Privacy Policy

Welcome to PicRush. This Privacy Policy describes how personal information is collected, processed, and safeguarded across our online gaming platform, which includes the web application hosted at https://picrush.app (the "Site"), our native mobile client applications (via Capacitor), and our associated real-time multiplayer WebSocket servers (collectively, the "Services").

This Privacy Policy explains how information about you is handled when you access PicRush, authenticate via Google Sign-In, play in guest mode, participate in multiplayer matches, or interact with our community. By accessing or using our Services, you acknowledge the data collection, storage, and processing practices detailed in this document.

We practice strict data minimization and collect only the data necessary to provide speed puzzle gameplay, ensure fair multiplayer matchmaking, and protect platform integrity. We clearly delineate between data received from third-party identity providers and data generated natively by PicRush game engines:

Note: PicRush-generated gameplay statistics (such as guess timings, stars, and leaderboard scores) are computed independently by PicRush game engines and are completely distinct from your Google account profile.

We process personal information only when we have a valid legal basis under applicable data protection frameworks (such as GDPR Article 6). We rely on the following lawful grounds:

• Contractual Necessity (Delivering the Gaming Service): Authenticating your account via Google Sign-In or native Android Credential Manager, synchronizing puzzle progression and earned achievements across devices, powering real-time WebSocket multiplayer rooms, and dynamically tabulating live podium standings.
• Legitimate Interests (Platform Security & Fair Play): Validating round solve timestamps against server-authoritative clocks to detect automated bot scripts and dictionary brute-force exploits, conducting network health telemetry (`/api/health`) to optimize regional routing, and defending against DDoS threats.
• User Consent (Optional Features & Preferences): Where required by law, serving personalized advertisements or setting optional display preferences, which you may freely grant, adjust, or revoke at any time.
• Legal Obligations & Compliance: Complying with applicable statutory obligations, lawful subpoenas, regulatory requests, or enforcing platform terms of service.

Because PicRush features competitive speedrun puzzles and multiplayer rooms, certain gameplay elements are publicly shared to facilitate gameplay:

PicRush uses essential cookies and local browser storage to provide functional gameplay, maintain player settings, and ensure account security:

To deliver a scalable, resilient gaming experience, we partner with specialized cloud infrastructure providers under strict Data Processing Agreements (DPAs):

We enforce specific data retention schedules to avoid keeping data longer than necessary:

• Active Registered Player Accounts: Account information, Google OAuth linkages, and earned game achievements are retained for as long as your account remains open and active.
• Inactive Guest Sessions: Anonymous guest identifiers unlinked to any Google Account that experience zero activity for more than 90 consecutive days are automatically purged from our servers.
• Permanent Account Deletion (Active Systems): When you initiate an account deletion request through your Account Settings or by emailing privacy@picrush.app, all associated personal information, Google OAuth identifiers (`sub`), profile records, and session tokens are permanently erased from our primary active databases (Supabase/PostgreSQL) within 24 to 72 hours.
• Encrypted Backup & Log Purge Cycles: Encrypted disaster-recovery database snapshots and transient security logs are held in isolated cold storage and automatically overwritten or permanently destroyed in rolling cycles within a maximum of 30 calendar days, during which they remain strictly inaccessible to operational workflows.

Depending on your location and subject to applicable data protection laws (including the EU and UK General Data Protection Regulation [GDPR/UK GDPR] and the California Consumer Privacy Act as amended by the California Privacy Rights Act [CCPA/CPRA]), you may have the following statutory rights regarding your personal data:

• Right of Access & Portability: You may request confirmation of whether we process your personal data and obtain a structured, commonly used, machine-readable export (JSON) of your account profile and game statistics.
• Right to Rectification: You may correct or update inaccurate player information (such as your display name or avatar) at any time directly in your Account Settings.
• Right to Erasure ("Right to be Forgotten"): You may request that we permanently delete your personal information and disassociate your records from public leaderboards.
• Right to Restrict or Object: Where we process data on the basis of legitimate interests, you may object to or request the restriction of such processing.
• Right to Withdraw Consent: Where processing is based on your affirmative consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. You can revoke Google account authorization at any time via your Google Account Security settings or disconnect in your Account Settings.
• Right to Lodge a Complaint:You have the right to submit a complaint to your local data protection supervisory authority (such as your national EU Data Protection Authority or the UK Information Commissioner's Office [ICO]) if you believe our processing violates applicable data protection regulations.
• Non-Discrimination: We will never discriminate against you, deny you access to puzzles, or degrade your gameplay experience for exercising any of your privacy rights.

To exercise any of these rights, you may utilize the self-service controls in your Account Settings or submit a verified request to privacy@picrush.app. We respond to all verifiable requests within 30 days.

PicRush is designed as a family-friendly educational and arcade game suitable for players of all ages, including students and language learners building English vocabulary. The platform is intended for general audiences and is not directed specifically to children under the age of 13.

We do not knowingly collect personal identifiable information from children under the age of 13 in the United States, or under 16 in the European Economic Area and United Kingdom, without verifiable parental consent in accordance with the Children's Online Privacy Protection Act (COPPA) and applicable regional data protection frameworks.

• No Conditioned Disclosures:We never condition a child or student's participation in picture puzzles or multiplayer rooms on disclosing more personal information than is strictly necessary to participate in the activity.
• Ad Protections for Young Learners: In our advertising integration with Google AdSense, ad requests served in Guest Mode or to accounts identified as minors are configured for non-personalized or contextual advertising only. We do not transmit player profiles, chosen nicknames, or personal identifiers to advertising networks for behavioral profiling or cross-site tracking.
• Expedited Parental Deletion: If a parent, legal guardian, or educator discovers that a minor has provided personal information to PicRush without consent, please contact us immediately at privacy@picrush.app with the subject line "COPPA Data Request". Upon identity verification, we will expedite the request and permanently expunge all associated data within 48 hours.

PicRush provides services internationally. Consequently, information collected from you may be stored and processed on cloud servers situated in India, the United States, or other jurisdictions where our sub-processors maintain facilities. Where cross-border data transfers occur, we ensure adequate legal transfer safeguards are implemented, including Standard Contractual Clauses (SCCs) approved by the European Commission.

This Privacy Policy shall be governed by and construed in accordance with the laws of India, without regard to conflict of law provisions, while preserving any mandatory statutory consumer privacy rights granted by the laws of your residence.

If you have questions, regulatory inquiries, or wish to exercise your data rights, our team is directly reachable through our monitored channels: