Five Privacy Policy

Last updated: 5 October 2026. Controller: Anubis Studio (Hossam Gamal). Contact: support@anubisstudio.net

This policy explains what data the game Five (خمسة لعب) for Android and iOS uses, why, who can see it, and how to delete it.

Account and sign-in

Guest play: on first launch we create an anonymous Firebase Authentication account (a technical ID, no email or phone number) and a permanent handle in the form khamsa_##### so friends can find you and admins can tell accounts apart.
Linking Google or Apple (optional): the sign-in provider shares an account ID, name and the email you agree to share. We use them only so your progress and purchases survive a change of phone.
Account password «Protect your account» (optional): if you set a password so you can sign in on another phone with your username, our server keeps only a one-way scrypt hash of it — never the password itself, and it is not tied to any email. So that an account is never open on two phones at once, we keep the hashed fingerprint of the phone your account is open on and the sign-in time; signing in on a new phone signs the old one out. We count failed attempts per username and per phone for a short time to protect your account from guessing. All of this is erased when you delete your account.
Your profile: the name you choose, your character and accessories, points, badges and stats, coin balance, your sign-in type (guest, Google or Apple), used only in aggregate counts, and the region code set on your device (for example EG). We use it in aggregate counts; if you switch on "Show my country to players", only your country (never your city) is shown to people you play with, and it is removed when you switch it off. We do not use GPS.

Language

Five is in English and Arabic. The first time you open it you pick a language (or "Automatic", which follows your phone), and you can change it any time in Settings → Language.
If you choose English, we ask once whether you read Arabic, to decide whether Arabic question packs are listed for you.
We store the language and that answer with your account so that notifications from our server arrive in your language; they are deleted with your account. The interface language is also part of the anonymous usage counter (with no identifier).

Online play and chat

Rooms: when you open or join a room, your name, character, answers and score are stored in Firebase Realtime Database and shown to the players in that room. A room its host marks as open is listed under Open rooms for any player until the game starts.
Rooms around you (Bluetooth and Wi-Fi): "Let people nearby see it" is off by default. Until you turn it on in the lobby of a room you host, your phone broadcasts nothing (not even your name) and does not ask for Bluetooth or local-network permission. When you turn it on, permission is asked once, and your phone announces to phones near you (on the same Wi-Fi via Bonjour/NSD, and over Bluetooth) only the room code, its name, the game, your name and character and the player count — no identifier or email. Broadcasting stops when you switch it off, the game starts, the room closes or fills, or you leave the app. When you open "Rooms around you" yourself, your phone only listens (permission is asked then). We never use Bluetooth or the network to locate you and never connect to any device.
Room link after install: if you tap a store button on a room link page, the page copies the room link to your clipboard, and the Google Play link carries the room code (Install Referrer). Only on the first launch after installing, the game looks for that room code (on iPhone only after you tap «دخّلني»). Anything else on your clipboard is never used, stored or sent anywhere.
Chat and stickers: room messages and direct messages between friends are stored so they reach the people you talk to. Do not post private information in chat.
Content terms: before your first message or post you accept the content terms once; we store which version you accepted and when.
Language filter: messages, player and room names and "Spill It" answers pass through an automatic abuse filter on our server. Blocked text is not published; we keep a copy and a count of violations with your account for review and abuse prevention, and they are deleted with your account.
Friends and follows: friend requests, your friends list, who you follow and who follows you, and an online indicator while the game is open.
Public profile and rankings: your name, character, badges, follower count and points appear on your public profile in the game, on the leaderboard and in the monthly championship.
Google Play Games and Game Center: if your phone is signed in to Google Play Games (Android) or Game Center (iPhone), the game copies your badges as achievements, and your total points and correct answers to leaderboards there. Google and Apple show your platform name on those leaderboards according to your privacy settings with them. We do not receive or store your gamer ID on our servers, and you can turn this off in the Play Games or Game Center settings on your phone.
Reports and blocks: if you report a player, message, question or pack, we store the report and the reported content for review. If you block a player, we store the block so nothing from them reaches you.

Microphone and voice recordings

The microphone is used only while you press record, and only with your permission:

Sing It Backwards on one phone: the recording is processed on your device and is not uploaded.
Sing It Backwards online, and voice notes in Mafioso chat: the short clip (up to 12 seconds when singing, up to 30 seconds for a voice note) is uploaded to Firebase Storage so the players in your room can hear it. We use it for nothing else and do not run voice recognition on it. You can ask for deletion at support@anubisstudio.net
Voice notes in chat: in a room chat and in a chat with a friend, a voice note (up to 30 seconds) is uploaded to Firebase Storage for the players in that room (or your friend, in a private chat) to hear; it is not listed anywhere public. It is deleted automatically after 24 hours (as are Sing It Backwards and Mafioso recordings). You can report any voice note with the «بلّغ» (report) button on the message, and blocking a player hides their voice notes.

Photos, questions and packs you create

If you add a pack cover or a question picture, you choose it from your photo library and a small JPEG copy is uploaded to Firebase Storage. It stays private to you until the pack or question is approved.
Every question, pack or new pack version is reviewed first. We store the content, your account ID, the submission time and the review decision and notes. Nothing reaches other players before approval.
Once approved, it appears to players under the display name on your profile, and we keep play and sale counts for creator rewards.
We use submission limits and technical content fingerprints to prevent duplicates and spam.

Your own photo («زيّن صورتك»)

If you buy «Your own photo» or the «VIP bundle», you can pick a picture from your photo library to show instead of your character. Your phone shrinks it to a small JPEG and sends it to our server, which stores it in Firebase Storage linked to your account.
Every photo is reviewed by our admin first. While it waits it is kept in a private place only the admin can open; only you see it on your phone, marked «waiting for review».
Once approved, it is shown only to signed-in players of the game (in rooms, chat, results and your profile), and players who blocked you don't see it. You can report any player's photo as «inappropriate photo».
The photo is deleted when it is rejected, when you change it (the old one is deleted), when you remove it, when the purchase is refunded, or when you delete your account. We use it for nothing else and run no face recognition on it.

Rights and image sources

The game includes still frames from films, series and plays, used for trivia questions. Most questions and images were made by the studio, and each frame is credited to its source channel or company in the game (Settings → «الحقوق ومصادر الصور», Credits and image sources) and on our credits page: anubisstudio.net/en/p/khamsa-l3b-credits/ — all rights stay with their owners.
Players can also add questions and images of their own in player packs and contributions, and admins review everything before it is published. Our admins review every new image players add; if we don't hold the rights, we reject it or contact the rights holder before it is published. Reported content is reviewed too.
Rights holders: if you own an image or clip and want it credited differently or removed, email support@anubisstudio.net with your company name, the work and the image or question, and we will add your credit or remove it within 48 hours.

Notifications

Friend invites (optional): if you allow notifications, we store a device push token (Firebase Cloud Messaging) and use it only for friend requests and game invites from friends. A notification contains the sender's name and the room code.
Chat messages (optional): while friend notifications are on, we notify you when someone writes in your room chat or your chat with a friend while you are out of the game. The notification shows the sender's name and the first words of the message (or "sent a sticker/voice note"), and a burst of messages becomes one notification. We know you are out of the game from your online status, and we never notify you about someone you blocked. Turn it off in Settings → «رسايل الشات» (chat messages).
Play reminders (optional): scheduled on your device, with their times stored on the device. They stop by themselves after two weeks without play.
You can turn each of them off in the game settings or the device settings.

Advertising

We use Google AdMob: a banner on the waiting screen, an ad when a game ends or between hands of card, domino and table games on one phone (never during a round), one every 3 tries in arcade games, an ad when the app opens at most once every 10 opens (never when you open it from a notification or a link), and a rewarded video only if you choose to watch one. Ads may be delivered through AdMob's partner Unity Ads, which receives the same consent choice.
Ads may be personalized to your interests only if you agree; otherwise they are non-personalized. On iPhone we ask through Apple's "Allow Tracking" prompt (ATT) after your first finished game, never at launch; if you do not allow it, ads stay non-personalized. Right before Apple's prompt we show a short note explaining what it will ask, with a single Continue button — the choice itself is made in Apple's prompt. On Android, and wherever the law requires consent (such as the EEA and the UK), Google's consent message (UMP) is shown before any ad, and if you decline, ads stay non-personalized.
When ads are personalized, AdMob uses the device's advertising ID, ad interaction data and an approximate location derived from the IP address (never GPS) to choose ads. In every case AdMob may process technical data such as device type, network and ad interactions to serve ads, prevent fraud and measure delivery.
The advertising SDKs (AdMob and Unity Ads) may process technical crash and performance data, such as app launch time and responsiveness, to analyze, measure and improve the advertising service. This is separate from the KL- reports sent to the studio for support.
You can change your choice at any time: "Ad privacy" in the game settings, "Allow Tracking" in the iPhone settings, or Google's ad settings on Android.
The ad-free subscription turns ads off while it is active.

Purchases

All purchases (coins, characters and accessories, packs, your own photo, frames, badges and the VIP bundle, and the monthly subscription) go through Google Play or the App Store. We never receive your card number or payment details.
Before anything unlocks, our server verifies the transaction with Google or Apple and stores a transaction record (product, transaction ID and status) linked to your account, to restore purchases and stop a receipt being used twice.
Gifts: when you send a gift, the receiver sees your name, character and the short note you add (up to 60 characters, filtered like chat). We keep a record of the gift (sender, receiver, item, time and payment method) to deliver it, handle refunds and stop abuse.

One phone, one player

To prevent duplicates and cheating, the game sends a one-way SHA-256 fingerprint of the phone's app-specific identifier (Android ID on Android, or a random ID kept in the iOS Keychain). Never the identifier itself, and never the advertising ID.
It makes each phone count once: one new friend in "Invite a friend", one rating (love or dislike) per pack or game, and the welcome coins and free honks once per phone, however many accounts are created on it.
The fingerprint is stored on our server for fraud prevention only and is not shared with anyone. If you delete your account, the fingerprint is unlinked from it and your ratings are removed; the phone stays marked as having received those one-time gifts so they cannot be claimed again.
For these three things only (ratings, the welcome coins and free honks, and "Invite a friend") we use Apple DeviceCheck on iPhone and Google Play Integrity on Android to confirm the app is genuine and keep the count fair for everyone. Apple and Google return only an integrity verdict; Apple keeps just two flags per device ("received the welcome gift" and "joined as a new friend") with no data about you. If the check cannot run right now, the game works as usual and the reward waits.
Gift codes (Android only): if you enter a coin code in Settings → "Got a gift code?", we store the code, your account ID, the one-way hash of your phone key and the time, so a code pays once per account and once per phone, and we count wrong attempts for a short time. This option is not offered on iPhone.

Anonymous usage counter

At most once a day the game sends Anubis Studio an anonymous count: the game name, platform (Android or iOS), interface language, app version, number of opens and minutes since the last report, and whether this is the first report this month or ever. No identifier, name or device model is sent. The country is counted from the network connection; the IP address is not stored.

Stars of the Month (signed-in players)

Anubis Studio honours the players who play more than one of its games with the same Google or Apple account (anubisstudio.net/stars). For that — and only while you are signed in with Google or Apple, never as a guest — the game sends once a day: the game name, the minutes played since the last report and the name you use in that game, with the game's Firebase ID token so the server can verify you.

The Google or Apple account id itself is never stored: the server turns it into one salted key, which is what tells us the same person plays two of our games. Your email is kept in our admin panel only, so we can reach you if you are honoured; it is never published, sold or shared. What is published on the site is the name, the games, the hours and a thank-you line — nothing else. Guest play is not part of this, and you can ask us to remove your name and data at any time at support@anubisstudio.net.

Crash reports and the error code

So that we can fix problems quickly, the game sends a technical report when it crashes or something stops you:

What is sent: the error message and the technical stack, the last screens and actions as short fixed tags (for example `home`, `create_room`), the platform and its version, the app version, the time, and your anonymous account ID.
What is never sent: anything you typed (chat, questions, names), your email, or any purchase receipt or token.
The error code: any failure that stops you is shown with a short code (for example `KL-4K7Q2X`) with a «copy code» button and a «contact support» button. The code is random and says nothing about you; it lets us find that exact failure when you send it to us.
With no internet: the report is kept on your device (at most 20) and uploaded as soon as you are online again.
We use Firebase Crashlytics (Google) and our own server to store these reports. Only the studio sees them, and they are removed once the problem is fixed.
In the builds we test ourselves (debug) reporting is switched off completely.

Who processes data

Google Firebase (sign-in, database, storage, push messages, crash reporting and server functions); Google servers may be outside your country.
Google AdMob (ads): it may receive the advertising ID (only where you allowed it), an approximate location derived from the IP address, device and network information, and ad interactions, to serve and measure ads and prevent fraud. Its policy: policies.google.com/technologies/partner-sites
Unity Ads (an ad partner through AdMob): it may receive the advertising ID (only where you allowed it), an approximate location derived from the IP address, device and network information, and ad interactions, to serve and measure ads and prevent fraud, and it receives the same consent choice you made. Its policy: unity.com/legal/privacy-policy
We may add other advertising partners in the future and will update this policy then.
Google and Apple for optional sign-in and payments, and for Google Play Games and Game Center (achievements and leaderboards).
We do not sell your data or share it with anyone else unless the law requires it.

Security

Data travels encrypted (HTTPS/TLS). Firebase security rules let each player write only their own data; sensitive operations such as coins, purchases and content review are performed by our server only.

Retention and account deletion

Account data and content are kept while your account exists.
In the game: Settings → Delete my account and data. We lock the account, then delete your profile, handle, friends, follows, direct messages, your messages in room chats (including Mafioso and the board game), voice clips and photos, reports, blocks, ban appeals, push token, the packs you created, your review submissions and your place on every leaderboard (daily, monthly, past months, levels and the online football league), and your name in the match archive, your content-terms acceptance and your language-filter records. If you signed in with Apple we revoke the Sign in with Apple authorization, and if you signed in with Google or Apple we remove your Five play from the studio's Stars of the Month panel and page. An account deleted by our admins goes through exactly the same steps. Achievements and scores already copied to Google Play Games or Game Center are removed from that platform's own settings (your Play Games or Game Center account), since we cannot reach them.
Approved questions in public packs may remain after your name is removed from them. We keep a technical marker that the account was deleted (so old sessions cannot recreate data) and transaction, gift and gift-code logs and admin logs under an indirect ID, without your name or messages, where the law or store rules require it, and a marker that the phone already received welcome coins or used a gift code, so it cannot be repeated.
Outside the game: email support@anubisstudio.net from an address that lets you prove ownership, with your handle (khamsa_#####) or friend code, and we will delete the account within 30 days. Never send a password.

Children

Five is a game for friends and families with chat and player-made content. It is not directed at children under 13, and we do not knowingly collect data from children under that age. If you learn that a child has created an account, contact us and we will delete it.

Age signal: on devices that support it, we ask Apple (Declared Age Range) or Google Play (Age Signals) for the user's age range, such as "under 13", "13–15", "16–17" or "18 or over", and sometimes for parental approval, only to show an appropriate experience. If the user is under 13, or approval is required but missing or declined, all online features are turned off: sign-in, chat, voice, publishing content and open rooms. One-phone games stay available and ads are non-personalized. The age range itself is not stored or sent to our servers; the server only receives a flag that the account is restricted. If a parent withdraws consent, we apply these restrictions again.

Your rights

You can ask for a copy of your data, a correction, deletion, or to object to a specific use at support@anubisstudio.net You can switch off notifications, microphone and photo access in your device settings at any time.

Changes

If we change anything important here, we will update the date above and point it out in the game or on this page.