Privacy Policy

Last updated: 13 November 2026

Royal Rows ("the game") is a puzzle game for iPhone, iPad, Android, Mac and the web. This policy explains what the game keeps on your device, what it sends to the server, why, who else is involved, how long it is kept, and the rights and choices you have. The short version: there are no ads, no analytics, no tracking and no data sales, you can play without an account, and you can delete everything at any time.

Who is responsible

The game is made and run by Cormac Berkery, an individual developer based in Amsterdam, the Netherlands ("I", "me"). I am the controller of the personal data described here under the EU General Data Protection Regulation (GDPR).

Contact for anything about privacy or your data: [email protected]

What stays on your device

Your settings, puzzle progress, scores, streaks, achievements, display name and any game in progress are stored on your device. The whole game can be played offline. Nothing on your device is read by anyone else, and uninstalling the game removes it (on the web: clearing the site's data).

What the server stores

To back up your progress and sync it between your devices, the game creates an account for you the first time it connects. No email address, phone number, real name or password is needed. The server stores:

• Account: a random account ID, the display name you choose for the leaderboard, when the account was created and when it was last used.
• Devices: a random install ID for each device you play on, and its platform (iOS, Android, macOS or web).
• Game results: for each solved puzzle, which puzzle it was, the date and time, your score, the time taken, lives left, hints and power-ups used, and XP earned; and when you used a power-up.
• Unlocks: anything unlocked on your account, such as board sizes.
• Sign-in sessions: for each device, a sign-in token that lets the game reconnect. Only a one-way hash of each token is stored. Tokens expire after 90 days.
• Sign-in with Apple or Google (optional): if you choose it, the account identifier that service gives the game and, if they share it, your email address (Apple may give a private relay address instead). This lets you get your progress back on a new device. To unlink it, email [email protected] or delete your account.
• Reports: if you report another player's display name, the report, its reason and when you made it; if someone reports yours, the same.

I never ask for, and the game never collects, your location, contacts, photos, advertising ID, device fingerprint, browsing history or payment details.

Why I use it, and the legal basis

• To provide the game you asked for (GDPR article 6(1)(b), performance of a contract): backing up and syncing your progress, working out streaks, levels and unlocks, restoring your account on a new device, and showing the Daily Crown leaderboard.
• To keep the service secure and fair (article 6(1)(f), legitimate interests): rate limits, short-lived technical logs, handling reports about offensive display names, and preventing abuse and cheating. I have weighed these interests against your privacy and keep the data involved to a minimum.
• To meet legal obligations (article 6(1)(c)): for example answering lawful requests from authorities, and keeping records of data requests.

I do not use your data for advertising, profiling or automated decisions that affect you, and I do not sell or rent it to anyone.

The leaderboard

On the Daily Crown leaderboard, other players see your display name, score and time, and their app receives your random account ID so that they can report or hide a name. Choose a display name that does not identify you if you prefer to stay anonymous. You can change it at any time in Settings. Display names that are offensive, impersonate someone or contain personal data may be hidden or reset.

Who else is involved

I use a small number of service providers (processors) who handle data only on my instructions and under a data processing agreement:

• Hetzner Online GmbH (Germany): hosts the server and its database in data centres in Germany and Finland (EU). All game data is stored in the EU.
• Cloudflare, Inc.: serves the website and the web version of the game, protects it against attacks, and forwards email sent to royalrows.com addresses. Cloudflare processes IP addresses and request data to do this and may do so outside the EU; transfers are covered by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.
• Apple and Google: distribute the app through the App Store and Google Play, and handle Sign in with Apple or Google if you choose it. They act under their own privacy policies for those services.
• The web version of the game downloads part of its graphics engine from Google's servers (gstatic.com), and, when Sign in with Google is available, Google's sign-in script; Google receives your IP address and browser details when that happens.

I may also disclose data if the law requires it, to protect the rights, safety or property of players or myself, or as part of a transfer of the game to a new owner, who would be bound by this policy.

International transfers

Game data is stored in the EU. Where a service provider above processes data outside the European Economic Area, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework) or by the EU Standard Contractual Clauses.

Logs and security

To keep the service running, the server logs each request's time, route, result and duration, with a one-way hash of the account ID. It does not log what you send, your sign-in tokens or your IP address. These logs are rotated and deleted within a few days. The web server in front of it may keep access logs that include IP addresses; they are deleted after at most 14 days. To limit abuse, the server keeps request counts per IP address and per account in memory for a few minutes; they are never written to disk.

All connections are encrypted (HTTPS). The database is not reachable from the internet, sign-in tokens are stored only as hashes, and backups are kept on the server with access limited to me. No system is perfectly secure, but I take reasonable technical and organisational measures to protect your data and will notify you and the Dutch Data Protection Authority of a breach where the law requires it.

How long it is kept

• Account and game data: until you delete it. Accounts with no activity for 24 months may be deleted automatically.
• Sign-in tokens: up to 90 days, then deleted.
• Server logs: a few days. Web access logs: at most 14 days.
• Backups: the database is backed up nightly and each backup is kept for 14 days, so deleted data disappears from backups within 14 days.
• Reports you made about others: kept, without your account ID, after you delete your account, so that moderation decisions stay explainable. Reports about you are deleted with your account.
• Emails you send me: as long as needed to answer them, and at most 2 years.

Deleting your data

In the game, open Profile, then "Delete my data". This permanently deletes your account, game history, devices, sign-in links and sign-in sessions from the server straight away, and erases the game from that device. If you signed in with Apple, the game also asks Apple to revoke its sign-in. Data on your other devices stays there until you delete it on each of them or uninstall the game.

You can also ask me to delete your account by emailing [email protected] from any address; to prove the account is yours, include the account ID shown in Profile. See royalrows.com/delete-account for details.

Your rights

Under the GDPR you have the right to:

• access the personal data I hold about you and get a copy of it;
• have incorrect data corrected;
• have your data deleted;
• receive your data in a portable, machine-readable format;
• restrict or object to processing based on legitimate interests;
• complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you can also complain in the EU country where you live or work.

To use these rights, email [email protected]. I will answer within one month. I may ask for your account ID to make sure I only hand data to its owner. Players outside the EU, for example in the UK or California, have similar rights and can use the same address.

Children

The game is suitable for all ages but is not directed at children under 13, and I do not knowingly collect personal data from them. The game works fully without an account, sign-in or any personal details. If you believe a child under 13 has signed in with Apple or Google or chosen a display name containing personal data, email [email protected] and I will delete it.

Cookies and similar technologies

The game and website use no advertising or tracking cookies. The web version stores your progress and settings in your browser's local storage, which is necessary for the game to work. While the web version is in private testing, a single cookie remembers that you entered the test password.

Changes

If this policy changes, I will update the date above. For significant changes, I will tell you in the game before they take effect.

Contact

Privacy and data requests: [email protected]
Everything else: [email protected]
Cormac Berkery, Amsterdam, the Netherlands