Privacy Policy

1. Introduction

Beralabs Studio ("Beralabs", "we", "us", or "our") is an independent app studio based in London, United Kingdom. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit beralabs.studio (the "Website") or use any app we publish, including Rummage (together, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this Policy. If you do not agree with this Policy, please do not use our Services.

2. Information we collect

We collect information in the following ways:

a. Account & authentication information

When you create an account you can sign in using Google Sign-In, Sign in with Apple, or an email/username and password. Depending on the method you choose, we receive:

• Your name and email address (from Google or Apple, or as you enter it yourself)
• A unique identifier issued by Google or Apple, used only to recognise your account on future sign-ins
• If you register with a username and password, a securely hashed version of your password — we never store or have access to your plain-text password
• Your chosen username, and, if you provide one, a display name and profile bio

We never receive your Google or Apple account password, and we only receive the profile fields (such as name and email) that you or your device's sign-in provider chooses to share with us.

b. Profile & in-app activity

• Your selected avatar, username, and any optional profile details (such as location or bio) you choose to add
• Gameplay and engagement data — games viewed or played, badges earned, streaks, leaderboard position, followed users, and privacy preferences (for example, hiding your last name)
• Content you submit, such as reviews, ratings, feedback, or support requests

c. Purchases & subscriptions

Subscriptions and in-app purchases are processed by the Apple App Store or Google Play. We receive confirmation of your purchase and subscription status (for example, which tier you're on and whether it's active), but we do not receive or store your card, bank, or payment details — these are held solely by Apple or Google.

d. Affiliate links

Rummage may show links to third-party retailers (for example, for games or items you may want to buy) through affiliate partners such as Awin. If you click one of these links, the affiliate network may record that click and any resulting purchase so that Beralabs can earn a commission. We do not share your account information with these retailers as part of this process.

e. Device & technical information

We automatically collect limited technical information needed to operate and improve the Services, such as device type, operating system version, app version, crash and performance logs, and general usage analytics (for example, which screens are used most). We use this information in aggregate and do not use it to build an advertising profile of you.

f. Communications

If you contact us through the Website's contact form or by emailing us directly, we collect your name, email address, and the content of your message so we can respond.

3. How we use your information

We use the information we collect to:

• Create and maintain your account, and let you sign in securely
• Operate core features — matching games to what you own, tracking progress, badges, streaks, leaderboards, and social features such as following other users
• Process and manage subscriptions and entitlements
• Respond to support requests and messages you send us
• Maintain the security and integrity of our Services, including detecting fraud, abuse, and violations of our Terms of Service
• Understand how our Services are used so we can fix issues and improve them
• Send you service-related communications (for example, about changes to your account or this Policy); we will only send you marketing communications if you opt in, and you can opt out at any time
• Comply with our legal obligations

4. Our legal basis for processing

Where UK or EU data protection law applies, we rely on the following legal bases:

• Contract — processing needed to create your account and provide the Services you've signed up for
• Legitimate interests — to secure our Services, prevent abuse, and improve features, balanced against your rights and interests
• Consent — for optional features (such as marketing emails) and, on the Website, for non-essential cookies
• Legal obligation — where we must retain or disclose information to comply with the law

5. Sign-in with Google, Apple & password accounts

We offer three ways to create and access your account, and you're free to choose whichever you prefer:

• Sign in with Google — governed by Google's own Privacy Policy for the information Google shares with us; we only request your basic profile (name, email) and a stable account identifier.
• Sign in with Apple — Apple allows you to share your real email address or a private relay address; if you choose to hide your email, we only ever see the relay address Apple provides.
• Email/username and password — your password is hashed using industry-standard methods before it is stored; we cannot see or recover your original password.

You can switch sign-in methods or unlink a provider from your account settings; contact us if you'd like help doing this.

6. How we share information

We do not sell your personal information. We share information only in the following circumstances:

• Service providers — companies that host our infrastructure, send emails, provide analytics, or otherwise help us run the Services, under contractual obligations to protect your data and use it only for the purposes we specify
• Sign-in & platform providers — Google, Apple, and the App Store / Google Play, to authenticate you and process purchases
• Affiliate partners — limited click/conversion data when you follow an affiliate link, as described above
• Other users — information you choose to make visible on your profile (such as your username, avatar, and public activity), subject to your privacy settings
• Legal & safety — where required by law, to protect the rights, safety, or property of Beralabs, our users, or the public, or to investigate fraud or security issues
• Business transfers — if Beralabs is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy

7. Data retention

We retain your information for as long as your account is active or as needed to provide the Services. If you delete your account, we will delete or anonymise your personal information within a reasonable period, except where we're required to retain it for legal, security, or legitimate business purposes (for example, fraud prevention or dispute resolution).

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your information ("right to be forgotten")
• Object to or restrict certain processing
• Request a portable copy of your information
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a data protection authority — in the UK, the Information Commissioner's Office (ICO)

Most of these actions can be completed directly from within Rummage's account settings. For anything else, contact us at support@beralabs.studio and we'll respond within a reasonable time.

9. Children's privacy

Our Services are intended for a general, family-wide audience, and Rummage is designed to be a game the whole family can use together. However, creating an account requires agreeing to these Terms, and we ask that account holders be at least the age of digital consent in their country (13 in most regions, though this may be older where you live). Where a child wants to play under a parent's account, we encourage the parent or guardian to manage sign-in and account settings on their behalf.

We do not knowingly collect personal information directly from children below the applicable age of consent without appropriate parental involvement. If you believe a child has provided us with personal information other than as described here, please contact us at support@beralabs.studio so we can investigate and, if necessary, delete that information.

10. Data security

We use industry-standard technical and organisational measures — including encryption in transit, hashed passwords, and access controls — to protect your information. No method of transmission or storage is 100% secure, so while we work hard to protect your data, we cannot guarantee its absolute security.

11. International data transfers

We're based in the United Kingdom, but our service providers may process information in other countries, including the United States. Where we transfer personal information outside the UK or European Economic Area, we use appropriate safeguards recognised under UK and EU data protection law, such as Standard Contractual Clauses or an adequacy decision, to protect your information.

12. Cookies & similar technologies

Our Website uses only essential cookies needed for it to function, plus optional analytics cookies to help us understand site usage — we do not use these for advertising. Within the Rummage app, we use similar device-level identifiers for analytics and crash reporting rather than browser cookies. Where required, we'll ask for your consent before setting non-essential cookies.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. If we make material changes, we'll notify you by updating the "Last updated" date above, and, where appropriate, through the Website or within the app. We encourage you to review this Policy periodically.

14. Contact us

If you have questions about this Privacy Policy or how we handle your information, contact us at:

Beralabs Studio
London, United Kingdom
Account or data requests: support@beralabs.studio
General enquiries: info@beralabs.studio