Privacy Policy

Effective date: 28 August 2026 · Last updated: 28 August 2026 · Version 2.0

The short version

Waterway Rumble has no accounts, no sign-in, no analytics, no ads, and no chat. Your game progress stays on your own device. We come very close to collecting nothing at all. The one exception: store versions of the game talk to a single service, RevenueCat, which confirms World Tour Pass purchases. It hears from the game when the game starts (so a Pass you own stays unlocked) and when you buy or restore the Pass, it receives only the anonymous details described below, and that is the complete list of anything that ever leaves your device because of us.

Who we are

Waterway Rumble is made by Flaux, an independent Australian games developer. For anything privacy related, email hello@flaux.ai and a real person will reply. In the legal language some regions use, Flaux is the "data controller" for the small amount of data this policy describes, which simply means we are the ones responsible for it.

Everything at a glance

Nothing about any of this identifies you. There is no account and no identity anywhere in the game, so you can play the whole thing anonymously. Buying the Pass is entirely optional, and the purchase check identifies an anonymous copy of the game, not a person. Your progress and character name never leave the device at all.

What the game stores on your device

The game saves your progress in your device's ordinary app storage (Android SharedPreferences, iOS UserDefaults, or your browser's local storage if you play a web build). It is not a file you have to manage. It contains: your coin and ink balances, items you own and have equipped, races finished, per-level records, a recording of your best run on each level (so you can race your own ghost), unlocked levels and medals, sound, graphics, and difficulty settings, your wish-listed item, your easter-egg progress, whether you own the World Tour Pass, and your character's name.

About the character name: you type it yourself, it is capped at 12 characters, and it is stored only on your device. It is never sent anywhere, never shown to another player, and never seen by us. There is no multiplayer, no leaderboard, and no chat, so there is nobody for it to be shown to. Type whatever you like, but as with any name field in any app, we suggest not using a real full name.

The World Tour Pass purchase

The game offers a single optional one-time purchase, the World Tour Pass. The payment itself is handled entirely by the store you got the game from (the Amazon Appstore, Google Play, or the Apple App Store). We never see your card number, billing address, store account, or any payment details. Your store account and the payment are covered by that store's own privacy policy, and the store's family purchase controls apply.

To confirm purchases and keep them working, store versions of the game use RevenueCat, Inc., a purchase-infrastructure service. RevenueCat acts only on our instructions and only to run purchases for Waterway Rumble: in the legal language, it is our "processor", a company that handles data solely on our behalf, never for its own purposes. The game contacts RevenueCat when it starts (a quick check that a Pass you own is still valid) and when you buy or restore the Pass. RevenueCat receives:

• a random ID created for your copy of the game when it is first installed. It is not your name, email, or anything else about you;
• when you buy or restore, the store's purchase receipt for the Pass. On the Amazon Appstore the check also includes an ID Amazon issues for your store account, because Amazon requires it to verify the receipt; we still never see your name, email, or payment details. When you restore, the store, not you, tells RevenueCat you already own the Pass;
• basic technical details that come along with any such request: device model, operating system version, the game's version, language and locale, and the connection's IP address. We never see the IP address; RevenueCat's servers see it in order to deliver the response and hold it as part of the purchase record, under the same rules as everything else here. The full list is in RevenueCat's privacy policy, linked below.

This is used for exactly one job: confirming purchases are genuine, unlocking (or re-unlocking) the World Tour Pass, and protecting against fraudulent purchases. Here is how we make sure the random ID cannot be used for anything else: it is random, so it says nothing about you; we hold no other information it could be matched to; RevenueCat is bound by a written data processing agreement to protect this information to at least the standard described in this policy and to use it only to provide the purchase service to us; and neither we nor RevenueCat use it for advertising, profiling, tracking, or contacting anyone. Data sent to RevenueCat is encrypted in transit.

RevenueCat's servers are in the United States, wherever you live. Its data processing agreement, which covers our use of the service, includes the European Commission's Standard Contractual Clauses and the UK Addendum, the standard legal safeguards for data leaving the EU and UK. You can read it at revenuecat.com/dpa and RevenueCat's own privacy policy at revenuecat.com/privacy.

How long it is kept: the purchase record is kept for as long as it is needed to keep your World Tour Pass unlocked and restorable, because the Pass is a one-time purchase that is yours for good. If you want the record deleted sooner, email us (see "Deleting your data" below).

What the game does NOT do

• No accounts and no sign-in. There is nothing to register, so there is also no account to delete.
• No personal details. The game never asks for or collects your name, email address, or phone number. (If you choose to email us for support, we see your email address then, and use it only to reply.)
• No analytics, telemetry, or crash reporting. We know nothing about how you play: no scores, no progress, no crash reports. The purchase service necessarily notices when an anonymous copy of the game checks in at launch, but that is as far as it goes, and neither we nor RevenueCat use it to build any picture of you.
• No advertising. No ad network or ad SDK is present in the app, and the game never reads your device's advertising ID.
• No tracking. The game does not track you across other companies' apps or websites, and does no profiling or automated decision-making about you. There is nothing to feed it.
• No location, no camera, no microphone, no contacts, no photos. The app never asks for these permissions because it never uses them.
• We never sell, trade, or rent your information. The only sharing that ever happens is with RevenueCat, our purchase service provider, which acts only on our instructions, as described above. The only situation in which we would disclose anything else is if the law compelled it, for example a court order, and there is very little that could even be disclosed.

A note on Android permissions

The Android build declares three permissions: INTERNET (to talk to RevenueCat as described above), ACCESS_NETWORK_STATE (added by the purchase library to detect whether a connection exists), and the store's billing permission (required to offer the World Tour Pass). None of them read anything about you, and there is no other network code in the app.

A note on the "Watch Ad" button

The free web version of the game shows a 2X COINS (WATCH AD) button on the results screen. It is a placeholder built into the game itself with a short countdown. It is not a real advertisement, nothing is downloaded, and no ad company is involved or sees anything about you. Every store build (phones, tablets, and TVs) switches it off entirely. If real ads are ever added, this policy will be updated first.

Children and families

Waterway Rumble is made for everyone, including kids. So we treat every player as if they might be a child, and the whole game follows the strictest rules: no ads, no tracking, no accounts, no chat, and no personal details like names, emails, photos, or locations ever collected from anyone, of any age. The only data that exists, the anonymous purchase check described above, is designed to identify a copy of the game, not a person. Purchases go through your app store's own purchase flow, where the store's parental controls and approval settings apply.

Parents: because we collect no personal details, there is nothing about your child for us to show you, correct, or hand over beyond that anonymous purchase record, and no server of ours holds anything at all. If your family bought the World Tour Pass and you would like the record deleted, email hello@flaux.ai and we will arrange it (see "Deleting your data" for one honest caveat). You can also stop any collection before it starts: nothing leaves the device except the check described above, and your app store's parental controls let you require approval for any purchase. Any other question about your child's privacy in the game, we are happy to answer at the same address.

Backups and reinstalling

Your device's own operating system may back your saved progress up, so that a reinstall or a new device does not cost you your unlocks. This is a feature of Android and iOS, not something the game does, and the copy belongs to you:

• Android may back the save up to your own Google account (Android Auto Backup). Google encrypts it, and it is restored when you reinstall. We have no access to it. You can turn off app data backup in your device's backup settings (Settings, then Google, then Backup), though on most devices that switch covers all apps, not just this game.
• iOS includes the save in your iPhone or iPad backup, which goes to your own iCloud account or your own computer. Again, we have no access to it.

Deleting your data

On your device: uninstall the app (or clear its data). That removes everything the game stores on the device. To also remove the backup copy your own platform made, use your platform's controls: on Android, Google Drive → Backups, or Settings → Google → Backup; on iOS, Settings → your name → iCloud → Manage Storage → Backups. If you play a web build, clearing the browser's site data removes the save.

The purchase record at RevenueCat: email hello@flaux.ai, or reach us via the support page, and we will have it deleted. Two honest caveats. First, deleting it means your World Tour Pass can no longer be restored from it, so only ask if you are sure. Second, because the record is anonymous, we cannot always tell which record is yours; include the device model and rough purchase date and we will work with RevenueCat to find it, and we will tell you plainly if we cannot.

Your rights and choices

Wherever you live, you can email hello@flaux.ai to ask what information exists in connection with your copy of the game, have it corrected or deleted, or object to how it is handled. We will acknowledge you promptly and give you a proper answer within 30 days. Because there is no account and almost no data, the honest answer will usually be short.

For players in the EU and UK: the purchase check is processed because it is necessary to deliver the purchase you chose to make (contract performance, Article 6(1)(b) of the GDPR, Europe's privacy law), and fraud prevention rests on our legitimate interest in only unlocking genuine purchases (Article 6(1)(f)). Nothing in the game relies on your consent, so there is no consent to manage or withdraw. You have the rights to access, rectify, erase, restrict, port, and object, all via hello@flaux.ai. You can also complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country. We would appreciate the chance to fix things first. UK players: we acknowledge complaints within 30 days.

For players in Australia: Flaux is a small Australian business, so parts of the Privacy Act 1988 (Cth) may not legally apply to us. We follow the Australian Privacy Principles anyway, because it is the right way to treat players. The purchase data described above is disclosed to an overseas recipient, RevenueCat in the United States, under the contractual protections described earlier. If you think we have handled your information badly, email hello@flaux.ai and we will respond within 30 days; if you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

For players in California: we do not sell or share personal information as those terms are defined in the California Consumer Privacy Act (the CCPA), and never have.

Security

There is no Flaux server and no database of players anywhere. The little that exists (the anonymous purchase record) is held by RevenueCat under its security programme, and it travels there encrypted. If anything ever went wrong with that data, we would tell affected players and the OAIC about it plainly and quickly.

Changes to this policy

If the game ever changes in a way that affects any of the above (real ads, online features, new purchases), this policy will be updated before that version ships. The new version will appear at this address with a new date and version number at the top, and material changes will be called out in the game's store update notes. The store privacy declarations (Google's Data safety, Apple's privacy label, Amazon's privacy labels) will be updated at the same time so they always match this page.

Contact

Questions about this policy or about privacy in the game:

hello@flaux.ai

Waterway Rumble is a single-player game that works offline. This policy is written to meet the Australian Privacy Principles and the privacy policy requirements of the Amazon Appstore, Google Play, and the Apple App Store, in plain language a 14-year-old can read, because that is who plays waterslide games.

Version history: v1.0 (26 Aug 2026) first published · v1.1 (27 Aug 2026) disclosed the RevenueCat purchase check · v2.0 (28 Aug 2026) full rewrite: summary table, launch-time check disclosed, children and families section, retention, regional rights, security.