Private is not a setting. It is the game rule.

The interface does not merely blur a hidden answer. Access rules return a user’s own locked answer and release the shared reveal only after the correct readiness condition is met.

• Two answers for a pair reveal
• Every captured participant for a group reveal
• Immutable submitted answers

Answer-ready and card-drop pushes use fixed localized copy. Device tokens and notification categories are controlled separately, with marketing-style drops off by default.

• Explicit category opt-ins
• Delivery deduplication
• Stale device cleanup

Members can safely leave a group, ownership transfers when needed, and account deletion removes the profile after coordinated processor cleanup. Subscription cancellation remains a separate store action.

• In-app export
• Permanent deletion
• External request path