Privacy Policy

Last updated: 22 October 2026

1. Who we are

Relic Rush (the "Game") at relicrush.com is run by Fun Based Games Ltd. ("we", "us"), a company based in Israel. We are the data controller for the personal data described here. This policy explains what we collect when you play, why, who we share it with, and the choices and rights you have. It covers the website, the installable web app and every game mode.

For anything about your data, write to contact@funbasedgames.com.

2. What we collect

If you play as a guest

You can play against the computer, and local games on one device, without an account. We do not create any record about you. What reaches us from a guest is limited to the anonymous game statistics described below, the technical logs every website receives (see "Technical data and server logs"), and a bug report if you choose to send one.

Account data

You need an account to play online and to appear on the leaderboards. When you create one, we store:

• your username (3–20 letters, numbers or underscores);
• your email address, and whether you have verified it;
• a one-way bcrypt hash of your password. We cannot read the password itself;
• the date you created the account, and when it was last active (the last time you signed in, opened the Game signed in, or connected to online play). Only the time is kept: no address and no device;
• the date you confirmed you are 13 or older;
• which version of the Terms of Service and this Privacy Policy you accepted, and when;
• moderation flags: whether the account is an administrator and whether it is banned, and for a ban, when it started, the reason we emailed you and which of our administrators made it;
• a record of what our administrators did to the account (for example a rename, a suspension, a password reset link or a message we sent you: what, when, by whom, and for a suspension the reason). It is kept for two years.

We do not ask for your real name, phone number, address or payment details. Sign-up asks your age only to check that you are 13 or older; we keep the date you confirmed it, not your age or date of birth. Some accounts made before we started asking for an email address may not have one until the player adds it.

Your email address

We use your email address for these things only:

• to verify that the address is yours (you can ask for the verification email again on the Account screen);
• to send a password reset link when you press "Forgot password" on the login screen. The link works for 1 hour;
• to send notices about your account: when its password is changed, if we have to rename it or suspend it (and why), and a last note when you delete it;
• when there is a reason to, for a message from us to you about your account or something you reported, written by a person and sent from contact@funbasedgames.com. If you lose access, we can also send you a password reset link; we never see or choose your password.

We never use it for marketing or newsletters, and we never show it to other players. These emails are sent from our Google Workspace mailbox.

Under 13

Accounts are for players aged 13 and over. If someone tells sign-up they are under 13, no account is created and they can keep playing against the computer as a guest. That browser then remembers the answer for 24 hours (in its own storage, under rr.signup.ageBlocked.v1), so the age cannot simply be changed and tried again straight away. This note stays on the device; it is not sent to us. See also section 9.

Online play

There is no chat of any kind in the Game, in the lobby or in a match. When chat was removed in October 2026 we deleted every chat message we had stored.

In an online match your moves, spells, dice rolls and other game actions pass through our server to the other players in your room. They are held in the server's memory for the length of the match and are never written to a database. We do not keep a replay or a move-by-move history of your games.

While you are in the online lobby, other signed-in players there can see your username in the list of who is online. If you host a game, its listing shows your username to players looking for a game.

Leaderboard records (signed-in players only)

When you finish an online game, or a game against the computer, while signed in, we store one record of it:

• the mode (online, or against the computer);
• whether you won;
• how many relics and how much mana you had;
• how many turns the game lasted and how long it took;
• how many players were in it and how many relics were needed to win;
• the date and time it ended;
• your username, linked to your account;
• for an online game you lost, the username of the player who won. This is what the Undefeated Token is built from.

The public leaderboards show usernames with their results (for example most wins, fastest win, longest game and most relics), the number of relics and players, and the date. Anyone who opens the leaderboards can see them.

Your own achievements (your games, wins, streaks and Undefeated Token) are shown only to you. They name the players involved, so if you are the first player to beat someone online, your username appears in their achievements, and theirs in yours.

Guests are never recorded here, and neither are local games on one device.

Anonymous game statistics

To understand how the Game plays (whether turns drag, whether some cards are never used, whether games are abandoned and where) we record a short summary of each finished or abandoned game. It holds only facts about the game: the mode, how it ended, the number of players, which seat in the turn order the reporting player had, the relic target, the number of turns, how long the game took, how long a typical turn and the slowest turns took, how many cards were played and which ones, relics collected, guardians defeated, whether the player was signed in (a yes or no, so we can count guests' games, never who), and when the summary arrived.

These records have no username, no account, no IP address and no identifier of any kind, not even a random one that could link two games to the same person. They cannot be traced back to you, so we also cannot find yours to show you or delete them one by one. They are collected whether or not you are signed in, because they are not about you. Games played in the Interactive Tutorial are not counted.

We also count how often four things happen: a game is started, the tutorial is opened, the leaderboards are opened, and someone clicks through to the physical board game. Each count is just the name of the event and the time. Nothing else is attached.

Bug reports

If you use Report a bug in the Game, your report contains:

• what you write;
• a reply address, if you give one. For a signed-in player it is filled in with the account's email address, and you can change or clear it;
• your account id and username, if you are signed in;
• facts about the game on screen: the mode, the number of players, the turn, the board seed and the game version;
• facts about your device: your browser and its user agent, your language setting, your screen size and the address of the page (which can include a room code);
• the last 20 lines of the in-game action log, which name the players in that game;
• up to two screenshots, if you attach them. These can show other players' usernames.

The report is sent as an email, through our Google Workspace (Gmail) account, to contact@funbasedgames.com. It is not stored in the Game's database. We delete bug report emails within 12 months. Our server log notes that a report was sent, how big it was, and the username if you were signed in, but not what it said.

Emails you send us

If you write to us, we receive your email address and whatever you include, and we use it to answer you.

Technical data and server logs

Like almost every website, our hosting provider (Google Cloud Run) automatically records standard information when your browser connects: your IP address, your browser type and version, the pages and files requested, the times, and any errors. Our game server also writes operational logs (for example when a room is created or a match starts) that include usernames and room codes. We use these logs to keep the service running, to fix problems and to spot abuse. We do not use them to profile you.

To slow down password guessing and spam, the server also keeps a short count of recent sign-ups, sign-in attempts, password reset requests, bug reports, game statistics sent and leaderboard requests for each IP address. This count lives only in the server's memory, is forgotten within about an hour, and is never written to the database.

Data stored in your browser

The Game keeps your settings and progress in your browser's local storage so they survive a reload. This data stays on your device and none of it is sent to us. (Staying signed in uses a cookie instead, described in section 10. A browser signed in before 22 October 2026 kept its login token here, under rr.auth.token; on its next visit the Game moves it into that cookie and deletes it.) Some keys end with your username (or "guest") so that two people sharing one browser keep separate settings.

Every item above is there to make the Game work or to remember a choice you made. None is used for tracking or advertising. The Game also registers a service worker that keeps copies of game files (code, pictures, music you have played) in your browser so the Game loads faster and can start offline. These copies contain no personal data. You can remove all of this at any time by clearing site data for relicrush.com in your browser.

What we do not collect

We set no cookies except the one that keeps you signed in (section 10). We do not use third-party analytics or advertising trackers, social-media pixels or fingerprinting. The statistics described above are our own, stay on our own servers, and are anonymous. We do not collect your precise location, your contacts, or anything from other apps or sites, and we do not buy data about you from anyone. Links in the Game to other sites (Discord, social media, the share buttons, our board game page) only take you there if you click them; those sites have their own privacy policies.

3. How and why we use your data

We do not use your data for marketing, for profiling, or for automated decisions that have legal or similarly serious effects on you. The username check at sign-up is automatic, but it only stops a name from being chosen; you can simply pick another.

4. Who we share data with

• Other players. In online play, other players see your username and your in-game actions. Signed-in players in the lobby see that you are online. Anyone can see your username and results on the public leaderboards. Please do not put personal information in your username.
• Service providers. Google Cloud (Google LLC) hosts our game servers, database and logs. Google Workspace (Google LLC) runs our email: account emails, bug reports and messages you send us. Google processes this data only to provide these services to us, under its data-processing terms. Have I Been Pwned checks a new password against passwords leaked from other websites; it receives only the first 5 characters of a one-way fingerprint of the password, which is shared by hundreds of other passwords, and never the password or anything about you.
• Discord. We only link to our Discord server. We do not send Discord any data about you. If you join, Discord's own terms and privacy policy apply to what you do there.
• Legal reasons. We may disclose data if we believe in good faith that the law, a court order or a government request requires it, or to protect the rights, safety or property of Fun Based Games, our players or the public.
• Business changes. If Fun Based Games is involved in a merger, acquisition or sale of assets, your data may pass to the new owner, who will remain bound by this policy.

We do not sell your personal data, and we never have. We do not share it with advertisers or data brokers.

5. International transfers

Our game servers and database are hosted by Google Cloud in the United States, and our email is handled by Google Workspace. If you play from the European Economic Area, the United Kingdom, Switzerland or another country with data-transfer rules, your data is transferred to and stored in the US. Google is certified under the EU–US Data Privacy Framework and offers Standard Contractual Clauses for transfers, which we rely on for these transfers.

We are based in Israel, and the European Commission has recognised Israel as giving adequate protection to personal data.

6. How long we keep data

• Account data: for as long as your account exists. When you delete your account on the Account screen, it is deleted straight away. If you ask us by email instead, we delete it within 30 days.
• What deleting your account does: your username, email address, password hash, dates and flags are removed. Your leaderboard records are deleted too, and your username is taken off other players' records (where you beat someone online, their record then says "an unknown rival"). Your username becomes free for someone else to choose, and it inherits none of your history.
• Backups: deleted data can stay in our routine database backups for a limited time, until those backups are replaced. We do not use backups for anything except recovering from a fault.
• Gameplay data: held in server memory during a match only, then discarded.
• Leaderboard records: kept while your account exists, so the boards stay meaningful over time.
• Chat: there is none. Every stored chat message was deleted in October 2026.
• Anonymous game statistics and counts: kept indefinitely. They contain no identifiers, so there is nothing in them to expire, and their value is in comparing one year with the next.
• Bug report emails: deleted within 12 months.
• Emails you send us: kept only as long as we need them to deal with your message and any follow-up.
• The record of what our administrators did to an account: two years. If the account is deleted, its name is taken off that record at once.
• Server and hosting logs: kept for about 30 days, and longer only if we need them to look into a specific security incident or abuse report.
• Data in your browser: stays until it expires or you clear it.

7. Security

We protect your data in ways that fit the small amount we hold. Passwords are stored only as bcrypt hashes, and a new password must be at least 8 characters and not one already leaked from another website (checked as described in section 4, without sending it anywhere). All traffic to the Game is encrypted (HTTPS and secure WebSockets). Sign-in uses signed tokens that expire after 7 days, and changing or resetting your password signs out every other device. Password reset links expire after 1 hour and work once; we keep only a one-way hash of them. Database passwords and signing keys are kept out of the code, and only the people who need it can reach the database and the moderation tools. No system is perfectly secure, so please use a password you do not use anywhere else, and tell us if you think something is wrong.

8. Your rights and choices

Depending on where you live (for example under the EU or UK GDPR, Israel's Protection of Privacy Law, or US state privacy laws), you may have the right to:

• Access the personal data we hold about you;
• Correct data that is wrong;
• Delete your account and personal data;
• Get a copy of your data in a format other services can read;
• Object to, or ask us to limit, use of your data that relies on our legitimate interests;
• Complain to a data protection authority: in Israel, the Privacy Protection Authority; in the EU, the authority in your country; in the UK, the Information Commissioner's Office (ICO).

Most of this you can do yourself on the Account screen, which opens from Account, beside your name at the top left of the main menu. There you can see your email address and whether it is verified (and send the verification email again), change your password, download a copy of your data (a JSON file with your account details and your leaderboard records), and delete your account. Deleting asks for your password.

For anything else, or if you cannot sign in, email contact@funbasedgames.com. We may need to check that the account is yours, for example by replying to the email address on the account. We answer requests within 30 days. We will not treat you worse for using your rights. Because we never sell data or use it for targeted advertising, there is nothing to opt out of on that front.

You can also delete everything the Game keeps on your device at any time by clearing site data for relicrush.com in your browser.

9. Children

Accounts, and so online play and the leaderboards, are for players aged 13 and over. Sign-up asks your age without suggesting an answer. If you are under 13, you cannot create an account, but you can still play against the computer as a guest, and we collect no personal data about you when you do.

We do not knowingly keep personal data about children under 13. If we learn that an account belongs to someone under 13, we delete it. If you are a parent or guardian and think this has happened, email us and we will deal with it. If you are under 18, please read this policy with a parent or guardian.

10. Cookies

Relic Rush sets one cookie for players, and only when you sign in: it keeps you signed in. It is strictly necessary for the account you asked for, so it needs no consent and the Game shows no cookie banner. Nobody else sets cookies through the Game.

Neither cookie is used for tracking, advertising or statistics, and neither is shared with anyone. The local storage and service-worker copies described in section 2 are used only to make the Game work and to remember your choices, not to track you across sites.

11. Changes to this policy

We will update this policy when our practices change. The date at the top shows the current version. If a change matters, we will tell you in the Game before it applies. We keep a record of which version each account holder accepted.

12. Contact

Fun Based Games Ltd.
Email: contact@funbasedgames.com