Privacy Policy

Effective date: September 27, 2026

This Privacy Policy explains how Roundy ("we", "us", "the Game") collects, uses, and protects your information when you play the Game on our website or in our mobile apps. By playing Roundy, you agree to the practices described here. If you have questions or requests, contact us at support@playroundy.com.

1. Information We Collect

Account information (only if you create an account)

• Email address and password — used to create and secure your account. Passwords are handled by Firebase Authentication; we never see or store your plain-text password.
• Username (display name) — chosen by you at signup. Publicly visible to other players.
• Bio — an optional short text you can add to your profile. Publicly visible.
• Avatar — a preset picture you select from our collection. We do not accept photo uploads. Publicly visible.

Gameplay data

• Your scores and the dates you earned them
• Trophies and progression milestones
• In-game currency balances (coins, diamonds, keys) and owned items (cards, ability levels, themes)
• Game session statistics (e.g. enemies defeated, session length) used to award your rewards

Automatically collected data

• Your IP address and basic device/browser information is processed by Cloudflare, which delivers this website, and by the Google services we rely on (Firebase, reCAPTCHA, Google Fonts) when your device connects to them.
• Aggregate visit statistics — we use Cloudflare Web Analytics to count visits: how many page views the site gets, which pages are viewed, the site that referred the visit, and the country and browser or device type it came from. It uses no cookies, stores nothing on your device, and is not used to identify you or follow you across other websites (see Section 4).

2. Public Information — Please Read

3. Cookies & Browser Storage

We do not set our own tracking cookies. We use your browser's built-in storage for game functionality only:

• Local storage — remembers your settings and preferences so the Game looks and sounds right when you return: your selected theme, ship and projectile colors, player name, owned themes, cached trophy count, whether sound is muted, and which one-time notices and hints you have already dismissed. If you play as a guest and then create an account, the coins, cards, and items from that guest run are also stored here until you claim them — this is kept until the claim succeeds (which requires verifying your email), so it survives closing and reopening your browser. It is removed as soon as the rewards are claimed, and you can clear it at any time by clearing your browser storage for this site.
• Session storage — temporarily holds your current game results (score, collected rewards) so they are not lost if a save needs to be retried, a short-lived theme-trial token, and small bits of state that keep one page consistent with the next, such as a notification still waiting to be shown to you. It is cleared when you close the tab.
• Both stores hold only game settings and progress of the kind described above. We never keep your password there, and we do not use either store to build a profile of you or to track you across other websites.
• Third-party cookies — Google reCAPTCHA (see below) may set its own cookies to distinguish humans from bots, and Google's advertising services may set cookies or read device identifiers to serve, cap, and measure the rewarded ads in the Game. These are controlled by Google, not us.

4. Third-Party Services We Use

The Game's website is delivered by Cloudflare, and its accounts, data and game logic run on Google cloud services. When you play, your device communicates with:

• Cloudflare — hosts and delivers this website from servers around the world (Cloudflare Pages). Your IP address, and basic request information such as your browser type and the page you asked for, reach Cloudflare whenever you load any page of the Game. Cloudflare also routes email sent to our support address, so a message you send us passes through it on the way to us. We also use Cloudflare Web Analytics, a small script on each page that reports aggregate visit statistics (page views, pages visited, referring site, country, browser and device type, and page load speed). It sets no cookies, uses no local storage, and does not fingerprint visitors; we see only totals, never a record of an individual visit. Cloudflare privacy policy.
• Firebase (Google) — Authentication (accounts), Firestore (game data storage), Cloud Functions (game logic), and App Check (anti-abuse). Firebase privacy information.
• Google reCAPTCHA Enterprise — protects the Game against bots and abuse. It analyzes interaction signals and may set cookies. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
• Google Fonts — loads the font used across the Game; your IP address is sent to Google's font servers when fonts load.
• Google Ads (rewarded video ads) — the "Watch Ad" reward feature uses Google's Ad Placement API (AdSense for H5 Games) to show rewarded video ads. We request non-personalized ads for every player, everywhere. That means the ads you see are chosen from the context — the fact that this is a game, and a coarse idea of your region — and not from a profile of your browsing history on this or any other site. Google and its advertising partners still use cookies or device identifiers for the limited purposes of capping how often you see an ad, measuring that it played, and detecting invalid traffic and fraud. You can review your Google-wide ad settings at Google Ads Settings or via www.aboutads.info. See Google's advertising technologies policy for details.
• Google Funding Choices (consent) — if you are in the European Economic Area, the United Kingdom, or Switzerland, a Google-certified consent dialog asks whether advertising cookies and identifiers may be used, and records your answer. This dialog still applies even though our ads are non-personalized: capping how often you see an ad and confirming it played both use cookies, and those need your consent in those regions. You can reopen it at any time to change your choices using the privacy or consent link shown by that dialog.

One more service is involved that your device never contacts directly — our servers use it on your behalf:

• Resend (email delivery) — sends the account emails you ask for: your address-verification link and your password-reset link. Your email address is passed to Resend so it can deliver those messages. It is used for nothing else, and we do not send marketing or newsletter email. Resend privacy policy.

5. What We Do NOT Do

• No banner or pop-up ads on this site's pages. Advertising in Roundy is limited to full-screen video ads shown inside the Game itself (see Section 4).
• No personalized or interest-based advertising. We ask Google for non-personalized ads for every player, so no advertising profile of you is built or used here.
• No behavioral tracking or visitor profiles. Our only analytics is Cloudflare Web Analytics, which counts visits in aggregate without cookies or device storage (see Section 4). Beyond that and the security and advertising services listed above, nothing on this site tracks you.
• We never sell your personal information to anyone.

6. How We Use Your Information

• To create and operate your account and save your progress
• To display leaderboards and trophies
• To award and verify in-game rewards, and to prevent cheating and abuse
• To respond to your support requests
• To understand, from aggregate visit counts, how many people use the site and which pages they visit, so we can improve the Game

7. Data Retention & Security

Your account and gameplay data are kept for as long as your account exists. Data is stored on Google Firebase servers, which use industry-standard protections (encrypted connections, access controls). No online service can guarantee absolute security, so please use a strong, unique password.

8. Your Rights & Choices

• Play without an account — you can play as a guest; guest sessions are not linked to an identity.
• Edit your profile — change your username, bio, and avatar anytime on the Account page.
• Delete individual scores — from the Account page's score list.
• Delete your account — the Account page's settings include a full account deletion option that removes your authentication account and your stored game data.
• Access / export / other requests — email support@playroundy.com and we will respond as required by applicable law.
• Control ad personalization — opt out at Google Ads Settings or www.aboutads.info. You can also simply not use the "Watch Ad" features; they are optional and never required to play.

Players in the EEA / UK (GDPR)

We process your data to perform our contract with you (running the Game) and for our legitimate interests (security, anti-abuse, and understanding aggregate site usage). Advertising cookies and identifiers are processed on the basis of your consent, collected through the Google-certified consent dialog described in Section 4; you can withdraw or change that consent at any time by reopening it. You have the right to access, correct, delete, restrict, or port your personal data, and to object to processing. You may also lodge a complaint with your local supervisory authority. To exercise these rights, use the in-game tools above or email us.

California residents (CCPA/CPRA)

You have the right to know what personal information we collect (listed in Section 1), to request deletion, and to non-discrimination for exercising your rights. We do not sell your personal information for money. However, when personalized ads are served, Google's use of advertising identifiers may qualify as "sharing" for cross-context behavioral advertising under the CPRA. To opt out, use the Google Ads Settings and www.aboutads.info controls above, or email support@playroundy.com. We do not knowingly share the personal information of anyone under 16.

International transfers

Your account and gameplay data are stored on Google infrastructure, primarily in the United States, and account emails are sent through Resend in the United States. The website itself is delivered by Cloudflare's global network, which means the request your browser makes for a page is normally handled by whichever Cloudflare location is nearest to you, wherever in the world that is. By using the Game you understand your data may be processed in the United States and in other countries where these providers operate.

9. Children

Roundy is a general-audience game and is not directed at children under 13, but no account is needed to play and we do not ask anyone's age to let them play. You must be at least 13 years old to create an account, and accounts are the only place we store personal information.

Because younger players may play as guests, we request non-personalized ads for everyone (see Section 4) — no advertising profile is built from anyone's play, at any age. The other services running during a guest session — App Check, reCAPTCHA, Cloudflare's cookieless visit counting and your browser's own local storage — exist to keep the Game secure and working and to count visits in aggregate, not to profile you.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us at support@playroundy.com and we will delete the account and its data.

10. Changes to This Policy

We may update this policy as the Game evolves (for example, if payments or new features are added). The effective date at the top will change, and significant changes will be highlighted in the Game.

11. Who We Are & How to Contact Us

Roundy is operated by an independent individual developer based in the State of New York, USA, who is the data controller responsible for the information described in this policy.

For any privacy question or request — including access, correction, deletion, or any of the rights described in Section 8 — write to support@playroundy.com. This is the address to use for every request under this policy, and it is monitored by the operator personally.

Read our Terms of Service →