BLUFF is made by 5arz Services LLC, which is the company responsible for the game and for everything described on this page. BLUFF is built in partnership with Lumi Enterprises Corp., which develops it together with us and publishes the iOS app on the App Store under its developer account. Lumi works on BLUFF under agreement with 5arz Services LLC, may access the data described here only as far as building and running the game requires, and may not use it for anything of its own.
BLUFF is built so that most of this page is short. You can play, win the daily and take a handle without giving us anything at all. One thing changes that, and only if you choose it: adding a phone number so your record survives your phone. This policy says exactly what that means.
Install the app and play. No account, no email, no number. Your handle, rating, record and stars live on the device. When you finish a daily, the six decisions you made and your handle go to the board so it can be re-scored and ranked — the score is computed on our side from those decisions and is never accepted from the app. That is the whole of it, and it is the only thing that leaves an account-free install.
The cost of that is honest and worth stating: lose the phone and you lose the record, because there is nothing that could prove it was yours.
We do not store your phone number. Not encrypted, not hashed with something anyone could reverse — a ten-digit number space falls to a brute-force attack in minutes. What we write down is an HMAC-SHA256 of the number under a secret key that lives outside the database, plus the last four digits so a screen can say “sent to ••••0142”. Sending the code needs the real number and we have it at that moment because you just typed it. We do not need it afterwards, so we do not keep it. Somebody who stole a copy of our database would hold a column of hashes they cannot reverse without also stealing a key we keep somewhere else.
The six-digit code is stored the same way, because a code sitting in a table in plain text is a login credential sitting in a table.
What a signed-in account holds: the hash, the last four digits, your handle and your career record. Nothing else.
There is nothing for sale in BLUFF. No in-app purchases, no subscription, no currency you can buy. Stars are an in-game score: they are earned by playing, they unlock cosmetic looks only, and they cannot be bought, cashed out, sold or transferred. We never see a card number because there is never a payment.
BLUFF contains no adverts of any kind — no banners, no video, no interstitials, nothing between you and a hand. The app ships with no advertising SDK in it. It does not read your device's advertising identifier, it does not ask for permission to track you across other apps or websites, and there is no third party receiving anything about you for advertising or measurement.
If that ever changes it will change here first, with a dated note, before the version that does it is released.
| What | When | Why | How long |
|---|---|---|---|
| Server logs (IP address, user agent, page requested) | When you load webluff.com | Security and abuse prevention, by our hosting provider | Retained by Cloudflare per their policy; we do not build profiles from them |
| Your email address | Only if you type it into the daily-hand box | To send you the daily hand and keep your streak | Until you unsubscribe |
| The country your connection is in | When you give us an email address | Stored alongside it, so we know roughly where players are | With the address |
A campaign tag — the ?c= or utm_ value on the link you
arrived through | Only if you arrived through a link we tagged ourselves | So we can tell which of our own posts, listings or creators actually work. It describes the link, not you | With the address |
| Anonymous page counters | When you load a page or tap through to the game | A number goes up by one. First-party, on our own servers — no cookie, no device identifier, no fingerprint, no third-party analytics, and nothing that can be traced back to a person | Aggregate counts only; there is no individual record to delete |
We do not sell your data, and we do not share it with anyone except the companies named on this page doing the specific job named — Cloudflare to serve and store, Resend to deliver an email you asked for, your SMS carrier to deliver a sign-in code, and Lumi Enterprises Corp. as our development partner, on the terms set out at the top of this page. We do not build advertising profiles. We do not track you across other apps or websites, for our own purposes or anybody else's. We do not ask for your contacts, your location, your photos, your microphone or your camera, and the app contains no code that could.
City leaderboards use the approximate city our hosting provider derives from your connection when your run reaches us. That happens on the server. The app never asks your device where it is and has no location permission.
BLUFF has nothing to buy and no adverts, and asks for a phone number only if you choose to sign in. It asks nobody for other personal information — including anyone under 13, from whom we do not knowingly collect any. If you believe a child has sent us personal information, write to [email protected] and we will delete it.
Because we hold so little, most requests answer themselves: use Reset career in your profile and everything on your device is gone, along with the token that linked your runs. For what sits on the board — a handle and the decisions behind its runs — you may ask us to access, correct, delete, or send you a copy, and you may object to processing or ask us to restrict it. Write to [email protected] with your handle and we will respond within 30 days. We will not treat you differently for exercising any of these rights.
If you are in the EEA or UK, our lawful bases are: legitimate interests for running and protecting a public daily board that people can trust, and consent for the launch email if you asked for one. You have the right to withdraw consent at any time and to complain to your local supervisory authority.
The site, the board and its scoring all run on Cloudflare, and completed runs are stored in Cloudflare storage. Email addresses, if you give one, are stored the same way, and are passed to Resend only to send the message you asked for. Our development partner Lumi Enterprises Corp. may access these systems as far as building and running the game requires. We do not transfer personal information to anyone else except where required by law.
Everything is served over HTTPS. The smallest attack surface is the one that does not exist, which is why the game sends six decisions and a handle rather than an account, and keeps everything else on your own device.
If this policy changes we will update the date at the top and, where the change is significant, say so in the app. Continuing to play after a change means you accept it.
5arz Services LLC
16192 Coastal Highway
Lewes, DE 19958
United States
[email protected]