Privacy Policy
Effective November 7, 2026
This policy explains what information the iPhone game Rage Room: Smash Sandbox (the "game") collects, why, who else receives it, and the choices you have. The game is made by Paintwell LLC, a California limited liability company in Los Angeles ("we", "us"). If anything here is unclear, email tim@paintwell.ai.
- You do not create a login account. Progress is saved on your device.
- A player record is created automatically when the game first connects successfully, even if you have not used invites. It holds your invite information, your total XP, which sets your rank, and the player name you choose, which is shown on the leaderboard.
- Google AdMob and RevenueCat process information for ads and purchases. Non-personalized ads still involve data collection.
- The game does not request camera, microphone, contacts or precise-location access. Ad providers can estimate approximate location from an IP address.
- Apple handles payment entry. If you contact support, we receive your email and anything you choose to send.
- See section 13 for privacy requests and advertising choices.
Contents
- What stays on your device
- What our server stores
- Advertising
- Purchases
- Game Center and the leaderboard
- The time check
- Who else receives information
- Why we use information
- Selling and sharing
- How long we keep it
- Security
- Where information is held
- Your choices and rights
- California residents
- EEA, UK and Switzerland
- Children
- Changes
- Contact
1. What stays on your device
The game saves progress, currencies, upgrades, gear, scores, settings and purchase flags in its app storage on your iPhone. Your chosen player name is saved there and is also sent to our server for the leaderboard (section 2). The save also includes your invite ID, public invite code, private player secret and timing information. Purchase flags on the phone are separate from the transaction information held by purchase providers.
Device backups may include app data, depending on your settings and Apple’s backup service. Deleting the app removes its local data but does not by itself delete invite records, purchase records, provider logs or existing backups. The game does not provide a cloud backup of your progress or current balances.
2. What our server stores
The game uses Supabase for invite rewards and ranks. It automatically requests a player record (also called an invite record) on its first successful online connection. The record contains:
| Item | What it is |
|---|---|
| Player ID | A random identifier for the record. It is not your name, but a persistent random ID can still be personal information. |
| Player secret | A private value used to authorize reward actions. Do not share it. |
| Invite code | Your public six-character code, which you can share. |
| Referral information | The code you used, whether the first room was reported cleared, pending invite gems and the number of credited referrals. |
| XP for ranks | Your total XP and when it was last sent. The game sends it so your rank can be worked out from where your XP places you among all players. The server returns your place, the number of ranked players and the leaderboard. |
| Leaderboard name | The player name you enter in the game, sent with your XP. The server keeps it only in capital letters, digits and a few symbols, up to 16 characters, and does not keep a name containing blocked words; without a kept name, the leaderboard shows PLAYER and your invite code. |
| Terms acceptance | The version of the Terms of Service and Privacy Policy you agreed to with Agree & Play, and when, kept as a record of that agreement. |
| Creation date | When the server record was created. |
The current game does not collect a Game Center ID. Creating an invite record issues a secret; later reward actions use it. Other players can see the leaderboard: the top 50 players’ names (or invite codes), XP, places and ranks. They cannot read the rest of your record. Players can report a name or block a player from the leaderboard; a report stores who reported whom and the name reported, and a name reported by several players is removed. Authorized service operators may access records to run the service and handle requests.
Supabase receives request metadata such as IP addresses and may retain operational or security logs. Those logs are separate from your invite record.
3. Advertising
The game requests non-personalized ads from Google AdMob. It does not request permission to access Apple’s advertising identifier (IDFA). Google’s software can still process device or app identifiers, IP-derived approximate location, ad interactions, and diagnostic information to provide, measure, and improve ads and prevent fraud. Non-personalized does not mean that no information is collected.
Ads can appear between runs. You can also choose a rewarded ad for tokens or a continue. Remove Ads stops between-run ads; it does not remove every optional rewarded ad or stop all advertising-SDK processing.
In the EEA, UK and Switzerland, Google’s privacy message presents your advertising choices. Where available, you can review or change them in Settings → Ad privacy. Depending on your choices and the available ad mode, you may see limited ads or no ad. Buying Remove Ads stops between-run ads; it is not required to make a privacy choice. Optional rewarded ads remain available only when an ad can be shown under your choices.
See how Google uses information from apps that use its services and Google’s Privacy Policy.
4. Purchases
Apple handles payment entry for App Store purchases. The game does not ask for your payment-card details or Apple Account password. Apple and RevenueCat process purchase records, including products, transaction information and purchase status.
RevenueCat creates an app user ID when no custom ID is provided. It uses purchase history for validation, entitlements, fraud prevention, purchase reporting and analytics. Restore Purchases checks the Remove Ads entitlement; it does not restore your consumable gem or token balance. A random app user ID does not mean that every record is anonymous.
See RevenueCat’s privacy policy. If you email us a receipt, remove unrelated purchases, your billing address and other unnecessary personal information.
5. Game Center and the leaderboard
Game Center is not available in the current game. The game has its own leaderboard, described in section 2: if your XP places you in the top 50, other players see your player name (or invite code), XP, place and rank. Do not use your real name or other personal information as your player name. To show as PLAYER and your invite code instead, clear your name in the game; to have your record removed, see section 13. If we add features that collect or publish additional information, we will explain them and update this policy before the new processing begins, and request consent where required.
6. The time check
To help keep token refills fair, the game makes a request to apple.com to read the server’s time. The request does not include your player name or invite record. Apple receives your IP address and the technical information ordinarily included in the request. The game also contacts Expo to check for and download updates, as described in section 7.
7. Who else receives information
| Provider | Purpose and information |
|---|---|
| Apple | App Store purchases and the time request; Apple handles information under its own terms and privacy policy. |
| Google AdMob | Advertising, measurement, analytics and fraud prevention using the information described in section 3. |
| RevenueCat | Purchase validation, entitlement restoration, reporting and analytics using purchase records and an app user ID. |
| Supabase | Invite, rank and leaderboard hosting and operations using the player record and request/log information. |
| Expo EAS Update | Checking for and delivering compatible updates; technical request information such as app version, platform and IP address. |
If you contact us, we receive your email address, message and any attachment you choose to send. Please avoid sensitive or unrelated information. We may disclose information when required by law or reasonably necessary to protect people or the service. A business transfer does not remove your existing privacy rights.
8. Why we use information
We use information to run the game, administer invite rewards, work out ranks, show the leaderboard, deliver purchases, provide advertising, protect the service and answer support requests.
- Contract: purchase administration and the game services necessary to provide what you request.
- Legitimate interests: security, fraud prevention and support, where our interests do not override your rights.
- Consent: advertising-related storage or processing where consent is required. Withdrawing consent does not affect earlier lawful processing.
- Legal obligations: records or disclosures required by applicable law.
You can object to processing based on legitimate interests and ask about the basis for a particular use. Advertising choices are described in section 3.
9. Selling and sharing
Information is disclosed to the providers for the purposes described in sections 3, 4 and 7. Privacy laws can give specific meanings to selling or sharing personal information. Advertising choices and applicable rights are described in sections 3, 13 and 14.
10. How long we keep it
- Device data: stays in app storage until removed. Backups may remain under your backup settings.
- Player records: keep only as long as needed for invite rewards and ranks, preventing duplicate rewards and related disputes.
- Support: keep messages and necessary purchase-support information for the time needed to handle the request and any justified follow-up or legal obligation.
- Provider records: retention depends on the service, purpose, our applicable instructions and any legal duties. Provider privacy policies do not replace our responsibilities.
Where a legal obligation or unresolved dispute requires longer retention, use is restricted to that purpose. Ask about deletion through section 13.
11. Security
The game uses HTTPS for its invite and rank requests. Access controls and the player secret are intended to protect invite records from unauthorized access. Authorized operators may need access to run the service and respond to requests. No system is perfectly secure. Keep your player secret private; your invite code is meant to be shared.
12. Where information is held
Paintwell LLC is based in the United States. The invite server is hosted in the United States, and our providers may process information in other countries.
13. Your choices and rights
For an invite-record request, email tim@paintwell.ai with your invite code so we can find the record. An invite code is not proof that the record is yours. Before providing, changing, or deleting a record, we may ask you to confirm control of the game installation or provide other proportionate information. Do not email your player secret, password, or payment-card information. If we cannot reasonably verify a request, we will explain what we can and cannot do. We respond within the period required by applicable law, generally one calendar month for EEA and UK requests and 45 days for California requests where that law applies. If a lawful extension is needed, we will explain it within the initial response period.
Depending on applicable law, you may have rights to access, correct, delete, receive a copy of or port your information, restrict processing, object to certain uses, withdraw consent and complain to a data protection authority. You may also have a right to appeal a denied request. We will not discriminate against you for exercising rights that apply to you.
These requests are not limited to invite records. Tell us if your request concerns purchase administration, support or another use described in this policy. Deleting local app data does not automatically delete server or provider records. Deleting an invite record can affect pending rewards; we will explain relevant consequences without removing mandatory rights.
Where available, Settings → Ad privacy opens Google’s privacy options. Remove Ads is a purchase that stops between-run ads, not a requirement for making a privacy choice.
14. California residents
California residents can contact us as described in section 13. Where the California Consumer Privacy Act applies, you may have rights to know, access, correct, delete, and obtain a copy of personal information, and to opt out of sale or sharing. You may use an authorized agent where permitted. We will not discriminate against you for exercising rights under applicable law. Our advertising practices and privacy choices are described in section 3.
15. EEA, UK and Switzerland
Paintwell LLC is responsible for processing whose purposes and means we determine, including invite administration, purchases and support. Providers such as Apple and Google may also process information for their own purposes. Contact us about our processing; you may also complain to the relevant supervisory authority.
16. Children
The game is intended for people age 13 and older, not children under 13. Any higher minimum age required by local law also applies. Check the App Store listing for the content rating in your region. If you believe we have collected personal information from a child under 13, contact tim@paintwell.ai so we can investigate and take appropriate action, including deletion where required.
Privacy choices matter for teenagers too. The information in this policy explains how the game uses data and how to ask for help or make a privacy request. If you are unsure about a choice, ask a parent or trusted adult, or contact us at tim@paintwell.ai.
17. Changes
We may update this policy when the game or our practices change. We will identify the effective date and provide notice of material changes before the new processing begins. We will seek consent where required; an update to this page is not blanket permission for a new use of information.
18. Contact
Paintwell LLC
Los Angeles, California, United States
tim@paintwell.ai