Privacy Policy

Effective Date: April 20, 2026

This Privacy Policy describes how RPSBattle ("we", "us", or "the Service") collects, uses, and shares personal information when you use rpsbattle.io. We apply this policy globally to all users, and we also honor additional rights granted to residents of the European Economic Area (EEA), the United Kingdom, California, India, and other jurisdictions where applicable law provides specific protections.

1. Who we are (Data Controller)

Controller: RPSBattle (operator)
Contact email: contact@rpsbattle.io
Website: https://rpsbattle.io

2. Information we collect

Category	Examples	Source
Google account data	Email address, display name, profile picture URL, Google account ID (sub)	When you sign in with Google OAuth
Service usage data	In-game nickname, match history, in-game currency and items, friend relationships	Provided by you or generated during gameplay
Technical / log data	IP address, access timestamps, browser/device information, authentication token (JWT) stored on your device	Automatically collected during use

We do not collect government IDs, precise geolocation, biometric data, payment card information, or special-category personal data (such as health, religion, or political opinions).

3. Why we use your information (Purposes)

To create and maintain your account and authenticate you on each visit.
To provide core gameplay features (matches, rankings, friends, chat).
To prevent abuse, cheating, and unauthorized access, and to keep the Service secure.
To diagnose technical problems and improve the Service (aggregate statistics).
To comply with legal obligations and to respond to lawful requests from authorities.

4. Legal bases for processing (EEA / UK users)

If you are in the EEA or the UK, we rely on the following GDPR / UK-GDPR legal bases:

Contract (Art. 6(1)(b)) — to deliver the gameplay service you requested.
Legitimate interests (Art. 6(1)(f)) — to secure the Service against abuse, to troubleshoot errors, and to improve features.
Consent (Art. 6(1)(a)) — where specifically required (e.g., optional cookies beyond what is strictly necessary).
Legal obligation (Art. 6(1)(c)) — to respond to valid legal process.

5. How long we retain your information

We keep personal information only as long as needed for the purposes described above. When you delete your account (via the in-game account deletion feature), your personal information is removed without undue delay, except where we are required to retain certain records to comply with legal obligations or resolve disputes.

6. Disclosures and sharing

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Limited disclosures occur only in the following cases:

To the service providers listed in Section 7, strictly to operate the Service.
When required by law, court order, or a lawful request by a public authority.
To protect the rights, property, or safety of users, the Service, or others.

6.1 CCPA / CPRA categories (California residents)

In the preceding 12 months we have collected the following categories of personal information and disclosed them only for operational purposes to service providers: identifiers (account identifiers, online identifiers), internet or network activity information (interactions with the Service), and approximate inference data derived from the above (e.g., skill level). We have not sold or shared personal information as those terms are defined under the CCPA/CPRA.

7. Processors and third-party services

Provider	Role	Location
Google LLC	OAuth authentication	United States
Vultr Holdings, LLC	Cloud server hosting and data storage	Vultr data center (outside the EEA)
Cloudflare, Inc.	Network security, DDoS mitigation, edge caching	Global edge network

8. International data transfers

Our servers are located outside the European Economic Area. If you access the Service from the EEA, the UK, or other jurisdictions with data-transfer requirements, your information may be transferred to and processed in those locations. We rely on appropriate safeguards provided by our processors (such as Standard Contractual Clauses where applicable) to protect your information during such transfers.

9. Your rights

Subject to applicable law, you have the following rights:

Access — request a copy of the personal information we hold about you.
Rectification — correct inaccurate or incomplete information.
Erasure / Deletion — request that we delete your personal information.
Restriction — ask us to limit how we process your information.
Objection — object to processing based on legitimate interests.
Portability — receive your information in a structured, machine-readable format (EEA/UK).
Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
Non-discrimination (California) — we will not discriminate against you for exercising your CCPA rights.
Complaint — you may lodge a complaint with your local data protection authority.

9.1 How to exercise your rights

The fastest way to delete your account and associated personal information is the "Delete Account" button inside the game. For any other request (access, rectification, restriction, etc.), please email contact@rpsbattle.io from the email address associated with your account. We will respond within 30 days (or the period required by your local law).

10. Cookies and local storage

10.1 Essential cookies / local storage

We use the minimum storage necessary to keep you logged in and to remember your in-game preferences (equipped skins, emoji set, etc.). Specifically:

A JWT authentication token stored in your browser's local storage to keep you signed in.
Small preference items such as equipped skin and toggle settings.

You can clear local storage at any time through your browser settings; note that doing so will sign you out of the Service.

10.2 Advertising cookies (Google AdSense)

We use Google AdSense to display ads. In this process, Google may use cookies to identify ad slots and limit ad frequency. We use non-personalized ads only, meaning we do not track your behavior across sites for personalized advertising, and we do not collect cookies used for personalized advertising.

The cookies Google uses for general ad serving and frequency limiting are documented at: https://policies.google.com/technologies/ads.

10.3 Cookie consent

On your first visit, a cookie banner appears at the bottom of the screen. Tapping "Accept" will hide the banner. If you prefer not to accept, you can block cookies in your browser settings; some features (such as sign-in) may not work correctly in that case.

11. Security

All traffic is encrypted in transit with HTTPS (TLS).
Rate limiting protects against brute-force and abuse.
Automated daily database backups with retention.
Server-side input validation on all user-supplied data.
Access to production systems is limited to the operator.

12. Children's privacy

The Service is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction, such as 14 in South Korea and 16 in certain EEA countries). We do not knowingly collect personal information from children under that age. If you believe a child has provided us with personal information, please contact contact@rpsbattle.io and we will delete the information promptly.

13. Changes to this policy

We may update this Privacy Policy to reflect changes in law, technology, or our practices. We will post the updated version here and, where appropriate, provide notice through the Service. Material changes will be highlighted at the top of this page.

14. Contact

Email: contact@rpsbattle.io
Controller: RPSBattle (operator)

For EEA/UK users: if you have concerns we cannot resolve, you may lodge a complaint with your national data protection authority.

← Back to the game