Privacy policy

PackRip: TCG Card Packs has no account system, asks for no e-mail address and knows no name. This page describes what it does collect, why, where it goes, and how to have it removed.

Updated 19 October 2026

Who this covers#

This policy covers the iPhone app PackRip: TCG Card Packs, published by Arinc Elhan. The browser product at packrip.co is a separate product with its own policy; the two keep separate data and separate saves.

There is no account#

On first launch the app generates a random identifier and stores it in the iOS Keychain. That identifier is not your Apple ID, not your iCloud account and not Apple’s advertising identifier. It is what the server uses to recognise your save. You can read and copy it any time from Settings, then About, then Device ID.

There is no signup, no login, no password, no e-mail collection and no social sign-in. The app never asks for your name, phone number, contacts, photos, location, microphone or camera.

What is collected#

These are the seven categories the app declares to Apple in its privacy manifest. The app declares that none of them is used to track you across other companies’ apps or websites.

• Device ID. The random Keychain identifier above. Used to attach your save and your purchases.
• Purchase history. Which coin packs and subscription periods were bought, so coins can be granted and PackRip Plus can be recognised. Handled by Apple and RevenueCat, and recorded in the backend database.
• Product interaction. Events such as opening a pack or finishing a Memory Rip game, used to understand which features are used. Collected through Firebase Analytics, plus anonymous daily counts sent to the app’s own backend.
• Crash data. Crash reports collected through Firebase Crashlytics, so crashes can be found and fixed.
• Performance data. Timing and failure counts, for example how long content took to load.
• Other diagnostic data. Technical details that accompany a crash or a failure, such as the iOS version and device model.
• Advertising data. What Google’s ad SDK needs to select, show and measure an ad, and to verify that a rewarded video you chose to watch was completed. Details in the advertising section below.

Language and country#

From version 2.0 the app sends the language it is running in, and the backend records the country your connection comes from, as seen by Cloudflare. Both are stored with your device identifier so the app can show copy in your language. The app is available in English, German, French, Spanish, Italian, Portuguese (Brazil) and Dutch, and you can change the language in Settings, then Language.

Cloud save#

Your collection, coins, experience, quests, achievements, Seals, preferences, pity counters and pack bank live on your device, and the app uploads a versioned snapshot to the backend so you can recover it later. If the server already holds a newer snapshot than the one being uploaded, the two are reconciled rather than one silently overwriting the other.

The backend is a Cloudflare Worker with a Cloudflare D1 database and Cloudflare KV, at packrip-api.elhanarinc.workers.dev. It stores your device identifier, a token issued for that identifier, your language and country, your latest snapshot, your pack bank, and one row per purchase and per completed rewarded video. Cloudflare processes standard request logs, including IP address and timestamps, for abuse mitigation under Cloudflare’s privacy policy.

Nothing expires on its own. A snapshot and its records stay until you ask for them to be deleted, which the section below explains how to do.

What other players can see#

The daily challenge leaderboard, duels and trainer profiles show the trainer name you choose, your title and name colour, your level and collection totals, and the cards you pin to your showcase. Names are filtered, other players can report one, and a reported name is replaced with “Anonymous”. Nothing else about you is shown.

Purchases#

Purchases are processed by Apple. Payment details never reach this app or its backend. RevenueCat validates the receipt and tells the backend so coins can be granted server-side and PackRip Plus can be recognised. RevenueCat receives the anonymous device identifier and Apple’s transaction metadata; it does not receive your Apple ID or contact details. See RevenueCat’s privacy policy.

Analytics and crash reports#

The app uses Google’s Firebase Analytics and Firebase Crashlytics to understand which features are used and to find crashes. It uses the variant of Firebase Analytics that does not access Apple’s advertising identifier. Separately, the app reports anonymous daily counts to its own backend, for example that a pack failed to open, with no user identifier, no card data and no free text.

Advertising#

The app shows advertising supplied by Google AdMob, through Google’s Mobile Ads SDK: banners, a full-screen ad between some pack openings, and an optional rewarded video you choose to watch for an in-game reward, such as a bonus pack or extra Memory Rip moves.

Every ad request is marked non-personalised, so ads are chosen from context rather than from a profile of you. The app does not request Apple’s advertising identifier and never shows the App Tracking Transparency prompt. When you finish a rewarded video, Google confirms it to the backend with your device identifier, so the reward reaches the right save.

A PackRip Plus subscription removes the advertising that appears unasked: banners and between-pack ads. Rewarded video stays available to everyone because it only plays when you start it.

Card and set content#

Sets, cards and game configuration are delivered from the backend and a content network so new content can arrive without an app update. Those are ordinary content requests and are not used to build a profile of what you look at.

Notifications#

Reminders are local notifications scheduled on your own device; no push token leaves it. The app does not ask for notification permission on first launch, sends at most three reminders a day, and lets you switch each channel off in Settings, then Notifications: Bank Full, Streak & Challenge, and Reminders & News. You can also turn them all off in iOS Settings, then PackRip, then Notifications.

App Tracking Transparency#

The app declares to Apple that it does not track you, and declares no tracking domains. It does not request the advertising identifier and does not present the App Tracking Transparency prompt.

Children#

Pack opening uses randomised odds, disclosed in the app before any purchase. The app is not directed at children under 13. Parents can restrict purchases with Apple’s Screen Time and Family Sharing controls. The App Store listing shows the current age rating.

Your choices#

• Have your data deleted. E-mail elhanarinc@gmail.com with your Device ID from Settings, then About. The cloud save, purchase records, rewarded-video records, public profile, language and country for that identifier are deleted.
• Restore purchases. Settings, then Restore Purchases, re-attaches your subscription state.
• Change the language. Settings, then Language.
• Turn off reminders. Settings, then Notifications, per channel, or iOS Settings for all of them.
• Remove banners and between-pack ads. A PackRip Plus subscription hides them.

Apple privacy manifest#

The app ships a PrivacyInfo.xcprivacy manifest declaring seven collected data types: device ID, purchase history, product interaction, crash data, performance data, other diagnostic data and advertising data. Advertising data is declared as linked to the device identifier, for rewarded-video verification; the other six are declared as not linked. None is declared as used for tracking, and NSPrivacyTracking is false. The manifest also declares the required-reason API use for UserDefaults and file timestamps.

Changes#

Material changes appear here with a new date at the top and a short list of what changed.

Contact#

Questions, deletion requests, anything else: elhanarinc@gmail.com.