Privacy policy — RSC Labs

1. Who we are

This policy is issued by RSC Labs ("RSC Labs", "we", "us"), a company registered in Brazil under CNPJ 66.442.055/0001-60, with its registered address at Rua 14 de Julho, 460, Porto Alegre, Rio Grande do Sul, Brazil. RSC Labs is the data controller for the personal data described here.

It covers our mobile games — currently Legacy XI (com.rsclabs.legacyxi) — and this website, rsclabs.net. Privacy questions and requests go to rodrigo@rsclabs.net.

2. What we collect

Data you give us

Account identifiers. If you choose to sign in, the email address and account identifier supplied by your sign-in provider (Google Sign-In), or an anonymous identifier if you continue as a guest.
Display name and flag. An optional team or manager name and country flag you choose when entering public leaderboards or daily challenges. These are shown to other players, so treat them as public.
Correspondence. The content of emails you send to our support or privacy address, and any attachments.

Data generated by playing

Game profile. Progress, collected cards, in-game currency balances, streaks, tournament and match statistics, and the state of a run in progress.
Purchase entitlements. Which items or subscriptions your account is entitled to, and the platform order identifiers needed to verify them.
Diagnostics. Crash reports and error traces, including device model, operating system version, locale and an installation identifier.
Product analytics. Aggregated in-game events, such as runs started or completed, used to balance difficulty and find broken screens.

Website

This website is a set of static pages served from Firebase Hosting. It sets no advertising or tracking cookies. Standard server logs (IP address, user agent, requested page, timestamp) are generated by the hosting provider for security and operations, and are retained by them on a rolling short-term basis.

3. Google user data

If you sign in with Google, we receive only your Google account identifier and email address, and only for as long as your account exists.

We use that data solely to authenticate you and to attach your game progress to an account so it can be restored on another device.
We do not use Google user data for advertising, for audience building, for profiling, or for any purpose beyond running the game features you are using.
We do not sell, rent or transfer Google user data to third parties, other than to the processors listed in section 6, who act on our instructions.
We do not use Google user data to train machine-learning or generative models.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Deleting your account deletes the Google account identifier and email address we hold, as described in section 8. You can also revoke our access at any time from your Google account permissions page.

Separately, RSC Labs uses the Google Ads API to manage advertising campaigns belonging to RSC Labs. That use involves our own business data, not player data, and is described on our Advertising & API use page. We do not upload player identifiers to Google Ads.

4. Why we process it

To run the game: saving progress, restoring it on a new device, and resolving what a run produced.
To operate leaderboards and daily challenges, and to keep them fair by filtering implausible submissions.
To deliver and verify purchases and subscriptions.
To diagnose crashes and fix defects.
To serve advertising, in accordance with your consent choices.
To answer your support, privacy and deletion requests.
To comply with tax, accounting and other legal obligations.

5. Legal bases

Where the LGPD (Lei nº 13.709/2018) or the GDPR applies, we rely on: performance of a contract for account, progress and purchase data; consent for personalised advertising and for publishing a display name to a public leaderboard; legitimate interests for security, fraud prevention, diagnostics and aggregate analytics; and legal obligation for records we are required to keep.

6. Processors we use

These providers process data on our behalf, under their own security and data-processing terms:

Google Firebase — Firestore (game profiles), Authentication (sign-in), Crashlytics (crash reports), Analytics (aggregate product events), Cloud Functions and Hosting. Firebase privacy.
Google AdMob — in-game advertising delivery and measurement. How Google uses data from partner sites and apps.
Google Play — app distribution, licensing and billing.
RevenueCat — purchase and subscription entitlement verification. RevenueCat privacy policy.

We do not sell personal data, and we do not share it for cross-context behavioural advertising beyond the advertising described in section 7.

7. Advertising & identifiers

Legacy XI shows advertising through Google AdMob. Where advertising is personalised, it relies on your device's advertising identifier (the Google Advertising ID), which is controlled by your operating system and can be reset or deleted by you at any time.

On first run we ask for your advertising consent using Google's consent management, and you can change that choice later in the game's settings.
If you decline, or where consent cannot be obtained, non-personalised advertising is served instead.
You can also opt out at the device level: Android → Settings → Google → Ads.
An in-app purchase removes advertising from the game entirely.

Full detail on both our advertising roles is on the Advertising & API use page.

8. Retention & deletion

We keep your game profile for as long as your account exists. Crash and diagnostic data is retained on a rolling basis by the relevant service and then discarded. Records of purchases are retained where tax or accounting law requires it, in the minimum form needed to satisfy that obligation.

Deleting everything. In the game: Settings → Account → Delete account. This removes your profile, progress, collection, leaderboard entries and stored identifiers. It is immediate, it does not require contacting us, and it cannot be undone. You can also request erasure by writing to rodrigo@rsclabs.net — we complete verified requests within 30 days, normally within five business days. Step-by-step instructions are on the account deletion page.

9. Your rights

Wherever you live, we will honour the following: access to the data we hold about you; correction of inaccurate data; erasure; portability in a machine-readable form; withdrawal of consent; objection to processing based on legitimate interests; and information about with whom your data has been shared. We do not discriminate against anyone for exercising these rights.

To exercise any of them, write to rodrigo@rsclabs.net. We may ask you to confirm control of the account before acting. If you are in Brazil and are unsatisfied with our response, you may complain to the ANPD; in the EEA or the UK, to your national supervisory authority.

10. International transfers

We are based in Brazil and our processors operate globally, so your data may be processed outside your country — including in the United States and the European Union. Where transfers require a safeguard, we rely on the mechanisms offered by those providers, such as the European Commission's standard contractual clauses.

11. Children

Our games are general-audience titles and are not directed to children. We do not knowingly collect personal data from children under 13, or under the higher age that applies where they live. If you believe a child has provided us with personal data, write to us and we will delete it.

12. Security

Data in transit is encrypted with TLS. Game data is stored in Google Cloud with access rules that restrict each profile to its owner, and administrative access is limited to RSC Labs personnel who need it. No system is perfect: if a breach affects your personal data, we will notify you and the competent authority as the law requires.

13. Changes

When this policy changes we update the effective date above, and for material changes we will give notice in the game or on this website before the change takes effect. Superseded versions are available on request.

14. Contact

RSC Labs
Attention: privacy
Rua 14 de Julho, 460 — Porto Alegre, RS, Brazil
CNPJ 66.442.055/0001-60
Email: rodrigo@rsclabs.net