Privacy & Security

Flap Rush is operated by Yazeed Almutiry ("we", "us"). We are the data controller for the personal data described in this notice, which means we decide what data is collected and why.

Paddle.com is the Merchant of Record for all purchases made on Flap Rush. Paddle acts as an independent controller for the payment data you enter at checkout.

• Playing without an account: your high score, chosen skin and sound preference are stored only in your browser's localStorage. No account or personal data is needed to play.
• Account data (email address, login identifier, and — if you sign in with Google — the basic profile Google returns): used to create and secure your account and to link your Skin Pass to you. Legal basis: performance of a contract.
• Subscription records (subscription status, plan, billing period, and the customer/subscription identifiers issued by Paddle): used to unlock premium skins and manage cancellations. Legal basis: performance of a contract and our legal obligation to keep sale records.
• Payment details (card number, billing address, tax location): entered directly into Paddle's checkout and processed by Paddle. We never see or store your full card details.
• Technical and security data (IP address, device/browser information, error logs): used to keep the service running, prevent fraud and abuse, and fix bugs. Legal basis: legitimate interests.
• Support messages: used to answer you. Legal basis: legitimate interests.

• Paddle.com — Merchant of Record for the sale, subscription management, payments, tax compliance, invoicing and refunds.
• Hosting and backend providers — Lovable and its cloud infrastructure provider host the site, the database and authentication.
• Google — Google Sign-In (if you use it) and Google AdSense for advertising.
• Professional advisers and authorities — where required by law or to establish or defend legal claims.

We do not sell your personal data. Where data is transferred outside your region, our providers rely on recognised safeguards such as Standard Contractual Clauses or adequacy decisions.

We use Google AdSense to show ads. Google may use cookies and similar technologies to serve personalised ads based on your visits to this and other sites. Essential cookies and local storage keep you signed in and remember your game preferences; advertising cookies are set by Google. Where required, a consent banner lets you choose. You can manage ad personalisation at Google Ad Settings.

Account and subscription records are kept while your account is active and for up to 6 years after your last purchase where tax and accounting law requires it. Technical and error logs are kept for up to 12 months. Data in your browser's localStorage stays until you clear it. When data is no longer needed it is deleted or anonymised.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent at any time. You can also complain to your local data protection authority.

To exercise a right, contact Yazeed Almutiry using the contact details below. We aim to respond within one month. Billing-record requests may be forwarded to Paddle, which holds the payment data.

• The site is served over HTTPS, so traffic between your device and us is encrypted.
• Security headers (CSP, HSTS, X-Frame-Options and more) help block clickjacking, code injection and other common attacks.
• Database access is protected by row-level security so each player can only read their own account and subscription rows.
• Card details never touch our servers — Paddle handles payments end to end.

Flap Rush is a casual game suitable for all ages, but accounts and paid subscriptions are intended for users who are old enough to contract in their country. Parents and guardians can manage ad personalisation through Google Ad Settings.

For privacy questions or security reports, contact Yazeed Almutiry through the contact details published on this site. For billing or refund questions, contact Paddle at paddle.net. See also our Terms & Conditions and Refund Policy.