Privacy Policy — Bluffer: Find the Imposter
Effective date: 11 October 2026 · Last updated: 17 October 2026
Bluffer: Find the Imposter ("the app") is published by VULANDER.NET PTE. LTD. ("we", "us"), a company registered in Singapore. It is a pass-and-play party game: one phone, three or more players in the same room. This policy explains exactly what the app does with data — including the data you never have to take our word for, because a round of Bluffer needs no network connection at all.
Questions, requests or complaints: david@vulander.net
1. The short version
Bluffer runs the game on the phone in your hand. The word packs ship inside the app, the voting is on the device, and nothing about a round is sent anywhere.
- There is no account, no sign-in and no profile. We cannot identify you.
- The app asks for no permissions at all — no contacts, photos, camera, microphone, location or notifications.
- Player names never leave your device. They are saved on the phone so the same group does not have to retype them, and they are never uploaded.
- There is no advertising and no advertising identifier (IDFA), and we do not track you across other apps or websites — which is why you never see an App Tracking Transparency prompt.
- There is anonymous usage analytics, so we can see which parts of the game people reach and which fail. It records that an event happened — a tutorial step was shown, the wheel was spun, a paywall was opened — and never what anyone typed. The first tutorial screen tells you so, and Settings → Privacy → Usage Analytics switches it off for good. Section 3.1 lists every event.
- The two tutorial questions are shared only if you tick the box. It starts unticked, and Settings → Privacy turns it off again. Section 3.2.
- We do not sell, rent or share personal information.
- The only things that leave your device are the anonymous events in 3.1, the opt-in tutorial answers in 3.2, and the purchase traffic Apple handles in 3.3.
2. Data that stays on your device
The following never leaves your device, is never transmitted to us, and is deleted when you delete the app.
| What | Why it exists | Where it is kept |
|---|---|---|
| The player names typed at setup | So the same group does not retype them next time | Local preferences (UserDefaults); cleared when you clear the player list or delete the app |
| Who is the Bluffer, the secret word, the votes and the result | To run the round and the reveal | Held in memory for the round, then reset |
| Recently drawn words and the categories you last played | So the same words do not come round again too quickly | Local preferences |
| Your settings: language pack, mascot, easier words, hints, voting on or off, discussion timer, music mute | So the game opens the way you left it | Local preferences |
| Your two tutorial answers — the occasion, and what usually spoils a party game for you | To tailor one tutorial screen and to pre-set the word difficulty | Local preferences; they leave the device only in the one case described in 3.2 |
| Whether the tutorial was finished, and whether we have asked you for an App Store review on this version | So neither is repeated | Local preferences |
| Which paid categories you own | So unlocked categories open without asking Apple on every launch | Verified by Apple's StoreKit, cached on the device |
Deleting the app removes all of it. We hold no copy and cannot restore it.
3. Data that leaves your device
3.1 Anonymous usage analytics
We count what happens in the app so we can see which screens people get stuck on and which features fail — the things we cannot fix if we cannot see them. The events are handled for us by an analytics provider that processes them in the EU.
Each event is a short, fixed name with a handful of fixed labels. The complete list is:
- which tutorial step was shown, and whether the tutorial was completed or skipped at that step;
- whether the guess in the tutorial's practice round was right or wrong;
- whether you accepted or declined the answer-sharing box in 3.2;
- that a role reveal or a wheel spin started, with the number of players at the table;
- the store funnel — a paywall was shown, a purchase was started, completed, cancelled, left pending or failed, and a restore was run — each with the category being sold, the screen the paywall opened from, and a short technical description of any error.
There is no free text in any of them — no player names, no secret word, no clue, no vote, and nothing else anyone types. Each event also carries the app version and build number, the iOS version, the device model, the locale, and whether the build came from the App Store or TestFlight, as App Store Connect already reports them to us.
Events are grouped under a one-way hash the app derives on your device from the vendor identifier Apple issues for this publisher — a value that is not the advertising identifier, not an Apple ID, and that Apple resets once you remove our apps from the device. There is no step that takes us from that hash back to you: we cannot tie it to a name, an email address, a payment method or anything you do outside our apps.
The analytics provider receives the request itself, so it sees your IP address in transit exactly as any internet service does; under its terms it does not store it, and it never reaches us.
Settings → Privacy → Usage Analytics turns all of this off, at any time and without affecting the game. The first screen of the tutorial tells you the analytics exist, and nothing is collected before you have passed that screen. Deleting the app also ends collection. There is nothing for us to delete on request, because we cannot tell which events are yours — if you would rather we did not process even this, write to us and we will honour your objection.
3.2 Your tutorial answers — only if you ask us to
The first run asks two questions: the occasion you are playing for, and what usually ruins a party game for you. Both answers stay on your device, where they tailor one tutorial screen and pre-set how forgiving the word list is. They are personal data about you, so they are treated as such.
The last tutorial screen shows you what would be shared and asks. The box starts unticked, nothing is sent until you leave that screen with it ticked, and declining costs you nothing and changes nothing about the game. If you accept, we receive the two answers as fixed categories — for example an occasion of family and a complaint of rules — with no free text and nothing attached beyond the same app, device and hash labels described in 3.1.
Settings → Privacy → Share My Answers withdraws it at any time, which stops any further sharing. We cannot pull back an answer already sent, because we cannot tell which one is yours.
3.3 Purchases
Paid categories are sold by Apple as one-time in-app purchases, with Family Sharing enabled. Apple handles the payment and tells the app only which categories are unlocked. We never receive your name, payment card, billing address or Apple ID. "Restore purchases" asks Apple, not us — the app has no purchase server of ours to call.
3.4 Crash and performance diagnostics
The app subscribes to Apple's MetricKit, which hands it the day's crash and performance report on the device; the app writes that into the device's own log and sends it nowhere.
Separately, Apple gives us crash and performance reports through App Store Connect, already aggregated and anonymised by Apple, and only for people who have left Share With App Developers switched on in iOS Settings → Privacy & Security → Analytics & Improvements. That switch is yours, and turning it off is honoured by Apple before anything reaches us.
3.5 The review prompt and the share sheet
After a round the guessers win, the app may ask iOS to show Apple's rating prompt, at most once per app version. Whether it appears, and anything you write in a review, is between you and Apple; all we keep is a note on your device that the question was asked.
The tutorial also offers a "Share this round" button, which opens Apple's standard share sheet with one fixed sentence about the practice round. It goes wherever you choose to send it — a message, a social app, nowhere — and never to us.
3.6 This website
The app and the website are separate. On vulander.net there are no cookies of our own, no analytics and no advertising scripts. Two things on the Bluffer pages do collect something:
- The beta sign-up form. Your name, email address and how you heard about Bluffer reach our inbox through a form-delivery service, with a spam check on the way, and the form then hands you to Apple's TestFlight — where joining the beta is governed by Apple's own privacy policy. We use your details only to run the beta and answer you. Nothing is added to a mailing list, sold or shared.
- The feature board. Votes and suggestions are kept in our hosted database. To stop one person voting repeatedly we store a salted SHA-256 hash of your IP address against the feature you voted for — never the address itself.
The full detail, including hosting and spam protection, is in the website privacy section.
4. Why we process this data, and our legal basis
- To run the game and honour your purchases — performance of a contract (GDPR / UK GDPR Art. 6(1)(b)). It is the service you asked for.
- To understand which parts of the game work and fix the parts that fail, and to keep it secure — legitimate interests (Art. 6(1)(f)). You can object: see 3.1 and section 9.
- To receive your tutorial answers — consent (Art. 6(1)(a)), given by ticking the box and withdrawn in Settings → Privacy.
- To put you on the TestFlight beta, and to reply to you — your request, and our legitimate interest in supporting the app.
We do not process special-category data, we do not profile you, we do not combine the usage events in 3.1 with anything else, and no decision about you is made by automated means.
5. Who we share data with
We have no advertising or data-broker relationships, and we do not sell data to anyone.
Data reaches only the service providers that make the app and the site work:
- Our analytics provider — the anonymous usage events in 3.1, as our processor.
- Apple — in-app purchase, the rating prompt, the share sheet, MetricKit on your device, and the aggregated diagnostics in 3.4.
- Our form-delivery and spam-protection providers — the beta sign-up form in 3.6.
- Our hosting and database providers — the website and its feature boards.
Each acts on our instructions and under its own privacy terms. We may also disclose data if required by law, or to establish, exercise or defend legal claims — given how little we hold, there is very little to disclose.
6. International transfers
We are in Singapore. Our analytics provider processes its events in the EU; Apple and our website providers operate internationally, including in the United States. Where you are in the EEA, the UK or Switzerland, those transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our providers' data processing terms, or another lawful transfer mechanism.
7. How long data is kept
| Data | Retention |
|---|---|
| Player names, settings, word history and tutorial answers on your device | Until you clear them in the app or delete the app |
| Anonymous usage events | Per our analytics provider's retention period. They carry no identifier we can resolve to a person, so there is nothing in them for us to look up, correct or delete on request |
| Tutorial answers you chose to share | As above — they arrive as categories on an anonymous event, with nothing that points back to you |
| Beta sign-up name and email | For as long as the beta runs, then deleted — or sooner if you ask |
| Feature-board votes and suggestions | While the board is live; the IP hash is kept only to prevent repeat voting |
| Purchase records | Held by Apple under Apple's policy. We keep none |
We keep no user database, so there is nothing we retain about you beyond the above.
8. Playing with other people
Bluffer is a game about other people at the table, so a word about them.
- The names typed at setup are personal data belonging to those players. They stay on the phone and are never transmitted — but they are saved between sessions, and anyone who picks up that phone can see them. First names or nicknames are plenty for the game.
- Nothing about a round is recorded beyond the device: no scoreboard, no history of who bluffed, no account to attach any of it to.
- The phone is passed around during play, and the app is built for that — a role is shown only behind a gatekeeper screen, and votes are cast in a secret ballot. That protects the game, not your phone: it is still your phone, with your other apps on it.
9. Your rights
Depending on where you live, you have rights over your personal data. Because the app has no accounts, the fastest route for almost everything is the app itself: player names, settings, word history and your tutorial answers live on your device, deleting the app erases them permanently, and Settings → Privacy switches off answer sharing.
For the little else that exists, you may ask us to confirm what we hold, correct it, delete it, restrict or object to its processing, or receive a copy. Email david@vulander.net or use the support form, and we will respond within 30 days.
- EEA / UK (GDPR): the rights above, and the right to complain to your supervisory authority.
- California (CCPA/CPRA): we do not sell or share personal information, or use it for cross-context behavioural advertising, so there is nothing to opt out of. You may still request access, deletion or correction, and we will not discriminate against you for asking.
- Singapore (PDPA): access and correction requests go to the same address.
One honest limitation: the usage events are identified only by a hash your device computes, which we have no way to tie to you. If you ask us to delete "your" analytics we will not be able to find it — deleting the app stops it at the source instead. A beta sign-up, by contrast, has your email on it, and we can find and delete that immediately.
10. Children
Bluffer is a family party game and families play it together. The app has no account, no advertising, no third-party ad networks and no IDFA, it asks for no device permissions, and it collects no personal information from any player — the only optional transmission is the tutorial answer sharing in 3.2, which is off unless an adult switches it on.
The app is not distributed in the App Store Kids Category, and we do not knowingly collect personal information from children under 13 (or the equivalent age in your jurisdiction). If you believe a child has provided personal information to us — through the beta form, for instance — contact david@vulander.net and we will delete it.
11. Security
- The game plays with no network connection at all, which removes the largest risk entirely rather than mitigating it.
- The analytics and purchase traffic that does leave the app uses HTTPS/TLS.
- There is no account to compromise, no password to steal and no user database of ours to breach.
- Purchases are verified cryptographically by Apple's StoreKit, on the device.
- Player names and game state are never transmitted, so they cannot be intercepted or leaked from a server.
No system is perfectly secure, but there is very little here to take.
12. Changes to this policy
If we change how the app handles data, we will update this policy and move the "Last updated" date. Material changes will be announced in the app's App Store release notes. Continuing to use the app after a change means you accept the updated policy.
13. Contact
VULANDER.NET PTE. LTD. — data controller
22 Sin Ming Lane, #06-76 Midview City, Singapore 573969
Registered in Singapore, UEN 202639834K
Email: david@vulander.net
For questions, feedback or a data request, email the address above or use the support form.
This policy is governed by the laws of Singapore, without prejudice to data protection rights you hold under the laws of your own country.