Privacy Policy
This policy explains what the Rimfall Legends app, its game server and the website rimfalllegends.thebora.dev, all operated by the Rimfall Legends team (thebora.dev) ("we", "the service"), collect about you, why, how long it is kept and what you can do about it. It is written for players, in plain language.
1. Who we are
The service is run by the Rimfall Legends team (thebora.dev), which decides how your data is used (the data controller). Website: rimfalllegends.thebora.dev. For every privacy question or request, write to rimfall@thebora.dev.
2. What we collect
- Account data: your username and e-mail address (full accounts only), and your password. The password is never stored as text: only a salted argon2id hash is kept.
- Guest data: guests get a random player id, a player code (RF-XXXXXX) and a secret stored on your device, plus a random install id created by the app. The server keeps only a hash of the secret. None of these is a hardware or advertising identifier.
- Gameplay and match data: your profile (coins, blades, upgrades, skins, trails, auras, avatar, quests, streak, achievements, titles), leagues and ratings, ranked season results, and your matches (mode, opponents and teammates, rounds, placements, finishes, points, rewards, and the launch swipe of each round, which the server uses to verify the result).
- Replays: at the end of every online match the server stores a replay record (the match setup and every round, with the players' display names, player codes and cosmetics) so that the players and their friends can watch it again.
- Social data: your friends list, friend requests, invites, the players you block, your online status and your "Allow friends to watch" setting.
- Reports: when you report a player, we store who reported whom, the reason and your optional note (up to 200 characters).
- Purchases: items you buy in the game with in-game coins (blades, upgrades, skins, trails, auras). The game has no real-money purchases at the moment, so no payment data is collected.
- Technical data: the app version, platform (android or ios), a device label, your time zone offset (to roll daily quests at your local midnight), and your IP address, which appears in the connection logs of the game server and of the web server in front of it.
- Crash and error reports: when the app crashes, freezes or a match goes out of sync, it sends a report to our own game server (right away for an out-of-sync match, otherwise the next time it starts): the app version and build, platform, operating system version, device model, your player code (if you are signed in), the type of problem, the technical error text and the last few screens and match events before the problem (for example "opened the shop", "round 2 started"). Reports contain no e-mail address, password, location or contacts; the server removes anything that looks like an e-mail address or a token and does not store your IP address with the report. Crash reports are on by default and you can turn them off at any time in Settings > Advanced > Send crash reports.
3. What we do not collect
- No advertising, no ad identifiers, no tracking across apps or websites and no third-party analytics, advertising, crash-reporting or tracking SDKs. Everything the app sends goes only to our own server.
- No location, contacts, photos, microphone or camera data.
- The website uses no cookies, no analytics and no third-party trackers.
- We do not sell or rent your data and do not share it with advertisers or data brokers.
4. Why we use it
- To run your account and sign you in (account and guest data); this is necessary to provide the game you asked for.
- To run the game: save your progress, match you with players of a similar league, pay rewards, run seasons and leaderboards, store replays and verify that matches were played fairly.
- To find and fix crashes, freezes and out-of-sync matches (crash and error reports); this is our legitimate interest in a working game, and you can opt out.
- To keep the service safe: detect cheating and abuse, apply rate limits, handle reports and enforce the Terms of Use (reports, technical data, server logs); this is our legitimate interest and that of the other players.
- To let friends find, invite and watch you (see section 5).
5. What other players can see
- Leaderboards, matches and your profile card show your display name, avatar, league, rank, title, season titles and top blades. Choose a username you are comfortable sharing.
- Your player code lets other players send you a friend request. Friends see your online status and can invite you.
- Spectating: friends can watch your live online matches with a short delay. You can turn this off in Settings > Privacy & online > Allow friends to watch.
- Replays: the players of a match and their friends can watch its replay for 30 days. If a player of the match creates a share link, anyone who has the link can watch the replay (display names and cosmetics, but no player codes) until the link expires after 30 days.
- Your e-mail address, password and IP address are never shown to other players.
6. Who else receives data
We do not share personal data with third parties for their own purposes. Our servers are rented from a hosting provider that stores the data on our behalf and must protect it. We may disclose data when the law requires it, for example to answer a valid request from an authority.
7. How long we keep it
- Account, profile and progress data: for as long as your account exists.
- Match records: for as long as your account exists. When you delete your account they are anonymised and can no longer be linked to you.
- Replays and share links: 30 days, then deleted automatically.
- Reports: up to 12 months after the report was handled, longer only while a moderation case or an appeal is still open.
- Crash and error reports: 90 days, then deleted automatically.
- Connection logs of the game server and the web server (including IP addresses): up to 30 days, then deleted.
- Backups: the database is backed up every day and backups are deleted automatically within 8 weeks, so deleted data also disappears from them within that time.
8. Your rights, in the app
- Download my data: Settings > Account > Download my data gives you a JSON file with your account, profile, ratings, recent matches, coin history and season results.
- Rename: full accounts can change their username in Settings > Account (once every 14 days).
- Delete my account: Settings > Account > Delete account removes your account, profile and progress, your friends and the replays of your matches at once and anonymises your match history. This cannot be undone. Guests can delete their account the same way. You can also ask for deletion by e-mail, see rimfalllegends.thebora.dev/delete-account.
- Crash reports: Settings > Advanced > Send crash reports turns them off (it is on by default). Reports that were not sent yet are discarded.
- Spectating: Settings > Privacy & online > Allow friends to watch turns it off.
- Other requests (access, correction, objection, restriction, portability) and complaints: write to rimfall@thebora.dev. We answer within 30 days. You can also complain to a data protection authority (in Turkey the Personal Data Protection Board, in the EU the authority of your country).
9. Security
All traffic between the app and the server is encrypted with TLS (HTTPS and secure WebSockets); the app checks the server's certificate and refuses unencrypted connections. Passwords are hashed with argon2id, session tokens are short-lived and rotated, and access to the server is restricted. No system is perfectly secure, so please use a unique password.
10. Children
Rimfall Legends is not directed to children under 13 and we do not knowingly collect personal data from them. The game has no free-text chat, no ads and no real-money purchases; its age rating is shown on the App Store and Google Play. If you are under 13 (or under the age of digital consent in your country), please use the game only with the consent of a parent or guardian. A parent who believes a child has given us personal data can write to rimfall@thebora.dev, and we will delete it.
11. Where the data is processed
The game server, its database and the website run on rented servers of a hosting provider in the European Union (Lithuania). If you play from outside the EU, for example from Turkey, your data is transferred there so that we can provide the game. If we move the servers, this policy will be updated.
12. Changes
We may update this policy when the game changes (for example when ads, analytics or real-money purchases are added). The date at the top shows the latest version; important changes are announced in the app.
13. Contact
Privacy questions and requests: rimfall@thebora.dev
Rimfall Legends team (thebora.dev) - rimfalllegends.thebora.dev