SPLIT Reflex Privacy Policy
1. Scope
This policy explains how SPLIT Reflex handles information when you play the game, use optional leaderboards, contact support, or visit its public pages. SPLIT Reflex does not require an account and does not contain advertising or in-app purchases in version 1.
2. Information we handle
Core play on your device
The game stores progress and preferences locally, including best scores, previously stored gameplay progress, tutorial/help state, sound and motion preferences, pending score submissions, cached leaderboard statistics, and aggregate on-device play counters. These counters are totals and coarse score buckets, not a network event history. Clearing app/site data or uninstalling removes the app’s active data from that device. A device or platform backup may retain or later restore a copy according to settings controlled by the device owner and platform provider. You can manage platform backups separately in the relevant device or platform settings.
Optional leaderboard
If you choose a generated public alias and submit an eligible score, we process:
- a random player identifier created on your device;
- the generated alias you claim;
- a secret sent to prove control of the identifier; only its hash is stored;
- game mode, seed, input/replay log, derived score and ruleset; and
- creation, update and submission timestamps.
The replay log records game inputs needed to validate the run. It does not record screen, microphone, contacts, photos, location, or free text.
Optional anonymous feedback
If you choose to send feedback inside the app, we process the category and message you submit, app version, platform, operating-system version, and the submission time. Do not include personal or sensitive information. The feedback record is not stored with your leaderboard identity, email address, advertising identifier, device identifier, precise device model, or location.
Technical and support data
Hosting and security providers may process IP address, user agent, request time, requested route and security events in access logs. If you contact us, we process your message, any contact details you choose to provide through a separate support channel, and the information needed to answer it.
3. Why and on what basis
We process optional leaderboard identity and score data because it is necessary to provide the leaderboard feature you request (GDPR Article 6(1)(b)). We validate replays and process limited technical logs for fair competition, security, availability and abuse prevention based on our legitimate interests (Article 6(1)(f)). We process support messages to answer your request (Article 6(1)(b)) and, where a specific legal duty applies, to meet that duty (Article 6(1)(c)). We process optional in-app feedback to maintain and improve app functionality based on our legitimate interests (Article 6(1)(f)). We have considered data minimisation, the optional nature of online features and the interests and rights of younger users when relying on legitimate interests.
You can play the core game without using the public leaderboard.
4. Recipients and international transfers
Cloudflare, Inc. provides DNS, content delivery, security, hosting and the D1 database used by SPLIT Reflex. The D1 primary currently runs in Cloudflare’s Eastern Europe region, without an EU-only jurisdiction restriction or global read replicas. Cloudflare may process data from other locations when providing its network, security and support services. Where legally required, international transfers are covered by Cloudflare’s Data Processing Addendum and the safeguards described there, including the applicable Standard Contractual Clauses. See Cloudflare’s Data Processing Addendum and subprocessor information.
ROMARG S.R.L. provides the split@noababy.ro support mailbox. We do not sell personal data or use it for cross-app advertising.
5. Retention
- Active on-device app data: until you clear app/site data or uninstall; separately controlled device/platform backups follow the settings and retention rules of Apple, Google, or the device owner.
- Leaderboard identity and accepted runs: until deletion is requested through the authenticated in-app action. Deletion removes the active D1 rows; D1 Time Travel may retain restorable database history for up to 30 days afterward.
- Cloudflare Workers Logs, if enabled for a deployment, are retained for no longer than seven days. Other necessary security and abuse records are kept only for the provider-configured period or as required by law.
- Anonymous in-app feedback: up to 12 months.
- Other support messages: up to 24 months.
6. Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing, and you may complain to your local data-protection authority. Contact split@noababy.ro. We will ask only for information reasonably needed to locate and protect the record. We normally respond within one month. Where the GDPR permits an extension, we will tell you within that first month and explain why. In Romania, the supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP): https://www.dataprotection.ro/.
For leaderboard deletion, use the proof process described at https://split.noababy.ro/delete. Do not email the device secret in plain text. Active local-only app data is controlled on your device and can be removed by clearing app data or uninstalling. Device or platform backups may need to be managed separately through the relevant platform settings.
7. Children
SPLIT Reflex is intended for players aged 13 and over and is not designed specifically for children. It does not knowingly request a real name, email, photo, or free-text public profile. Younger players should read this notice with a parent or guardian. Where local law requires a parent or guardian to approve use of an online feature, that feature should be used only with that approval. If you believe a child supplied personal data, contact us.
8. Security
The release uses encrypted transport, pseudonymous identifiers, hashed server-side secrets, replay validation and limited data fields. Production database access is restricted to the controller’s Cloudflare account, which currently has one accepted administrator membership. No system is completely secure.
9. Changes
We will update the effective date and provide appropriate notice when material practices change. Store privacy declarations will be kept consistent with this policy and the released app.
10. Contact
NOABABY S.R.L.
CUI 52771636
Jud. Argeș, Loc. Ștefănești, Oraș Ștefănești, Aleea Liniștii nr. 143D, România
split@noababy.ro