Privacy Policy

1. Who We Are

Riff Rodeo is operated by an independent developer ("I," "me," "Riff Rodeo," or "we"). Riff Rodeo is currently operated as an individual project and is not operated by a separate corporation or LLC.

For privacy questions, requests, or concerns, contact me at riffrodeogame@gmail.com.

2. Scope of This Policy

This Privacy Policy explains how Riff Rodeo collects, uses, discloses, stores, and otherwise processes information when you use the Riff Rodeo website and multiplayer music game (the "Service").

This policy applies to information processed through the Service. It does not apply to third-party websites, services, or content that Riff Rodeo does not control. Those services may have their own privacy policies and terms.

The Service is designed to operate without requiring users to create an account or provide an email address, password, payment information, or precise location.

3. Information We Collect

Riff Rodeo is designed to minimize the amount of personal information required to play.

Information you provide. When you join a lobby, you choose a display name. You may also provide information through normal game interactions, such as song selections and guesses.

Identifiers. The Service creates random player and lobby identifiers so that the game can associate activity with the correct player and lobby and support reconnection.

Game activity. During a game, the Service processes information such as lobby membership, display name, player and lobby identifiers, guesses, song selections, scores, game state, connection status, and timestamps.

Technical information. When you access the Service, our infrastructure providers may process technical and network information such as your IP address, browser type, device or operating-system information, HTTP request information, timestamps, security information, and error or diagnostic information.

We do not intentionally request account passwords, dates of birth, precise location, payment information, government identification numbers, health information, or other sensitive personal information through the normal game flow.

Please do not use your real name, email address, telephone number, home address, precise location, financial information, health information, government identification number, or other sensitive personal information as your display name or in game-related fields.

4. How We Use Information

We use information for the following purposes:

• To create, operate, and maintain multiplayer lobbies and game sessions.

• To reconnect players and preserve appropriate player and game state.

• To process guesses, song selections, scores, and other game activity.

• To search and retrieve music catalog information requested through the Service.

• To maintain the availability, performance, reliability, and security of the Service.

• To detect, prevent, and investigate abuse, fraud, malicious traffic, automated traffic, and security incidents.

• To rate-limit excessive or abusive requests.

• To diagnose errors and technical problems.

• To enforce our terms and protect the Service, users, and others.

• To comply with applicable law, legal process, or lawful governmental requests.

• To establish, exercise, or defend legal claims.

We do not sell personal information for monetary consideration. We do not use personal information for behavioral advertising or cross-context behavioral advertising.

We do not use personal information to make decisions about individuals based on profiling or automated decision-making that produces legal or similarly significant effects.

5. Legal Bases for Processing

If the GDPR, UK GDPR, or another law requiring a legal basis applies to our processing, we generally rely on the following legal bases:

• Performance of a contract or provision of a requested service: to operate the game, create lobbies, maintain game state, and provide the functionality you request.

• Legitimate interests: to secure, maintain, troubleshoot, protect, and improve the Service; prevent abuse and malicious activity; and establish or defend legal claims, where those interests are not overridden by applicable rights and interests.

• Legal obligation: where processing is necessary to comply with applicable law or a lawful legal request.

• Consent: where applicable law requires consent for a particular processing activity and we request that consent.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

6. Cloudflare and Security Processing

Riff Rodeo uses Cloudflare for website delivery, networking, security, and related infrastructure.

Cloudflare may process technical and network information when you access the Service, including IP address, request information, browser or device characteristics, timestamps, and information used to identify malicious, automated, or abusive traffic.

Cloudflare's security systems may use technical signals, heuristics, browser characteristics, JavaScript-based detections, and other security mechanisms to distinguish legitimate visitors from automated or malicious traffic. These mechanisms are used for security and abuse prevention, not by Riff Rodeo for advertising or behavioral profiling.

Cloudflare documents that its bot-detection systems can use heuristics, malicious fingerprints, JavaScript detections, and behavioral analysis to identify automated traffic. [Cloudflare's bot-detection documentation](https://developers.cloudflare.com/bots/concepts/bot-detection-engines/)

Cloudflare processes information under its own privacy practices in addition to any processing it performs on behalf of Riff Rodeo. [Cloudflare Privacy Policy](https://www.cloudflare.com/policies/privacy/)

7. Cookies and Browser Storage

Riff Rodeo uses limited first-party browser storage for essential game functionality, player continuity, local game statistics, and user preferences.

We currently do not use advertising cookies, social-media tracking cookies, or third-party behavioral advertising technologies. Optional first-party product analytics are described below.

8. Browser Storage Details

The following browser storage is currently used by the Service:

Player identifier. A random first-party cookie identifies a returning browser for up to one year. It supports reconnection, matchmaking, and aggregate unique and returning-player metrics. It is not used for advertising or cross-site tracking.

Local player statistics. Your browser stores lifetime games played and won, guessed-song totals and accuracy, and the average elapsed time to correctly guess a song locally. These statistics are not uploaded as an individual player profile.

Analytics choice. If you allow optional analytics, the Service stores an anonymous session identifier in session storage and your choice in local storage. You can choose No thanks in the analytics notice; clearing site storage also removes the choice.

Optional analytics. With permission, the Service sends page visits, control interactions, viewport-normalized click coordinates, scroll depth, and named game actions to our Cloudflare Worker. This supports aggregate heatmaps and event-based session recordings. We do not send typed values, display names, guesses, audio, or raw page text.

Game operations. Separate from optional browser analytics, the game server records aggregate lobby and game operation metrics needed for service monitoring, such as open and running lobby counts, connected players in active games, rounds, songs, peak player counts, and pseudonymous unique and returning-player totals. These metrics are not tied to the browser analytics session and do not include display names, guesses, song titles, or audio.

9. Music and Third-Party Services

Riff Rodeo uses third-party services to provide parts of the Service.

Music search. Riff Rodeo uses Apple's iTunes Search API to retrieve music catalog information. Search requests may be transmitted to Apple. Apple processes information according to its own privacy practices.

Music artwork and media. Song artwork, previews, or other media may be delivered from Apple-hosted or other third-party URLs. When your browser requests resources directly from a third party, that third party may receive technical information associated with the request, such as your IP address, browser information, and request metadata.

Hosting and realtime infrastructure. Riff Rodeo uses Cloudflare infrastructure for hosting, networking, realtime communication, and related operational functions.

Third-party providers may process information in countries other than where you live and may have their own retention periods and privacy practices.

10. Information Sharing and Disclosure

We may disclose information to service providers that help us operate the Service, including hosting, networking, security, realtime infrastructure, and music-catalog providers.

We may also disclose information when reasonably necessary to comply with applicable law, valid legal process, lawful governmental requests, or other legal obligations.

We may disclose information when reasonably necessary to investigate security incidents, abuse, fraud, attacks, or violations of our terms; protect the rights, safety, or property of Riff Rodeo, users, or others; or establish, exercise, or defend legal claims.

If Riff Rodeo becomes involved in a merger, acquisition, reorganization, financing, bankruptcy, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

We do not sell personal information for monetary consideration and do not share personal information for cross-context behavioral advertising.

11. International Data Transfers

Riff Rodeo and its service providers may process information in countries other than the country in which you live. Those countries may have data-protection laws that differ from the laws in your jurisdiction.

Where applicable law requires safeguards for international transfers, we will use an appropriate lawful transfer mechanism, such as an adequacy decision, standard contractual clauses, or another legally recognized safeguard.

You may contact us at riffrodeogame@gmail.com if you would like additional information about applicable international transfer safeguards.

12. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this policy, including providing the Service, maintaining security, resolving disputes, enforcing agreements, and complying with legal obligations.

The browser's lobby session storage may remain for up to 7 days to support reconnection.

Lobby state is generally deleted when the last player leaves. Short-lived lobby directory information may expire after approximately 12 hours.

Operational, security, diagnostic, and network logs may be retained by us or our service providers for periods determined by operational, security, legal, and compliance requirements. Actual retention periods may vary by provider, service, and type of information.

When information is no longer reasonably necessary for the purposes for which it was collected, we will delete it, anonymize it, or otherwise dispose of it as permitted by applicable law.

13. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information processed by the Service. These may include encryption in transit, access controls, rate limiting, data minimization, and limited retention.

No website, application, network, or electronic transmission can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.

If we become aware of a security incident involving personal information, we will take reasonable steps to investigate, mitigate, and provide notices required by applicable law.

14. Your Privacy Rights

Depending on where you live and subject to applicable legal exceptions, you may have rights concerning your personal information, including rights to access, know, correct, delete, restrict, object to, or receive a copy of certain information.

You may also have the right to withdraw consent where processing is based on consent and the right to lodge a complaint with a privacy or data-protection regulator.

To exercise a privacy right, email riffrodeogame@gmail.com with the subject line "Privacy Request." Describe the request and provide enough information for me to reasonably identify the relevant information, lobby, player identifier, or display name.

I may request additional information when reasonably necessary to verify a request and protect against unauthorized disclosure. Information provided for verification will be used for that purpose and related request processing.

We will not discriminate against you for exercising privacy rights that apply to you.

We may decline or limit a request where permitted or required by law, including where complying would adversely affect another person's rights, compromise security, prevent us from complying with a legal obligation, or interfere with legally protected activity.

15. California Privacy Rights

If you are a California resident and the California Consumer Privacy Act, as amended (CCPA), applies to Riff Rodeo, you may have additional rights, including the right to know about personal information collected, used, or disclosed; the right to request deletion; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit certain uses or disclosures of sensitive personal information where applicable; and the right to non-discrimination for exercising applicable rights.

Riff Rodeo does not sell personal information for monetary consideration and does not share personal information for cross-context behavioral advertising.

The categories of personal information we may process include identifiers such as display names and player or lobby identifiers; internet or network information such as IP address and request information; device and browser information; game and usage information; and security or diagnostic information.

We may obtain information directly from you, automatically from your browser or device when you use the Service, and from service providers that operate infrastructure on our behalf.

We use these categories of information for the purposes described in this policy, including providing the Service, maintaining security, preventing abuse, troubleshooting, and complying with legal obligations.

If applicable California law requires additional notices, request methods, or disclosures, those requirements will apply in addition to this policy.

Because Riff Rodeo does not sell or share personal information for the purposes described above, there is currently no separate "Do Not Sell or Share My Personal Information" link.

16. European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area, United Kingdom, or Switzerland and applicable data-protection law applies, you may have rights including access, rectification, erasure, restriction, objection, and data portability, subject to applicable exceptions.

You may also have the right to lodge a complaint with the supervisory authority or data-protection regulator in the country where you live, work, or believe an infringement occurred.

If you have questions about our use of legitimate interests as a legal basis, you may contact me at riffrodeogame@gmail.com.

Riff Rodeo does not currently have a separately appointed Data Protection Officer. If applicable law requires us to appoint a representative or Data Protection Officer, this policy will be updated accordingly.

17. Children's Privacy

Riff Rodeo is not directed to children under 13, and I do not knowingly collect personal information from children under 13.

The Service does not require an account, email address, payment information, or other traditional account-registration information.

If I learn that personal information has been collected from a child under 13 in circumstances where applicable law requires parental consent, I will take reasonable steps to delete that information.

If you are a parent or guardian and believe a child has provided personal information to Riff Rodeo, contact riffrodeogame@gmail.com.

Riff Rodeo does not knowingly sell or share children's personal information for advertising purposes.

18. Automated Decision-Making and Profiling

Riff Rodeo does not use personal information for automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Game scoring, matchmaking, game logic, and similar functionality are part of the normal operation of the game and are not intended to evaluate individuals outside the game.

19. Do Not Track and Global Privacy Control

Riff Rodeo does not currently sell or share personal information for cross-context behavioral advertising.

Because we do not currently engage in those activities, we do not use browser privacy signals to opt you out of advertising-related sale or sharing activities that we do not conduct.

If our privacy practices change in a manner that makes Global Privacy Control or another legally recognized opt-out signal applicable, we will honor that signal as required by applicable law.

20. Your Responsibilities

Please do not enter personal or sensitive information into display names, guesses, song selections, or other game fields unless the Service specifically requests it.

If you intentionally provide information about another person, you are responsible for ensuring that you have a lawful basis to provide that information where applicable.

21. Changes to This Policy

I may update this Privacy Policy when the Service, data practices, service providers, or applicable legal requirements change.

When this policy changes, the "Last updated" date at the top of this page will be updated.

If a change is materially significant and applicable law requires additional notice or consent, I will provide the notice or obtain consent required by law.

22. Contact

For privacy questions, requests, complaints, or concerns, contact:

Email: riffrodeogame@gmail.com

Riff Rodeo is currently operated by an independent developer rather than a separate business entity.

Privacy Requests

To submit a privacy request, email riffrodeogame@gmail.com with the subject line "Privacy Request." Please identify the right you are exercising, such as access, deletion, correction, objection, restriction, or portability, and provide enough information for the request to be reasonably understood and verified.

If you believe your request has not been handled as required by applicable law, you may have the right to contact the privacy or data-protection regulator in your jurisdiction.