RECURIFT Privacy Policy

Data we process

Guest settings and custom levels are stored locally on the device. If you sign in to Community, the service processes your username, display name, salted password hash, session tokens, a one-way hashed device identifier, campaign progress, owned cosmetics, custom-level drafts, published levels, ratings, comments, reports, ranking stars, run times and timestamps. Campaign progress, cosmetics and creator drafts are synchronized between devices signed in to the same account. The original Android device identifier is not sent to us.

When you buy a cosmetic, our server receives the product identifier and verifies the purchase with Google Play Billing. We retain the product identifier, a one-way hash of the purchase token, the Google Play order identifier when supplied, the account receiving the entitlement and the verification time. We do not receive or store your card or other payment credentials.

Google Mobile Ads may process IP address, approximate location derived from IP, app interactions, diagnostics, advertising ID, app set ID and related device identifiers for advertising, analytics and fraud prevention. Watching a rewarded ad is optional and rewards are clearly labelled. Where required, Google UMP presents privacy choices before ads are requested.

Purposes and legal bases

We process account and Community data to perform the service you request, maintain rankings, synchronize progress, verify purchases, prevent abuse and moderate user content. Security and anti-fraud processing is based on our legitimate interests. Advertising data is processed according to your available consent and device privacy choices.

Sharing and transfers

Data is shared only with infrastructure providers needed to host Community and with Google where needed for Mobile Ads, consent management, Play Billing purchase verification and Play Integrity security checks. Data can be processed outside your country under safeguards used by those providers. We do not sell personal data.

Retention and security

Account data remains until deletion. Operational backups are retained for up to 14 days. Moderation reports may be retained for up to 12 months after resolution when needed to prevent abuse or meet legal obligations. Transport uses HTTPS; passwords use scrypt and session tokens are stored as hashes.

Your choices and rights

You can play without an account. You may withdraw advertising consent through Privacy options in the app. Depending on your location, you may request access, correction, deletion, restriction, portability or object to processing, and complain to your data protection authority. Delete an account in the app or at Account deletion.

Children and changes

Community accounts are not intended for children under 16 in the EEA/UK or under 13 elsewhere. We may update this notice when features or legal requirements change and will update the effective date.

Community Terms