Last updated: 4 September, 2026
Twenty or One (“the game”, “we”, “us”) is a mobile game published by NTUK NTUK, based in Toronto, Canada. This policy explains what information the game handles, why, and what choices you have.
The short version: the game has no accounts and does not ask for your name, email address, or phone number. Most of what follows describes the small amount of technical and gameplay information needed to run duels, plus the advertising described in section 5.
The game does not collect, and does not ask for:
When you first open the game, it generates a random identifier and stores it on your device. This is how the game recognises your progress, streak, and challenge history without an account. It is generated by the app; it is not your device’s serial number or hardware ID. Deleting the app removes it from your device.
Updated 4 September 2026. The name you choose is shown to the players you play with, on their screens — anywhere the game puts you in front of another player. Where the game shows a rating, it appears beside your name. Other than these, we don’t show anything about you to other players.
If you play with friends, you choose a display name so other players in your room can tell who is who. It may be a nickname — we do not verify it and do not need your real name. Display names pass through an automated filter for offensive words. Anything you type here is visible to other players in your room, so please do not put personal information in it.
Added 2 September 2026. If you play rated games, we create a pseudonymous player identity on our server — an ID and a rating. It is not linked to your name, email, or device hardware, and we cannot recover it for you if you lose it.
Added 2 September 2026. If you report another player, we keep the report — which identifies your device and theirs — for about 30 days, and then delete it. If you block another player, the block lasts until either of you deletes their data. If you report another player, we review it and act within a few days.
To run duels and let you play against recorded opponents, the game records how a turn was played: which deal you were given, which target lane you chose, the cards you placed and removed, and when you locked in — all with timestamps. It is stored against your device identifier, not against you personally.
The game counts a small number of events so we can tell whether features work: a challenge being sent, a challenge being opened, an install arriving from a challenge link, and how often players choose a rematch. It also counts, across all players, how many chose each lane in the daily puzzle — the figure shown as “X% went Low”. These are aggregate counts and are not used to build a profile of you.
Added 27 August 2026. If the game crashes, a crash report is sent to Sentry, a crash-reporting service, so we can find and fix the fault. A report describes the crash — what failed, where in the code, and basic device context such as the phone model, operating system version, and whether the app was in the foreground. We configure it to carry no account of you: no device identifier, no display name, no gameplay history, and we switch off its screenshot, session-replay and interaction-tracking features. Two limits on that, stated plainly rather than assumed: the crash-reporting layer itself records some device events around a crash (battery state, app lifecycle) that our filters do not reach, and Sentry’s servers, like any web server, receive the sending device’s IP address when a report arrives. We do not use either to identify you.
Technical request data. When the game or this website contacts our servers, our hosting provider (Cloudflare) receives your IP address and basic request information, as any web server does. We use it to operate and protect the service. It is not linked to your device identifier or to your gameplay.
| Information | Purpose |
|---|---|
| Device identifier | Run the game without accounts; keep your streak, settings and challenges attached to your device |
| Display name | Let other players identify you in friend rooms |
| Gameplay recordings | Provide opponents to play against, validate results, and prevent cheating |
| Anonymous counters | Understand whether features are working; improve the game |
| Crash reports | Find and fix faults that make the game crash |
If you are in the UK or European Economic Area, our legal basis is legitimate interests for running the game and for anonymous counting.
We use a small number of service providers. We do not sell your information, and we do not share it with anyone beyond the following:
These providers operate internationally, so information may be processed outside Canada, including in the United States and the European Union, under the safeguards those providers maintain.
Removed 23 August 2026 — the game shows no ads. Earlier versions of this policy described advertising that was never implemented. The section number is kept so that older copies of this policy can be compared against this one.
Removed 23 August 2026 — the game offers no purchases. As with section 5, earlier versions described a paid option that was never implemented, and the number is kept so the change is visible rather than silently renumbered away.
Depending on where you live, you may have the right to access the information we hold about you, correct it, delete it, or object to how it is used. Canadian users have these rights under PIPEDA; users in the UK or EEA under the GDPR; users in California under the CCPA/CPRA.
Corrected 23 August 2026. An earlier version of this section said you could email us your device identifier and we would act on any of those rights. That was wrong about one of them, and it was wrong from the day it was published rather than something we stopped doing.
Because the game has no accounts, the only way we can find your information is by your device identifier — and the identifier is a credential, not an account number. Anyone who has it can reach the data it points to. That single fact splits your rights in two, and we treat the two halves differently on purpose:
What we can tell you without any request at all is what section 2 lists, because it is the same for every player. There is no profile, and there is nothing we hold that section 2 does not name.
We respond within 30 days.
Deleting the app also removes the identifier and local data from your device.
The game is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided information to us, contact us and we will delete it.
Information is transmitted over encrypted connections and stored with our service providers under their security controls. No system is perfectly secure, but the game’s design limits exposure: there are no accounts, no passwords, and no contact details to lose.
If this policy changes in a way that materially affects you, we will update the date at the top and, where appropriate, tell you in the game. Continuing to play after a change means you accept the updated policy.
Questions, requests, or complaints: contact@twentyorone.com
If you are in Canada and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada. If you are in the UK or EEA, you may contact your local data protection authority.