Privacy Policy

Last updated: November 5, 2026

This policy covers Tiny Rivals and this website, both made by Cedarstep Studios LLC ("we", "us"). In short: we collect as little as we can, we don't sell your data, and you can ask us to delete it at any time.

What we collect

Your game account

• A guest ID. The app makes a random ID the first time you open it. It isn't linked to your name, phone number or device hardware. The app keeps it in your phone's secure storage, so it stays if you delete and reinstall the app.
• Your profile: the player name, avatar and look you choose, and your player ID. Other players can see these: your friends, players in your rooms and tournaments, anyone who enters your player ID, and anyone who opens an invite link you share.
• Game data: scores, results, your record against each rival, ranks, Bolts and what you spend them on (including tournament entry fees), Wardrobe items, your friends list, invites and the players you block. Your friends can see when you're online.

If you sign in with Apple

Sign in with Apple is optional. It's only asked for when you enter competitions, or when you want your progress back on a new phone. We then receive a user ID from Apple and an email address: your real one, or a private relay address if you choose to hide it. We also keep a token from Apple, encrypted, so we can unlink your Apple ID when you delete your account. The app doesn't send us your name. We use these only to recover your account and to contact you about a competition.

Keeping matches fair

• Apple DeviceCheck and App Attest. These let us check the app is genuine and remember whether a phone has made an account before or has been banned. We keep the check's result with your account. Apple stores two yes/no flags for us, which stay with the phone even if you delete the app or your account. Neither identifies you.
• Network address. Our servers see your IP address when you connect. We use it only for rate limits that stop spam and abuse, hold it in memory for a day at most, and don't store it with your profile.
• Match data. For competitions, we keep a record of your inputs so our server can check the score is real.
• Reports. If you report a player, we keep who reported whom, the reason you picked, and the reported player's name and avatar at that moment.

Ads

There are no ads in the app yet. When they come, they'll always be optional: after a win you'll be able to watch a short ad for extra Bolts. Before ads appear, we'll name our ad partner here, with a link to its privacy policy. It may collect information about your device to show and measure ads. On iPhone it can use your advertising ID only if you allow tracking when the app asks. You can change this any time in Settings > Privacy & Security > Tracking.

Analytics and crash reports

None. The app has no analytics or crash-reporting tools. If we ever add one, we'll name it here first, with what it collects.

Prizes

We don't collect anything for prizes. If you win one, the tournament's official rules, in the app, say what we need from you to deliver it, and we'll update this policy before we ask for it.

If you email us

We get your email address and whatever you write, and keep it as long as we need to help you.

What we don't do

• We don't sell your personal data.
• We don't ask for your real name, phone number, contacts, photos or location.
• There's no chat. Your player name is the only thing you type into the app.
• There are no in-app purchases, so we never handle payment details.

Where your data is kept

Our game servers run on Hetzner in Germany. If you play from outside the EU, your game data is sent there. Live matches run on Hetzner servers in the United States, which get only what a match needs (each player's ID, name, avatar, look and moves) and keep it in memory for that match. Cloudflare runs our domain and forwards the emails you send us. Apple and our ad partner handle their data under their own policies.

How long we keep it

We keep your account and game data while your account exists. When you delete your account, we delete its data within 30 days. A few things stay: a record that the account was deleted, so it stays deleted if we restore a backup; tournament records showing it entered and paid its entry fee; notes of moderation actions; server logs; and the DeviceCheck flags above. We also keep what the law requires, such as records about a prize that was paid out.

Your choices and rights

• Delete your account: in the app, go to Profile, tap the settings gear, then Delete account. Or email us with your player ID, and we'll confirm the account is yours first.
• See or correct your data: email us and we'll send you a copy or fix it.
• Depending on where you live (for example the EU, UK or California), you may have further rights, such as objecting to how we use your data or complaining to your local data protection authority. Email us to use any of them.

Children

Tiny Rivals is made for a general audience and isn't directed at children under 13. We don't knowingly collect personal data from children under 13. If you think a child has given us data, email us and we'll delete it.

This website

This site uses no cookies, no trackers and no analytics. Our host, Cloudflare, processes basic request data such as IP addresses to deliver the site and protect it from attacks.

Changes

If we change this policy, we'll update the date at the top. For important changes, we'll also tell you in the app.

Contact

Cedarstep Studios LLC
privacy@cedarstepstudios.com