Privacy Policy – Rival Grid

Last updated: October 19, 2026

1. Controller and contact

The controller responsible for the processing described in this Privacy Policy is:

Axel Fianke – smart & green media

Achter de Lin 26
24369 Waabs
Germany

Email: info@rival-grid.com

Rival Grid does not sell your personal data.

2. This website (rival-grid.com)

This website is purely informational. There is no player login, no account creation and no contact form on it.

Hosting and server log files

This website is hosted directly by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The hosting provider supplies the infrastructure needed to deliver the website.

When you visit the website, the hosting provider’s web server automatically processes technical connection data, in particular your IP address, the date and time of the request, the page requested (URL), the referring page (if transmitted by your browser), data volumes transferred, the HTTP status, and browser and operating-system information (user agent). This processing serves to deliver the website, diagnose technical errors, and protect against attacks. The legal basis is our legitimate interest in operating a secure and functional website (Art. 6(1)(f) GDPR). The retention period for server logs depends on the retention settings actually configured by the hosting provider.

Cookies and tracking

This website does not use cookies or similar technologies for analytics, advertising, or tracking and does not embed analytics or advertising scripts, social-media plugins, or externally hosted fonts. Fonts and images are served through our web host. We do not set our own tracking cookies on this website. Any technically necessary storage or security mechanisms of the hosting provider are separate from this.

Encryption of the connection

The connection between your browser and our hosting provider’s web server is encrypted using HTTPS (TLS). This website does not offer a player login or contact form. If you email us, the security of email delivery depends on the email providers involved.

Contacting us

If you email us, we process your email address and the content of your message to answer you (Art. 6(1)(b) or (f) GDPR). We delete it once the matter is resolved, unless legal retention duties apply.

External links

This website links to the Google Play Store and the Apple App Store once the app is available there, and to a deletion request form hosted at keeplo.de. If you follow such a link, the operator of the target site processes your data under its own privacy policy. The deletion request form at keeplo.de is run by the same operator as Rival Grid and uses a captcha to prevent abuse.

3. Guest accounts and permanent accounts

Rival Grid allows you to create a guest account when you choose “Play as Guest”. Authentication is provided by Supabase. You can play as a guest without providing an email address, password, or real name.

A guest account is associated with a randomly generated user identifier (UUID). This identifier is used internally to connect your game progress, profile, Ranked data, matches, Hearts, Duel Slots, and other game state to the same player.

Optional permanent accounts

Depending on your app version, you can voluntarily secure or restore your progress by creating a permanent account. The following sign-in methods are supported:

email address and password;
Google Sign-In; and
Sign in with Apple.

When you create or link a permanent account, Supabase stores account data such as your email address, the identity of the sign-in provider (for example a Google or Apple user ID), and authentication metadata such as timestamps and session information. If you use Sign in with Apple with a private relay address, we receive the relay address instead of your real email address. Passwords are not readable by us; they are stored by Supabase only in hashed form.

Google Sign-In in the app requests only the basic profile scopes (openid, email, profile) and passes Google’s ID token once to Supabase to sign you in. The token is not stored, logged or tracked by Rival Grid, and no offline access or refresh token is requested from Google.

Apple and Google act as identity providers only when you choose their sign-in method. They process data according to their own privacy policies.

Guest play remains possible without any of this information. Rival Grid does not require your real name, phone number, contacts, precise location, photographs, camera access, or microphone access.

When you accept the Terms of Service, we keep a record for your player account: the versions and content hashes of the Terms shown and the Privacy Policy made available alongside them, the language, the acceptance time supplied by your device, and the time the server records the acceptance. Where available, we also store the app version, a randomly generated installation ID, and whether acceptance took place when creating an account or for an existing account. We use this information to document acceptance of the Terms; the record is generally deleted with your account. The Privacy Policy is provided for information only and is not accepted separately; this record is not consent to optional usage analytics or advertising.

4. Player profile and display name

Every player has a Rival Grid player profile. The app automatically assigns an initial player handle, which you can change from your profile.

The following profile information may be stored:

your account identifier;
your selected display name;
a normalized version of the display name used to ensure handle uniqueness;
profile creation and update timestamps.

Your display name is a game handle. You are not required to use your real name, and you should avoid using sensitive personal information as your handle.

Your display name may be visible to other Rival Grid players, for example in Ranked leaderboards, matches, results, friend lists, challenges, or other competitive and social features.

5. Gameplay, Ranked, Daily Challenge and Rival Cup

To operate asynchronous competitive matches fairly, Rival Grid stores game-related information such as:

match history;
piece placements and submitted moves;
scores and match outcomes;
Rival Points (RP), Ranked tier, wins, losses, ties, and rating changes;
results and standings in the Daily Challenge and in Rival Cup competitions;
match seeds and ruleset information required to reproduce and validate a match;
whether an opponent was another player or an AI opponent;
information required to manage asynchronous matches and open Duel Slots.

This information is used to provide matchmaking, validate results, prevent manipulation, calculate ratings, display leaderboards and standings, and operate the competitive game.

Match data is associated with your Rival Grid account identifier rather than with a required real-world identity.

6. Progression, Hearts, Duel Slots, missions and cosmetics

Rival Grid uses game systems called Hearts and Duel Slots, as well as progression, missions, achievements, in-game currency (Grid Tokens) and cosmetic items. The servers may store information such as:

your current number of Hearts and the time at which your next Heart becomes available;
active and available Duel Slots and temporary rewarded Duel Slot grants;
whether a Heart was lost as the result of a Ranked match;
your progression state, level, XP, missions and achievements;
your Grid Token balance and cosmetic items you have unlocked or equipped.

This information is required to operate these game mechanics consistently across app sessions and devices.

8. Push notifications

If you allow notifications in your device settings, Rival Grid can send push notifications, for example about matches, challenges, or Hearts. To do so, the servers store:

your Rival Grid account identifier;
a randomly generated installation ID;
your Expo Push Token and, where available, the native push token provided by Apple Push Notification Service (APNs) or Firebase Cloud Messaging (FCM);
the platform, app version, locale, and time zone of your device;
your notification settings within the app.

Notifications are delivered through the Expo Push Service and, from there, through the push services of Apple or Google. These providers receive the push token and the notification content required for delivery.

You can turn notifications off at any time in your device settings or in the notification settings of the app.

9. Advertising – Google AdMob, UMP and ATT

Rival Grid uses Google AdMob to display advertising. The app may show:

fullscreen interstitial advertisements at natural breaks between matches; and
optional rewarded advertisements that you choose to watch in exchange for an in-game benefit, such as one Heart or a temporary additional Duel Slot.

Google and its advertising partners may process information such as your IP address and the approximate location derived from it, device information including advertising identifiers, advertising data, product-interaction data, and crash and performance data, in order to provide, measure, secure, and personalize advertising.

Google describes its data practices in its own privacy information:

Google Privacy Policy: https://policies.google.com/privacy
How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites

If you have bought the in-app purchase to remove advertisements (“Remove Ads”) (see “Purchases” below), automatic interstitial advertisements are no longer shown. Optional rewarded advertisements remain available if you choose to use them.

Advertising consent (UMP)

Where required, Rival Grid uses Google’s User Messaging Platform (UMP) to request and manage advertising-related privacy choices. Depending on your location and the applicable requirements, you may be asked to make choices regarding personalized advertising before advertisements are requested. Where consent is required, it is the legal basis for the advertising-related processing and for accessing information on your device for this purpose (see section 14).

Where available, you can review or change these choices from:

Help & About → Privacy Options

App Tracking Transparency and IDFA (iOS)

On iOS, Rival Grid may ask for permission under Apple’s App Tracking Transparency (ATT) framework. The Advertising Identifier (IDFA) is used only if your device’s operating system permits it. If you decline or restrict tracking, advertisements can still be delivered, but without an available IDFA.

Advertising consent and Rival Grid’s separate usage-analytics setting are independent of each other.

10. Rewarded advertisement verification

When you choose to watch a rewarded advertisement, Rival Grid uses Server-Side Verification (SSV) to verify that the reward was legitimately earned.

Before the advertisement is shown, the Rival Grid server creates a temporary, single-use reward reference. Google may send technical information about the completed rewarded advertisement back to Rival Grid’s server, including information such as:

a transaction identifier;
the ad unit involved;
reward information;
a cryptographic verification signature; and
the temporary reward reference created for that specific reward request.

Rival Grid verifies this information before granting a Heart, a temporary Duel Slot, or a Daily Challenge bonus such as Grid Tokens and XP. The reward reference is designed so that Rival Grid does not need to send your raw Supabase account identifier to Google as the reward reference.

Reward verification information is also used to prevent duplicate rewards and advertising fraud.

11. Product analytics – PostHog

Rival Grid offers optional usage analytics with PostHog to understand how the game is used, identify usability issues, and improve game systems. Optional product analytics is carried out only if you have explicitly agreed to it beforehand. Without your consent, these analytics remain disabled.

Optional product analytics may include events from the app and our game servers. These events are associated with your pseudonymous Rival Grid account identifier (UUID) so that usage can be analysed across sessions. This identifier can be linked to your player account: the information is therefore pseudonymised, not anonymous.

Information sent to PostHog may include:

app lifecycle information such as app opens, updates, foregrounding, and backgrounding;
onboarding progress;
screens viewed;
matchmaking actions;
match starts, submissions, and results;
whether a resolved opponent was human or AI;
game-performance information such as score, match duration, target progress, and result;
use of Hearts and Duel Slots;
advertising-related product events such as whether an advertisement was available, shown, or rewarded;
profile interactions;
language settings;
app version;
build number;
operating platform;
locale;
technical error and diagnostic information.

Rival Grid does not intentionally send the following information to PostHog:

your display name;
your email address;
authentication tokens or passwords;
Supabase access or refresh tokens;
AdMob server-verification payloads;
reward-intent tokens;
full match identifiers;
opponent moves or hidden opponent scores.

If you have consented to usage analytics, sanitised technical error and diagnostic events from the app or game servers may also be sent to PostHog. Data needed for security, fraud prevention and operation is processed separately where an independent legal basis applies.

Session Replay

Session Replay is disabled. Rival Grid does not use PostHog to record videos or replays of your screen, taps, or gameplay session.

Enabling and disabling optional analytics

When first setting up the app, you can agree to or decline optional usage analytics. Both choices are equally available. You can change your decision later at any time in the app under:

Help & About → Analytics → Usage Analytics

If you decline or have not made a choice, no optional PostHog product-analytics events are sent from the app or our game servers to PostHog. You may withdraw consent at any time with effect for the future. After withdrawal, further optional transfers stop; data already processed lawfully is not automatically deleted retroactively. Gameplay, purchases, rewards, and processing necessary to run the game remain unaffected. We may also disable analytics centrally.

PostHog provides further information about its privacy practices at https://posthog.com/privacy.

12. Purchases – RevenueCat and in-app purchases

Rival Grid offers an optional in-app purchase to remove advertisements (Remove Ads); availability depends on your app version and store. Payments are handled by the app store through which you buy (Apple App Store or, where offered, Google Play). We do not receive your payment card or other payment details.

To manage purchases and entitlements, Rival Grid uses RevenueCat. Rival Grid passes your Supabase account identifier (UUID) to RevenueCat as the App User ID. RevenueCat and Rival Grid process purchase and entitlement information such as:

the App User ID;
purchase history, including the products purchased, transaction identifiers, and purchase and expiration dates;
whether an entitlement such as Remove Ads is active;
technical information such as platform and app version.

This information is used to unlock your purchase, restore it on other devices or after reinstalling, and prevent misuse. RevenueCat describes its data practices at https://www.revenuecat.com/privacy.

13. Google AdMob reporting and Google OAuth (operator only)

Separately from the game, the operator uses the Google AdMob API to see how the app’s advertising performs. For this purpose a Google Cloud project named “Rival Grid AdMob Analytics” and a Google OAuth client are used.

What it is: an internal business reporting tool for the operator. It is not offered to players or website visitors. This website has no “Sign in with Google” button and does not ask visitors for access to any Google data.
Who has access: only the operator. Access is authorised once by the operator’s own Google account that owns the AdMob account. No player, website visitor or third party has access to this reporting or to the Google data it receives.
Permission requested: one read-only scope, https://www.googleapis.com/auth/admob.report, which allows reading AdMob reports. No write access to the AdMob account is requested.
Data read: aggregated advertising figures for the app, namely date, app, platform, impressions, clicks and estimated earnings. They contain no information about individual players and are not linked to Rival Grid accounts.
Storage: where this synchronisation is enabled, the aggregated figures are stored in the operator’s Rival Grid backend (Supabase) and may be shown in the operator’s analytics workspace (PostHog). The OAuth refresh token is kept as a server-side secret and is never published on this website.

Rival Grid’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The legal basis is the operator’s legitimate interest in evaluating the economic performance of the app (Art. 6(1)(f) GDPR).

14. Service providers, legal bases and international transfers

Rival Grid uses third-party infrastructure and service providers where necessary to operate the app and this website. These currently include:

Supabase

Authentication, database storage, server-side game logic, player profiles, Ranked and match data, social features, push token storage, Hearts, Duel Slots, and reward verification.

Apple and Google (identity providers)

Optional sign-in with Apple or Google, only if you choose these methods for a permanent account.

Google AdMob

Interstitial and rewarded advertising, reward verification, related consent functionality (UMP), and the operator’s aggregated reporting described above.

Expo Push Service

Delivery of push notifications, together with the push services of Apple and Google.

PostHog

Optional pseudonymised product analytics and related technical diagnostics from the app and game servers only with express consent.

RevenueCat

Management of in-app purchases and entitlements, where purchases are offered.

IONOS

Direct HTTPS (TLS) hosting of the website, technical delivery and web server log files.

These providers process information on behalf of Rival Grid or, in the case of Apple, Google, and the app stores, under their own responsibility, according to their own terms, privacy policies, and applicable data-processing arrangements. Rival Grid does not provide advertisers with access to your Rival Grid match history, private gameplay data, or account credentials.

Legal bases (GDPR and TDDDG)

Where the GDPR applies, we process personal data on the following legal bases. Where we store information on your device or access information stored there (for example identifiers or push tokens), the German Telecommunications Digital Services Data Protection Act (TDDDG, § 25) also applies.

Contract / providing the app (Art. 6(1)(b) GDPR): account and profile data, gameplay, Ranked, Daily Challenge and Rival Cup data, progression, Hearts, Duel Slots, cosmetics, social features, and, where purchases are offered, purchase and entitlement handling. Storage of and access to information on your device that is strictly necessary to provide the game you requested (for example sign-in session and game state) is covered by § 25(2) no. 2 TDDDG.
Consent (Art. 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG): (1) Optional product analytics: With your express consent, we transfer the pseudonymised usage and diagnostic events described in section 11 from the app and our game servers to PostHog. Consent is not required to play and may be withdrawn at any time under Help & About → Analytics → Usage Analytics, with effect for the future. (2) Advertising: Where legally required, Google’s UMP is used to request advertising-related privacy choices. On iOS, ATT permission may also be needed; ATT permission does not replace any other required consent. (3) Push notifications: You decide whether to allow push notifications. Advertising choices and optional usage analytics are independent of each other.
Legitimate interests (Art. 6(1)(f) GDPR): security, fraud and abuse prevention, necessary technical error diagnosis, reward verification, moderation of reports, website operation and protection by our hosting provider, and the operator’s aggregated advertising reporting that is not linked to individual players. Optional PostHog product analytics is not covered by this list; it is based on separate consent (see section 11).
Legal obligations (Art. 6(1)(c) GDPR): where we must retain or disclose data, for example under tax or commercial law.

International transfers

Some of these providers, for example Google, Apple, PostHog, RevenueCat, Supabase, and Expo, may process data outside the European Economic Area, including in the United States. Where this happens, the transfer is based on an adequacy decision (such as the EU–US Data Privacy Framework for certified providers), on Standard Contractual Clauses, or on another safeguard permitted by the GDPR.

15. Data retention and deletion

Game and account data may be retained for as long as necessary to operate Rival Grid, maintain Ranked and match integrity, prevent abuse, and provide your game progress. Push device registrations are deactivated when notifications are turned off or when a push service reports that a device is no longer registered. Moderation reports are kept for as long as necessary to handle them and to prevent repeated abuse.

Technical reward-verification and fraud-prevention records may also be retained where necessary to ensure that advertising rewards cannot be claimed repeatedly.

If your Rival Grid account data is deleted, information may remain temporarily in backups or technical logs where this is necessary for security, legal compliance, or system restoration.

Requesting deletion

You can delete a permanent account in the app (depending on your app version), or request deletion without the app. All options are described on our account deletion page. You can submit a request even if you have uninstalled the app or no longer have access to it, either with the deletion request form or by email to info@rival-grid.com stating that your request concerns Rival Grid data deletion.

The form and the email address are request channels only. Nothing is deleted automatically. Before a deletion, we verify account ownership using the secure verification options available for the relevant account type. The contact email, player ID, display name, or screenshots alone are not sufficient proof of account ownership.

Personal account data and the player progress that can be linked to your account will be deleted, including your purchase profile at RevenueCat. Certain anonymized records may be retained: matches played against other players remain in their history as “Deleted Player” without your name, and anonymous purchase records without any link to a person may be kept for security, fraud-prevention, transaction-integrity, billing, or legal reasons. Analytics data is pseudonymous and, where possible, we also request its deletion at PostHog.

We normally process sufficiently verified deletion requests within 30 days.

Uninstalling the app alone does not necessarily delete data already stored on Rival Grid’s servers.

16. Security

Rival Grid uses technical and organizational measures intended to protect game and account information.

Communication between the app and its backend services is encrypted in transit. For this website, see section 2, “Encryption of the connection”. Server-authoritative systems are used for sensitive game functions such as Ranked results, advertising rewards, Hearts, Duel Slots, and profile changes.

No system can guarantee absolute security.

17. Children

Rival Grid is not specifically directed at children.

We do not knowingly request real-world identity information from children. Advertising and privacy treatment may vary depending on applicable legal requirements, platform rules, and age-related settings.

If Rival Grid’s intended audience or age treatment changes, this Privacy Policy and the relevant advertising settings will be updated accordingly.

18. Your rights

Depending on where you live, you may have rights regarding personal data relating to you, including rights to request access, correction, deletion, restriction of processing, data portability, and to object to processing based on legitimate interests, as well as other rights provided by applicable data-protection law. Where processing is based on consent, you can withdraw it at any time with effect for the future.

To make a privacy-related request, contact info@rival-grid.com.

Because Rival Grid can be used without an email address, we may need reasonable information to associate your request with the correct account and to verify that you own it.

You also have the right to lodge a complaint with a competent data-protection supervisory authority. For our location this is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

19. Changes and contact

We may update this Privacy Policy as the app, this website or their features change. Material changes will be reflected on this page together with an updated date.

For privacy questions, data requests, or other questions about Rival Grid:
Axel Fianke – smart & green media, Achter de Lin 26, 24369 Waabs, Germany
Email: info@rival-grid.com