Rafters Privacy Policy
Effective: September 29, 2026 · Last updated: September 29, 2026
Rafters ("the app") is made by Zachary Chung, an individual developer based in California, USA ("I", "me"). This policy explains what the app collects, why, who else handles it, how long it's kept, and your choices. Contact: zacharytylerchung@gmail.com.
The short version
- Solo play needs no account, and its data stays on your phone.
- Online play (friends, live matches, friends leaderboards, challenge codes) needs an account made with Sign in with Apple and is for ages 13 and up. I store your username, display name, and game results on my server so the online features work.
- No ads, no analytics, no tracking, and I never sell or share your data.
- Delete your account at any time in Settings › Delete account.
1. Data that stays on your device
Your seasons, streaks, missions, binder, achievements, settings, and reminder schedule are stored only on your device (and in a shared space the Rafters widget reads). I never receive them. Deleting the app deletes them.
The age check before online sign in stores only an age band (under 13, 13 to 17, or 18+) on your device. It is never sent to me.
Reminders are local notifications scheduled on your device. Nothing is sent to me.
2. Data I collect if you create an online account
| Data | Where it comes from | Why |
|---|---|---|
| An account ID, and the identifier Sign in with Apple gives the app | Sign in with Apple | To create and secure your account |
| Username and display name | You | So friends can find, add, and recognize you |
| Level, and when you last had the app open | The app | Shown to your friends |
| Friend requests, friends, and players you block | You | Friends, and keeping unwanted players away |
| Online matches (both players' names and IDs, the seed, picks, and sealed calls) | The app | To run the match between two phones |
| Daily boss results (wins, losses, margin, stars), the five players you drafted in the Daily, and weekly XP | The app | Friends leaderboards and anonymous Daily totals |
| Challenge codes you create or play (your display name and result) | You | Challenge boards |
| Reports you send about other players | You | Moderation |
| Technical logs: IP address, device and app version, request times | Automatically, by the server | Security, abuse prevention, and fixing problems |
Rafters doesn't ask Apple for your name or email address. I don't collect your location, contacts, photos, advertising identifier, or payment information.
3. Who can see what
- Players you're friends with, or have a friend request with, see your username, display name, level, and when you were last online, plus your Daily results and weekly XP (friends only).
- Anyone who knows your exact username can send you a friend request. They can't see anything about you until you accept.
- Anyone with a challenge code, signed in or not, sees the display names and results on that challenge's board.
- Daily statistics (how many players drafted each player, and how results were spread) are only ever shown as totals. Nobody can see what you personally picked.
- Series links you send (for example in Messages) contain both players' names, the seed, and the picks. Anyone you send a link to can open it.
- Game Center (optional) is run by Apple. Scores and achievements you post there follow Apple's privacy policy and your Game Center settings.
4. How I use data, and legal bases (EEA and UK users)
- To provide the online features you ask for (performance of a contract).
- To keep the service safe, prevent abuse, moderate content, and enforce the Terms (legitimate interests: a safe game for players).
- To comply with the law, including age assurance (legal obligation).
I don't use your data for advertising, profiling, or automated decisions with legal effects, and I don't sell or "share" personal information (as those terms are used in US state privacy laws).
5. Service providers
- Supabase, Inc. hosts the database, sign in, and realtime service in the United States (AWS us-west-1) as my processor, under its data processing agreement (including the EU Standard Contractual Clauses and the UK Addendum).
- Apple provides Sign in with Apple, Game Center, the App Store age range, notifications, and app distribution, under Apple's privacy policy.
I share data with nobody else, except where the law requires it or to protect players' safety.
6. International transfers
Rafters' server is in the United States. If you're outside the US, your data is transferred there. For EEA and UK users, these transfers rely on Standard Contractual Clauses.
7. How long I keep data
- Account, profile, friends, and blocks: until you delete your account.
- Unanswered match invites: 3 days. Idle matches are closed after 30 days, and finished matches are deleted 180 days after they end.
- Daily results and picks, challenges and their boards: about 13 months (400 days).
- Weekly XP: about 60 weeks.
- Reports: until resolved, then up to 12 months.
- Server logs: kept by Supabase for a short period (days, not months) for security.
- Deleting your account removes your data at once. Any provider backups roll off within their normal retention window.
8. Deleting your account, and other choices
- Delete your account: Settings › Delete account. This permanently deletes your account, username, display name, friends, blocks, online matches, leaderboard entries, Daily picks, challenges and challenge results, and reports you filed. It also disconnects Rafters from your Apple ID (you can confirm in iOS Settings › your name › Sign in with Apple). Games stored on your phone stay until you delete the app.
- Change your display name in Settings. Block or report any player from the Friends tab or a challenge board.
- Turn off reminders in Settings or in iOS Settings › Notifications. Stop using Game Center in iOS Settings › Game Center.
9. Your rights
Depending on where you live (for example the EEA, the UK, or certain US states), you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict some processing, and to withdraw consent. Email zacharytylerchung@gmail.com with your username. I'll respond within 30 days (45 where US state law allows) and may need to confirm the request comes from you. EEA and UK users may complain to their local data protection authority.
10. Children
Solo play is for everyone, but online features aren't for children under 13. Before online sign in, Rafters uses Apple's age range signal where available, and otherwise a neutral age question, and doesn't let under-13s create an online account. If I learn that I've collected personal data from a child under 13, I'll delete it. Parents can contact me at zacharytylerchung@gmail.com.
11. Security
Data is encrypted in transit (HTTPS). The server's row-level security limits each player to exactly what this policy describes, and names are checked against a filter. No system is perfectly secure. If a breach affects your data, I'll notify you and regulators where the law requires.
12. Changes
I'll post changes here and update the date above. If a change is significant, I'll tell you in the app before it takes effect.
13. Contact
Zachary Chung · zacharytylerchung@gmail.com