Privacy

What the game knows about you.

Rivalock includes no third-party analytics and sells nothing. The only adverts are the ones you choose to watch; in Europe, they are personalised only with your consent. What follows describes what the code actually does.

Who is responsible for your data

The data controller is Benjamin Chemla, sole trader, 77 rue Jean Mermoz, 95230 Soisy-sous-Montmorency, France (SIREN 109 137 547), who publishes Rivalock. One address for any question about your data: contact@rivalock.com.

The account

An account is needed to play, and it holds your progress: it is what gives it back to you when you change phone. Three ways to create one: a username and a password, Google, or Apple. The email address is optional, and you can add it later from your account: it is only used to recover the account if you forget your password — without it, a forgotten password cannot be reset. With Google and Apple we receive the technical identifier the provider passes us, never your password.

What is stored on our servers

• Your username, and your email address if you provide one. Google and Apple may pass none: the game works without.
• Your progress: rooms finished, stars, coins, daily streak, achievements, titles, avatars, purchases made.
• Your games: duel results and answer times, ranking, friend list and head-to-head with each of them, your daily challenge time, your Survival runs, the coins you give a friend or wager against them, and the feats published in the news feed.
• What you report — a puzzle, a player — and the players you block.
• A push notification token, only if you accept them. It serves seven things, and you can switch each one off in the game’s settings: a live challenge (or a ranked opponent found), a take-turns challenge waiting for you, its result, a friend request, an arena invitation, coins given by a friend, and the weekly ranking — the Sunday reminder and the Monday result. It is erased as soon as it stops being valid, or when you sign out.
• A password is never stored in clear: only a scrypt hash is kept.

Crashes and journey markers

The game sends two things to our servers, hosted on Microsoft Azure in Europe, and nothing else: application crashes, and anonymous journey markers — "a room was completed", "the account screen was shown". They are sent from the very first launch, before any account exists, and travel with a randomly generated installation identifier that carries neither your name nor your email address and disappears if you uninstall the game. It exists so we can tell that one crash hit a thousand people rather than the same person a thousand times. While you are signed in these reports also carry your session token, so they can be linked to your account. Our servers also pass your network address to Azure just long enough to infer an approximate country and city; the address itself is not kept. No third-party analytics tool is embedded, and none of this is sold or shared.

The rivalock.com website

The website sets no cookie and embeds no third-party analytics tool. It only counts, anonymously, what happens on it: the pages opened, the site a visitor came from, the download buttons tapped, the puzzles played and how they ended. These counts go to our servers, at Microsoft Azure in Europe, with a number drawn at random for each page opened and never kept: two visits cannot be linked. Neither your name, nor your answers, nor the puzzles are sent. The friends’ challenge page remembers your first name in your browser so it does not ask again; it only leaves in the links you choose to send.

What never leaves the device

Your room notes — the pad you scribble on during a puzzle —, your accessibility and language settings, and the detail of what you touched in a room. None of it is sent, and none of it is visible to another player.

What other players see

Your opponents and your friends see your username, your avatar, your title, your badges, your finished room count, your stars, your streak and your ranking. Your friends also see your time and result on the daily challenge, and the news feed shows them your feats — a chapter finished, a record, a season pass tier, joining the Season pass or the expansion. The rarest ones — a mythic avatar or title, a worldwide rank, a Survival record, a winning streak — may be shown to every player. The Survival ranking shows your best score and its time, and any player can replay that run. A take-turns challenge shows your opponent your times and your wrong answers once both runs are finished. Nobody sees your email address or the hints you used. The top ten of the weekly leaderboard are also shown on rivalock.com, with their username, their avatar and their results for the week.

Opponents run by the server

When no player is available for a ranked match, the service may offer you an opponent run by the server. It plays the same puzzles, under the same rules, and receives nothing more about you than an ordinary player would.

Offline

Once the account exists, the rooms and the daily challenge play with no network, indefinitely. The game then sends your progress when the connection returns; it sends nothing while you play.

Purchases

They go entirely through the Apple App Store and Google Play. We never see your payment method and keep no trace of it: only the fact that a product is unlocked is recorded. Receipt validation is handled by RevenueCat, which receives a purchase identifier and the receipt issued by the store for that purpose, never your payment method.

Adverts

Rewarded videos are served by Google AdMob, and they are the only adverts in the game: you start one when you choose to, to get a hint, coins or to open a bonus level. No advert ever appears between two rooms, or after a duel. To show them, Google receives your device’s advertising identifier, your IP address and technical details about the phone. In the European Economic Area, the United Kingdom and Switzerland, a message asks for your consent before the first personalised advert; you may refuse, and will then see non-personalised adverts. On iPhone, Apple additionally asks its own tracking question. You can change your mind at any time: in the game, gear icon → Menu & settings → Settings → Ad privacy choices (the line only appears where this choice applies), and on iPhone in the phone’s tracking settings. Google’s policy is described at policies.google.com.

Why we are allowed to do this

• The contract you accept when you create an account: the account, your progress, duels, friends, rankings, purchases.
• Our legitimate interest in running the game properly and fairly: crashes and journey markers, fighting cheating, handling reports. You can object to it by writing to us.
• Your consent, which you can withdraw at any time: notifications, personalised advertising and, on iPhone, tracking.

Who else processes it for us

• Microsoft Azure (Microsoft Ireland Operations Ltd) — our servers, the database, crash reports and password-reset emails, in Sweden.
• Expo (650 Industries, Inc., United States) — the service that routes notifications (it receives the token and the text of each notification) and delivers app updates.
• Apple and Google — signing in with their account, the stores, and delivering notifications to the phone (Apple Push Notification service, Firebase Cloud Messaging). Google also serves the adverts (AdMob).
• RevenueCat (RevenueCat, Inc., United States) — purchase validation.

Some of these services are based outside the European Union, in particular in the United States. These transfers are covered by the safeguards the GDPR provides for — the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

For how long

Account data is kept for as long as the account exists. No account is deleted for inactivity: it stays until you delete it. Crash reports and journey markers are erased after 90 days at most. Deleting your account erases your profile, your progress, your friendships, your challenges, your reports and your blocks; duels already played still count for your opponent, but nothing in them identifies you any more.

Your rights

You can ask for access to your data, its correction, its deletion, an exportable copy, a restriction of its processing, or object to what relies on our legitimate interest. One address for all of it: contact@rivalock.com. We answer within thirty days. You can also delete your account yourself, from the game. And if our answer does not satisfy you, you can lodge a complaint with the CNIL (cnil.fr), the French data protection authority, or with the authority of your own country.

Minors

The game is not aimed at children under thirteen and knowingly collects no data from them.

This text describes how the code works as of 6 October 2026. It is informational and is not legal advice.

Back to the site