This Privacy Policy and Terms of Service document (the "Policy") explains how RuiCodex ("we," "us," or "our") collects, uses, protects, and handles information when you use the mobile application Idle Defense: Cosmic TD (the "App"). By downloading, accessing, or using the App, you explicitly agree to the terms outlined in this Policy.

1. Information Collection & Usage

We respect your privacy and strive to collect only the data absolutely necessary to run the game efficiently. The App may collect:

• Local Game Data: Your progress, tower levels, inventory, and settings are saved locally on your device via localStorage.
• Cloud Save Data: If you voluntarily create an account and authenticate — using Sign in with Apple on iOS or Sign in with Google — your game state, chosen username, and device identifiers are transmitted securely to our servers strictly for the purpose of cross-device synchronization and leaderboards. You can play the entire game as a guest without an account; guest progress stays on your device only.
• Leaderboards & Weekly League: Once you choose a player name, your progress figures (highest wave, total kills, play time, prestige count and your weekly-league score) are sent to our server with that name — and linked to your account if you are signed in — so the global leaderboard and the weekly league work and implausible scores can be filtered out. These figures are not anonymous; they are deleted together with your account.
• Product Analytics (consent-based): With your consent we record a small number of gameplay events, both on our own server and in our self-hosted PostHog — session start and end, progression milestones, prestige, shop and offer interactions, purchases and rewarded-ad views — together with an app-generated identifier, your app version, platform and language. These are used only to understand how the game is played and where players get stuck. Frequent actions (upgrades, cleared waves) are counted on your device and sent once per session, not one by one. We do not collect your name, e-mail address or the contents of anything you type.
• Purchase Verification: When you buy something in the App, the order number, product, price, currency and the purchase token issued by Google Play or the App Store are sent to our server, together with an app-generated device identifier, so we can confirm the purchase with the store, deliver the item exactly once and restore it later. We never receive your card or payment details.
• Feedback You Send: If you use Settings → Send feedback, we store the category and message you write, your optional "what next" vote, an app-generated device identifier, your app version, language and platform. It is used only to fix problems and plan updates, is never shown publicly, and is deleted together with your account. Please do not include personal information in the message.
• Crash Reports (consent-based, gradual rollout): If the App hits an unexpected error, we may send the error type and the place in the code where it happened. Error messages, which can contain personal content, are deliberately not sent.

1b. Your Choice: Ads & Analytics Consent

In the European Economic Area, the United Kingdom and Switzerland the App asks for your consent before personalised advertising and analytics, using Google's official consent form (UMP). Product analytics and crash reports are only collected when that consent is granted. If consent has not been given, or has not yet been answered, nothing is captured.

You can review or withdraw your choice at any time from Settings → Privacy → Privacy options inside the game. Withdrawing stops analytics collection immediately, in the same session, and you can keep playing exactly as before.

2. Third-Party Services & Advertising

To support the continued development of the App, we integrate secure third-party services. These services may collect their own data under their respective privacy policies:

• Google AdMob: We use AdMob to display rewarded video advertisements only — these are optional and play only when you choose to watch one in exchange for an in-game bonus. AdMob may collect device-specific information (e.g., Advertising IDs, IP addresses) to provide personalized ads.
  On iOS: before any tracking identifier (IDFA) is used, the App asks for your permission through Apple's App Tracking Transparency framework. If you decline, rewarded ads still work — they simply are not personalized. You can change this choice at any time in Settings > Privacy & Security > Tracking.
  On Android: you can reset or delete your Advertising ID and opt out of personalized ads in Settings > Google > Ads.
• Apple App Store & StoreKit (iOS): In-app purchases on iOS are processed by Apple. If you use Sign in with Apple, we receive only a unique identifier and, at your choice, an email address — which may be Apple's private relay address that hides your real one. We never receive your Apple Account password or any payment details.
• Google Play Services (Android): Used for secure authentication, app integrity checks, and processing in-app purchases. If you use Sign in with Google, we receive your account's unique identifier, display name, and email address. We never receive your Google password or any payment details.
• PostHog (self-hosted by us): Product analytics and crash reports are processed by a PostHog instance that we operate ourselves on our own servers (posthog.ruicodex.com). The data is not sold, and it is not shared with advertising networks. Analytics events carry an identifier we generate for analytics only — never your account's internal id, your name or your e-mail address.
• Appwrite (self-hosted by us): Live figures in the game — the number of players online, the weekly league standings and the global leaderboard — are pushed to your device through an Appwrite instance we operate (appwrite.ruicodex.com). Those public rows contain no user ids and no player names: each entry is identified by an irreversible per-week code, and your device matches it to a name using the response from our own API.

RuiCodex is not responsible for the data collection practices of these third parties.

3. Data Deletion & User Rights (GDPR / CCPA)

If you reside in a jurisdiction covered by GDPR, CCPA, or similar privacy laws, you possess the right to access, rectify, or erase your personal data.

• You can clear your local game data at any time by uninstalling the App or clearing the App's data in your device settings.
• If you have utilized Cloud Saves or the Guild feature, you may request complete deletion of your server-side account and associated data by contacting us directly — step-by-step instructions, including deletion by email without the app, are on our account deletion page.
• Deleting your account inside the App (Settings → Danger Zone → Delete account) removes your account, cloud save, redeemed codes, leaderboard, weekly-league and event entries, guild ownership and any feedback you sent from our servers, and also deletes the analytics profile and its events from our PostHog instance. Purchase records are kept only in anonymised form (no account or device link), because tax and refund law requires them.

4. Children's Privacy (COPPA)

The App is not directed toward children under the age of 13. We do not knowingly collect personal identifiable information from children. If you are a parent or guardian and discover that your child has provided us with personal data, please contact us immediately so we can take necessary actions to remove that information from our servers.

5. Limitation of Liability

6. Purchases, Restoring and Refunds

The App has no subscriptions. All in-app purchases are one-time and are processed entirely by the platform operator — Apple on iOS, Google on Android. RuiCodex never receives or stores your payment card details.

• Non-consumable items (Founder Pack, Remove Ads, Commander Pass and the Commander Pass upgrade) are tied to the store account you bought them with. If you reinstall the App or move to a new device, sign in with the same store account and use Restore Purchases in the in-game shop to get them back at no additional cost.
• Consumable items (gem packs, the Prestige Pack, Salvage Vault openings, Time Warps and the Commander Chest) are added to your balance at the moment of purchase and are used up in play, so they cannot be restored.

Refunds are handled by the store you purchased from, under that store's own policy, and not by RuiCodex:

• iOS — App Store: request a refund at reportaproblem.apple.com, or via Settings > [your name] > Media & Purchases > View Account > Purchase History.
• Android — Google Play: request a refund from your order history in the Google Play Store, or at play.google.com.

If you were charged for an item that never arrived in the game, please contact us first at info@ruicodex.com — we can usually resolve that faster than a refund request.

Nothing in this Policy limits any statutory right of withdrawal, refund, or remedy that you may have under the consumer protection laws of your country of residence.

7. Security

We value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. Our servers utilize industry-standard encryption (HTTPS/WSS) and secure JWT authentication. However, remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and we cannot guarantee its absolute security.

8. Changes to This Policy

We reserve the right to modify or replace this Policy at any time. We will notify you of any significant changes by updating the "Last Updated" date at the top of this page. Continued use of the App following any changes indicates your acknowledgment and acceptance of the updated Policy.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact our legal and support team at:

📧 info@ruicodex.com