ClapOut for Android XR: privacy policy
Effective 29 October 2026. This policy covers the ClapOut app for Android XR glasses and headsets (package com.hayeco.clapout). The website at clapout.app has its own policy at https://clapout.app/privacy, and the two say the same thing about everything they share. The rules for playing with others are in our terms at https://clapout.app/terms-xr.
Who we are
ClapOut is a card game made and run by HAYE CO, a small independent studio. "We", "us" and "our" mean HAYE CO. For any question about this policy or your information, email connect@mikehaye.com.
The short version
- Your hands and your room stay on your device. ClapOut uses hand tracking and scene understanding to let you pinch cards, clap, and put the card mat on your real table. That data is processed on the device and is never sent to us.
- To play with other people, the app sends our game server a name you choose and a random player id.
- The microphone is used only for voice chat, only after you unmute at a table, and your voice is never recorded.
- Ads are optional rewarded videos from Google AdMob, shown only when you choose to watch one.
- No sign-in and no purchases in this app.
- You can delete your data from the app (About & privacy, DELETE MY DATA) or at https://clapout.app/delete-data.
What we collect and why
| What | Why | Where it lives |
|---|---|---|
| The name you type | So the others at your table can see who is who | On your device, and on our server while you play |
| A random player id | So the server knows which progress (level, rank, XP) and Claps balance are yours | On your device; on our server with your progress |
| A rejoin token for the table you are at | So you go back to your seat if the app closes mid-game | On your device until the game ends or you leave |
| Your answer to the age question | So the app can keep under-18s away from strangers' voices and under-13s off online tables | On your device only |
| Your moves and technical data (IP address, times of requests) | To deal and referee the game, keep tables working and stop abuse | Server logs, kept for 30 days |
| Gameplay events (a game started, a reward was claimed) | To run the game's progress and Claps correctly and improve the game | On our server, kept for 90 days |
| Reports you send about another player | To look into the report and keep the game safe | On our server, kept for 1 year |
| Your block list | So players you block stay silent for you | On your device only |
The player id is random. It is not linked to your real identity or your Google account. It is passed to Google AdMob when you choose to watch an ad (see "Ads and consent"), and Google may associate it with the information its ads SDK collects, such as your device's advertising id. Please do not use your full name, or anything you would not want strangers to see, as your player name. Our server refuses offensive names and names that pretend to be a ClapOut bot or ClapOut staff, for every player on every device, and the app also hides other players' offensive names.
Hand tracking and scene understanding
ClapOut asks for hand tracking and scene understanding (the "coarse" and, where the device offers it, "fine" scene permissions) before the first table, and explains why first. They are used to:
- follow your hands so you can pinch cards, clap, and use the palm menu;
- find a flat surface (your real table) and its depth, so the mat sits on it.
All of this is processed on your device by Android XR. Hand data, plane data, depth data and camera-derived data are never sent to us, never stored by us, and never shared. You can turn these permissions off in Settings at any time; the game then cannot set the table.
Microphone and voice chat
Voice chat is optional. The app asks for the microphone only when you first press UNMUTE at a table that has voice; it never asks at launch. Everyone enters a table muted. At a Quick Play table, which seats strangers, voice is off until you turn it on from the palm menu, and players who told the app they are under 18 cannot turn it on there.
When your mic is on, your voice is streamed live to the other players at that table through LiveKit, a real-time media service. To connect you, LiveKit receives your display name and a voice identity made for that table only (your seat number and a random code, not your player id). Voice is not recorded: neither the app, our server nor LiveKit on our behalf keeps any audio. You can mute yourself at any time, mute any other player for yourself, and block or report a player. Withdraw the microphone permission in Settings at any time.
Ads and consent
ClapOut can show optional rewarded video ads from Google AdMob: you choose to watch one and receive free Claps. An ad is shown only when you press WATCH. When an ad is requested, Google may collect and use information such as your device's advertising id, IP address and ad interactions, under Google's own policies (https://policies.google.com/technologies/partner-sites). So the server can credit the reward, the app passes your random player id to Google as the ad's "user id"; Google sends it back to our server with the reward.
Where the law requires it (the European Economic Area, the United Kingdom and Switzerland), Google's consent message (the User Messaging Platform) asks for your choice before any ad is requested. You can opt out of personalised ads in your device's settings (Settings > Google > Ads, where available) and reset or delete your advertising id there.
Reports
When you report a player from the table or the lobby, the app sends our server the report: your player id, the reported player's id, the table code, the reason you picked, the time, and a one-way hash of your IP address (so we can spot report abuse without keeping the address). We keep reports for 1 year and use them to warn or ban players who break the rules. If the app cannot reach the server, it offers an email to connect@mikehaye.com instead, and nothing is sent until you send that email.
Service providers
- Google Cloud runs the game server and keeps its logs.
- Supabase stores player progress, the Claps balance, gameplay events and reports.
- LiveKit carries live voice chat.
- Google AdMob serves the optional rewarded ads.
We do not sell your personal information.
How long we keep data
| Data | Kept for |
|---|---|
| Server logs (IP address, request times) | 30 days |
| Gameplay events | 90 days |
| Reports | 1 year |
| Voice | Not recorded; it exists only while it is streamed |
| Your name, player id, progress and Claps | Until you delete your data |
What is stored on your device stays there until you delete your data in the app, clear the app's data or uninstall it.
Deleting your data
- In the app: open About & privacy in the lobby and press DELETE MY DATA. The server deletes your name, player id, progress, Claps and gameplay events, and the app clears what it keeps on your device.
- On the web: https://clapout.app/delete-data explains the same and lets you ask us by email at connect@mikehaye.com (give your player name and, if you can, the first characters of your player id, shown under About & privacy). We delete within 30 days and confirm by email.
Reports, and any ban that came of them, stay for their 1 year after you delete your data, so a ban cannot be dodged by deleting and coming back.
Your choices and rights
- Access, correction and deletion: use DELETE MY DATA, or email connect@mikehaye.com with your player name (and table code, if you have one) and we will send, correct or delete what we hold.
- Permissions: hand tracking, scene understanding and the microphone can be turned off in Settings at any time.
- Ads: never press WATCH, or opt out of personalised ads in your device's settings.
- On the device: clearing the app's data removes your name, player id, age answer, block list and settings.
If you live in the EEA or the UK, data protection law (including the GDPR) gives you the right to access, correct, erase, restrict, object to and port your personal information, and to complain to your data protection authority. If you live in California, you have the right to know, delete and correct, and not to be treated differently for using them. We do not sell personal information. To use any of these rights, email us.
Children
ClapOut is for a general audience. It is not directed to children under 13 and we do not knowingly collect personal information from children under 13. Before the first online table the app asks your age group: if you are under 13, the app keeps you to solo games against the bots, which send nothing about you to other players; if you are under 18, you never hear or talk to strangers (voice at Quick Play tables stays off). If you are a parent and believe your child has given us personal information, email connect@mikehaye.com and we will delete it.
Security and international transfers
We keep as little as we can and protect it with reasonable technical and organisational measures. Our providers may process information outside your country, including in the United States, under their own safeguards.
Changes
If this policy changes, we will update it here and change the effective date above.