HuddleRush is operated by Future Developments s.r.o., Czech Republic. Contact: mark.muron@gmail.com. This policy explains what we process when you play, why we process it, and how to exercise your rights.

Account: your email address when you create a recoverable account, the public handle you choose, and a Supabase account id. Guest play uses an anonymous Supabase id and public guest handle. Gameplay: selected franchise, draft results, leaderboard entries, match records, referrals, purchases, and winner taunts you send. Marketing: if you tick the optional sign-up checkbox, we store that opt-in. Analytics: limited named gameplay events, error reports, browser/device type, and approximate region; we do not record sessions.

Stripe processes extra-spin payments. We never receive or store card numbers. Stripe sends a checkout session id and spin metadata so Supabase can credit spins exactly once.

Strictly necessary local storage keeps your selected franchise, custom taunts, career stats, sessions, and local-only fallback profile/wallet/leaderboard data when Supabase is unavailable. Analytics and advertising cookies are used only after consent; before consent, analytics run in memory when configured, Google tags use consent mode with storage denied, and advertising tags stay denied.

We process data to run the game, accounts, password resets, paid extra spins, referrals, live matches, and leaderboards; to send marketing only if you opted in; to understand and improve gameplay when analytics is configured; and to keep the game fair and secure.

Supabase hosts auth, database, realtime, and edge functions. Vercel hosts the web app. Stripe processes payments. PostHog receives gameplay analytics events when configured. With consent, Google Analytics/Ads and the Meta Pixel may receive usage signals for measurement. We do not sell your data.

Registered account data, purchases, referrals, match data, and leaderboard records are kept while the game operates or until deletion is requested where legally possible. Guest accounts are temporary and may not be recoverable if you clear storage or change devices. Analytics data is retained according to the configured PostHog and Google project settings and can be deleted on request.

Under the GDPR you can request access, correction, deletion, restriction, portability, and withdraw consent where applicable. You can also complain to your local data-protection authority.