Privacy policy

Current text of the privacy policy.

Last updated: 2026-11-05

1. Who we are

The Rookie (the "game") is a mobile game for Android and iOS. The controller of your personal data is Lluis Alcala (Eliustar), based in Spain ("we", "us"). You can contact us about privacy at privacy@playtherookie.com.

2. The short version

• There is no sign-up. The game does not ask for your name, email address, phone number or password. It creates an anonymous account linked to your device.
• On first launch the game asks for your year of birth. If you are, or may be, under 16 you play in protected mode: no ads, no usage statistics, no error reports and none of the player-to-player features listed in section 10. The year itself is neither stored nor sent.
• Our server runs the game (fights, gold, gems, purchases, rankings), so your progress is stored on our server.
• Optional rewarded ads are for adults only and start only after the age question and the consent step. Where the law requires your consent, ads are not personalised, or not shown at all, until you give it.
• Usage statistics are collected only if you say yes. Error reports are on by default for adults. You can turn both off at any time in Settings > Privacy and data, where you can also download a copy of your data and switch on "Do not sell or share my data".
• You can delete your account in the game: Settings > Account > Delete account. Accounts that stay inactive for 24 months are deleted automatically (section 7).
• The game is not directed at children under 13 (section 10).

3. What data we process

3.1 Account, device, age and region

When you first open the game online, the app asks our server to create an account. The server generates a player ID and a device ID, and the app keeps a secret key on your phone to sign in. We store only a one-way hash of that secret and of recovery codes, never the values themselves. We also store the platform (Android or iOS) and when the device was registered and last used.

If you create a recovery code to move your account to another phone, it is valid for 24 hours, can be used once, and we store only its hash.

The account also holds:

• your age class, "adult" or "protected", worked out on your phone from the year of birth you type. The year is not stored or sent (section 10);
• your region (EEA, UK, US or other), taken from your phone's region setting and used only to apply the right privacy rules;
• your privacy choices: usage statistics yes or no, error reports yes or no, and "Do not sell or share" yes or no;
• when you were last active, to delete accounts that stay inactive (section 7). Any time the game contacts our server while you are signed in counts, and we record it at most once an hour.

3.2 Game data

Your fighters (including the names you type for them), race, level, stats and equipment; gold, gems, cosmetics and roster slots; season, VIP, achievement and statistics data; hall of fame entries; game settings stored on the server (for example whether you appear as a rival and whether you accept challenges); and your phone's time-zone offset from UTC in minutes, which the server uses to decide when your game day resets. This is not your location.

3.3 What other players can see

• A display name that the game sets automatically from the name of your first fighter.
• Your best fighter (name, race, level, power), your number of victories and fights, and your clan name, tag and emblem, in clan lists, pupil lists and rankings.
• The master code and challenge code that you choose to share.

Fighter and clan names are text you type: do not put personal information in them. The "Appear as a rival" option in Settings controls whether your fighter can be offered to other players as a rival.

Players in protected mode have no public name: rankings and podiums show none, they are never offered as rivals, and they cannot use clans, master codes, pupils, challenges or shared replays (section 10).

3.4 Replays and challenges

The server saves some of your notable fights as replays (a random seed and snapshots of the two fighters, not video). If you share a replay, anyone with the share code can watch it. You can send and receive friend challenges by code; a challenge record holds snapshots of both fighters, and the names are replaced by generic ones when shown to the other player. If you block a challenger we store a derived hash of that opponent, not their account ID. Sharing replays and friend challenges are not available in protected mode.

3.5 Purchases

Payments are handled by Google Play or the Apple App Store. We never receive your card number or your store account details. The app sends the purchase receipt to our server, which verifies it and records the store, the transaction ID, the product ID and the purchase and expiry dates. We also receive refund information from the stores (for example Google Play voided purchases or App Store server notifications), reverse the corresponding items and keep a count of refunds per account to detect abuse.

3.6 Technical data

Each time the app talks to our server, the server records the time, the request type, the result, its duration, your player ID, your IP address, the app version, the platform, the content catalogue version and a technical trace ID. We use this to keep the service secure, apply rate limits, prevent fraud and abuse, and find faults. In traces, IPv6 addresses are shortened to their network part. How long these records are kept is in section 7.

3.7 Error reports

For adults the app sends reports of errors and failed server calls: app version, platform, operating system, device model, the error message and stack trace, how many times it happened, the device clock time and a random session ID, linked to your player ID. Tokens, secrets and recovery codes are removed on the server. They are on by default. Turn them off in Settings > Privacy and data ("Error reports"): the app then stops creating them and the server drops any it still receives. Reports already received are kept until they expire (section 7). Nothing is created before the age question and the consent step are done, and in protected mode reports are never created.

3.8 Usage statistics (only with your consent)

Once the age question and the consent step are done, the game asks "Help improve The Rookie". If you tap Allow, the app records what you do: session start and end and length, screens viewed, tutorial tips, recruiting, fights (result, level, whether skipped), level-ups, shop and real-money purchases (product, price and currency), season claims, offers shown, ads watched (placement, ad network and estimated revenue), the result of the notification permission request, recharges, and the technical result of the check of the device's saved credentials (for example "ok" or "failed"). Each event carries a random event ID, the time, a session ID, the platform, the app version and your player ID. Events contain only short identifiers, numbers and yes/no values, never free text, your name, contacts or location. If you tap "No, thanks" nothing is recorded. In protected mode nothing is recorded and the question is not asked.

You can change your mind in Settings > Privacy and data ("Usage data"). Turning it off empties the queue on your phone and asks our server to delete everything it received; if you are offline, the app keeps retrying until the server confirms. If your account turns out to be in protected mode, the server also deletes the usage statistics it holds.

3.9 Ads and consent

The game can show optional rewarded video ads (for example to recharge a resting fighter) through Unity LevelPlay, which mediates between several ad networks (Unity Ads and Google AdMob). Ads are for adults only. The ad software does not start with the game: it starts only after the age question and the consent step. For the consent step the game uses Google's User Messaging Platform, which asks you about ads where the law requires it. If that platform does not allow ads (for example because its message cannot be shown, or you do not give the consent it needs), the game shows no ads; if it takes longer than about 20 seconds the game goes on without ads and they can start later if you answer. If you do not agree to personalised ads, the game tells the ad software not to personalise them. Rewarded ads are shown only on devices where this consent step is available.

Once started, the ad software and the ad networks act independently of us: they may process your IP address, device identifiers such as the advertising ID, and data about the ads shown, to serve, measure and prevent fraud in ads. We do not give the ad provider your player ID. We learn only which ad was shown, from which network and its estimated revenue, and we record that only if you allowed usage statistics. When you watch a rewarded ad, the game gives the ad software a random, one-use reward code as the user identifier of that ad view; our server creates it, it is valid for 30 minutes, and it is not your player ID, account ID, device ID or advertising ID. LevelPlay calls our server with the same code when the reward is earned, only to confirm it; after use we keep the code on our server for up to 7 days, and it is deleted with your account.

Your controls: Settings > Privacy and data > "Privacy options" (shown where Google requires it) reopens the consent message; "Do not sell or share my data" tells the ad software not to use your data for personalised ads; you can also reset or delete your advertising ID, or limit ad personalisation, in your phone's settings. See the privacy policies of Unity (https://unity.com/legal/privacy-policy), Google (https://policies.google.com/privacy) and of the networks the game uses.

3.10 Reminders

Reminders ("your fighters have rested", "come back") are local notifications scheduled on your phone from your fighters' state. One of them warns you, 23 months after you last left the game, that an account that stays inactive is deleted (section 7). They are not push notifications: no notification token is created or sent to us. The permission is requested the first time it is useful, and you can turn reminders off in Settings or in your phone's notification settings.

3.11 Data on your device

The app keeps on your phone a cached copy of your game state, your device credentials (on Android encrypted with a key held by the Android Keystore; on iOS, and if saving that way fails, in the app's private storage), your preferences (sound, language, reminders, your usage-statistics choice, tutorial tips seen), your age class and region, a marker that your answer was "protected" (kept apart from the other preferences, so that a new account on this phone does not undo it), your privacy switches, queues of usage events and error reports not yet sent, and the last 3 files you saved with "Download my data". The app is excluded from Android's automatic backups.

3.12 What we do not collect

The game does not ask for your name, email, phone number, contacts, photos, files, camera, microphone or precise location. We do not store your year of birth. Ad networks may infer an approximate location from your IP address.

4. Why we use data and on what legal basis

We do not use your data for automated decisions with legal or similarly significant effects. The server does apply automatic game rules (for example reward limits), and ranking prizes can be withheld or revoked after review if abuse is detected.

5. Who receives data

• Hosting. Hostinger hosts our server and database in France (Paris).
• Cloudflare. It routes the traffic between the game and our server, so it sees requests in transit.
• Google and Apple. They process your payments and tell us about refunds.
• Unity LevelPlay, Google's consent platform and ad networks. See section 3.9. Only adults who passed the consent step reach them.
• Other players. The public information in section 3.3.
• Authorities. When the law requires it.

We do not sell the personal data we hold on our servers and we do not use it to build advertising profiles. Usage statistics and error reports are stored on our own infrastructure; apart from the ad software, the consent platform and the Unity game engine and purchasing components, which have their own policies, the game does not add third-party analytics or crash-reporting services.

6. International transfers

The game is available worldwide, and our server runs in France (Paris). If you are in another country, your data is transferred to and processed there. Google, Apple, Unity and the ad networks may process data in other countries under their own policies. Where the law requires a safeguard for a transfer out of the EEA or the UK, we rely on an adequacy decision or the standard contractual clauses.

7. How long we keep data

When you delete your account, or we delete it for inactivity, we ask our log store to delete the log lines that carry your player ID. The request takes effect after about a day and is retried if the log store does not answer. It does not reach security logs, which hold only a one-way hash of your ID, nor traces; those expire as above. You can ask us to remove them earlier (section 9).

8. Deleting your account

In the game go to Settings > Account > Delete account and confirm twice. The deletion runs on our server in one step and cannot be undone. Uninstalling the app does not delete your account. Players in protected mode can delete their account in the same way.

Erased: your devices and recovery codes, game state and saves, fighters, gold, gems, cosmetics, season progress, social profile, master and pupil links, clan membership (the leadership passes to the oldest member and an empty clan is deleted), replays and share codes, challenges, usage statistics, podiums and ranking entries, your privacy choices and your data-export records. The app also wipes its local copy and starts again as a new player.

Kept: store purchase and refund records, without your player ID and with the date of deletion, because accounting law requires it and so the same receipt cannot be redeemed again. Your place in a tournament that is already running is replaced by a bot built from a copy of your fighter so that the group keeps its size; that copy is deleted when the tournament data expires. Logs expire as described in section 7.

If your phone is offline or the server does not answer, nothing is deleted and you can try again.

9. Your rights

Subject to the law that applies to you, you have the right to access your data, correct it, have it erased, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting earlier processing. You also have the right to complain to your data protection authority.

• Access and portability: Settings > Privacy and data > "Download my data". The game saves a JSON file and opens your phone's share sheet. It holds your account, devices (without secrets), game state, purchases (store transaction IDs shortened), social profile, clan, challenges and replays without the other player's name or ID, tournament entries, up to your latest 2000 usage events and your privacy settings. Your master and pupils appear only as one-way hashes. The file can be up to 5 MB, and you can download one per hour and three per day.
• Erasure: Settings > Account > Delete account.
• Withdraw consent and object: turn off "Usage data" or "Error reports", or open "Privacy options" to change your answer about ads, all in Settings > Privacy and data.
• Do not sell or share: Settings > Privacy and data > "Do not sell or share my data", offered to every player.
• Correction, restriction, early removal of logs, and anything else: write to privacy@playtherookie.com. Because we hold no name or email for you, tell us a code that identifies your account in the game (such as your master code) so we can find it. We answer within one month.

California and other US states. Where a state privacy law applies you can ask to know, delete or correct your data, to opt out of its sale or sharing, and not to be treated worse for doing so. Use the controls above or write to us. We do not sell the personal data we hold on our servers. Sending device data to an ad provider so that it can show you personalised ads can count as a "sale" or "sharing" under some of these laws; that is what the switch controls, and players under 16 never reach the ad software.

If other privacy laws apply to you (for example in the UK or Brazil) you can use the same channels.

10. Children and protected mode

The game is not directed at children under 13, or under the age of digital consent in your country if that is higher (up to 16 in some EU countries).

The age question. On first launch, before anything else, the game asks for your year of birth on a neutral screen with no suggested answer. Your phone works out your age class and forgets the year; the year is not stored, logged or sent. We do not verify the answer. Because only the year is asked, a player who might still be under 16 is treated as under 16, in every country. Until you answer, the game treats you as under 16.

Protected mode (under 16). There are no ads and no consent step, no usage statistics, no error reports, and none of the player-to-player features that follow: rankings with names, clans, master codes and pupils, friend challenges, shared replays, being offered as a rival, and the Hall of Champions. The main game, purchases, account recovery, "Download my data" and account deletion work as usual. The server enforces this too, not only the app.

It cannot be undone from the app. A protected answer cannot be changed in the game. The phone remembers it even if you delete your account or start a new one, and an account the server holds as protected stays protected when you recover it on another phone. Reinstalling the game asks the question again, so we cannot prevent a child from entering a different year.

We do not collect names, email addresses or other direct contact details. If you are a parent or guardian and believe a child has given us data, write to privacy@playtherookie.com and we will delete the account.

11. Security

Release builds talk to our server only over HTTPS. Device secrets and recovery codes are random and stored only as hashes on our server, access tokens are short-lived, bodies are size-limited and requests are rate limited. Logs have secrets and tokens removed. On Android the app encrypts the device secret with a key held by the Android Keystore where it can. The file you save with "Download my data" is shared only through your phone's share sheet, when you choose to. Our own infrastructure holds your data under access control. No system is perfectly secure, so we cannot guarantee absolute security.

12. Changes to this policy

We will publish any new version at this address and change the "Last updated" date at the top.

13. Contact

Lluis Alcala (Eliustar), Spain · privacy@playtherookie.com