Privacy Policy
Effective October 10, 2026
Rhythm Breach is an iPhone game made by DeadPixel LLC ("we", "us"). Rhythm Breach is distributed on the App Store by Christopher Moore on behalf of DeadPixel LLC. This policy explains what the game and its server (rhythm.ckmtools.dev) collect, why, how long we keep it, and what you can ask us to do with it. The short version: you play without signing up, we don't ask for your name, email, contacts or location, we don't sell your data, and we don't track you across other companies' apps or websites.
Your anonymous account
The first time you open the game, it quietly creates an anonymous account on our server. There is no sign-up. The account has:
- a random account ID (not linked to your name, Apple ID, phone number or device identifiers);
- a random secret token that the app keeps in your iPhone's Keychain and sends to prove it's you. Our server stores only a one-way hash of the token, plus when it was created and roughly when it was last used (to the hour);
- a player name (Root generates one, like "Neon Daemon"; you can change it) and a short random tag, plus when you last changed the name.
Please don't use your real name or anything that identifies you as your player name. Names go through a profanity filter.
Gameplay data
To run the daily leaderboards, attempts, streak and library, our server stores, for your account:
- Runs you finish on the daily song: the date, difficulty, attempt number, score, accuracy, outcome, counts of Perfect/Good/Miss, best combo, the time it was submitted, and the run's input log (the timing of each tap and release within the song). We replay the input log to check the score is genuine, and keep it to detect cheating.
- Attempts: which attempts you started, on which day and difficulty, and when.
- Extra attempts from ads: when a rewarded ad grants you more attempts, the ad's transaction ID from Google, the day and difficulty, and when.
- Library choices: which locked songs you won back, and when.
- Name reports: if you report another player's name on a leaderboard, which player and name you reported, the reason you picked, and when; if your name is reported, the same records about you. A name reported by several players is replaced with a generated one, and that name can't be used again.
- Subscription status (if you subscribe; see "Purchases" below).
Your streak and library are worked out from these records. Leaderboards are public to other players: they show your player name (and tag, when someone else has the same name), score, accuracy and outcome.
Some data stays only on your iPhone and is never sent to us: your timing calibration, settings, the cached daily songs, runs waiting to be sent, and the share card images. A share card leaves your phone only if you choose to share it.
IP addresses and server logs
Every request to our server passes through Cloudflare (see below), which tells our server the IP address it came from. Our server uses that address only to limit how many requests one address can make (to stop abuse). It is held in the server's memory, is never written to our database, logs or backups, and is discarded when the server restarts (which happens with every update).
Our server logs record the type and path of each request (for example "POST /v1/runs") and, for requests that fail, the full address requested and the app's user-agent string, plus your account ID in a few messages (for example when an ad grants attempts). They don't contain IP addresses. Logs are capped at about 30 MB, overwritten as new entries arrive, and deleted whenever the server is updated.
Ads (Google AdMob)
If you choose to watch a rewarded ad for extra attempts, the ad is shown by Google AdMob, using Google's Mobile Ads SDK in the app. We ask Google for non-personalized ads only, and the app does not use Apple's App Tracking Transparency or ask permission to track you, so it can't access your device's advertising identifier.
Even for non-personalized ads, Google collects information from your device to show the ad, limit how often you see it, measure it and prevent fraud. This can include your IP address (which Google uses to estimate your general location), device and app information (including an app-specific device identifier, the IDFV), and how you interact with the ad. So that Google can tell our server you earned the reward, the app passes your anonymous account ID and the day and difficulty to Google with the ad, and Google sends them back to our server.
If you're in the European Economic Area, the UK or Switzerland, the app shows Google's consent form before ads, where you can make your choices; you can change them later in the app.
Google's use of this data is covered by Google's Privacy Policy and How Google uses information from sites or apps that use its services. Subscribers don't see ads.
Purchases (Apple)
Subscriptions are sold and billed by Apple through the App Store. We never see or store your payment details, name, email or Apple ID. To unlock subscriber features, the app sends us the App Store's signed transaction information for your subscription (such as the product, transaction IDs, purchase and expiry dates, and renewal status), which our server checks and stores with your anonymous account. Apple's handling of your purchase is covered by Apple's Privacy Policy.
Cloudflare
Our server is reached through Cloudflare, which provides the secure connection (HTTPS) and protects the server from attacks. Cloudflare processes the requests your app and browser make, including your IP address, as our service provider, under Cloudflare's Privacy Policy. This website uses Cloudflare Web Analytics to count page views: it sets no cookies, doesn't fingerprint you or track you across sites, and gives us only aggregate numbers (visits, pages, countries, referrers).
Our support email ([email protected]) is forwarded by Cloudflare Email Routing. If you email us, we receive your email address and whatever you write, and use them only to answer you.
What we don't do
- We don't sell or rent your data, and we don't share it for cross-context behavioral advertising.
- We don't track you across other companies' apps or websites, and we don't use App Tracking Transparency.
- We don't use analytics or crash-reporting services in the app. This website has no cookies or trackers; its only analytics are Cloudflare's cookieless, aggregate page counts (above).
- We don't collect your name, email (unless you write to us), phone number, contacts, photos, microphone or location.
How long we keep it
- Your account and gameplay data are kept while the game is running, so your streak, library and past leaderboards keep working, until you delete them (see below).
- IP addresses: only in server memory, until the next restart. Server logs: overwritten as they fill and deleted at every update.
- Backups: the database is backed up nightly to storage we control. After a deletion, your data disappears from backups as they expire, within 6 months.
- Support emails: kept as long as needed to help you, then deleted.
Deleting your data, and your other choices
In the app: open Settings (the gear on the Today screen) > Delete my data. This deletes your account and everything tied to it from our server immediately: your player name, runs and scores, leaderboard entries, streak and library, attempts and ad grants, name reports, and our record of your subscription purchases. The app then forgets your account and its local copies (calibration and settings stay on your iPhone) and starts again as a new player. Copies in our backups disappear as the backups expire, within 6 months.
By email: you can also email [email protected] with your player name and tag (in the app: Settings > Player name), and we'll delete it for you within 30 days. You can ask us for a copy of your data, or to correct it, the same way.
Deleting your data doesn't cancel a subscription: Apple keeps billing your Apple ID until you cancel it in your Apple ID settings (the app's delete screen has a button for it).
Deleting the app doesn't delete the data on our server, and the Keychain may keep your account on your iPhone if you reinstall. Depending on where you live (for example in the EEA, the UK or California), you may have further rights over your data, such as objecting to how it's used or complaining to your data protection authority; contact us and we'll help.
Why we use your data
We use the data above only to run the game: to provide the daily song, leaderboards, attempts, streak, library and subscription features, to verify scores and prevent cheating and abuse, and to keep the service secure. Where the law asks for a legal basis, that's providing the game you asked for (contract) and our legitimate interest in keeping it fair and secure; for ads in the EEA and UK, the consent you give in Google's form.
Where your data is stored
Our server and its backups are in the United States. Cloudflare, Google and Apple may process data in other countries under their own policies.
Security
Connections to our server use HTTPS. The server accepts traffic only through Cloudflare's tunnel, stores only hashes of account tokens, and runs with minimal privileges. No system is perfectly secure, but we work to protect your data.
Children
Rhythm Breach is not directed at children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has used the game, contact us and we'll delete the account's data.
Changes
If we change this policy, we'll post the new version here with a new effective date. If a change is significant, we'll also mention it in the app.
Contact
Questions or requests about your privacy: