Last updated: August 2026
Netnovate LLC, 7901 4th ST N STE 300, St. Petersburg, FL 33702, USA, operates RPS Ninja at https://rpsninja.uk and is the data controller responsible for processing personal data described in this policy. For privacy-related questions or to exercise your rights, contact us at [email protected].
Registered accounts: player name, e-mail address, password (stored only as a secure hash), optional country, language preference, e-mail verification status, XP, win streak, tutorial progress, and last activity timestamps.
Guest play: a display name you enter locally (also stored in your browser), game participation data, and optional approximate location (country/city) derived from your connection.
Sign in with Apple (iOS app): when you sign in with Apple we receive a stable Apple user identifier and, if you choose to share them, your name and/or private relay or real e-mail address. We store the Apple user ID to recognise returning players and the chosen display name for gameplay. We do not receive your Apple ID password.
Facebook Login (website): if you choose to sign in with Facebook on our website, we receive a scoped Facebook user ID, your public name, and your public profile photo URL via the public_profile permission. We do not request or receive your Facebook e-mail address or friend list.
Facebook Instant Games: when you play via Meta/Facebook, we receive a scoped player ID and a cryptographically signed token (Zero Permissions / NEZP). We may receive an optional display name, profile photo URL, and locale from the Instant Games SDK. We do not receive your Facebook e-mail or friend list in this mode.
During games: in-game chat messages, game state, match results, combat choices, and online presence while you use the lobby, tutorial, or an active match.
Leaderboard: for registered players we show name, country flag, rank, games played, win rate, and XP. On iOS we may also submit your career XP to Apple Game Center (leaderboard ID alltime_leaderboard) when you are signed into Game Center.
Advertising (native iOS app): when ads are enabled, Google AdMob may process device and advertising identifiers (including Apple’s IDFA if you allow tracking), IP address, ad impressions/clicks, and similar technical data to deliver and measure ads (see section 5).
We rely on the following legal bases under the GDPR (where applicable):
We also send account e-mails (verification and password reset) necessary to operate your account.
We use strictly necessary cookies:
For marketing and analytics we use the Meta (Facebook) Pixel on the public website only, which may set cookies and similar technologies to record page views and interactions (e.g. which pages you visit). This helps us understand ad performance and improve our campaigns. The Pixel relies on our legitimate interest in campaign measurement; you can object at any time (see section 7) or manage ad personalisation directly via Meta’s ad preferences. Where local law requires prior consent for such technologies, we are working towards a consent mechanism; until then, you can block the Pixel using browser extensions or your ad preferences.
We do not sell your personal data. We only share data with the service providers and platforms described below, each acting as a processor or independent controller for their own platform:
Apple (Sign in with Apple & Game Center) – in the native iOS app, authentication uses Sign in with Apple. Apple processes authentication data under its own terms. If you revoke Sign in with Apple or delete your Apple ID, Apple may notify us and we anonymise the linked account (see section 6). When Game Center is enabled, career XP may be submitted to Apple’s Game Center leaderboards; Game Center data is governed by Apple.
Google AdMob (advertising in the iOS app) – the native iOS app may show banner and interstitial ads through Google AdMob (Google LLC). AdMob and its advertising partners may collect and use device identifiers (such as the advertising identifier IDFA on iOS when you grant permission), IP address, ad interaction and performance data, and similar technical information to deliver ads, measure campaigns, prevent fraud, and personalise advertising where allowed. On iOS we may show Apple’s App Tracking Transparency (ATT) prompt; you can deny tracking and still play. Where required (e.g. EEA/UK), we use Google’s User Messaging Platform (UMP) to obtain or manage ad consent. Google’s policies: Google Privacy Policy, How Google uses data in apps that use AdMob. You can limit ad personalisation in iOS under Settings → Privacy & Security → Tracking, and via Google Ads Settings.
Meta Instant Games & Facebook – when you open RPS Ninja inside Facebook/Messenger, the game runs in a Meta webview and uses the Instant Games SDK (v8, Zero Permissions). Meta may process technical data needed to operate the platform. Our servers verify signed player tokens from Meta; we store the scoped player ID to recognise returning players. If you request data deletion in Meta account settings, Meta notifies us and we anonymise the linked account (see section 6); you can check the status on our data deletion status page. Meta policies: Privacy Policy.
Facebook Login (website) – used only if you actively choose to sign in with Facebook on our website. We receive the data described in section 2 via a separate Facebook Login app and store it to create or link your account.
Meta (Facebook) Pixel – on the public website (not inside the Instant Games webview) we may embed a tracking pixel from Meta Platforms Ireland Ltd. / Meta Platforms, Inc. It may process your IP address, browser data, pages viewed, and events on this site. Meta may link this data to your Meta account if you are logged in there. For details see Meta’s Privacy Policy and your ad preferences.
Cloudflare may sit in front of the website and provide security and delivery. Cloudflare can pass country/city headers to our server; we store country/city only in connection with game participation where applicable.
Font Awesome (CDN) loads icon fonts when you open the site. The provider may process your IP address for delivery.
E-mail delivery uses our configured SMTP provider to send verification and password-reset messages.
Account data is kept for as long as your account exists. Game and match history is retained for statistics and leaderboards. E-mail verification tokens expire after 24 hours and password-reset tokens after 1 hour; used or expired tokens are no longer valid. Server and e-mail logs are kept only as long as needed for operation and troubleshooting.
Account deletion: you can permanently delete your account in the app or website under Edit Profile. We then anonymise personal identifiers, reset XP and win streak, unlink your account from past matches, and end your session. Deletion cannot be undone.
Facebook Instant Games deletion: when you request data deletion via Meta account settings, Meta calls our deletion endpoint. We then anonymise your linked account as above and record a confirmation code you can look up on our deletion status page. This typically completes within a few minutes of the request.
Depending on applicable law (including the GDPR if you are in the EEA/UK), you may have the right to access, rectify, delete, or restrict processing of your personal data, to object to certain processing (including processing based on our legitimate interest, such as the Meta Pixel), and to data portability. You may also lodge a complaint with a supervisory authority.
On iOS you can withdraw ad-tracking permission at any time under Settings → Privacy & Security → Tracking. Ad consent choices shown via Google UMP can be reopened from the app when we provide a privacy/consent control, or managed through your device and Google ad settings.
You can update name, country, password, and language in your profile when logged in. To permanently delete your account (including XP, stats, and game progress linked to your account), use Delete account in Edit Profile. For other privacy requests, contact [email protected].
Netnovate LLC is based in the United States. Some of our service providers (including Meta and Cloudflare) may process data outside your country of residence, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses or the provider’s own compliance framework for international transfers.
RPS Ninja is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact [email protected] so we can remove it.
We may update this privacy policy from time to time. The current version is always available on this page.