Privacy policy

In short: APP RUN works without a login. Your progress stays on your device. For the world leaderboard, the game creates an anonymous guest account and sends every finished run. Rewarded videos are optional, and whether ads run at all depends on your age answer. In-app purchases go through Google Play. Error reports and gameplay statistics can be switched off in the game. You can delete everything in the app.

This privacy policy explains how personal data is processed in the mobile game APP RUN (package name com.creacrate.apprun, version 0.20.0 for Android) and when you visit its pages on apps.creacrate.com. An iOS version is planned; we will update this policy before it is released. Last updated: 25 September 2026.

1. Controller and contact

The controller responsible for the processing of your data is:

CreaCrate Productions e.U.
Owner: Emad Elzahar
Lotte-Hass-Weg 2/11
1220 Vienna, Austria
Company register number FN 577739t, Commercial Court of Vienna

For all data protection questions and requests, email privacy@creacrate.com. Further company details are in the legal notice.

2. Overview

• On your device: your save file with progress and settings (section 3).
• Age question: decides whether ads and diagnostics run at all (section 4).
• Guest account, leaderboard, runs and vouchers: processed with Supabase (section 5).
• Rewarded videos: Google AdMob, only if you start one (section 6).
• In-app purchases: Google Play Billing and RevenueCat (section 7).
• Error reports and gameplay statistics: Sentry, switchable (section 8).
• Deletion: in the app or by email (section 9).
• Email contact and visits to this website (sections 10 and 11).

There is no login and no email account. The game does not ask for your location, contacts, camera, microphone or files. We do not sell personal data and do not build our own advertising profiles. Likes and followers in the game are game values only and have no connection to real social media accounts.

3. Data stored only on your device

APP RUN keeps a save file on your device. It contains your game progress (likes and followers as current balances and as lifetime totals, upgrades, looks, fans, and cached rights from purchases and vouchers), your language, sound and haptics settings, your answer to the age question, the diagnostics switch and your tutorial progress. The game also stores the refresh token of your guest account so that it can reconnect.

This data stays on your device. We cannot read your save file, and there is no cloud synchronisation of your progress: a new device starts a new save. Only the data described in sections 5 to 8 leaves the device. The game can be played offline.

Storing this information on your device is strictly necessary to provide the game to you (§ 165(3) Austrian Telecommunications Act 2021, TKG 2021), so no separate consent is required. It is removed when you delete your account and progress in the app (section 9), clear the app data or uninstall the game.

4. The age question

When you first start the game, it asks which age group you belong to. You can change the answer later under “Account & data”. Only the group is stored, only on your device, and never a date of birth. The groups are: under 13, 13–15, 16–17, 18 and over, and no answer.

What follows from your answer:

• Under 13 or no answer: the game requests no ads at all and does not start Google’s consent tool.
• 13 to 17: ad requests are flagged for users under the age of consent. Only non-personalised ads are requested, with a maximum ad content rating of PG.
• 18 and over: Google’s consent dialog runs before any ad. Whether advertising is personalised depends on that consent.
• Under 13: no error reports or gameplay statistics are sent either (section 8). If you give no answer, diagnostics are sent.

5. Guest account, leaderboard, runs and vouchers (Supabase)

Guest account

The game creates an anonymous guest account automatically: a randomly generated user ID, with a refresh token stored on your device. You do not register, and we never receive a name or an email address.

World leaderboard

The leaderboard shows an alias made of “Runner-” and the first twelve characters of your user ID, your selected look and your values: total likes, total followers, best distance, regular fan count, enemies defeated and bosses defeated. These entries are public to other players. The leaderboard is therefore not anonymous: the account is pseudonymous, and part of its identifier is visible to others.

Runs

Since version 0.20.0, every finished run is sent to our server: a run ID, distance, duration, likes, followers, enemies and bosses, and the server times at which the run started and was received. For each submission, the server keeps an audit log with the outcome (accepted, flagged or rejected) and the reasons for it.

Automated plausibility checks can flag an account as implausible so that a person can review it. A flag on its own hides nothing, changes no values and has no legal or similarly significant effect on you; it only prepares a manual review. This is not automated decision-making within the meaning of Art. 22 GDPR.

Vouchers

If you enter a voucher code in the Creator Store, we store a redemption record (your account, the code in hashed form, the time and what was granted) and a counter that limits how often codes can be tried.

Purpose and legal basis

We process this data to run the guest account, the leaderboard and the voucher function, to keep rankings fair and to prevent fraud and misuse. The legal basis is our legitimate interest in a working and fair game (Art. 6(1)(f) GDPR). You can object at any time (section 15); the simplest way is to delete your account (section 9).

Storing the refresh token on your device is strictly necessary for this function (§ 165(3) TKG 2021).

Service provider, data location and retention

We use Supabase as our processor. Our contracting partner is Supabase Pte. Ltd., Singapore; its data processing addendum becomes part of the contract together with Supabase’s terms. Our project runs in the region eu-west-1 (Ireland), where the database and the sign-in service are operated.

A project region in the EU does not mean that all processing stays within the European Economic Area (EEA). Supabase is based in Singapore and uses sub-processors, many of them in the USA, for example for hosting infrastructure, support, monitoring and error analysis. For these transfers, Supabase’s data processing addendum includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). According to that addendum, data is encrypted in transit and at rest.

Unused run tickets are deleted after two days. Runs, submissions, audit entries, leaderboard values and voucher records are kept until your account is deleted. Technical logs and backups at Supabase follow Supabase’s retention rules for our project and are not necessarily deleted at the same moment as your account.

6. Rewarded videos (Google AdMob)

APP RUN shows no banners, no interstitials and no forced ads. There are only two optional videos: continue a run once, and double the likes of a run. You decide each time whether to watch one.

Whether ads are requested at all, and whether they may be personalised, follows from your age answer (section 4). Where Google requires it, the Creator Store shows an “Ad privacy settings” button with which you can change or withdraw your choice. Storing and reading advertising identifiers and personalised advertising require your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). This also applies to non-personalised ads where identifiers are used, for example to limit how often an ad is shown and for ad reporting. You can also reset or delete your advertising ID in your Android settings.

When an ad is requested, Google collects the advertising ID, the IP address, device and app information, ad interactions and diagnostic data under its own terms. For AdMob, Google generally acts as an independent controller for its own purposes; the Google Ads Controller-Controller Data Protection Terms apply. For users in the EEA, this is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which may transfer data to Google LLC in the USA. We receive only aggregated reports and no data that identifies you. The authorised sellers for our ad inventory are published at apps.creacrate.com/app-ads.txt.

7. In-app purchases (Google Play Billing and RevenueCat)

APP RUN offers one-time purchases. There are no subscriptions and nothing is charged repeatedly: the like and follower multipliers ×2, ×4 and ×8, the Creator Starter (which includes a Superfan), Superfan packs of 1, 4, 8 and 20, and the designs “Neon Nights” and “Peach Sunset”.

The payment itself happens entirely at Google. We never see your card or bank details. Google provides us with the order details in the Play Console: order ID, product, price, currency and country.

We use RevenueCat, Inc., USA, as our processor to validate purchases and to restore them. RevenueCat receives an anonymous, randomly generated RevenueCat user ID that is not linked to your Supabase guest account, the purchase token and receipt, the product ID, the time of purchase, price, currency and store country, your device and operating system model and the app version.

The purpose is to deliver and restore your purchases, to prevent fraud and to handle refunds. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR), our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR) and our legal obligations for accounting records (Art. 6(1)(c) GDPR in conjunction with § 132 Austrian Federal Fiscal Code). According to its current data processing addendum, RevenueCat relies on the EU Standard Contractual Clauses for transfers to the USA.

Refunds go through Google Play. Deleting your game account does not delete the purchase records held by Google and RevenueCat, and your purchases can be restored on a new device.

8. Error reports and gameplay statistics (Sentry)

To find crashes and to understand where the game is too hard or unclear, the app sends error reports and gameplay statistics to Sentry. You can switch this off at any time in the game under “Account & data → Diagnostics: on / off”. It is on by default, and it is never active for the under-13 age group (section 4).

What is sent

• Error reports: the error message and the script stack trace, app version and environment, operating system name and version, device model, number of CPUs, engine version, the current screen, the language, and the state of the current run (distance, seconds, hearts, fans).
• App start: language, whether the tutorial is done, fan counts, multiplier, best distance and number of runs.
• End of a run: the cause (wall, hits or quit), distance, duration, likes, followers, hearts left, whether the run was continued, bubbles, enemies, bosses, fans, look, and whether it was a record.
• Tutorial and videos: which tutorial step was reached, when, and whether it was skipped; for each reward video its type and whether it was completed.
• Rejected runs: the reason only.

What is not sent

No account, store or advertising identifiers, no names and no text you type. The app generates no installation ID for this purpose, so the reports cannot be linked to you or to each other.

Technically, your IP address reaches Sentry with every request. Our Sentry project has the option “Prevent Storing of IP Addresses” switched on, so the IP address is not stored there.

Provider, legal basis and retention

The provider is Functional Software, Inc. d/b/a Sentry, USA. We use Sentry’s EU data region, so the data is received in the EU and stored in Frankfurt, Germany (ingest.de.sentry.io). Sentry is our processor; as a company based in the USA, it relies on the EU–U.S. Data Privacy Framework and on the EU Standard Contractual Clauses for transfers.

The legal basis is our legitimate interest in a stable game, in fixing errors and in improving the game (Art. 6(1)(f) GDPR). You can object at any time, and the switch in the game does this immediately. Sentry deletes the data after the retention period of our plan; under Sentry’s standard plans that is 30 or 90 days for error events and 30 days for logs.

9. Deleting your data

In the app, open Home → “Account & data” → “Delete account & progress” and confirm with “Permanently delete”. This deletes your guest account and, with it, your leaderboard entry, all runs, submissions, run tickets and voucher records, because the database removes them together with the account. Your local progress on the device is deleted as well. Details are on the page Account and data deletion, which also describes the email route via privacy@creacrate.com.

What deletion does not reach: data at Sentry cannot be linked to a person and expires with Sentry’s retention; RevenueCat and Google Play keep the records of your purchases, which therefore remain restorable; data that Google processes for ads follows Google’s own policies.

Your player ID helps us find your account in an email request, but it is not proof that the account is yours. We never ask for passwords or tokens.

10. Contacting us by email

If you email us, we process your email address, the content of your message and any details you give us, such as your player ID, device or app version. We use this data to answer your message. The legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR); if you exercise your data protection rights, we process the data to meet our legal obligations (Art. 6(1)(c) GDPR in conjunction with Art. 12 and 15 to 22 GDPR).

Your emails are processed by our email provider IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as our processor. We keep the correspondence as long as it is needed to handle your request and to show how it was handled, and delete it when it is no longer needed for these purposes, unless statutory retention obligations apply.

11. This website

These pages are published on apps.creacrate.com. The website uses no cookies, analytics or tracking. It is hosted by Vercel Inc., USA, as our processor. When you open a page, Vercel processes technical access data, which can include the IP address, time, requested page, referring page and browser information, to deliver the page and protect it against misuse. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR). For transfers outside the EEA, Vercel’s data processing addendum includes the EU Standard Contractual Clauses. Access data is kept according to the log retention of our hosting plan.

12. Recipients

• Supabase Pte. Ltd. and its sub-processors – guest account, leaderboard, runs and vouchers (processing on our behalf, section 5),
• Google Ireland Limited and other Google companies – rewarded videos (independent controller, section 6) and payment through Google Play Billing (section 7),
• RevenueCat, Inc. – validating and restoring purchases (processing on our behalf, section 7),
• Functional Software, Inc. d/b/a Sentry – error reports and gameplay statistics (processing on our behalf, section 8),
• Vercel Inc. – hosting of this website (processing on our behalf, section 11),
• IONOS SE – email contact (processing on our behalf, section 10),
• authorities and courts, where we are legally obliged to disclose data.

We do not use automated decision-making within the meaning of Art. 22 GDPR. If you consent to personalised advertising, Google may create profiles for advertising purposes under its own responsibility.

13. Transfers outside the EEA

Several providers are based outside the EEA or use sub-processors there: Supabase (Singapore, with sub-processors in the USA), RevenueCat (USA), Sentry (USA, with the EU data region for our data), Google (USA) and Vercel (USA). Supabase, RevenueCat and Vercel rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in their data processing addenda; Sentry relies on the EU–U.S. Data Privacy Framework and on the Standard Contractual Clauses; Google uses the transfer mechanisms set out in its terms. Our email provider IONOS SE is based in Germany.

14. Children and young people

APP RUN is rated 12 and is designed for players aged 13 and over; on Google Play its target audience is declared as the age groups 13–15, 16–17 and 18+. The game is not directed at children under 13.

Because we cannot verify an age answer, the game is built so that the protective setting also applies when someone answers “under 13” or gives no answer: no ads are requested at all in either case, and for “under 13” no diagnostics are sent either (sections 4 and 8).

Where processing is based on consent, a child in Austria can consent on their own from the age of 14 (§ 4(4) Austrian Data Protection Act, DSG); for younger children, consent from a parent or guardian is needed. If you believe that a child has given us personal data without the required consent, write to privacy@creacrate.com.

15. Your rights

Under the GDPR, you have the right to:

• access (Art. 15), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20) for data that we process by automated means on the basis of consent or a contract, such as your purchases,
• object (Art. 21) to processing based on our legitimate interests – this concerns the guest account, leaderboard and runs, the error reports and statistics, email contact and the access data of this website,
• withdraw consent at any time with effect for the future (Art. 7(3)), for example for personalised advertising.

To exercise your rights, write to privacy@creacrate.com. We reply without undue delay and within one month at the latest (Art. 12(3) GDPR). Because the guest account contains no name or email address, we may need your player ID and further details to find your account; the player ID alone is not proof. We never ask for passwords, tokens or copies of ID documents.

You have the right to lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at. You can also contact the supervisory authority of the EU country where you live.

16. Do you have to provide data?

You are not legally or contractually obliged to provide data to us. Watching a rewarded video is voluntary, the diagnostics switch is yours, and the game can be played offline. To take part in the world leaderboard, however, a guest account and the transmission of your runs are necessary; without them the leaderboard cannot work. For a purchase, the processing described in section 7 is necessary.

17. Changes

We update this policy when the game or its data processing changes, in particular before an iOS version is released. The date at the top shows the current version.