Tambola Play & Win — Privacy Policy

Effective date: 24 October 2026

Tambola Play & Win ("the app"; also shown as "Tambola Play and Win" or "Indian Housie") is published by ConeM Labs ("we", "us"). Contact: support@conemlabs.com · https://conemlabs.com

This policy covers the app for Android and iOS. It is published at https://conemlabs.com/tambola/privacy.html.

Summary

The app creates a player account for you automatically. It is a random player ID; we don't ask for your name, phone number or email address to play.
If you tap Link Google to save your progress, Google tells us your Google account ID, email address and name. That is optional.
The display name you type is shown to the other people at your table, in games you play with friends, and in your weekly league standings. Please don't use your full real name if you don't want others to see it.
Games with friends run through Google Firebase. Public tables, rewards, levels, coins, card albums and leagues run on our own server, hosted by Neon in the United States.
The app shows banner ads from Google AdMob. Ads use your device's advertising ID and may be personalized by Google. You can limit this in your device settings.
We use Google Firebase (Analytics, Crashlytics, Remote Config) to see how the app is used and to fix crashes.
Everything in the app is free. Coins, stardust, packs, cards and trophies are virtual, have no cash value and cannot be bought or sold. There is no real-money play and no prize of monetary value.
We don't sell your data.

1. Your player account

When you first open the app, Firebase Authentication creates an anonymous account for you: a random player ID that is stored on your device and on Google's servers. It is not linked to your name, phone number or email address. If you uninstall the app or switch phones, that ID is lost together with the progress attached to it, unless you link a Google account.

Link Google (optional). If you tap "Link Google" (or "Save your progress"), the app opens Google's sign-in page in a secure browser window. Google then tells Firebase your Google account ID, your email address and the name on your Google account, and attaches them to your player ID. We use them only to recognise you on another device, to show your linked email in the app, and to answer support requests. We never post to your Google account, read your contacts, or see your Google password.

If that Google account is already linked to another player profile, the app asks whether you want to switch to it; this device's guest progress is then left behind.

2. What you type

Display name. You choose a display name when you join a table, host a game or edit your profile. It is saved on your device and on our server, and it is visible to the other players at that table, to everyone in a game you host or join, and to the other players in your weekly league group, together with your level, trophies and equipped title.
Game codes and names. When you host a game for friends you choose a game name and the app generates a short game code (and, optionally, a PIN). Anyone with the code can join that game and see the players' display names, tickets and called numbers.
Feedback. "Send feedback" opens your own email app with a message to support@conemlabs.com, pre-filled with the app version. You can edit it before sending. If you send it, we receive your email address and what you wrote, use them only to reply, and delete the conversation when it is no longer needed.

3. Game data

Games with friends (Host Game / Join Game) run through Google Cloud Firestore, part of Firebase. For each game we store the game name and code, the host's and players' display names and player IDs, each player's ticket and marked numbers, the numbers called, prize claims, and short "close to winning" and win alerts. A game is deleted automatically a few minutes after it ends, and in any case within a few hours of being created.
Public tables (Play Now / Live Games) run on our own server. When you join a table we store your player ID, your display name, the ticket the server dealt you and when you joined; when you claim a prize we store the prize and the time. These rows are deleted about 24 hours after the table ends. Numbers you mark on your ticket stay on your device.
Quick Play deals. For some games the server deals your ticket and the order of the numbers so that rewards can be checked. These records are deleted after two days.

4. Progress, rewards and leagues (our server)

Your profile on our server holds: your player ID, display name, experience points and level, coins and stardust, the card packs you own and have opened, the cards in your albums, cosmetics you own and have equipped (daubers, ticket skins, caller voices, titles), your daily streak, play statistics (games played, prizes won), your league tier and trophies, and a log of the rewards you received (what, when and for which game) so that each reward is paid only once.

Every request to our server carries your Firebase sign-in token, which proves which player ID is asking, and, like any internet request, your IP address. To verify a reward for a game with friends, our server reads that game from Firestore using your own token, so it can only see what you can see.

Our server runs on Neon (Neon, Inc.; serverless PostgreSQL and functions) in the Amazon Web Services us-east-2 region in the United States. Neon processes this data on our behalf and does not use it for its own purposes. Neon's privacy policy is at https://neon.com/privacy-policy.

The server also keeps a short-lived record of your IP address only inside request logs used for debugging and abuse protection.

5. Google Firebase

We use these Firebase services, provided by Google:

Firebase Authentication for the anonymous account and the optional Google link (section 1).
Cloud Firestore for games with friends (section 3).
Google Analytics for Firebase. It collects screen views, sessions and app lifecycle events, feature-usage events that we define (for example that a game was joined or a prize was claimed, never your name or ticket), device information (model, OS version, language), an app-instance identifier, and an approximate location (for example, country or city) that Google derives from your IP address.
Firebase Crashlytics. If the app crashes, it sends a crash report with the stack trace, the app's state at the time, device metadata (model, OS version, free memory and disk space, orientation), a Crashlytics installation identifier and the recent Analytics events before the crash.
Firebase Remote Config. The app fetches settings from Google (for example, which server to talk to and the minimum supported version). The fetch carries an app-instance identifier and basic device information.

Google processes this data on our behalf. Google's privacy policy is at https://policies.google.com/privacy, and its explanation of how it uses data from apps that use its services is at https://policies.google.com/technologies/partner-sites.

6. Advertising (Google AdMob)

The app is free and shows banner ads served by Google AdMob. Ads are shown only on the home screen, in the lobby and under the game screen; there are no full-screen ads. To serve and measure ads, Google receives your device's advertising ID (Google Advertising ID on Android, IDFA on iOS where you allow tracking), your IP address and approximate location, device and app information, and information about the ads shown and tapped. Depending on your settings, Google may use this to show ads based on your interests across apps.

You can limit this: on Android, use "Delete advertising ID" or "Opt out of Ads Personalization" in Settings → Google → Ads; on iOS, decline tracking when asked, or turn off "Allow Apps to Request to Track" in Settings → Privacy & Security → Tracking. Google's advertising policies and controls are described at https://policies.google.com/technologies/ads.

7. Voice calling

Numbers are read aloud by your device's built-in text-to-speech engine; nothing is sent anywhere for that. For a more natural Hindi voice, the app can download a small on-device voice model (an open-source Piper voice packaged by the sherpa-onnx project) from GitHub (github.com). This is a plain file download: nothing about you or your game is sent, but, as with any download, GitHub sees your IP address. Speech is then generated entirely on your device. The app also downloads some fonts from Google Fonts the first time they are needed.

When you share a game, the app creates a link of the form https://tambolaplay.com/play/<game code> and hands it to the app you choose (for example WhatsApp). The link contains only the game code. Anyone who opens it can join that game and see the players' display names.

9. How we use data

to run games, tables, rewards, albums and leagues
to keep your progress when you link a Google account
to pay each reward once and to stop cheating and abuse (for example, limits on rewards per day)
to understand which features are used and to fix crashes
to show ads that keep the app free

We don't use your data for any other kind of profiling, and we don't sell it.

10. Who receives data

Other players: your display name, level, trophies and title (sections 2 to 4).
Service providers acting for us: Google (Firebase) and Neon (our server).
Advertising partner: Google AdMob, which acts as an independent controller for the advertising data in section 6.
Services you choose to use: Google sign-in, the app you share a link with, GitHub and Google Fonts for downloads.
Legal requirements: we may disclose data if the law requires it.

11. Retention

Games with friends: deleted a few minutes after the game ends, and in any case within a few hours of creation.
Public tables: join and claim records deleted about 24 hours after the table; Quick Play deals after two days.
Profile, rewards log, albums and league history: kept while you have an account, so your progress and rewards are not lost, and deleted when you ask us to delete your account (section 12).
Firebase Analytics: event-level data is kept for 2 months; aggregated reports may be kept longer. Crashlytics: 90 days.
Request logs: a few days.
Support emails: only as long as needed to handle your request.

12. Your choices and rights

Display name: you can change it at any time in the app.
Google link: it is optional. You can play as a guest for as long as you like.
Ads: see section 6 for the device settings that limit personalized ads.
Deleting your account and data: email support@conemlabs.com from the Google account you linked, or tell us your display name and roughly when you last played, and we will delete your profile, rewards log, albums and league records from our server and your account from Firebase. Uninstalling the app removes everything stored on your device, but not your server profile.
Requests: depending on where you live, you may have the right to access, correct or delete your data, to object to its processing, or to take it with you. Email us and we will reply within 30 days. You can also complain to your local data-protection authority.

13. Children

The app is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child has created an account or sent us personal information, contact us and we will delete it.

14. Security

All network traffic uses HTTPS (TLS). Our server accepts only requests that carry a valid Firebase sign-in token, and it pays rewards only after checking the game itself. Database access is limited to our server. No system is completely secure, so please use a display name you are comfortable showing to other players.

15. International transfers

ConeM Labs is based in Canada. Firebase and AdMob data is processed by Google, and our server data by Neon on AWS, in the United States and possibly other countries where those providers operate. Those countries may have data-protection laws that differ from yours. We rely on our providers' standard contractual safeguards for these transfers.

16. Changes

If we change this policy, we will post the new version at the same address with a new effective date. If the changes are significant, we will also point them out in the app or in the release notes.

17. Contact

ConeM Labs Inc. — 729 Emerson Ave, Oshawa, ON L1H 3L2, Canada — support@conemlabs.com — https://conemlabs.com