Comprehensive Privacy Policy

We want to state with absolute clarity: All Rummy App DOES NOT COLLECT, TRANSMIT, STORE, OR PROCESS ANY SENSITIVE PERSONAL OR FINANCIAL DATA.

When you download an APK and create an account inside that specific application, your financial transactions, phone numbers, and KYC validations are handled directly by that independent gaming operator and its RBI-licensed payment aggregators (e.g., Razorpay, Cashfree, Paytm).

To maintain high-speed web delivery, defend against distributed denial-of-service (DDoS) assaults, and optimize mobile layouts, our edge cloud servers automatically log anonymized technical parameters:

• Anonymized Server Access Logs: Standard web server requests containing pseudo-anonymized IP addresses (with the final octet masked), request timestamps, requested URL resources, HTTP protocol response codes, and referring web addresses.
• Device & Browser Telemetry: Client user-agent strings, device manufacturer, operating system version (e.g., Android 14, iOS 18, Windows 11), preferred browser language, and viewport dimensions to dynamically render responsive mobile interfaces.
• Voluntary User Communications: If you voluntarily reach out to us via email or our official Telegram channel, we receive your email address, handle, and the message content you provide solely to resolve your specific support inquiry.

Cookies are compact text files stored on your device hard drive by your web browser when visiting web domains. We maintain a strict policy of cookie minimization:

How to Disable Cookies: You hold sovereign control over cookie placement. You can adjust your browser settings (in Chrome, Firefox, Safari, or Brave) to refuse all cookies or notify you whenever a cookie is dispatched. Disabling cookies will not degrade your browsing experience on our directory.

Our directory contains outgoing hyperlinks that direct users to external developer servers, official APK file hosts, and messaging networks (including Telegram).

Please be aware that our Privacy Policy applies exclusively to our own domain. Once you click an external link or download a third-party APK, you leave our computational perimeter and are governed by the respective privacy policies, data retention protocols, and terms of service of those third-party operators.

We strongly advise you to inspect the privacy statements of every third-party application you install, particularly regarding their KYC collection, SMS OTP permissions, and banking integration protocols.

We implement industry-standard administrative, organizational, and technical security protocols to safeguard our digital platform against unauthorized access, destruction, disclosure, or alteration:

• Transport Layer Security (TLS 1.3): All network communications between your browser and our edge servers are encrypted using modern 256-bit cryptographic ciphers with mandatory HTTPS enforcement and HSTS preloading.
• DDoS & Web Application Firewall (WAF): Intelligent real-time edge firewalls actively inspect and neutralize anomalous traffic spikes, SQL injections, and cross-site scripting attempts.
• Principle of Least Privilege: Server access is strictly restricted to designated administrative personnel through multi-factor authentication (MFA) and SSH public-key cryptography.
• Ephemeral Log Retention: Anonymized server logs are automatically cycled and permanently purged after a maximum retention window of ninety (90) days.

Safeguarding the privacy and well-being of young individuals is of paramount importance to our team. All Rummy App is strictly intended for individuals who are at least 18 years of age.

We do not knowingly collect, solicit, or maintain personal information from individuals under the age of 18. If we become aware that a minor has provided us with personal information through support correspondence, we will immediately delete that information from our database records. Parents or guardians who believe a child has contacted our platform should alert us immediately at: support@holyrummyplayin.com.

Under the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) of India, you (as a Data Principal) are endowed with distinct statutory rights regarding personal data:

To ensure lightning-fast page delivery across all 28 states and 8 union territories of India, All Rummy App leverages distributed edge delivery networks (Cloudflare and tier-1 Indian data centers in Mumbai, Chennai, and New Delhi).

In strict adherence to Section 16 of the Digital Personal Data Protection Act, 2023, we do not transfer any user data to countries or territories restricted or blacklisted by the Central Government of India. Any technical routing across edge compute nodes is executed through end-to-end encrypted pipelines ensuring zero persistent international data retention.

When players execute real money transactions within third-party gaming applications, those financial exchanges are routed through Reserve Bank of India (RBI) authorized Payment Aggregators (PAs) and National Payments Corporation of India (NPCI) UPI switches:

• Card-on-File Tokenization (CoFT): In compliance with RBI mandates, debit and credit card numbers are tokenized by authorized card networks (Visa, Mastercard, RuPay). Real 16-digit card numbers are never stored in plain text.
• Zero Intermediary Access: All Rummy App has zero technical integration with, visibility into, or custody over operator payment flows. We never receive banking transaction logs or UPI Virtual Payment Address (VPA) linkages.

Modern web browsers permit users to broadcast automated privacy preference signals, such as Do Not Track (DNT) and Global Privacy Control (GPC) headers.

Because our website operates under a strict data minimization philosophy and deploys zero cross-site behavioral ad retargeting pixels, our servers inherently respect your privacy preferences by default. We do not track users across external digital properties, sell browsing logs, or profile consumer habits for programmatic ad auctions.

In alignment with cybersecurity directives issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the Information Technology Act, 2000:

• Our technical operations center maintains 24/7 automated threat monitoring and anomaly detection across all edge nodes.
• In the improbable event of a confirmed security incident impacting our server infrastructure, we follow mandatory protocols to notify CERT-In within six (6) hours of detection.
• We will issue prominent public disclosures on our portal advising users of remediation measures and technical status updates.

Below is the comprehensive audit of all cookies deployed across our edge architecture:

Tip: You can scroll horizontally on the table above to view all column attributes on mobile devices.

When installing third-party gaming APKs, players should exercise digital self-defense by auditing the permissions requested by the game during installation and gameplay:

To ensure that past web usage cannot be weaponized, subpoenaed, or reconstructed into retrospective behavioral dossiers, All Rummy App operates automated log destruction protocols:

• Zero Permanent Database IP Storage: Inbound IP addresses recorded for DDoS traffic rate-limiting are stored only in volatile memory (RAM) and purged every 60 minutes.
• Salted Cryptographic Hashes: Analytical telemetry utilizes unidirectional cryptographic hashing (SHA-256 with rotating salt) so that unique visits cannot be traced back to a specific individual subscriber line or ISP broadband connection.
• Nightly Edge Log Purges: All edge node web logs are permanently scrubbed and overwritten after their operational security analysis cycle concludes.