Privacy Policy

1. Who we are and what this policy covers

Hype Rivals is owned and operated by IntelliVentures LLC FZ, registered at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. (“we”, “us”, “our”). We are responsible, as the “controller”, for the personal information described in this policy. You can reach us at [email protected].

This policy covers Hype Rivals wherever you play it: the web game, the Telegram Mini App, our apps for iPhone, iPad and Android (“our apps”), and this website, hyperivals.app (together, the “Service”). It does not cover services run by other companies that you use alongside the game, such as Telegram, Google, Apple, Google Play Games, Game Center, the app stores, payment providers or crypto wallets. Each of those has its own privacy policy.

In Telegram, Hype Rivals is published by Rich App, our exclusive publisher on Telegram. The game opens from Rich App’s Telegram bot, and the account you play with there is also your Rich App account. Rich App handles the information it receives as our publisher under its own privacy policy.

2. Information we collect

Account and sign-in information

• Guest account. The first time you open Hype Rivals on the web or in our apps we create an account for you automatically, so you can play straight away. It gets a player ID, a random nickname and a language taken from your browser or device settings. On the web, a sign-in cookie on your device is what connects you to a guest account; in our apps, a sign-in token kept in your device’s secure storage (the iOS Keychain, or storage protected by the Android Keystore) does.
• Telegram. When you play in Telegram, Telegram sends us, and we store, your Telegram user ID, first name (which becomes your starting display name), username, profile photo link, language and whether you have Telegram Premium. When you sign in with Telegram on the web or in our apps, Telegram sends us your Telegram user ID, first name, username and profile photo link. We do not store your last name, and Telegram does not give us your phone number.
• Google. If you sign in with Google, on the web or in our apps, we store your Google account ID and your verified email address. We do not store your Google name or profile picture.
• Apple. If you use Sign in with Apple, in our apps or on the web, we store your Apple account ID. In our iPhone and iPad app, Apple also shares an email address, which is either your own or a private relay address, as you choose; on the web and in our Android app, Apple shares no email address with us. We do not store your name. We also keep an encrypted Apple token for one purpose: so that we can ask Apple to revoke the sign-in when you delete your account.
• Sign-in sessions. For each device you sign in on, we keep a session record: the kind of app you used (the web, Telegram, or our iPhone, iPad or Android app), when the session started and was last used, and a hashed security token. We never receive your passwords.
• App installation. Our apps create a random ID for each installation and send it when a new guest account is started. We use it only in our servers’ memory, to limit how many guest accounts one installation can start, and we do not store it with your account.
• Bringing your account back. In our apps, links between your account and Google Play Games, Game Center and the restore keys the apps keep on your devices, each kept only as a one-way code (a hash), and, if you agreed to it, your agreement to share a code with Google Play Games without a Play Games profile (see section 14).
• How you found us. If you arrived through a friend’s invite link or one of our ads, we record who invited you, or which ad campaign and click the link came from. When you open one of our own links (hyperivals.app/go/…), we record when, the kind of device (such as an Android phone, an iPhone or a computer), your country, and the campaign details and click ID an ad network added to it; we do not store your network (IP) address or browser details with it. In our Android app, the same information can come from Google Play’s install referrer, which tells the app which link led to the installation (see section 5). When a Google ad led to the installation, we also record the country and network (IP) address the app first connected from, and the model and Android version of the device, for the reports section 5 describes.

Your profile

Your display name, which you can change; your public tag, a unique handle other players use to find you; and the avatar you pick from our catalogue. You cannot upload photos, and we never show your Telegram profile photo to other players.

Gameplay information

The matches you play and their results; your cards, card levels and decks; chests, Coins, Gems and other items; your Trophies, arena, season progress and Collection Level; your achievements; tournament and leaderboard entries; goals and rewards; your friends, friend requests and blocked players; the players you invited or who invited you; reports you send about other players, messages or House names; and your settings, such as sound, language and notification preferences. Notification preferences include your device’s time-zone offset, so that we can respect quiet hours.

Your age

After the first tutorial, the game asks your age once. In our apps, the app also asks Apple (Declared Age Range) or Google Play (Age Signals) for an age range each time it starts, and uses it to keep your answer to the age question on the same side of 18 as the store’s; if the store gives no answer, or you decline, nothing is recorded. As soon as a store’s answer arrives, we check it and keep only its result: the day it was given, the first day on which it says you are 18 or over, and whether the store confirmed it. We never keep the age range the store sends or how the store says it knows it. For every answer we keep where it came from (the question in the game, the store on one of your devices, or our support team) and the day it was given; for your answer to the question and an answer from our support team we also keep the age it states, and for a store’s result a one-way code (a hash) of the device it came from, so that a newer answer from the same device replaces the older one. We keep the latest answer to the question, each device’s latest store result (up to 10 devices) and any answer our support team adds, and we record which versions of our Terms of Service and this policy you accepted with your answer. An answer, from the game or a store, that says you are under 18, or a parent's or guardian's withdrawn consent, also turns off personal offers.

A parent or guardian withdrawing consent. Apple tells us when a parent or guardian withdraws consent for a child to use our iPhone and iPad app. Apple’s notice names the app’s download, not an account, so each time our iPhone and iPad app starts it sends us the App Store’s signed record of that download (the app transaction), and the App Store names it with every purchase you make there; we keep only a one-way code (a hash) of its ID with your account (up to 10). When Apple tells us that consent was withdrawn, every account with that code is treated as under 18 and stopped everywhere: its sign-ins end, and it cannot be signed in to on the web, in Telegram or in our apps until our support team lifts the stop, after hearing from the parent or guardian. A newer age answer does not lift it. We keep a record of each of Apple’s notices, so that the same notice is never applied twice, and a notice that matches no account is kept only as the one-way code and the day it arrived, so that our support team can match it later. We use the stores’ age results, these codes and these notices only for the age rules and this stop, never for analytics, advertising, choosing what we offer you or profiling.

Houses and chat

• Your House. Which House you are in, your role and when you joined; your Boss battles and the stars they won; the cards you asked for, gave, received and lent; the decks you shared; your weekly House record; your lifetime House stats; and the House requests and invitations you sent or received.
• House chat. The messages you send, after links, phone numbers, @handles, wallet addresses and filtered words have been removed.
• Moderation. Reports you make and reports about you, with a copy of a reported message or House name; the steps of any chat restriction on your account and their reasons; and any appeal you write.
• Being seen online. While you have the game open, the server knows you are online, but that is never stored. We store only when you last closed the game, so that housemates can see how long you have been away, and whether you chose Appear offline.

Purchases

• When you buy something we store the offer, its price, the payment method, the payment provider’s transaction and order IDs, the amounts, the state of the purchase, what it gave you, and any refund or chargeback. We never receive or store full card numbers or bank details.
• Card payments on the web are processed by Stripe. If your account has an email address, we pass it to Stripe with the payment so that the checkout can be pre-filled and your receipt can be sent.
• If you pay with TON or USDT, we store the address of the wallet you connected and the transaction’s record on the blockchain. Blockchain transactions are public and permanent: nobody, including us, can change or delete them.
• In our apps, Apple or Google takes the payment. When you start a purchase, we give the store a random reference for it, never your name, so that the purchase can be matched to your account. The store then tells us which product you bought, the transaction ID and whether the purchase is valid, and later tells us if the purchase is refunded or cancelled.
• A Google Play Games reward reaches our Android app through Google Play as a free purchase. What we keep about it is described in section 14.

Personal offers

After a ranked match, on Home and in the Shop the game may show you an offer chosen for you, such as a way to level up the card that nearly won your last match, or a Level-Up Kit for it. We choose these offers from your gameplay information (your deck and cards, your match results, and facts about your matches worked out from their plays, such as which card made the most Hype) and from your purchases (whether you have paid before, and the price you usually pay, so that an offer never asks more than one step above it). For each kind of offer we keep when one was last shown, how many you saw today, whether you set one aside with Not now, an offer still open for you (its card, what it holds and when it ends), and the version of our app you last played with. You can turn personal offers off at any time in Settings, Personal offers, on every device. They are off for a player whose age answer says under 18, and for a player of unknown age where the law asks for a known adult; we keep no offer history for a player under 18, and an age signal from a store can only turn offers off, never choose, price or measure one. This information is deleted with your account.

Device and technical information

• IP address. Our servers and our network provider see it with every request. We use it to deliver the Service and to protect it from abuse, for example by limiting how many requests one connection can make. We do not store it with your account, but it can appear in server logs and in error reports. In our iPhone and Android apps, the country your connection comes from, which our network provider works out from your IP address, decides whether House chat is available to you; it is checked each time and never stored for that. The one exception: when a Google ad led to an installation of our Android app, the IP address and country of its first connection are kept for the reports to Google Ads described in section 5, for at most 180 days.
• App and device details. The kind of app or Telegram client you play in, the version of our app, your language, and basic diagnostic events such as a numbered error code or how long a picture took to load. Diagnostic events contain no free text and no device fingerprint, and we keep only running totals of them, not a record for each player.
• How you use the game (analytics) and crash reports. The screens you open and what you do in the game: starting and finishing the tutorial and its steps, reaching an arena, signing up or signing in (only the method, such as Google), opening a card or an offer, starting and finishing a match (its mode and whether you won, lost or drew), joining a House, opening a chest, saving a deck, seeing or tapping one of our offers (which offer, and where it stood) and making a purchase (what you bought and its price). Our apps send these through Google Analytics for Firebase, with a random identifier of the app on your device, together with the information that SDK measures by itself (app opens, sessions, how long you play, the app version, your device model and operating system, and a general location such as your country or city that Google works out from your IP address). The web version and Telegram send the same events to our server, which passes them to Google Analytics with a random identifier kept in your browser, the session, your country and the kind of device and browser; no Google script runs in the page. In our apps, Firebase Crashlytics receives a report when the app crashes or the game hits an error: where in our code it happened, your device model, operating system and app version, and a random Crashlytics identifier. None of this contains your name, email, player ID, tag, messages or anything you type. Google Analytics for Firebase reads your device’s advertising identifier only while ad measurement is on for you (see section 5).
• Push notification tokens, if you turn notifications on (see section 6).
• Cookies and similar storage (see section 7).

Camera, only when you scan a QR code

If you choose to scan a friend’s QR code in your browser or in Telegram, the game asks for permission to use your camera. The picture is read on your device only to find the code. It is never sent to us and never stored. Our iPhone, iPad and Android apps never use your camera and never ask for it: to scan a code there, you use your phone’s own camera app, and the code’s link opens the game. We receive only that link.

What we do not collect

We do not collect your precise location, your contacts, your photos or recordings from your microphone. Our own code never reads your device’s advertising identifier (Apple’s IDFA or Google’s advertising ID), and our servers never receive one. In our apps, the Google, Meta and TikTok tools described in section 5 read it, and only while ad measurement is on for you.

3. How we use information

We do not use your information to make automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles about you. The automated chat check can stop a message from being posted, and many refused messages in a short time can restrict your chat for a while; a person decides every appeal.

4. What other players can see

• Your public profile. Any signed-in player can open it. It shows your display name, public tag, avatar and arena; your Trophies and best Trophies; your Collection Level and global rank; your number of matches, wins and win rate; your lifetime House stats and any avatar frame you wear; and your head-to-head record against the player who is looking.
• Leaderboards list players by name and rank. There is no way to opt out of them.
• Your House. If you are in a House, its name and badge appear next to your name on your profile, leaderboards, friends lists, recent rivals and tournament standings. Anyone can open a House’s page, which lists its members with their display names, roles and Trophies, and how many of them fought the Weekly Boss this week.
• Inside your House, your housemates also see your role, when you were last active, and whether you are online now (unless you choose Appear offline, which players under 18 start with); your stars and the cards you gave this week; your card requests, donations and shared decks; which of your cards they can borrow for a Boss battle; and House moments, such as a Diamond Pass House gift, which shows your name to the whole House.
• House chat. Your messages are seen by every member of your House who can read chat.
• In a match, your opponent sees your display name, avatar and Trophies. In a friendly match, they also see your tag.
• Friends. After you play a friendly match with someone, or when you challenge them, they can see when you are online.
• Invites. If you joined through another player’s invite link, that player can see your display name, avatar, tag and the progress milestones you reach, including whether you bought a Diamond Pass, which earns them a reward. They may be notified when you reach a milestone.
• Google Play Games and Game Center. In our apps, players there can see the achievements you earn, and in Game Center your scores on our leaderboards, with your Google Play Games or Game Center name, as your settings with Google or Apple allow.
• A shared Google account, Apple ID or device. When one of our apps brings an account back, anyone who uses the same Google account, Play Games profile, Game Center account or Apple ID as you, or a phone set up from yours, can be offered your account and see its display name, avatar and Trophies (see section 14).

You choose your display name and tag, and what you write in House names and chat. Do not put personal information in them.

5. Who we share information with

We share information only as described here. Anyone we share personal information with under this policy, including our service providers, our advertising partners, our publisher on Telegram and any company related to us, must give it the same or equal protection as this policy does. Service providers may use it only to provide their services to us.

Service providers that work on our behalf

• Cloudflare protects our servers and speeds up delivery. It handles IP addresses and request data for every visit.
• Our hosting and database providers store and run the Service.
• Google Firebase Cloud Messaging delivers push notifications. It receives your device’s push token and the notification we ask it to deliver. On iPhone and iPad it hands them to Apple Push Notification service, which delivers them to your device.
• Google Analytics (Google Analytics for Firebase in our apps) receives the analytics events described in section 2 and tells us how the game is played, as our service provider. It never receives your name, email, player ID or messages.
• Firebase Crashlytics (Google) receives the crash and error reports of our apps described in section 2, as our service provider.
• Google (Gmail) delivers our internal error reports to our team. A report can include a player ID and an IP address.
• Telegram delivers urgent safety alerts to our team: a report about a child’s safety or a threat is also posted to our team’s private Telegram chat, with the details of the report.

Chat moderation

OpenAI provides the automated check described in our community rules. When the check is available, the text of each House chat message is sent to OpenAI’s moderation service before anyone sees it, and the text of a message is sent again when someone reports it. OpenAI receives only the text, never your name, player ID or other account details, and processes it on our behalf as our service provider. We use only OpenAI’s free moderation service: when it is unavailable, a message is checked by our word filter alone.

Our publisher on Telegram

Rich App publishes Hype Rivals on Telegram. When you play there, the game opens from Rich App’s bot, your Telegram sign-in and Telegram Stars payments go through that bot, the bot sends you the game’s Telegram messages, and your account is also your Rich App account. Rich App receives your Telegram details and your account for these purposes.

Platforms and sign-in providers

• Telegram runs the Mini App platform, processes Telegram Stars payments, and provides Telegram sign-in, including the sign-in with Telegram on the web and in our apps.
• Google provides Google sign-in. In our Android app, Google Play processes purchases and tells us about refunds, shares an age range where it has one (Age Signals), and gives us the app’s install referrer, so that we can credit the friend who invited you or the ad that brought you. Google Play Games receives what section 14 describes: private codes that link your account to your Play Games profile, your achievements and the stats of matches you play in our Android app. Google Play also delivers Google Play Games rewards, and Block Store, part of Google Play services, keeps the app’s restore key on your phone.
• Apple provides Sign in with Apple, in our apps and on the web. In our iPhone and iPad app, Apple processes App Store purchases and tells us about refunds, shares an age range if you allow it (Declared Age Range), and tells us when a parent or guardian withdraws consent for a child to use the app, naming the app’s download (see Your age). Game Center vouches for your Game Center player ID and receives your achievements and leaderboard scores, and iCloud Keychain keeps the app’s restore key, as section 14 describes.

Payment providers

• Stripe processes card payments. You give your card details to Stripe, not to us, and Stripe receives your email address if your account has one.
• NOWPayments processes cryptocurrency invoices on the web.
• TON payments go from the wallet app you connect through TON Connect onto the public TON blockchain. We use toncenter.com to read the blockchain and confirm your payment.
• jsDelivr, a public code-delivery network, serves the open-source TON Connect library that the game loads. As with any web request, jsDelivr receives your IP address and browser details. We send it no account, gameplay or purchase information.

Advertising partners: ad measurement, which is tracking

We advertise Hype Rivals on websites, in apps and in Telegram, through advertising networks that include Google Ads, Meta (Facebook and Instagram) and TikTok, and we measure which of our ads bring players. We do not show ads inside Hype Rivals.

• What we report. If you reach Hype Rivals by tapping one of our ads, the link carries a click ID from the ad network. We tell that network that its ad brought a new player, and we may also tell it that the player finished a first match or a first three matches (for some of our ads, counting ranked matches only) or made a first purchase. The report contains the click ID, and it can contain a payout value (for some campaigns, higher for players with Telegram Premium). An ad network that runs ads inside Telegram is told only about what you do in Hype Rivals inside Telegram, and its report contains your Telegram user ID; nothing you do on the web or in our apps is ever reported to it. It never contains your name or contact details. When the report is sent from your browser or device, the ad network also receives your IP address and browser or device details, as it would with any request.
• Your choice, and where we ask first. In the European Economic Area, the United Kingdom and Switzerland, we report nothing about you to any ad network unless you allow it. If an ad or one of our links may have brought you there, the game asks you once, with the age question (or at your next visit, if you answered it before) and only if your answer says you are 18 or over, with two buttons, Allow and Don’t allow; nothing changes in the game whichever you choose. Wherever you play, you can turn ad measurement off or on at any time in the game’s Settings (Ad measurement), and while it is off nothing about you is reported to any ad network and the Meta, TikTok and Google advertising features described below stay off.
• Our own links. Some of our ads and posts point to a link of ours (hyperivals.app/go/…), which takes you to Google Play, the App Store, our Android app’s download or the game. If you then start playing for the first time within 7 days, we credit that link, and the ad network that ran it can be told the results described above; our Android app’s download from our website carries a code for your click so that the app can tell us which one it was, and the App Store receives only the name of the campaign, for Apple’s own counts. If you already had an account, opening one of our links is counted only in our own statistics and never reported to anyone.
• Google Ads, Meta and TikTok. When one of their ads brings you to us, we keep the click ID they add to the link, and we may report the same results to them afterwards so that they can measure the ad.
• In our Android app, Google Play’s install referrer can carry an ad’s click ID, which we use in the same way. When a Google ad led to the installation, our server tells Google Ads that the app was installed and opened, that you finished a first ranked match, and about each purchase you make in the 180 days after the installation, with its price in US dollars. These reports contain Google’s click ID, the time of each event, the app version, and the country, network (IP) address, device model and Android version recorded when the app was installed; never your advertising ID, your name, your contact details or your account ID. Google tells us in return which of its campaigns and ad groups the ad belonged to. We send these reports only if every age answer says you were 18 or over when you installed the app, and never while you have ad measurement turned off. If you installed the app in the European Economic Area, the United Kingdom or Switzerland, or from a country we could not tell, or we last saw you playing from there, we send them only after you have allowed ad measurement, as described above, and each report then tells Google that European rules apply and that you gave your consent. If you never allow it, nothing is sent, and the click ID and the details kept with it are deleted 180 days after the installation.
• In our iPhone and iPad app, an ad click is reported to an ad network only if you allow it when the app asks, through Apple’s App Tracking Transparency prompt. You can change your answer at any time in your device’s settings. Whatever you answer, Apple’s own privacy-preserving attribution (SKAdNetwork and AdAttributionKit) can tell an ad network, without identifying you, that an installation came from its ad and whether the new player signed up, finished or won a first match, or made a first purchase. For our own Apple Ads ads, the app also reads a one-time code from Apple’s AdServices attribution, which needs no permission and is not your advertising identifier; our server hands it back to Apple once, Apple answers whether an Apple Ads ad led to the installation and, if so, which campaign, ad group and keyword it belonged to, and we keep only those campaign details with your account. Nothing is reported back to Apple.
• Google Analytics and Google Ads. If your answer to the game’s age question says you are 18 or over, you play from outside the European Economic Area, the United Kingdom and Switzerland or you allowed ad measurement there, you have not turned it off, and, in our iPhone and iPad app, you allowed tracking, the analytics events described in section 2 may also be used by Google to measure our ads and to show our ads to people likely to enjoy the game, and in our apps Google Analytics for Firebase reads your device’s advertising identifier for that. Otherwise they are used for analytics only.
• Meta and TikTok in our apps. Our apps include Meta’s SDK and TikTok’s Business SDK, on the same terms as Google’s above: they stay off unless your answer to the game’s age question says you are 18 or over, you play from outside the European Economic Area, the United Kingdom and Switzerland or you allowed ad measurement there, you have not turned it off, and, in our iPhone and iPad app, you allowed tracking. When on, they tell Meta and TikTok that the app was opened, that you signed up, that you finished a third ranked match, and about a purchase with its price and currency, together with your device’s advertising identifier, your device model, operating system and app version and your network (IP) address, so that they can measure their ads. They never receive your name, email, player ID, tag, messages or anything you type, and their automatic collection of other events is turned off.
• Your advertising identifier. Our own code never reads Apple’s IDFA or Google’s advertising ID, and our servers never receive it. Only the Google, Meta and TikTok tools described above read it, and only while ad measurement is on for you.

Linking what you do in Hype Rivals to an ad you saw elsewhere is a form of tracking, and some laws treat it as “sharing” personal information for advertising, or as targeted advertising. You can stop it at any time in the game’s Settings (Ad measurement), or ask us to (see section 10).

Other players

Other players can see your public information, as described in section 4.

Legal reasons and business changes

We may disclose information when the law requires it; to protect the safety, rights or property of our players, of the public or of us; or to establish or defend legal claims. When an authority lawfully asks us to preserve information about a House, we keep a copy of that House’s recent feed, with who wrote each message and when, until the request is resolved. If the Service is sold, merged or transferred, the information may pass to the new operator, who will be bound by this policy for the information transferred.

We do not sell your personal information. Apart from the ad measurement described above, we do not share it for advertising.

6. Notifications and messages

• Telegram messages. If you play Hype Rivals in Telegram, the bot of our publisher, Rich App, may message you about the game: for example when a reward is ready, when a friend challenges or nudges you, or when someone you invited reaches a milestone. These messages are on unless you turn them off in the game’s menu in Telegram. We send at most 3 a day and 10 a week, at least 4 hours apart, and none between 22:00 and 08:00 in your time zone. The bot may also send you messages about Rich App’s own games. Blocking the bot in Telegram stops all of them at any time.
• Push notifications on the web and in our apps stay off until you turn them on and allow them in your browser or on your device. You can turn them off at any time in the game’s menu or in your browser or device settings.
• House notifications, such as a housemate calling you back, a join request being accepted or your Boss Chest being ready, stay off until you say yes. The game asks once, when you join a House, and you can change it in the game’s menu. They count toward the same limits as our other messages.
• Inbox. Some messages arrive in your in-game inbox.
• We do not send marketing email.

7. Cookies and similar technologies

The web version of the game uses:

• A sign-in cookie that keeps you signed in. For a guest account, it is renewed every time you play and runs out after about a year without play. For an account signed in with Google, Apple or Telegram, it is renewed every time you play and runs out after 7 days without play. Two smaller cookies remember how you signed in (for as long as your session lasts, and at least 30 days) and keep your connection on the right match server during a match.
• A returning-browser cookie that holds your player ID and a random identifier of the sign-in session the game last had in this browser, signed by us so that nobody else can make one: never your name, email or anything you could sign in with. No script on the page can read it, and it is sent only to the part of our server that signs you in. If your browser later clears the game’s other storage, it lets the game ask you to sign in again, instead of starting a new guest account in place of an account you can still sign in to. It is kept for a year after you last opened the game in that browser, and is deleted when you sign out, sign out of all devices or delete your account in that browser. Once an account is deleted, its cookie does nothing in any browser.
• Local storage and session storage in your browser, for your settings, your sign-in state, recent game data and the random analytics identifier described in section 2, with the start of your current visit. IndexedDB storage is used only if you turn on push notifications.
• A service worker that stores game files on your device, so the game loads faster.

Our apps keep your sign-in token in your device’s secure storage (the iOS Keychain, or storage protected by the Android Keystore). Whichever way you signed in, your session is renewed every time you play and runs out after about a year without play, or when you sign out or delete the account. The apps also keep your settings and game files on the device.

We use no advertising cookies and no analytics cookies. This website, hyperivals.app, sets no cookies of its own. When you reach the game from one of our ads, your browser contacts that ad network as described in section 5, and the ad network’s own cookies may be involved. You can clear cookies and site data in your browser at any time, but clearing them removes a guest account’s sign-in, and that account then cannot be recovered on that device.

8. Where we process information

We are based in the United Arab Emirates and use service providers around the world, so your information may be processed outside your country, including in countries whose data protection laws differ from yours. Where the law requires a safeguard for such a transfer, we rely on an appropriate mechanism, such as standard contractual clauses.

9. How long we keep information

• Account, profile and gameplay information: for as long as your account exists. We do not delete inactive accounts automatically.
• Sign-in sessions: a session signed in with Google, Apple or Telegram on the web expires 7 days after it was last used, and is deleted 7 days after it expires or is ended, and never sooner than 14 days after it was last used. A guest account’s session, and every session in our apps, expires about a year after it was last used and is deleted a week after that, even if it was ended sooner.
• Push tokens: removed when you sign out on that device or sign out of all devices, or after 60 days in which the game is not opened on it.
• Inbox messages: deleted 7 days after they expire.
• Match data: the live details of a match are removed when it ends. Match results stay in your history and your opponents’ histories.
• Purchase records: kept as accounting records for as long as the law requires. The raw data a payment provider sends us about a payment is erased after 120 days.
• Ad click IDs: kept until the ad network has been told the result it measures, then deleted. We keep which campaign or link brought you as part of your account. Apple’s one-time AdServices code is deleted as soon as Apple has answered, and at the latest after 24 hours. A click on one of our links that brought no new player is deleted after 30 days, and an ad network’s click ID kept with a click is deleted at the latest 30 days after the click. A Google Ads click ID from our Android app, with the country, network address and device details recorded beside it, is deleted at the latest 180 days after the installation, and sooner once nothing more will be reported to Google.
• Analytics and crash reports: Google Analytics keeps analytics events for up to 14 months, and Firebase Crashlytics keeps a crash or error report for 90 days.
• Server logs: kept for up to 90 days and then deleted, unless we need them longer to investigate a security incident or abuse.
• House chat and the House feed: each House’s feed keeps its most recent 200 items and nothing older than 30 days, and a daily job deletes everything else. A House’s feed is deleted when the House closes, and your messages are deleted with your account.
• Reported messages and House names: the copy made for a report is kept until the report is decided and for 180 days after that, then deleted. The report itself stays as a moderation record.
• Preserved House feeds: a copy made for an authority’s request is kept until that request is resolved.
• Your weekly House record: kept until you open that week’s Boss Chest, and never more than about 30 days after the week ends. House requests and invitations are deleted when they are answered or expire: 48 hours after a request, 7 days after an invitation.
• Age answers, chat restrictions and appeals: kept with your account for as long as it exists. An age only goes up, so an old answer stays true; our support team can remove an answer that was wrong. A store’s age answer is never kept, only its result, as Your age explains.
• A parent’s or guardian’s withdrawn consent: the one-way codes of your app’s downloads and any stop are kept with your account for as long as it exists. Apple’s notices are kept as a record with the day and the one-way code, and a notice that matched no account as the one-way code and the day only, for as long as we run the Service, so that a repeated notice is never applied twice and our support team can match a late one.
• Google Play Games, Game Center and restore keys: the links to your account for as long as it exists, and a link that has stopped working, for example after you sign out of all devices, for 90 days; the stats of a match until 7 days after the app has passed them to Google Play Games, and never more than 30 days; and a record of each Google Play Games reward claimed, which stays after your account is deleted, without your account. Section 14 explains each.

When an account is deleted, some records are kept without your name or sign-in details, as explained on the account deletion page.

10. Your rights and choices

In the game you can change your display name, tag and avatar, choose which notifications you get, mute emotes, block and report players, leave your House, choose Appear offline, appeal a chat restriction, sign out, and delete your account.

On your device you can turn off notifications and, when you play in a browser or in Telegram, the game’s access to your camera (our apps have none). In the game’s Settings you can turn ad measurement off or on (see section 5). On iPhone and iPad you can also allow or refuse tracking for Hype Rivals at any time, in Settings, under Privacy & Security, then Tracking. In our apps you can turn off sharing a code with Google Play Games without a Play Games profile in Play Games settings, and sign out of Game Center in your device’s Settings (see section 14).

Correcting your age. If an age answer on your account is wrong, including an old answer from a device you no longer use, email us. Our support team can remove it, and if it was your answer to the game’s question, the game asks you again.

A stop after withdrawn consent. If a parent or guardian withdrew consent and wants the account to work again, or it was stopped by mistake, the parent or guardian can email us. Our support team checks the request and lifts the stop; the account can then be signed in to again.

Your rights. Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it, in a portable format where that applies;
• correct it;
• have it deleted;
• object to, or ask us to restrict, some uses of it, including our ad measurement;
• withdraw a consent you gave, such as for push notifications, without affecting what we did before;
• not be treated differently for using these rights; and
• complain to your local data protection authority.

How to make a request. Email [email protected], preferably from the email address linked to your account, and include your player tag, which is shown on your profile. We may ask for more details to confirm the account is yours before we act. We answer within 30 days, or sooner where the law requires.

We do not sell personal information. If you would rather we did not send ad reports about your account, tell us and we will send no further reports for it.

11. Deleting your account

You can delete your account at any time in the game, on the web, in our apps and in Telegram: open the menu, tap Account, then Delete account. You can also ask us to delete it by email, without installing or opening the game. The account deletion page explains how, what deletion removes, and the few records we must keep.

Deleting your account signs out every device and, if you used Sign in with Apple, asks Apple to revoke it. It resets the analytics identifier on the device you delete it from and stops analytics and crash reports there. It removes the account’s links to Google Play Games and Game Center and its restore keys first, so that no device can bring it back, and asks Google Play Games to forget the link. It replaces your public tag with a new one, and your old tag is never given to another player. It sets your Coins, Gems and Trophies to zero and deletes your cards, achievements and other items. It takes you out of your House (if you lead it, the game hands leadership to another member who can lead) and deletes your House chat messages, card requests and weekly House record, and your age answers. The text of a chat appeal you wrote is erased too, unless the moderation case it belongs to is still open. Cards you gave or received stay with the players who hold them, and the copy of a message someone reported stays with that report until it is deleted, as section 9 explains.

An account you sign in to with Telegram is deleted the same way, except that its Telegram sign-in, and the details Telegram shares with it, are kept, because that sign-in is shared with Rich App, our publisher on Telegram, and Telegram keeps you signed in with it. To remove it as well, email [email protected]. If you sign in again later, you start with a new, empty account.

12. Children

Hype Rivals is a general-audience game. It is not designed for young children. Where the law where you live requires a parent or guardian to agree before a child uses an online service, or before we handle a child’s information, that agreement is required (see section 2 of our Terms of Service).

The game asks every player’s age once. Until a player answers, and whenever an answer puts them under 18, House chat stays closed: they cannot send messages and do not see them. A player under 18 also starts with their online status hidden from housemates, and a player under 13 cannot create or rename a House. In our Android app, only a player who has answered, and whose every answer says 18 or over, is asked whether to share a code with Google Play Games without a Play Games profile (see section 14), and a Google ad’s results are reported to Google only for a player whose every answer says they were 18 or over when they installed the app (see section 5). We use age answers, and the age ranges that app stores share, only for these purposes.

If you are a parent or guardian and believe your child is using Hype Rivals without your agreement, contact us and we will delete the account.

13. Security

We protect information with measures that include encrypted connections (HTTPS), sign-in tokens that we store only in hashed form, that expire and that can be revoked, sign-in tokens that our apps keep in your device’s secure storage, restore codes and keys that we keep only as one-way codes made with a secret key, access controls, and network protection. No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorisation.

14. Google Play Games, Game Center and restoring your account

Our Android app, including on Google Play Games on PC, works with Google Play Games, and our iPhone and iPad app works with Game Center. The apps use them to bring your account back when you reinstall the game or move to a new device, and to show your achievements there. Google Play Games is Google’s service and Game Center is Apple’s: each handles what it receives under its own privacy policy, the Google Privacy Policy or Apple’s Privacy Policy. We never send them your name, email address, player ID or messages. None of this happens on the web or in Telegram.

Bringing your account back

When you reinstall one of our apps, or open it on a new device, the app looks for the account you last played and opens it, so that you keep your progress without signing in. If more than one account could be yours, for example because two people share a Google account or an Apple ID, you choose which one to open, or start a new game. If you signed out of the account, the app asks you before opening it. If you signed out of all devices, it does not open the account until you have signed in again. A deleted account never comes back. If the app opens an account that is not yours, “Not you?” on its welcome message starts a new game on that device and leaves the other account as it was. To find your account, the app uses:

• Google Play Games, in our Android app. If you have a Play Games profile, our server gives Google Play Games a private code for your Hype Rivals account, and Google keeps it with your Play Games profile, so that on a new device it can tell our server which account you played. The code is either random or made from your account with a one-way function, and it contains nothing about you, such as your name, email address or player ID. We keep only a one-way code (a hash) of what we gave Google.
• Google Play Games without a profile, in our Android app. If you play without a Play Games profile, the app shares such a code with Google Play Games only if you agree. It asks you once, in a message titled “Keep your progress safe with Google”, and only if you have answered the game’s age question and every age answer on your account says 18 or over. If you choose Turn on, Google keeps the code with the Google account on your device, and shows you a short message saying that the game works with Google, where you can also turn it off. You can turn this sharing off at any time in Play Games settings. We record that you agreed, when, and which version of the message you saw. A code shared this way lasts 30 days, and the app renews it each time you play. If you choose Not now, nothing is shared and the app does not ask again by itself; you can turn it on later from the game’s Account menu.
• Block Store, in our Android app. The app keeps a random key for the account you play in Block Store, a part of Google Play services that keeps it on your phone, encrypted, and can carry it to a new phone when you copy your data across or restore your phone’s backup. The app uses the key only to find your account. Our server receives the key and keeps only a one-way code (a hash) of it.
• Game Center, in our iPhone and iPad app. If you are signed in to Game Center, the app asks Apple for a signed statement of your Game Center player ID and sends it to our server, which checks Apple’s signature and keeps only a one-way code (a hash) of the player ID, linked to your account. The app shows you your Game Center name but does not send it to us.
• iCloud Keychain, in our iPhone and iPad app. The app keeps a random key for the account you play in your device’s keychain. If iCloud Keychain is on, Apple keeps the key end-to-end encrypted and makes it available on your other Apple devices, so that the app can find your account after a reinstall or on a new device. Our server receives the key and keeps only a one-way code (a hash) of it.

Our servers make every one-way code above with a secret key that only they hold, and none of these codes or keys is shown to other players. Anyone who uses the same Google account, Play Games profile, Game Center account or Apple ID as you, or a phone set up from yours, may find your account opened for them in this way, or see its display name, avatar and Trophies in the list the app shows when more than one account could be theirs. A guest account that comes back this way is one account on every device that has it: signing out of it, or continuing as a new guest, on any of those devices ends it on all of them, and the game says so before you confirm.

When you sign out of an account in our apps, the app deletes its key from Block Store or from your keychain (with iCloud Keychain on, from your other Apple devices too), and we ask Google Play Games to forget the codes that link your Play Games profile to that account. We keep a note on the account’s other links that you signed out, so that the app asks you before it opens that account again on any device. If you choose Sign out of all devices, every device is signed out, the account’s links and restore keys stop working at once (they are deleted 90 days later), we ask Google Play Games to forget its codes, and the account’s push tokens are removed.

Achievements, scores and stats

• Achievements. Hype Rivals has twenty achievements, the same wherever you play. Our servers decide when you earn one and keep a record of it with your account, and you can see them on your own profile in the game. Our apps also report the ones you have earned to Google Play Games or Game Center, which show them on your profile there and announce a new one with a message of their own.
• Game Center scores, in our iPhone and iPad app. The app sends Game Center four scores for our leaderboards: your best Trophies, your ranked wins this week, your Collection Level and the Hype you make in each match, of which Game Center shows your best. Game Center shows them with your Game Center name to other Game Center players, as your Game Center settings allow, and uses them for Game Center challenges. When you invite friends to a friendly match through Game Center, Apple gives them a code that opens that match.
• Google Play Games stats, in our Android app. For each match you play in our Android app, except tutorials and the Weekly Boss, the app tells Google Play Games the kind of match (ranked, practice or friendly), whether you won, lost or drew, how many Ovations you earned, how many cards you played, how much Hype you made and how long the match lasted. It also tells Google Play Games which arena you have reached. Google uses them for features of Google Play Games, such as the stats on your Play Games profile. Matches you play anywhere else are never sent, and our server keeps each match’s stats only for the short time described below.

Google Play Games rewards, in our Android app

Google Play Games can give you a free reward for Hype Rivals, such as an avatar, an emote or a Spotlight Chest, which Google delivers through Google Play as a free purchase. When you claim it, the app sends our server Google Play’s purchase token and order number for it. Our server checks them with Google Play, gives the reward to the account you claimed it with, and tells Google Play that it was delivered. For every reward we keep a one-way code (a hash) of its purchase token and of its order number, which reward it was, what happened to it and when, so that the same reward can never be claimed twice. While your account exists the record names it; when your account is deleted, we keep the record without it.

How long we keep it

• Links and restore keys, with when each was made and last used, any note that you signed out, and your agreement to share a code without a Play Games profile: for as long as your account exists. A link that is replaced, for example because a device now plays another account, stops working at once and is deleted 90 days later.
• Achievements: for as long as your account exists.
• Match stats for Google Play Games: deleted 7 days after the app has passed them on, and never kept more than 30 days.
• Reward records: kept after your account is deleted, without your account, so that a reward can never be claimed twice.
• What Google Play Games and Game Center keep is up to Google and Apple, under their own privacy policies.

Your choices

• You do not need Google Play Games or Game Center to play. We send Google Play Games nothing about your account unless you have a Play Games profile or agreed to share without one, and we send Game Center nothing unless you are signed in to it.
• In Play Games settings you can turn off sharing without a profile and manage what Google Play Games keeps; Google Play Games also lets you delete a game’s data from your Play Games profile. In your device’s Settings you can sign out of Game Center and choose who sees your Game Center profile.
• To remove the restore key from your devices, sign out of your account in the app. You can also turn off iCloud Keychain, or your phone’s backup, in your device’s settings.
• If you delete your account, we remove its links and restore keys before anything else, so that no device can bring it back; we ask Google Play Games to forget its codes; and we delete your achievements and the match stats we still hold. A restore key left on a device then opens nothing. Achievements and scores already sent to Google Play Games or Game Center stay there under Google’s and Apple’s own policies.

Google Play Games and Game Center also show their own messages and buttons in our apps, such as a welcome message, a message when you earn an achievement, Google Play Games’ Sidekick tab at the edge of the screen and the Game Center button on the Home screen, and the Google Play Games software in our Android app sends Google its own technical and usage information. Those are Google’s and Apple’s, under their own privacy policies.

15. Changes to this policy

If we change this policy, we update the date at the top of this page. If a change is significant, we tell you in the game or on this website before it takes effect.

16. Contact us

IntelliVentures LLC FZ
Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Email: [email protected]

For help with the game, your account or a purchase, see our help and support page.