Privacy Policy

1. Overview & Developer Identity

This Privacy Policy describes how RBX Rewards Studio ("we", "us", or "our") handles personal information, gameplay metrics, and technical telemetry when you download, install, and interact with the RBX Rewards mobile application (the "App") and associated online services.

By accessing or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any practice described herein, please cease using the App and uninstall it from your device.

2. Information We Collect

We collect the minimum amount of data required to ensure functional mini-games, track your virtual RBX Coin rewards, safeguard the platform from botting and fraud, and present non-intrusive advertisements.

A. Information You Provide

• Display Profile: When configuring your profile, you may optionally set a custom display name and choose an avatar caricature. We do not require real names, phone numbers, or social media links to play.
• Support Correspondence: If you contact us via email at support@rbxrewards.app, we retain your email address and message contents to assist you with inquiries and claims.
• Redemption Data: When redeeming promotional digital cards, we may record the recipient delivery identifier (e.g., recipient email or Roblox username provided for direct code delivery).

B. Automatically Collected Technical Data

• Device Identifiers: Operating system version (Android/iOS), device brand/model, screen dimensions, and system language to ensure proper rendering and responsive gameplay.
• Advertising Identifiers: Google Advertising ID (AAID) on Android, or Apple Identifier for Advertisers (IDFA) on iOS, subject to your explicit permission via Apple's App Tracking Transparency (ATT) framework.
• Network & Anti-Fraud Telemetry: Anonymized/hashed IP addresses, Cloudflare bot-mitigation metrics, and rate-limiting counters to protect our servers against multi-account fraud, auto-clickers, and script attacks.

3. Local Device Storage (On-Device Data)

In order to minimize external server storage and respect your offline privacy, the App stores core operational and progress data locally on your device using SharedPreferences and encrypted Hive / Flutter Secure Storage.

This includes:

• Your virtual RBX Coin balance and session tokens.
• Mini-game scores and personal records for all 5 arcade modes: Flappy Jump, Tap Tap, Math Quiz, Flip Cards, and Scratch Cards.
• Daily login streak count and 24-hour reward cooldown timers.
• Spin wheel remaining free spins and chest unlock timestamp states.
• DailyCapService counters (earnings_date, daily_features_earnings, daily_offerwalls_earnings).
• User profile preferences (custom avatar selection and display name).

Note: If you clear the App's storage via your device operating system settings or uninstall the App without syncing, locally stored offline progress may be permanently erased.

4. Third-Party SDKs & Advertising Partners

To deliver monetization, offerwalls, and backend synchronization, we integrate reputable third-party software development kits (SDKs). Each partner operates under its own stringent privacy regulations:

5. Apple App Tracking Transparency (ATT) Disclosures

In strict compliance with Apple App Store Review Guideline 5.1.2, iOS versions of RBX Rewards will present an explicit App Tracking Transparency (ATT) permission prompt prior to accessing your device's Identifier for Advertisers (IDFA).

• If you select "Ask App not to Track": Third-party ad networks receive a zeroed identifier and deliver only contextual, non-personalized advertising. Your gameplay and ability to earn coins are unaffected.
• If you select "Allow": Ad partners may use cross-app telemetry to present ads that are more relevant to your gaming interests.

6. How We Use Information

We process collected data exclusively for the following legitimate business purposes:

1. Core App Functionality: Accurately calculating coin balances, XP level progression, streak bonuses, and high scores.
2. Reward Verification & Delivery: Validating legitimate coin earnings before fulfilling promotional digital Roblox gift cards or promotional codes.
3. Platform Integrity & Anti-Fraud: Detecting bots, auto-clickers, emulators, and illicit reward manipulation.
4. Customer Support: Resolving player tickets, missed offerwall credit claims, and technical bug reports.

7. Children's Privacy (COPPA & Families Policy)

In compliance with the Children's Online Privacy Protection Act (COPPA), the General Data Protection Regulation (GDPR-K), and Google Play Families Policy:

• We do not condition a child's participation in games upon the disclosure of more personal information than is reasonably necessary.
• We configure ad network SDKs to restrict behavioral targeting whenever an account is identified as belonging to a minor.
• If you are a parent or guardian and discover that your child under 13 has submitted personal information to us, please contact us immediately at privacy@rbxrewards.app. We will promptly delete such data from our servers.

8. Data Security & Retention

We implement industry-standard administrative, physical, and technical safeguards. All communications between the mobile application and our Supabase / Cloudflare infrastructure are encrypted in transit using Transport Layer Security (TLS 1.3 / HTTPS).

Retention Period: We retain account telemetry and redemption logs only as long as necessary to provide services and satisfy anti-fraud auditing requirements (typically up to 12 months following account inactivity). Locally cached device data remains on your physical phone until cleared by you.

9. Your Privacy Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction (such as the European Economic Area, United Kingdom, or State of California), you hold specific privacy rights regarding your personal information:

• Right to Access: You may request a copy of any personal data we hold associated with your user ID.
• Right to Rectification: You may request correction of inaccurate data.
• Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your account and associated records.
• California Notice (CCPA/CPRA): We do NOT sell or share your personal information for monetary consideration. You have the right not to be discriminated against for exercising your privacy rights.

10. Account & Data Deletion

In compliance with Google Play's Account Deletion Policy and Apple App Store Guideline 5.1.1(v), we provide both in-app and web-based deletion mechanisms:

• Instant In-App Reset: You can clear your profile, cached rewards, and local history by tapping "Clear Data" in your device's application manager or contacting support.
• Web Deletion Portal: Visit our dedicated Data Deletion Request Page to submit a deletion request online. We process all verified deletion requests within 7 business days.

11. Policy Updates & Contact

We may periodically revise this Privacy Policy to reflect modifications in our game mechanics, SDK updates, or statutory regulations. Any changes will be posted to this page with an updated "Effective Date".

For privacy-related inquiries, legal notices, or data requests, contact our dedicated privacy officer: