Privacy Policy

Effective date: 6 October 2026

Rumbol ("we", "our", "the Game") is an online ball-fighting game at rumbol.arkedpiksel.com. This Privacy Policy explains what information we collect when you play, how we use it, and the choices you have.

Information we collect

You can play Rumbol as a guest without giving us your name, email or anything else that identifies you. What we collect depends on how you play:

Guest account: your first visit creates an account on our server, so your progress is kept online. It's identified by a random account key saved in your browser. We store only a one-way hash of that key, never the key itself.
Optional sign-in: if you set a username and password, we store the username and a salted one-way hash of the password (we can't see or recover your password). If you link Google Sign-In, we store your Google account's unique ID and, if Google provides it, your email address. Your Google name is used once, to suggest your first display name.
Gameplay data: your display name, player ID (the # code), coins, gems, unlocked fighters, match history and stats, ranked ratings and season results, capsule pull history, and ad-reward claims. This is what lets your progress follow you between visits and devices.
Purchases: if you buy gems, payment is handled directly by Stripe on a page they host. We never receive or store your card details, only which gem pack was bought, the amount, the time, and Stripe's reference for the payment.
Technical data: your IP address, used to limit abuse (for example too many sign-in attempts) and to stop one person playing ranked against themselves from two accounts. It's held in memory and written to our server logs only alongside account and security events (an account being created, sign-ins and failed sign-ins, password changes, requests refused for abuse). Server logs also record game events by player ID, such as match results and purchases. Logs are deleted automatically after 30 days.
On your device: the Game uses your browser's local storage (not cookies) to keep your account key, your ad choice and a few settings such as sound. The account key is sent to our server to sign you in; the rest stays in your browser.

We don't use analytics or tracking tools, and we don't set cookies of our own.

How we use your information

To run the Game and keep your progress, coins and fighters.
To run online play: matchmaking, ratings, leaderboards and match history.
To process gem purchases and help with purchase problems.
To keep the Game secure and fair: preventing cheating, abuse and break-in attempts, and investigating problems.
To answer you when you contact us.

We do not sell your personal information.

What other players can see

Your display name and player ID are shown to other players in matches, in their match history, and on the leaderboard together with your ranked rating, tier and win record. Your username, email, Google account and purchases are never shown to other players.

Advertising

Rumbol may show ads from Google AdSense to stay free to play, but only if you agree. The first time ads are available, the Game asks you. If you accept, Google may use cookies and information about your device to show and measure ads, which can include personalised ads, as described in Google's policy. If you decline, no ad code loads and no advertising cookies are set. You can change your choice at any time with Ad choices at the bottom of the Game's page.

Third-party services

Google Sign-In: optional sign-in method.
Google AdSense: ads, only with your consent.
Stripe: payment processing for gem purchases (Stripe's privacy policy).
Google Drive: storage for our daily backups of the game database.

Each processes data under its own privacy policy, and may do so outside Malaysia. Our game server and database are in Malaysia; the backups are stored with Google. We don't share your information with anyone else, except where the law requires it or to investigate abuse of the Game.

Data retention

Account and gameplay data are kept for as long as your account exists.
Server logs are deleted automatically after 30 days.
Daily backups are kept for 14 days, so deleted data disappears from them within 14 days.
Records of purchases are kept for as long as the law requires for accounting and tax, even after an account is deleted.

Deleting your account and data

To delete your account, email myces.software@gmail.com with your player ID (the # code on your profile). To make sure the account is yours, we'll ask you to make a small change from inside it, such as setting your display name to a code we send you, or to write from the Google account linked to it. Verified requests are completed within 30 days.

Deleting removes your account, sign-in details, display name, progress, coins, gems, fighters, and match and pull history. Purchase records are kept for accounting as described above, no longer linked to your profile, and Stripe keeps its own records under its policies.

Please note: a guest account with no username, password or Google link is reachable only through the account key in your browser. If that's lost, we have no way to confirm the account is yours, so set up a sign-in method if you want to be able to reach your account later.

Your rights

Under Malaysia's Personal Data Protection Act 2010 you can ask to see, correct or delete the personal data we hold about you, or withdraw your consent to us using it (which may mean we can no longer provide parts of the Game to you). You can change your display name yourself at any time from your profile. For anything else, contact us at the address below.

Children's privacy

Rumbol is not directed at children under 13, and our Terms of Service require players to be at least 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it.

Security

Passwords are salted and hashed with scrypt, and account keys are stored only as a one-way hash. The Game is served over HTTPS only. No system is perfectly secure, so we can't guarantee absolute security, but we work to protect your information and will act promptly if something goes wrong.

Your choices

Play as a guest without giving any personal information.
Add a username and password, or link Google, only if you want to.
Change your display name at any time from your profile.
Accept or decline ads, and change that at any time with Ad choices.
Ask us to delete your account, as described above.

Changes to this policy

We may update this Privacy Policy from time to time. We'll update the effective date above, and let players know in the Game about significant changes.

Contact us

Questions about this policy or your data? Email us at myces.software@gmail.com.