Privacy Policy

What we collect

• Account: the username you choose and your password (stored only as a one-way hash, never in plain text). If you sign in with Google, we receive your Google account identifier and email address instead of a password.
• Profile: your avatar, language and invite code, plus who invited you and how many players you invited.
• Game data: scores, best score per game mode, game sessions (start and end time, score and gameplay statistics used to validate results), energy and the items in your chest.
• Reports: when you report a username, we store your account, the reported account, the reason and the name at that moment. The reported player sees the reason, never who reported.
• Purchases: the product and the store transaction ID of each purchase, so we can deliver your items once. We never see your card or payment details.
• Technical logs: IP address, request time and the address requested, kept by our server for a short time for security and troubleshooting.

What we do not collect

• No ads and no advertising ID.
• No analytics or tracking tools, and no selling or sharing of your data for marketing.
• No location, contacts, photos, camera or microphone.
• Notifications are local reminders scheduled on your phone (for example, when your energy is full). We do not collect a push token.

How we use it

• To create your account and keep you signed in.
• To run the game: energy, items, game modes and rewards for invites.
• To validate scores on our server and keep the rankings fair.
• To deliver what you buy, and to remove unused items if a purchase is refunded.
• To protect the service against abuse (for example, limiting repeated login attempts) and to review reported usernames.

What other players see

Rankings are public inside the game: other players can see your username, avatar and best scores. Choose a username that does not identify you if you prefer.

Service providers

We share data only with the services that make the game work, and only what each one needs:

• Google Play: distributes the app and processes payments. Google Sign-In, if you use it, confirms your Google account.
• RevenueCat: validates purchases with Google Play. It receives your player ID and purchase details.
• Railway: hosts our server and database in the United States.

Google Privacy PolicyRevenueCat Privacy PolicyRailway Privacy Policy

Security

All traffic between the app and our server is encrypted (HTTPS). Passwords are stored as hashes. Your session is kept in the encrypted secure storage of your phone. Scores and purchases are checked on the server, not trusted from the app.

Retention and deletion

We keep your data while your account exists. When you delete your account, your profile, scores, ranking entries, items, sessions and purchase records are erased from our database right away, and your customer record at RevenueCat is deleted too. Google keeps its own record of Play Store payments under its policy.

You can delete your account inside the app or request it on our account deletion page.

Delete your account

Your rights

You can change your username and avatar in the app at any time. You can also ask us for a copy of your data, a correction or its deletion by writing to the email below. We reply within 30 days. These rights apply under laws such as the GDPR and Brazil’s LGPD.

Children

Tap Royale is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child created an account, contact us and we will delete it.

Changes to this policy

If we change this policy, we will update the date at the top of this page. Significant changes will also be announced in the app.

Contact

Questions about privacy: alirioguerra.92@gmail.com