The short version
Tally Rush is built around a guest-first account, local play, and a small set of online features. We do not sell personal data, run third-party advertising, or use personal data to measure your real intelligence.
01 Controller
Who controls your data
The controller responsible for Tally Rush is Cédric Jean René Maloux, an individual entrepreneur registered in the Czech Republic:
- Registered office
- Vinohradská 2030/44, Vinohrady, 120 00 Praha 2, Czech Republic
- Business ID
- IČO 88624200
- VAT ID
- DIČ CZ6806227296
- Register
- Registered in the Czech Trade Licensing Register
- Privacy contact
- support@tallyrush.me
In this policy, “Tally Rush,” “we,” “us,” and “our” refer to this controller. Tally Rush has not appointed a data protection officer because the current processing activities do not require one.
02 Data
What data we use
Device-local game data
The app stores settings and progress on your device, including sound and haptic preferences, unlocked levels and avatars, local scores and records, Daily Challenge state, missions, achievements, reminder preferences, and basic replay metrics. Ordinary offline Rush Mode play does not need to be sent to our servers.
Account and identity data
On first launch, Tally Rush may create a pseudonymous guest account using Supabase Auth. We process an authentication user ID, an internal player ID, an eight-character public player code, account status, and creation/update timestamps.
If you connect with Sign in with Apple, we receive a stable Apple-linked identifier and the authentication information needed to secure the account. Apple provides your email address, or a private relay email if you choose to hide it. We do not receive your name or Apple Account password.
Profile and public game data
We process your chosen display name, preset avatar, optional country code, public player code, scores, rank, accuracy, response-time statistics, and attempt count. The public elements are described in Leaderboards and validation. Your country is chosen by you; we do not infer or publish it from your IP address.
Gameplay and progression data
Depending on the mode, this includes level and difficulty configuration, answers, correctness, timestamps and response times, session identifiers, scores, accuracy, personal records, XP, mastery, streaks, achievements, missions, Daily submissions, Arena entries, rank snapshots, and validated leaderboard results.
For official Daily and Arena results, compact per-answer event logs are sent so the server can reproduce the puzzle stream, calculate the result, detect duplicates or impossible timing, and protect the leaderboard.
Tallies and App Store purchases
We process your Tally balance and ledger, the product identifier, Apple transaction identifier, purchase status, App Store environment, number of Tallies credited, and verification timestamps. The app sends Apple’s signed transaction information to our server for validation and fraud prevention. Apple processes the payment method and billing details; Tally Rush does not receive your complete card or bank details.
Notifications
If you opt in, the app stores notification permission state, reminder categories, preferred time, and app-open or completion timestamps needed to schedule respectful local reminders. Local notification schedules remain on your device.
If you enable remote Arena, reward, or purchase-status notifications after connecting an Apple account, we also process the Apple Push Notification service (APNs) device token, token hash, notification preferences, authorization state, locale, time zone, app version/build, delivery destination, delivery status, and bounded error details.
Technical, security, and support data
When the app contacts our backend, systems necessarily receive network and request data such as IP address, timestamps, authentication state, request identifiers, function/error status, and app or device context. We may use rate limits, server timestamps, idempotency keys, and device-level signals to prevent spam, cheating, duplicate value grants, and account abuse.
If you contact support, we process your message, contact details, player code, and any diagnostic information or attachments you choose to provide.
Website visits
The Tally Rush website is a static site and does not itself set analytics or advertising cookies. The hosting and network providers may process basic access and security logs, such as IP address, browser type, requested page, timestamp, and response status, to deliver and protect the site.
Data we do not seek: precise location, contacts, photos, camera or microphone recordings, health data, payment-card numbers, chat messages, or data for third-party advertising profiles.
03 Analytics
Analytics
Tally Rush uses Google Analytics for Firebase to understand how players use the game and to improve its features. Analytics may collect an app-instance identifier, device and app information, app launches and sessions, approximate location derived from a masked IP address, feature and game-mode usage, gameplay outcomes such as duration, score, and accuracy, sharing activity, store activity, and in-app purchase events.
Tally Rush does not send your Tally Rush account ID, Apple ID, email address, or raw puzzle answers to Google Analytics. Analytics is not used for cross-app tracking, targeted advertising, or advertising measurement. Google’s processing is subject to its applicable privacy policies.
04 Why
Purposes and legal bases
| Purpose | Typical data | GDPR legal basis |
|---|---|---|
| Provide the game and accountRun modes, save progress, sync an account, show records, and handle deletion. | Account IDs, profile, local/synced progress, gameplay results, settings. | Performance of our contract with you (Article 6(1)(b)). |
| Official competitionValidate Daily and Arena results, calculate ranks, and publish leaderboard entries. | Event logs, scores, timing, public profile fields, rank and attempt data. | Contract (Article 6(1)(b)) and our legitimate interest in a fair, reliable game (Article 6(1)(f)). |
| Purchases and TalliesVerify App Store transactions, deliver Tallies, prevent duplicate credits, and answer purchase issues. | Player ID, product and transaction IDs, signed transaction, wallet and ledger. | Contract (Article 6(1)(b)); legal obligations where applicable (Article 6(1)(c)); fraud prevention (Article 6(1)(f)). |
| Notifications you chooseSchedule local reminders and deliver enabled transactional or competitive push messages. | Permission and preference state, reminder time, APNs token, locale/time zone, delivery status. | Your consent (Article 6(1)(a)); transactional notices may also support our contract (Article 6(1)(b)). |
| Analytics and app improvementUnderstand feature and game-mode usage, sessions, gameplay outcomes, sharing activity, store activity, and purchase events. | App-instance identifier, device and app information, approximate masked-IP location, event and outcome data. | Our legitimate interests in improving the app (Article 6(1)(f)); consent where required by applicable law. |
| Security and reliabilityAuthenticate requests, rate-limit abuse, diagnose faults, reconcile interrupted delivery, and protect accounts. | IP/request logs, IDs, timestamps, error status, anti-cheat signals, app version. | Our legitimate interests in securing and operating the service (Article 6(1)(f)). |
| Support and legal complianceReply to requests, resolve complaints, preserve required business records, and establish or defend legal claims. | Correspondence, account/purchase references, and records relevant to the request. | Contract, legal obligations, and legitimate interests (Articles 6(1)(b), 6(1)(c), and 6(1)(f)). |
Where we rely on legitimate interests, those interests are operating a secure and fair game, preventing fraud and cheating, keeping the service reliable, and protecting users and the publisher. We consider the limited data involved and your reasonable expectations, and you may object as explained below.
05 Competition
Leaderboards and automated validation
If you submit an official result, leaderboard users may see your display name, public player code, preset avatar, optional country, board/date, score, rank, accuracy or timing statistics, and attempt count. Do not use your legal name as a display name if you do not want it publicly associated with your result.
Official submissions are automatically replay-validated. The system reconstructs the puzzle sequence, recalculates scores, checks timestamps, detects duplicates, and may flag implausibly fast or malformed events. This can cause a result to be rejected or an account to be excluded from a leaderboard.
These game-integrity decisions affect in-app participation and ranking, but they are not intended to produce legal or similarly significant effects. If you believe a validation or exclusion is wrong, contact us for human review at support@tallyrush.me.
Tally Rush does not use scores, speed, rank, or Tallies to diagnose intelligence, health, education level, employability, creditworthiness, or any other real-world personal characteristic.
06 Recipients
Who receives your data
We disclose personal data only as needed to operate the service:
- Supabase provides authentication, database hosting, server functions, and related infrastructure as our processor. The primary Tally Rush database is configured in the West EU (Ireland) region.
- Apple provides the App Store, StoreKit purchases, Sign in with Apple, and APNs. Apple also processes its own platform and transaction data under its terms and privacy policy.
- Google Analytics for Firebase provides app analytics so we can understand feature use and improve Tally Rush. Analytics is not used for cross-app tracking, targeted advertising, or advertising measurement.
- Website, security, and network providers deliver tallyrush.me, route traffic, and protect the service from abuse.
- Other players receive the public leaderboard information listed above when you participate in official rankings.
- Authorities, advisers, or claim participants may receive relevant data where required by law or reasonably necessary to protect rights, users, the service, or legal claims.
Service providers may process data only for the contracted service and under appropriate confidentiality and data-protection obligations. We do not sell or rent personal data, and we do not share it with advertising networks or data brokers.
For more information about these providers, see Supabase Privacy, Apple’s Privacy Policy, and Google’s Privacy Policy.
07 Transfers
International data transfers
The primary Supabase project is hosted in the EEA in Ireland. Apple, Google, Supabase, and their approved subprocessors may nevertheless process limited data from countries outside the European Economic Area for support, security, authentication, analytics, delivery, or other infrastructure functions.
Where personal data is transferred outside the EEA, we rely on a lawful transfer mechanism as applicable, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, and supplementary contractual or technical safeguards. You may request information about the relevant safeguards by contacting us.
08 Retention
How long data is kept
| Data | Retention approach |
|---|---|
| Detailed official event logsPer-answer Daily and Arena validation events. | Automatically purged 14 days after submission. Summary results and ranks remain while the account is active. |
| Account, profile, progress, and resultsIdentity mapping, profile, XP, mastery, records, Daily/Arena summaries, leaderboard rows. | Kept while the account is active, then removed from the active player database when account deletion completes, subject to backups and legal exceptions. |
| Wallet and purchase delivery recordsTally ledger, Apple product/transaction ID, verification state. | Kept while needed for correct delivery, reconciliation, fraud prevention, support, and the active account. Separate financial or legal records may be retained for the statutory period required by law. |
| Push notification dataAPNs token, preferences, delivery queue and bounded error status. | Kept while remote notifications are enabled and the account is active, or until the token becomes invalid. Account deletion cascades to registered push devices and deliveries. |
| Analytics eventsApp-instance identifier, app sessions, feature and game-mode usage, gameplay outcomes, sharing activity, store activity, and in-app purchase events. | Kept according to the configured Google Analytics for Firebase retention settings and Google’s applicable policies. |
| Security, function, and website logsIP/request metadata, error and abuse-prevention records. | Kept for the shortest operational period reasonably needed, and longer only for an active security incident, abuse investigation, or legal claim. |
| Support correspondenceMessages and relevant account references. | Kept until the issue is resolved and for a reasonable period afterward where needed for complaints, legal claims, or compliance. |
| Device-local dataOffline progress, settings, reminder schedule, local records. | Remains on your device until you reset it in the app, delete your account where applicable, or remove the app/device data. |
Deletion from backups and distributed caches may take additional time. During that period, backup copies are isolated from ordinary use and retained only for recovery, security, or legal requirements before being overwritten under the provider’s cycle.
09 Control
Your rights and choices
Subject to the conditions in data-protection law, you may ask us to:
- confirm whether we process your personal data and provide access to it;
- correct inaccurate or incomplete data;
- erase your data or restrict its processing;
- provide eligible data in a structured, commonly used, machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier lawful processing; and
- ask for human review of an automated leaderboard or game-integrity decision.
How to exercise these rights
You can edit your display name, avatar, optional country, and notification choices in the app. Disable notifications in Tally Rush Settings or iOS Settings.
To permanently delete your account, use Settings → Delete account and data. This removes the authentication account and player-owned active-database rows, including profile, progress, Tallies, scores, leaderboard entries, and registered push devices. Deletion cannot be undone.
For access, portability, objections, or other privacy requests, email support@tallyrush.me. Include your public player code if available, but do not send passwords, Apple tokens, or payment-card details. We may ask for limited information to verify that the request concerns your account.
Required and optional information
A pseudonymous account identifier and gameplay/result data are necessary for online Daily, Arena, wallet, purchase, and leaderboard functions. If you do not provide them, you may still use local features where available, but those online functions will not work. A custom display name, country, Apple connection, and notifications are optional, although Sign in with Apple is required for purchases, permanent account recovery, and certain paid online functions.
Right to complain
You may lodge a complaint with the supervisory authority where you live or work, or where an alleged infringement occurred. Our lead authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, email posta@uoou.gov.cz.
10 Families
Children and families
Tally Rush is a general-audience mental-math game and does not knowingly seek sensitive information from children. If a user is not old enough under the law of their country to agree to these data practices or the Terms independently, a parent or legal guardian must review and authorize their use of the app.
Sign in with Apple has age and child-account rules that vary by country or region. A child should not create a connected account or make an App Store purchase without the authorization required by Apple and applicable law.
If you are a parent or guardian and believe a child’s data was processed without the required authorization, contact us so we can investigate and delete it where required.
11 Protection
How we protect data
Tally Rush uses measures designed for the nature and risk of the data, including encrypted network connections, authenticated requests, row-level database security, restricted server functions, least-privilege client keys, server-side purchase and score validation, idempotency controls, private storage for APNs tokens, and limited retention of detailed gameplay logs.
No internet or storage system can be guaranteed completely secure. Keep your device and Apple Account protected, install app and operating-system updates, and contact us promptly if you suspect unauthorized access.
12 Updates
Changes to this policy
We may update this policy when the app, providers, or legal requirements change. The current version will remain available at this URL and will show a revised “Last updated” date. If a change materially affects your rights or how we use personal data, we will provide an appropriate in-app or other prominent notice before the change takes effect where required.
Questions about your data?
Tell us what you need and include your public player code if it will help identify the account. Please do not email passwords, Apple identity tokens, or payment details.
Email privacy support