Legal
Privacy Policy
This policy explains what information WallRush collects, why, who we share it with, how long we keep it, and the choices you have. It applies to wallrush.io, the WallRush apps for Android and iOS, and the WallRush browser extensions (together, the “Service”).
WallRush is run by the WallRush team (“WallRush”, “we”, “us”). We are the data controller for the information described here. Contact us about privacy at privacy@wallrush.io.
The short version
- You can play WallRush without an account. Guests are still measured by analytics tools (see section 5) and leave anonymous game records.
- We collect what we need to run the game: your account details if you sign up, your games, and basic technical data.
- We don’t sell your personal information. We don’t show ads in WallRush at the time of writing.
- We use analytics and session-recording tools to understand and improve the site, and Meta’s measurement pixel. They load for every visitor from the first page view; we don’t show a consent banner.
- You can see, correct, export and delete your data. Deleting your account is available in the app and at wallrush.io/account/delete/.
1. Information we collect
When you play (with or without an account)
| What | Details | Why |
|---|---|---|
| Game records | Moves, result, game mode and difficulty, move times, number of walls used, the date, the platform (website, extension, Android or iOS) and the game’s version | To run games, improve the AI and keep play fair |
| Device identifiers we create | A random ID stored in your browser (rw_client_id), a random ID for each visit, and the analytics tools’ own IDs (the PostHog ID is also saved with the game record) |
To tell games from the same device apart and to spot abuse; they don’t contain your name or contact details |
| Online and friend matches | The name you type, temporary match codes and player tokens, game state and connection times | To connect the players (two, or up to four in a four-player quick match), show each player the others’ names, keep the game in sync and let you rejoin after a refresh |
When you create an account
| What | Details | Why |
|---|---|---|
| Account | Email address and password (stored only as a secure hash by our authentication provider) | To create and secure your account |
| Profile | Player name and, optionally, a profile picture | To show you on leaderboards and to friends |
| Progress | Rating, wins, losses, streaks and recent games | Leaderboards, your dashboard and fair matchmaking |
| Preferences | Board theme | To remember your choice |
| Social | Friends and friend requests | To run the friends feature |
| Reviews | Your star rating and review text, if you write one | Your display name, picture, rating and text are shown publicly on our reviews page once approved |
Public information. Your player name, rating, wins and losses appear on public leaderboards, and your player name, star rating and text appear on your public review if you write one. Don’t choose a name that gives away more than you want others to see.
When you contact us
- Support messages, bug reports and player reports: your name, email, the topic and your message. These are emailed to our team.
- Account deletion requests made on the web: your email and, optionally, a reason.
Technical information
Like any website, our servers and providers receive your IP address and basic browser information when you connect. To stop spam on our forms, we turn your IP address and browser type into a one-way scrambled code (a salted hash) and keep only that code, for about an hour, to count submissions. We don’t store your raw IP address in our database.
2. How we use information, and our legal bases
If you’re in the European Economic Area (EEA), the UK or Switzerland, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Running the game, your account, matchmaking, friends and leaderboards | Performance of our contract with you (our Terms of Service) |
| Keeping the Service secure, preventing cheating, spam and abuse, enforcing our rules | Our legitimate interest in a safe, fair service |
| Improving the game and the AI using game records | Our legitimate interest in making the game better |
| Analytics, session recordings and Meta’s measurement pixel | Our legitimate interest in understanding how the site is used and measuring visits |
| Answering your messages and requests | Our legitimate interest, or steps you asked us to take |
| Complying with the law and responding to valid legal requests | Legal obligation |
We don’t use your information for automated decisions that have legal or similarly significant effects on you. Matchmaking and ratings are calculated automatically, but they only affect the game.
3. Who we share information with
We share information only with service providers who help us run WallRush, under contracts that limit how they can use it, and in the cases listed below.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | United States (AWS US East) |
| Hostinger | Website hosting | Set by our hosting plan (ask us for the current location) |
| Brevo | Sending emails (confirmations, feedback, account emails) | European Union |
| PostHog | Website and product analytics: page views, when a game starts and ends, and account events. For a signed-in player it is linked to the account, with your player name, email address and rating | United States |
| Google (Google Analytics 4) | Website analytics | United States and other countries |
| Microsoft (Clarity) | Website analytics and session recordings | United States and other countries |
| Meta Platforms (Meta Pixel) | Measuring visits from Meta’s apps and ads | United States and other countries |
| Apple, Google (app stores) | Distributing our apps and processing app reviews and ratings you leave in their stores | Their own terms apply |
Meta and Google may also use information collected through their tools for their own purposes, as their own controllers, under their own privacy policies.
We may also share information:
- if the law requires it, or to respond to valid legal requests;
- to protect the rights, safety and property of WallRush, our players or others, including investigating cheating, fraud or abuse;
- with a buyer or successor if WallRush is ever sold or reorganised, in which case this policy continues to protect your information.
We don’t sell personal information, and we don’t share it for cross-context behavioural advertising except through the Meta Pixel described above, which you can block in your browser (see section 5).
4. International transfers
Some providers process data outside your country, including in the United States. Where data from the EEA, UK or Switzerland is transferred, we rely on the provider’s certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where they have one, or on the European Commission’s Standard Contractual Clauses.
5. Cookies, storage and your choices
We use browser storage to keep you signed in, remember your settings and recover a match after a refresh. Analytics and measurement tools set their own cookies. The full list, with durations, is in our Cookie Policy.
- Analytics, session recording and the Meta Pixel load for every visitor from the first page view. We don’t ask first, and there is no switch for them on the site. To stop them, use your browser’s tracking protection or a content blocker.
- Everywhere, you can block or delete cookies in your browser settings. The game still works, but you’ll be signed out.
- We don’t change what loads when your browser sends a Do Not Track or Global Privacy Control signal.
Session-recording tools (Clarity) record how pages are used, such as clicks, scrolling and page layout. We configure them to mask what you type into forms.
6. How long we keep information
| Information | How long |
|---|---|
| Account and profile | Until you delete your account. Deletion completes 7 days after you ask, so you can change your mind |
| Game records | Kept as statistics. When an account is deleted, the links to the person (account and device IDs) are removed |
| Online match records | Kept while they are needed to run and improve the game, then deleted or anonymised |
| Reports and moderation records | As long as needed to handle them |
| Feedback emails | As long as needed to answer and follow up |
| Rate-limit codes (hashed IPs) | About 1 hour for the feedback form; up to 2 days for in-app actions |
| Analytics data | Kept by each provider according to the settings we choose in their dashboards |
7. Your rights
Depending on where you live, you may have the right to:
- access the information we hold about you and get a copy in a portable format;
- correct inaccurate information (most of it you can edit yourself in Settings);
- delete your information (Settings → Delete account, or wallrush.io/account/delete/);
- object to, or ask us to restrict, some uses of your information;
- withdraw consent at any time, without affecting what we did before;
- complain to your data-protection authority. In the EU, find yours at edpb.europa.eu; in the UK, the ICO (ico.org.uk).
US state privacy rights. Residents of California and other states with privacy laws can ask to know, correct and delete their information, and to opt out of “sale” or “sharing” for targeted advertising. We don’t sell personal information. To stop the Meta Pixel, block it in your browser or with a content blocker. We won’t treat you differently for using these rights.
To use any right, email privacy@wallrush.io from the address on your account, or use the in-app tools. We answer within one month (45 days for US state requests), and we may need to confirm your identity first.
8. Children
WallRush is a general-audience game and isn’t directed at children under 13. You must be at least 13 to create an account. If you’re under the age required to consent in your country (up to 16 in parts of the EU), you need a parent’s or guardian’s permission.
If you believe a child under 13 has given us personal information, contact privacy@wallrush.io and we’ll delete it.
9. Security
We protect your information with encrypted connections (HTTPS), hashed passwords, database access rules that limit each player to their own data, rate limits, and restricted administrator access. No service is perfectly secure. If you find a security problem, please report it as described on our Security page.
10. Changes to this policy
We’ll update this page when our practices change and change the date at the top. If the changes are significant, we’ll also tell signed-in players in the app or by email before they take effect.
11. Contact
WallRush Email: privacy@wallrush.io (write to this address if you need our postal address)