Privacy policy

Who we are

Number RPG is operated by Yenlung Lai, a sole proprietor doing business as DappGo, in San Gabriel, California, USA. For GDPR and UK GDPR purposes, DappGo is the controller of the personal data described in this policy. Contact [email protected] with privacy questions, rights requests, or complaints.

Information we collect

You can play as a guest. Depending on the features you use, Number RPG may collect or receive the following categories of information.

• Account and profile information: an account ID, sign-in provider, provider subject ID, display name, country, and selected leader pet. An email address is used only when Apple, Google, or Meta provides one to us.
• Game and social information: cloud saves, progress, scores, leaderboards, gameplay events, invite codes, invite activity, friends, gifts, rewards, and related activity.
• Purchase information: product, transaction, store, environment, and purchase-time details received through RevenueCat to grant or restore entitlements. Apple or Google handles payment-card and bank details; Number RPG does not receive them through the app.
• Device and technical information: a hashed device or installation identifier, session information, app and platform details, language, time zone, and push-notification tokens when notifications are enabled.
• Usage and diagnostic information: app interactions, ad impressions and rewarded-ad events, crash details, performance data, remote settings, and consent or permission choices when the corresponding feature is enabled.

Sources and purposes

We receive information directly from you, from the sign-in and app-store providers you choose, from your device and the game, and from other players when you use invites, friends, gifts, or leaderboards.

• Provide the game, create or restore an account, save progress, operate leaderboards and social features, and keep the service secure.
• Process purchases, grant virtual items, restore eligible purchases, prevent cheating and abuse, and investigate fraud or account problems.
• Send push notifications that you request, such as friend-life, invite, or event notifications, and maintain optional local reminders on your device.
• Measure and improve reliability through analytics, crash reports, performance information, and remote settings after the applicable consent state allows collection.
• Show ads. Ads are non-personalized until the required consent is recorded; personalized ads are used only when the required consent and device permissions allow them.

Service providers and sharing

We share information with the providers needed for the feature you choose. These providers may process information under their own privacy policies and may act as independent controllers for some services.

• Apple: Apple sign-in and App Store purchase processing.
• Google and Firebase: Google sign-in, Google Play purchase processing, Firebase Analytics, Crashlytics, Performance Monitoring, Remote Config, Cloud Messaging, and Google AdMob advertising and consent services.
• Meta: Facebook sign-in, including Meta Limited Login on iOS.
• RevenueCat: purchase and entitlement processing.
• Other players may see the display name, country, leader pet, scores, and friend relationships that you make visible through the game. Number RPG has no chat feature.
• We may also disclose information when reasonably necessary to comply with law, protect users or the service, prevent fraud, or respond to a valid legal request.

Ads, analytics, notifications, and cookies

Number RPG uses Google AdMob to provide and measure advertising. The Google Mobile Ads SDK may collect your IP address and infer an approximate location, such as your general region, without accessing precise GPS location or requesting location permission. Google may use this information for app and advertising functionality, analytics, third-party advertising, and developer advertising or marketing, subject to applicable consent choices. DappGo does not separately store this SDK-derived location. Google retains advertising and related diagnostic data under its policies and configured controls, including for security, fraud prevention, and legal obligations; retention varies by data and purpose, so we do not promise a fixed deletion period for Google-held data. Manage available advertising choices in the app’s privacy settings or contact [email protected] about access or deletion. See Google’s advertising disclosure (Google AdMob) and retention policy (Google).

We use Firebase Crashlytics to diagnose crashes and errors, Performance Monitoring to measure startup, rendering, and network performance, and Remote Config to deliver app settings and gameplay configuration. Where applicable consent choices permit, Firebase Analytics measures app use, gameplay progress, purchases, ad performance, and notification interactions. These services can process installation and session identifiers, crash stack traces and error messages, device, operating-system, app and network information, performance measurements, language, timezone, and approximate country or region derived from IP addresses. Crashlytics reports can include your opaque Number RPG account ID and gameplay region or stage. Analytics uses an app-instance identifier; the app does not supply your name, email, or account ID as its Analytics user ID. Firebase Analytics advertising storage, advertising user data, and advertising personalization are configured off. These uses support operation, reliability, configuration, and analytics; they do not authorize Firebase advertising tracking.

When you enable eligible notifications, Firebase Cloud Messaging processes registration and installation identifiers, an Apple push token on iOS, and the app/device context needed for delivery. For account reminders, our service associates your push token with your account, platform, device language, timezone, and notification preferences. Friend-life-request messages can include a friend’s display name and the recipient account identifier. Promotional event messages require their own marketing preference. Season 2 announcements require a separate subscription to the season-2 topic; enabling lives or expedition reminders does not subscribe you to these announcements. Topic subscriptions and notification interactions may be processed to deliver chosen messages and, where Analytics collection is permitted, measure their use. Change notification choices in the app or device settings.

AdMob uses non-personalized ads by default until the required Google consent is recorded. On iOS, personalized advertising also requires App Tracking Transparency authorization; denying it leaves ads non-personalized. You can change available privacy choices in the app and tracking or notification permissions in device settings. The mobile app does not use browser cookies. This website may save language and theme choices in local storage; Google sign-in on the account-deletion page may use cookies or similar technologies under Google’s policies.

California privacy rights

If the California Consumer Privacy Act, as amended by the CPRA, applies to you, you may request to know or access the personal information we collect, delete it, correct inaccurate information, and receive a portable copy where required. You may submit a request to [email protected]. We will verify requests as needed to protect your account and other players.

We do not sell personal information for money. We may share device or advertising identifiers and ad-interaction information with Google AdMob for cross-context behavioral advertising only after the applicable consent choice; California law may treat that as sharing. To opt out, decline or withdraw the relevant advertising choice when available, turn off applicable device tracking permission, or email [email protected] with the subject “Do Not Sell or Share My Personal Information.”

• You may use an authorized agent with written permission. We may ask the agent and you for information needed to verify the request.
• We will not discriminate against you for exercising these rights. We generally respond to know, delete, and correct requests within 45 calendar days; if an extension is allowed, we will explain it. Opt-out requests are handled as soon as reasonably possible.

EEA and UK privacy rights

If the GDPR or UK GDPR applies, we use these legal bases: contract necessity to provide the game, accounts, saves, social features, and purchases; consent for personalized advertising and consent-gated analytics or similar optional collection; legitimate interests for security, anti-cheat, fraud prevention, service reliability, and support; and legal obligations for records we must keep. You can withdraw consent at any time, and withdrawal does not affect processing that happened before withdrawal.

You may request access, correction, erasure, restriction of processing, data portability, or object to processing based on legitimate interests. Contact [email protected] first. You may also complain to the data-protection supervisory authority in the EEA country where you live or work, or where you believe an infringement occurred; in the UK, you may complain to the Information Commissioner’s Office.

• DappGo and the providers named above may process information in the United States and other countries outside the EEA or UK. Where required, we use a lawful transfer mechanism such as an adequacy decision, standard contractual clauses, or another approved safeguard. Contact us for more information about a transfer.
• We do not knowingly use Number RPG to make decisions based only on automated processing that produce legal or similarly significant effects.

Retention and deletion

We keep account and player data while your account is active. Successful in-app and Google web self-service account deletion takes effect immediately; email or web-form requests are completed within 30 days after verification, subject to limited retention exceptions. Our published retention commitment for Google Analytics and Firebase Analytics data remains 14 months, within the scope of the property’s retention controls described in Google’s documentation (Google Analytics); those controls do not cover every aggregate report or separately exported record. Server request logs are retained for 30 days. Apple and Google may retain purchase records in their store accounts.

Firebase retention varies by service. Under Firebase’s published policy (Firebase), Crashlytics begins removing crash data and associated identifiers after 90 days. Performance Monitoring keeps IP-associated events for 30 days and installation-associated or de-identified performance data for 60 days before removal begins. Cloud Messaging and Remote Config installation identifiers may remain until installation deletion is requested; Firebase states that removal from live and backup systems completes within 180 days after that request. Account deletion does not immediately erase every Firebase record.

Account deletion requests removal of developer-held account, player, and push-registration data, as described on Delete account. The app also attempts to clear the departing account’s notification eligibility, topic subscriptions, and push token. This asynchronous cleanup can fail and does not itself delete the Firebase installation identifier or previously uploaded Analytics, crash, or performance records. Those remain subject to provider retention and deletion processes. Contact [email protected] about access to or deletion of associated Firebase information, in addition to the in-app and public deletion options. Limited records may be kept for tax, accounting, security, fraud prevention, disputes, or legal obligations, then deleted or anonymized when that reason ends.

• Provider policies: Firebase / Google, AdMob, Apple, Meta, and RevenueCat.

Children

Number RPG is not directed to children under 13 and is intended for people aged 13 and older. We do not knowingly invite a child under 13 to create an account. If we learn that a child under 13 has provided personal information, a parent or guardian can contact [email protected]; after verification, we will delete the child’s account and information as required by law. If local law requires a higher age or parental consent, that rule applies.

Security, changes, and contact

We use reasonable technical and organizational safeguards for the information we handle, including protected account sessions and verification for deletion requests. No service can guarantee absolute security, so keep your device and sign-in credentials secure.

We may update this policy when the game, providers, or legal requirements change. The date at the top identifies the current version. Contact [email protected] with privacy questions, rights requests, or concerns.