Privacy Policy

Who we are

RushTown is made by Jaimie Vranckx, an independent developer based in Antwerp, Belgium ("we", "us"). We are the controller of the personal data described below. You can reach us at support@rushtowngame.com.

What our server stores, and why

Your game account

The first time you play, the game makes a random account ID on your phone (it isn't your phone's own ID). If you link Google Play Games, we also receive your Play Games account ID from Google, so you can sign in on another phone. The server keeps a record of your current session (your account ID and when you were last seen).

Your company

Your saved game (towns, buildings, vehicles, coins, items and progress), your company name and logo, and your level. We keep the latest save, the last 5 uploads and one save a day for 7 days, so we can repair a broken save.

Fair play

A short summary of each save (such as your level, coins and tokens) to check that progress adds up, and a record of rewards given by the server (totals for your account, and the last 100 with their reason and time). Google Play Integrity checks once per start that the game is the real one on a real device; we keep only the result of the latest check, never its token.

Rankings and events

Your company value, your weekly score and league, and your rank and points in events.

Alliances

Your alliance, your role in it, the goods you sent for its weekly goal (kept 8 weeks), help requests while the job runs, contributions to alliance projects, your requests to join an alliance (which its leaders see), and when you last left an alliance.

Friends and chat

Your friends list, your block list, your chat settings, when you accepted the chat rules, your conversations, chat requests (until answered; a declined request is remembered for 7 days so the same player can't ask again), group chats, and the messages you write in alliance, private and group chats.

Reports and moderation

When a player reports a message, we keep the report, the reporter's account ID and a copy of the message with up to 5 messages around it, so a person can review it. We also keep any chat mutes or chat bans on your account. When an account is banned from chat, we keep a scrambled (hashed) form of its Google Play Games account ID with the ban until the ban ends, at most 12 months, so the ban still applies if the same Google account comes back, even after deleting the account. When we close an account, we keep a closure note with the account ID, the end date and our reasons, together with a scrambled (hashed) form of the game's random install ID from that phone (not your phone's own ID), so the game can show why the account was closed when it's opened on that phone. The note is kept until the closure ends, at most 12 months, also after the account is deleted.

Support requests

When you contact support in the game, we keep your message (topic and text), your player ID and company name, and your game version and platform, so we can help you and answer in your in-game Mail. If you add an email address to get an answer by email, we keep that too. Only the developer reads support requests.

Purchases

When you buy a pack, Google Play handles the payment, and we never see your payment details. Google tells our server the order number, the product and the date, so we can check the purchase and give you what you bought, and later whether it was refunded. We keep the order number, the product, the purchase and refund dates, and whether it was a test purchase.

In-game Mail

The messages we send you in the game, such as answers to your support requests, our decisions about your account or content and the reasons for them, news and gifts, with whether you have read each one and claimed its gift.

Crash reports

If the game crashes, the next time you start it, it sends us the end of the game log from the session that crashed (about the last 250 lines), with your account ID, game version and platform, so we can find and fix the problem and match it to a support request. Emails, IP addresses, IDs and long numbers are hidden on your phone before anything is sent. At most 5 reports a day are sent, and only the developer reads them. You can turn this off in the game under Settings → Account → Send crash reports.

Server logs

Technical logs of what the server did (such as save uploads, rewards and integrity results) with account IDs, and sometimes a connection's IP address in error messages. Our web server keeps no access logs.

We use this data for these reasons (legal bases under the EU GDPR):

• To give you the game (performance of our contract with you): your account, cloud saves, alliances, chat, friends, rankings, events, in-game Mail, support and the packs you buy.
• To handle refunds and claims (our legal duties as a seller and our legitimate interests): purchase records.
• To keep the game fair and safe (our legitimate interests, and yours as a player): save checks, Play Integrity, server logs, reports, moderation and blocks.
• To fix problems (our legitimate interest in a game that works): crash reports. You can object at any time by turning off "Send crash reports".
• To meet legal duties, such as handling reports of illegal content and telling players why we acted (the EU Digital Services Act).
• With your consent: personalised ads, through Google's consent form (see Ads).

What other players can see

• Everyone: your company name, logo and level, company value, league and weekly score, event ranks and points, and your alliance's name, tag, badge, language, description and member count.
• Members of your alliance: your role, whether you're online or when you were last seen, and the goods you sent this week.
• The people in a chat: the messages you write there, with your company name and logo.

Please don't put personal information in your company or alliance name or in chat.

Where your data is kept, and who helps us

• Hetzner Online (Germany) hosts our server in Nuremberg, Germany, and our encrypted backups in Falkenstein, Germany, under a data processing agreement. Your data stays in the EU.
• Zoho hosts our support email in its EU data centre. If you email us, your message and email address are kept there for as long as needed to help you, and at most 12 months after we last wrote.
• Google handles the Play Games sign-in, the Play Integrity check and payments for packs under the Google Privacy Policy, and provides the optional ads (see below).
• This website runs on our own server at Hetzner in Germany. It uses no cookies and keeps no access logs.
• GitHub hosts a small public file the game reads at start, and now and then while you play, to check for updates; GitHub sees your IP address when the file is downloaded.
• Our uptime monitor only checks that the server answers, and our team chat on Discord only receives counts of open reports. Neither receives any player data.

Only the developer can access the server and the review of reports. We don't sell your data, we don't share it with advertisers, and we don't use outside analytics or crash-reporting services: crash reports go only to our own server.

How long we keep it

• Your account, saves, rankings, alliance data, friends and settings: for as long as your account exists.
• Chat messages: 90 days.
• Reports: until they are decided, then 6 more months (for appeals), then they are deleted.
• Weekly alliance tallies: 8 weeks. Weekly rankings and leagues reset every week.
• Support requests: until 12 months after they are closed.
• In-game Mail: 90 days. Our decisions about your account or content: 190 days, so they stay readable for the 6 months you have to appeal. A message sent to all players ends when we take it down, usually after 30 days.
• Purchases: 2 years after the purchase, for refunds and claims. If you delete your account, we remove the link to your account and keep the rest until the 2 years are up.
• Crash reports: 90 days.
• Server logs: at most 30 days.
• Chat bans: a hashed Google Play Games account ID with the ban, until the ban ends, at most 12 months (also after the account is deleted).
• Account closures: the closure note with a hashed install ID, until the closure ends, at most 12 months (also after the account is deleted).
• Backups: encrypted, and kept for at most 3 months. Data you delete disappears from the backups when they expire.

Deleting your account

In the game, go to Settings → Account → Delete account and type DELETE. Your account is deleted at once: your logins, all your saves, your rankings, your chat messages and every other record listed above, and your phone starts a new game. You can also ask us by email; we handle requests within 30 days.

A few things stay for a limited time: reports that involve your messages (until decided plus 6 months), a chat ban if your account had one (only a hashed form of your Google Play Games account ID and the ban, until it ends, at most 12 months), a closure note if we closed your account (until the closure ends, at most 12 months), purchase records without the link to your account (until 2 years after each purchase), and our encrypted backups (until they expire, at most 3 months).

Ads

RushTown shows rewarded ads only when you choose to watch one, for example to double your earnings for a while, finish a building at once or get your next daily gift early. You can watch up to 10 a day. There are no banner or pop-up ads, and you never need to watch an ad to progress.

The ads are provided by Google AdMob. To show ads, measure them and prevent fraud, Google's ads software in the game may collect:

• your device's advertising ID and app set ID;
• your IP address, which can be used to estimate your approximate location;
• how you interact with the ads and the app, such as app starts, ads shown and taps;
• diagnostic information, such as crash logs and performance data.

Google's ads software only starts the first time you tap a "Watch an ad" button. After that, it may load the next ad in advance so that one is ready. This data goes to Google, not to us, and is encrypted in transit. Google explains how it uses this data in How Google uses information from sites or apps that use its services and in the Google Privacy Policy.

We ask for ads that are suitable for all ages.

Your choices about ads

• Consent. If you are in the European Economic Area, the UK or Switzerland, Google's consent form asks for your choice before ads are personalised. You can change it at any time in the game under Settings → Privacy & ads choices, which appears once you have watched your first ad. Without consent, Google may show non-personalised or limited ads.
• Advertising ID. You can reset or delete your advertising ID in your phone's settings, usually under Settings → Google → Ads, or Settings → Privacy → Ads.
• Not watching. Ads are always optional. If you never tap a "Watch an ad" button, the ads software never starts and Google receives nothing from it.

Google Play Games

Linking Google Play Games is optional, but it's the only way to keep your company if you change or lose your phone, and it's needed to write in chat. When you link it, Google gives our server your Play Games account ID, and the game reads your Play Games player name for your profile. You can manage or delete your Play Games profile at play.google.com/games/profile.

What stays on your device

Your sign-in

Your random account ID and the sign-in tokens that keep you logged in (refreshed at most every 60 days).

A local copy of your save

So the game starts quickly and nothing is lost if the connection drops. Older test saves may be kept as a backup file.

Your settings

Graphics level, interface size, sound, language, chat settings, which version of this policy you have seen, and which shop offers you have already looked at (so "New" tags go away).

Your ad choices

Stored on your device by Google's consent software.

A game log

The game's recent technical messages, with emails, IP addresses and IDs hidden. It's only sent after a crash, as a crash report (see above). You can also copy it yourself and send it to us, for example in our Discord.

Loading files and a shared picture

Prepared world data that helps the game start faster, and the last picture of your town you shared.

Uninstalling RushTown deletes all of this from your phone. It doesn't delete your account on our server; use Delete account for that.

Sharing pictures

When you tap a Share button, the game takes a picture of your town, without the game's menus, and opens your phone's share menu with a short text and a link to RushTown on Google Play. You choose the app to share it with. Nothing is sent unless you send it, and the app you choose handles it under its own privacy policy.

Device permissions

RushTown does not ask for access to your location, camera, microphone, contacts, photos or files. It uses the internet, which it needs to play, for our server, the update check, Google Play Games and the ads. Google's ads software also uses some standard permissions that need no prompt, such as access to your advertising ID and your network state.

Links to other sites

The game has buttons that open our community pages, such as Discord, and this policy and our Terms of Service in your web browser. Those sites are run by other companies, and their own privacy policies apply when you visit them.

Google Play

When you download RushTown from Google Play, Google may collect information under its own privacy policy. Packs are paid through Google Play under its terms and privacy policy; we receive only the order details listed under Purchases, never your payment details.

Children

RushTown is not directed at children under 13, and you must be at least 13 to play. We do not knowingly collect personal data from children under 13; if you think a child under 13 has an account, contact us and we will delete it. We ask Google for ads that are suitable for all ages.

Your rights

Under the EU General Data Protection Regulation, you have the right to access your personal data, have it corrected or deleted, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. To use these rights, email us with your player ID (in the game under Settings → Account). We answer within one month. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or the authority in your own country.

Changes to this policy

If this policy changes, we will update it on this page and change the effective date above. The game also shows a short notice the next time you open it.