Privacy Policy

1. Who we are

RapidRebus (“we”, “us”) makes the RapidRebus app for iPhone and Android and runs rapidrebus.com. If you have a question about this policy or your data, email privacy@rapidrebus.com.

2. What we collect

2.1 When you play

The first time you open the app, Firebase Authentication creates a random player ID for you. No name or email is needed. Under that ID we store:

• Your game profile: puzzle progress and solve times, coins, your streak and Streak Shields, achievements, settings, your referral code, and the display name you choose (or one we generate, like “Player #8089”).
• Your time zone, so the daily puzzle, streaks and quiet hours follow your local day.
• Leaderboard entries: your display name and your daily, weekly and monthly scores.
• Races: your display name, score and whether you're online while you're in a race room.
• Duels: when you share a puzzle you solved, a challenge with your display name, the puzzle and your time. When you answer someone's challenge, your display name, your time and whether you revealed the answer.
• Referrals: who invited whom, so both players can get their bonus coins.

2.2 If you sign in

Signing in with Apple or Google is optional. If you do, we receive the email address and name that the provider shares with us and use them to link your progress to that account. Apple's “Hide My Email” works with RapidRebus.

2.3 Notifications

If you allow notifications, we store a push token for your device and your notification settings (for example your reminder time and quiet hours) so we can send the notifications you've turned on.

2.4 Purchases

Coin purchases are handled by Apple or Google. We receive the product you bought and a transaction record so we can add your coins. We never see your card or bank details.

2.5 Device and usage information

• Analytics: Google Analytics for Firebase records app events such as starting or solving a puzzle, using a hint, sharing, or buying coins, together with an app instance ID, device model, operating system, app version and approximate country.
• Crash reports: Firebase Crashlytics records what went wrong and the state of the device when the app crashes.
• Remote settings: Firebase Remote Config uses an installation ID to deliver game settings such as coin prices.

2.6 Advertising

RapidRebus shows optional rewarded ads through Google AdMob: you choose to watch one in exchange for coins. AdMob may collect device identifiers, your IP address and how you interact with ads.

• In the European Economic Area, the UK and Switzerland we ask for your consent with Google's consent form before any ad is requested. You can change your choice any time under Settings > Privacy options.
• On iPhone we don't ask to track you, so ads there don't use your device's advertising identifier.
• Players under 18 only ever get non-personalised ads. Players under 13 get no ads at all.

2.7 Your age

We ask your age the first time you would see an ad or make a purchase. The answer stays on your device and decides how ads and purchases work for you.

2.8 Our website

rapidrebus.com uses Google Analytics to count visits and see which pages people use. Puzzles you play in the browser are checked in your browser, and we don't record your answers.

3. How we use it

• To run the game: save your progress, keep your coins, run the daily puzzle, leaderboards, races and duels.
• To send the notifications you've allowed, such as reminders, streak alerts, duel results and leaderboard changes.
• To pay rewards, such as referral bonuses and race coins.
• To fix crashes and bugs, and to understand which parts of the game people enjoy so we can improve it.
• To show and measure ads, as described above.
• To keep the game fair, for example by capping impossible race scores, and to prevent abuse.
• To meet our legal obligations.

If you're in the EEA or the UK, we rely on these legal bases: performing our agreement with you (running the game), our legitimate interests (crash reports, analytics, fairness and security), your consent (personalised ads and notifications), and legal obligations.

4. What other players can see

Your display name appears next to your scores on leaderboards, in race rooms and on duels you send or answer. Anyone with a duel link can see the sender's display name and time. Please pick a display name that doesn't reveal personal details like your full name.

5. Who we share it with

We share information only with the companies that help us run RapidRebus, and only for that purpose:

• Google Firebase (Authentication, Cloud Firestore, Realtime Database, Cloud Functions, Analytics, Crashlytics, Cloud Messaging and Remote Config), which hosts the game's data and services.
• Google AdMob, which serves the optional ads.
• Apple and Google, for sign-in, purchases and app distribution.
• Vercel, which hosts rapidrebus.com.

We may also disclose information if the law requires it, or as part of a merger or sale of our business, in which case this policy will continue to protect it.

We don't sell your personal information. If you're in California: serving personalised ads through AdMob may count as “sharing” under California law. You can opt out by turning off personalised ads in your device settings or by emailing us.

6. Where your data is stored

Your data is stored on Google Cloud servers, which may be outside your country, including in the United States and the European Union. Google protects international transfers with approved safeguards such as the EU Standard Contractual Clauses.

7. How long we keep it

• Your profile and progress: for as long as your account exists.
• Race rooms: deleted automatically within about a day of being created.
• Crash reports: about 90 days.
• Analytics: detailed event data for at most 14 months.

When you delete your account in the app, we delete your sign-in, your profile and progress, your achievements and your notification records straight away. Scores already posted to leaderboards and past race and duel results can remain under your display name; email us and we'll remove them.

8. Your choices and rights

• Delete your account from the Profile screen at any time.
• Turn notifications off in the app's Settings or your phone's settings.
• Change your ad consent under Settings > Privacy options, and limit ad personalisation in your phone's settings.
• Ask us for a copy of your data, to correct it, to delete it, or to restrict or object to how we use it. Email privacy@rapidrebus.com and we'll reply within 30 days. We may need to confirm the request comes from you.

If you're unhappy with how we've handled your data, you can also complain to your local data protection authority.

9. Children

RapidRebus is suitable for all ages. Players who tell us they are under 13 never see ads and can't sign in, and we don't knowingly collect names or email addresses from children under 13. The game still saves a child's progress under a random player ID so it works properly. If you're a parent and believe your child has shared personal information with us, email privacy@rapidrebus.com and we'll delete it.

10. Security

Data travels between the app and our servers over encrypted connections, and Google encrypts it at rest. Our database rules only let each player change their own data, and anything that pays coins or decides results runs on our servers. No system is perfectly secure, but we work to protect your information and will tell you if something goes wrong that affects you.

11. Changes to this policy

When we change this policy we'll update the date at the top. If a change is significant, we'll also let you know in the app.

12. Contact