another 24 hours and looks again.

Cloudflare’s storage can restore deleted data for up to 30 days. The relay does not ask it to.

What the other devices receive

The game: your name, your seat’s colour and team, your life, counters and commander damage, your dice rolls, the log with its times, whether your device is connected, whether you joined from a browser, and whether the game began on a free Foil night. Not your random ID. Your mana pool stays on your device; when you crack a Treasure, the colour you pick is sent with that change and shows in the log.

The four-letter code is the only key to a table. Anyone who has it can take a free seat before a game starts, and is then sent what the other devices are sent. Every seat shows in the lobby, where the host can remove one. The relay sends the game only to devices that hold a seat: a connection that has the code and no seat is sent nothing of it.

What Cloudflare sees

Cloudflare hosts the relay. The encryption ends at Cloudflare, so everything the relay handles passes through its servers. Like any host it also sees your IP address, which places you roughly (a city or a region), the address you asked for and the headers described above. That is true of this page too. Podlink’s code reads and stores none of it.

Cloudflare keeps its own traffic and security records. What it shows me of them can include the IP address of some recent requests, and I use them only to keep the relay running.

Cloudflare handles table data only to host the relay, under its data processing agreement, and must protect it at least as well as this page describes. Cloudflare chooses where a table runs, and Podlink asks for no place. By Cloudflare’s own account that is a data centre near the first device that asked for that four-letter code, and it does not move afterwards. Codes are used again, so a table can run far from you and outside your country, including in the United States.

For data that leaves the EU, the UK or Switzerland, Cloudflare is certified under the EU-US Data Privacy Framework, its UK extension and the Swiss-US framework, and its agreement includes the EU’s standard contractual clauses and the UK addendum. Read Cloudflare’s data processing agreement on cloudflare.com, or write to me for a copy.

What your Wi-Fi can see

An open table is announced

The device that opens a table announces it on the local network while the table is open, so that Podlink on nearby devices can list it. The announcement carries the four-letter code, the host’s name, the format and starting life, how many seats are taken and their colours, whether the game has started, whether the table is on the relay, and Podlink’s protocol version. The device’s network name (often its owner’s first name, as in Sams-iPhone), its address and the table’s port go with it.

Every device on that Wi-Fi can read this with ordinary network tools. An iPhone or iPad also announces over peer-to-peer Wi-Fi, which reaches Apple devices close by that are not on your Wi-Fi. And while Podlink looks for tables (on the start screen, and while a linked device is joining or reconnecting), other devices on the Wi-Fi can see that it is open on yours.

A table hosted on a device is not encrypted

If the relay cannot be reached when a table is opened (the app waits 6 seconds), or the relay is taking no new tables that day, the host’s device runs the table itself. Devices on the same Wi-Fi connect to it straight over the Wi-Fi, and that traffic is not encrypted. Anyone able to capture it could read the names, every change in the game and each joining device’s random ID, and anyone able to get in its way could alter it. A captured ID can be used to take that device’s seat, at that table or at a later one, until the app that made it is deleted.

A table hosted on a device also sends the game to every connection it accepts, seated or not. So any device on that Wi-Fi can follow the game without joining, and once the table is linked to the relay, so can anyone who has its code.

The host’s device then holds what the relay otherwise would, each joining device’s random ID included, until the table is closed. An iPhone or iPad hosting this way also offers the browser page to the Wi-Fi over plain HTTP, on a port from 8787 to 8790. When it has internet, it links the table to the relay for devices that join by code. The relay passes their messages along and keeps only the host’s key and the time the host’s device last dropped off, for 24 hours after that device last connected or dropped off, and longer while it is connected.

At a table on the relay, the Wi-Fi sees the announcement and an encrypted connection to Cloudflare under the relay’s name, and nothing of the game itself. The announcement does carry the code.

Joining from a browser

Friends without the app can each take a seat from a web browser. The page is one file, from the relay or, at a table hosted on an iPhone or iPad, from that device. It loads nothing from any other site. The relay sends it with rules the browser enforces, which also stop it using the camera, the microphone or your location.

• It sets no cookies. It keeps three things in that browser’s storage: a random ID it makes up when it is first opened, the name you type and the last table code. The ID stays the same at every table until you clear the site’s data, which removes all three.
• When you tap Join table it opens one connection, back to where the page came from, and sends what the app sends, with a note that it is the browser page.
• It keeps the screen on while you are seated and can buzz on your turn. Browsers allow both without asking.
• Cloudflare adds its own error-reporting instruction to the relay’s answers. A Chrome-family browser that then fails to reach the relay can report the failed address to Cloudflare (a.nel.cloudflare.com). Podlink does not receive it.

This page and the support page run no scripts, set no cookies and store nothing.

Purchases

Podlink Foil is bought through Apple’s App Store. Apple takes the payment and keeps the record, under its own privacy policy. Podlink is not given your Apple Account, the name on it or your card.

When the app opens, and from the Foil sheet, iOS asks the App Store for Foil’s price, whether your Apple Account has bought it, and whether this copy of the app came from the App Store. The app keeps the yes or no on your device and does not send it to the relay.

Apple shows every developer totals for their app (downloads, sales by country) and crash reports from people who chose to share them. Podlink adds nothing to those.

Permissions

• Local network (iPhone and iPad). To find tables on your Wi-Fi, to let nearby devices find yours, and to link the devices at a table hosted on a device. It is not your location. If you say no, joining by code, by QR code or from a browser still works over the internet.
• Camera. Only when you tap Scan QR. The picture is read on your device and only the four letters are kept. Nothing is recorded, saved or sent.
• Notifications (Android 13 and later only). For one notice that says a table is open.

Podlink does not ask for your location, Bluetooth, contacts, photos, microphone, or permission to track you. The apps contain no code that uses them.

What Podlink does not do

• No account, no sign-in, no email address.
• No ads, no analytics, no crash reporter. The iPhone app contains Podlink’s own code and Apple’s, and nobody else’s.
• No tracking across apps or websites, no advertising ID, no location. No advertising, analytics or tracking code from anyone is in Podlink, so no other party collects what you do over time or across sites through it. Since nothing is tracked, a browser’s Do Not Track or Global Privacy Control signal changes nothing.
• No selling of personal information, and no sharing of it for advertising, as California’s law uses those words.

You can check. The only internet address in the apps’ code is the relay’s, and the iPhone app does not pin certificates, so a proxy you trust on your own iPhone shows every message it sends. On a Mac on the same Wi-Fi, dns-sd -B _podlink._tcp shows the tables being announced.

Android

Podlink for Android is in testing. It is not on Google Play, and testers get it straight from me. The current test build:

• Connects to the relay and to devices on your Wi-Fi, as described above, and to nothing else. It contains no analytics, ad or crash-reporting library.
• Reads QR codes on the device with ZXing, an open-source reader that contacts nobody.
• Has no Foil and no purchases. Declares no location or Bluetooth permission.
• Checks every 5 seconds that a table listed nearby is still there, by opening a connection to it and closing it.
• Keeps its data in the app’s private storage, out of Google’s backup. Uninstalling removes it.

Android itself may fetch an emoji font for any app through Google Play services. Podlink sends nothing with it. When Podlink reaches Google Play, Google will handle purchases there as Apple does, and this page will say so first.

Children

Podlink is not directed at children under 13 and does not knowingly collect anything from them. It asks for no age, no account and no contact details. The only thing it asks you for is a name, and a nickname does as well. If you believe a child has sent something they should not have, write to me and I will delete it.

Your data and your rights

Wherever you live, you can ask what Podlink holds about you, ask for a copy in a form you can take with you, and ask for it to be corrected or deleted. It costs nothing, and you will not be treated differently for asking.

You do not have to give Podlink anything: a game on one device sends nothing. A linked table cannot seat you without a name (any nickname will do) and the random ID.

• On your device. Deleting the app deletes what it kept, apart from the free-night record.
• On the relay. Tables delete themselves, as described above. To delete one at once, close it from the device that opened it while its lobby says Online. Closed while that device is offline, the table goes by the 24-hour rule. To leave nothing on the relay, play on one device.
• By asking. Write to support@getpodlink.app with the table code and the name you used. A table usually deletes itself before I read your message. If it is still there, I will delete it and tell you what it held for your seat, within 30 days. The relay does not know who anyone is, so the code and the name are the only way I can find anything. Your message stays in my mailbox, with my email provider, for as long as it is needed to answer you and to show what was asked and done. I delete it sooner if you ask.
• In the EU and the UK. I am the controller. Table data is used because the linked table you asked for cannot run without it (performance of a contract); your email and Cloudflare’s records, because I have a legitimate interest in answering you and keeping the relay running. You can also object, ask me to restrict what is done with your data, and complain to your data protection authority (in the UK, the ICO). If you think I have handled your data wrongly, you can also complain to me: I will acknowledge it within 30 days and tell you the outcome.
• In California and other US states. You have the rights to know, to correct and to delete. There is no sale or sharing to opt out of: see What Podlink does not do.
• Saying no. Leave or close a table whenever you like. Podlink relies on your consent only for the permissions above, which you can switch off in your device’s Settings.

Changes

If this policy changes, the new text goes on this page with a new date at the top.

Aaron Binner · support@getpodlink.app