Rushmark Privacy Policy

Rushmark is a game made by Beyond Bounds Digital, a company registered in South Africa (“Beyond Bounds”, “we”, “us”). This policy explains what information the game collects, why, who can see it, how long we keep it, and how to have it deleted. It covers the Rushmark game on Android — whether installed from Google Play or downloaded from this site — and on Steam, and the handling of deletion requests sent to us. It does not cover the rest of the beyondbounds.co.za website.

In short

• Rushmark never asks for an email address, phone number or password. On Android you sign in with Google Play Games; on Steam, Valve identifies you. Either way, all we receive is a player ID and a display name.
• What we keep is what a leaderboard game needs: your times, scores, replays, achievements, play statistics and saved game data.
• Times, chosen display names and replays are visible to other players. That is what a leaderboard is.
• We do not collect your location, contacts, photos, camera or microphone. There are no ads, no advertising ID and no analytics or tracking SDKs in the game.
• On Google Play the optional full-game purchase is processed by Google. We never see your payment details.
• You can delete everything we hold about you at any time — from inside the game, or see Deleting your data below.

1. Who is responsible for your data

Beyond Bounds Digital is the “responsible party” under South Africa’s Protection of Personal Information Act (POPIA) and the “controller” under the EU and UK GDPR where those apply. Our privacy contact, and our Information Officer under POPIA, can be reached at info@beyondbounds.co.za.

2. What we collect, and why

2.1 Identity

Android version. The game signs you in with Google Play Games. When it does, our server receives your Play Games player ID and your Play Games display name from Google — and nothing else: not your email address, your Google account name, your contacts or your photo. The player ID is a number Google assigns to your Play Games profile; it identifies you to us and lets your times and saves follow you across devices and reinstalls. Our server then issues the game a private access token for that player. Your Play Games display name is what other players see on leaderboards; you change it in your Google account, not in the game, and Google reviews it. We may still remove a leaderboard entry that was not achieved legitimately.

If you decline to sign in, the game runs fully offline: local personal bests, no leaderboards, and nothing about you is sent to our server. You can sign in later from Settings.

Steam version. Steam identifies you by your Steam ID and your Steam persona name, which Valve provides to the game. We do not receive your email address, password or payment information from Steam.

2.2 Gameplay records

• Leaderboard entries — your finish times, scores, Survival section counts, season and event standings, together with the course they were set on and your resulting rank.
• Ghost replays — when you set a new personal best on a timed course, the game uploads a recording of that run: the positions, actions and timings of your character. It is not video and contains no audio. Other players can download replays to race against or watch them, and yours is replaced each time you beat your own time.
• Achievements and play statistics — which achievements you have unlocked, and counters such as attempts per course, total sections cleared and total time played. Statistics are also added into world totals that every player can see; those totals do not identify you.

2.3 Saved game data

So that your progress follows you across devices, the game saves and syncs: personal bests and splits, your own ghost recordings, best scores, play statistics, unlocked skins and trails, season and event progress, the rivals you have chosen, your music and playlist settings, and your control and display settings. On Android these are stored on our server; on Steam they are stored in Steam Cloud. Only you can read your saved game data.

2.4 Purchases (Google Play only)

Rushmark on Google Play is free to download, with a single one-time purchase that unlocks the full game. The purchase itself is handled entirely by Google Play Billing: Google collects your payment details under Google’s own privacy policy, and we never receive them.

To confirm the purchase, the game sends our server the purchase token Google issues. Our server verifies that token with Google and records that your player is entitled to the full game. We keep the purchase token and Google’s order reference so that the unlock can be restored if you reinstall, and revoked if Google refunds the purchase — our server checks Google’s list of refunded (“voided”) purchases every fifteen minutes for that purpose. The game also keeps a copy of your entitlement on the device so the full game works offline.

2.5 Technical data

When the game contacts our server, the server sees your IP address and the time and content of each request, as any internet service does. IP addresses are used only to limit abusive traffic and to diagnose problems; they are not linked to your player record and are not used to work out where you are. Server logs are kept for at most 30 days.

2.6 What we do not collect

The game does not collect your email address, phone number, real name (unless you type one as your display name), location, contacts, photos, files, camera, microphone, advertising ID or device hardware identifiers. It contains no advertising, no third-party analytics and no crash-reporting or tracking SDKs. The Android app requests only internet access and the Google Play Billing capability.

Google Play and Steam may show us aggregated, anonymous install and crash statistics that those platforms generate under their own privacy policies.

3. What other players can see

• Visible to anyone: your display name (or Steam persona name), your times, scores and ranks on each leaderboard, and your ghost replays. On Android, leaderboards can be read without an account, so they are public in the ordinary sense.
• Visible only to you: your saved game data, your play statistics as linked to you, your purchase status, your IP address and your Play Games player ID.
• Rivals. Choosing another player as a rival is private to you; that player is not told.

4. Who we share data with

• Google (Google LLC and its affiliates) — provides the sign-in and your Play Games player ID and display name, processes the full-game purchase through Google Play Billing, and answers our server’s requests to verify both. On Android the game also runs on Google Play services on your device. Google’s privacy policy.
• Valve (Valve Corporation) — for the Steam version, all leaderboard entries, replays, saves, achievements and statistics are stored on Valve’s Steamworks services under the Steam Privacy Policy. Our automated season tooling reads leaderboard standings from Steam once a day to compute season rankings and to check entries for impossible times, and writes the results back to Steam. It runs on GitHub-hosted infrastructure and keeps no database of its own; its run logs can contain Steam IDs and times and are retained by GitHub for a limited period.
• Our hosting provider — the server for the Android version runs on a hosted machine in South Africa. The provider supplies the machine and does not access the data on it.

We do not sell personal information, share it for advertising, or give it to data brokers. We would disclose it only where the law requires us to.

5. Where your data is stored

Data from the Android version is stored in South Africa. Data from the Steam version is stored by Valve, and purchase data by Google, on their own infrastructure, which may be outside your country. If you play from the European Economic Area or the United Kingdom, using the game involves transferring your data to South Africa and to those providers; Google and Valve each publish the safeguards they rely on for such transfers, and we rely on the same.

6. How long we keep it

• Your player record, gameplay records and saved game data — until you delete them or ask us to. We do not currently delete inactive players automatically, so that your times remain on the leaderboard for as long as they stand. Uninstalling the game does not delete them: sign in again on any device and they are back, or delete them as described in section 7.
• Ghost replays — only your best run on each course is kept; a replay is deleted the moment you beat it.
• Purchase verification records — for as long as your player record exists, so that the unlock can be restored and refunds honoured. Google keeps its own record of the transaction.
• Server logs — at most 30 days.
• Backups — we take backups of the server; data you delete may persist in a backup for up to 30 days before the backup itself is discarded.

7. Deleting your data

You can delete everything we hold about you at any time, and you do not need the game installed to do it:

1. In the game (Android version): Settings → DELETE ACCOUNT, pressed twice to confirm.
2. On the web: beyondbounds.co.za/rushmark/delete-account
3. By email: info@beyondbounds.co.za

Deleting removes your player record, every leaderboard entry and replay, your achievements and statistics, your saved game data, and your purchase verification record — on the server and, when done from inside the game, the copies on that device too (your control and display settings stay). Deletion is immediate and permanent; nothing is retained apart from backups (see section 6) and short-lived server logs. It does not touch your Google Play Games profile, which is Google’s: signing in again afterwards starts a fresh, empty player record. Nor does it cancel a purchase you have made with Google — the game can normally re-verify your original Google purchase and restore the unlock.

For the Steam version, your data is held by Valve rather than by us. Email us and we will remove your leaderboard entries, replays and season standings from Steam and reset your Steam achievements and statistics for the game. Your Steam Cloud saves for Rushmark can be deleted by you on Steam’s own Cloud storage page.

8. Children

Rushmark is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has created a leaderboard entry or a display name, contact us at info@beyondbounds.co.za and we will delete it.

9. Security

All traffic between the game and our server is encrypted (HTTPS). Your player record can only be changed with the private access token held by your copy of the game. The server accepts connections only through its encrypted front door, limits abusive traffic, and is backed up. Access to the data is limited to the people who run the game. No system is perfectly secure; if a security incident affects your data we will tell you and the relevant authority as the law requires.

10. Your rights

Under POPIA — and under the GDPR if you are in the EEA or the UK — you have the right to ask what personal information we hold about you, to have it corrected or deleted, to object to or restrict its processing, to receive a copy of it in a portable form, and to withdraw any consent you have given. Email info@beyondbounds.co.za; we will answer within 30 days and usually much sooner, and we may ask you to confirm which player record is yours.

You also have the right to complain to a supervisory authority: in South Africa, the Information Regulator; in the EEA or UK, your local data protection authority.

The game does not make automated decisions about you that have legal or similarly significant effects. Leaderboards rank players automatically, but that is only sorting the times you set.

11. Legal bases (EEA and UK)

12. Changes to this policy

When this policy changes we will update the date at the top. If a change materially affects what we collect or how it is used, we will also say so in the game or on its store page before it takes effect.

13. Contact

Beyond Bounds Digital info@beyondbounds.co.za