Privacy policy

01Controller and scope

Rutimon is a project managed by Skeilapps SL. The contact for privacy, support and exercising your rights is info@skeilapps.com.

This policy covers rutimon.com, its administration dashboard and the Rutimon game on the web and in mobile applications. The information website, game and dashboard have different functions: visiting the home page does not create a player account.

02Information we process

• Website visits: IP address, request date, browser and technical logs required by the hosting provider to deliver content and protect the service.
• Account: player identifier, session and protected credentials. You can start as a guest; if you save or recover your account, we process your email address and authorised profile data through email, Google or Apple. We do not receive your Google or Apple password.
• Game: trainer name, habits and categories you write, task completion, time zone, creatures, levels, streaks, shield, health, rewards, inventory, rankings, battles and teams.
• Purchases: internal user identifier, product, platform, transaction identifiers and payment or subscription status. Apple or Google process the payment; Rutimon does not store your full card details.
• Game measurement: internal identifier, platform, version, sessions, screens viewed, onboarding steps and interaction with Premium offers. This helps identify where a journey stops and check conversions and retention. This measurement does not include your habit text, personalisation answers, names, email address or card details.
• Optional website measurement: if you accept analytics, we record a random browser identifier, pages and store button clicks, with source and campaign when available. We do not automatically link those visits to an installation or player account.
• Notifications, if you authorise them: device and subscription identifiers, account association, preferences and interaction with notices.
• Rewarded ads, when available and you choose to watch them: IP address, technical data and interaction used by Unity LevelPlay (ironSource Ads). The current version requests non-personalised ads and limits the use of advertising identifiers. Rutimon uses an internal identifier and temporary reference to verify the reward.
• Support and moderation: the content of messages or reports you send, information needed to resolve them and logs of administrative actions.

03Purposes and legal bases

Permission in the website cookie notice does not authorise ads in the app or replace device permissions. Each optional purpose is managed in its own context.

• Providing the game you request: creating your account, storing and synchronising your game, resolving tasks and battles, managing teams, purchases and restorations. Basis: performance of a contract or preliminary steps you request.
• Responding to support enquiries and handling requests relating to the service. Basis: provision of the service or a legitimate interest in answering enquiries.
• Protecting accounts, preventing cheating, fixing errors and maintaining security logs. Basis: a legitimate interest in protecting the service and its users, with access limited to what is necessary.
• Sending optional notifications and using advertising identifiers when necessary. Basis: consent where required. Notification permission can be withdrawn on your device; ads have their own privacy options.
• Meeting tax, accounting and valid requests from authorities. Basis: compliance with legal obligations.

04Your game, other players and administration

Your trainer name, creatures and necessary game results or data may be visible in rankings, battles and teams. Do not publish personal information in your trainer name. We do not show your email address to other players.

Authorised staff may access account, task, progress, economy, report and notification information through the dashboard to provide support, maintain the game and prevent abuse. This access does not make your habits public and is subject to authorisation controls.

Rutimon organises habits; it does not request diagnoses, medical records or other particularly sensitive data. Avoid including them in tasks or messages. It also does not require contacts, precise location, camera or microphone for the features described.

05Providers and recipients

We do not sell your personal data. Providers receive the data needed for their role. Data may also be disclosed when required by a legal obligation or valid request. Opening external links takes you to services with their own policies.

• Vercel: hosting the website and web version of the game, delivering pages and technical operation and security logs.
• Supabase: authentication, database and game and dashboard functions.
• Cloudflare: delivery of game images or videos and media infrastructure.
• Google Analytics: consent-based measurement of public pages, browser technical data and visits with pseudonymous identifiers. We do not send tasks, accounts, tokens or URL parameters. Google may process data outside the EEA; see its policy and the transfer safeguards described here.
• Google and Apple: external sign-in when you choose it; their stores also process purchases you make through them.
• RevenueCat: purchase validation, subscription status and restorations.
• OneSignal: delivery and management of notifications in versions where they are enabled and you have given permission.
• Unity LevelPlay (ironSource Ads): rewarded ads and verification of their rewards in new versions. Google AdMob may appear in earlier versions.

06International transfers

Some providers operate internationally and may process information outside the European Economic Area. When this happens, processing must have a valid transfer basis, such as an applicable adequacy decision or standard contractual clauses and any appropriate additional measures.

You can request information about the recipients and safeguards applicable to your data by writing to the privacy contact. We do not assume that all data is hosted exclusively in Spain or the European Union.

07Retention

Your account and game are retained while you use the service and until you request deletion. There is no automatic deletion after a fixed number of inactive days. Enquiries are retained for as long as needed to resolve them and address potential liabilities.

Technical and security logs are retained for the time needed to investigate incidents and prevent abuse, according to the provider's function and configuration. Purchase records and information subject to legal obligations may be kept for the required periods, with use limited to that purpose.

The rutimon.com cookie preference is remembered in this browser without automatic expiry until you change it or clear storage. Google Analytics cookies are configured to last up to six months. Backups may temporarily retain deleted data until their routine replacement, without using it again to provide your game.

08Deleting your account and recovering your game

You can request deletion in the app settings when this option is available for your account, or by email with the subject 'Delete Rutimon data'. Include the associated email address or your trainer name and identifier if you play as a guest. Never send passwords or access codes.

We may request minimal information to verify that the account belongs to you. When the request is fulfilled, the profile, habits, progress, creatures and related information are deleted or unlinked, except data that must be retained to meet legal obligations or address liabilities.

If you play as a guest without linking a recoverable sign-in method, losing your session or uninstalling may prevent game recovery. Deleting your account or the app does not cancel a subscription: you must also manage it through Apple or Google.

09Your rights and complaints

You can request access, rectification, erasure, objection, restriction and portability where applicable. You can also withdraw consent without affecting the lawfulness of earlier processing. To do so, write to the privacy contact; verification must be proportionate and does not require you to send us your password.

We will respond within the usual legal period of one month. If complexity requires a permitted extension, we will inform you within that first month. You can complain to the Spanish Data Protection Agency or the competent supervisory authority.

Game decisions, such as rewards, damage, levels or matchmaking, are calculated automatically according to the game's rules. They are not used to make decisions with legal or comparably significant effects outside the game. If you notice an error or incorrect penalty, you can request a support review.

10Children

Rutimon is not specifically directed at children under thirteen. A store's age rating does not replace rules on data consent or capacity to enter into a contract.

In Spain, where processing relies on consent from a child under fourteen, consent from a parent or guardian is required. Other countries' applicable ages and authorisations apply. Children need the authorisation required by law to use the service and make purchases. If you identify an account created without the necessary authorisation, contact us for review.

11Security and changes

We apply encrypted connections, authentication and access controls. No system can guarantee absolute security; protect your device and notify support if you suspect unauthorised access.

We will update this policy when processing or features change. The date appears at the beginning and significant changes will be communicated through an appropriate channel. You can read about cookies, service terms and the licence separately.