Privacy Policy

Last updated: October 19, 2026

Rabbit Royale is a free-to-play game. We collect as little as we can: no password, no phone number, no real name. We show no ads and sell no data. We measure how the Game is played and collect crash reports, with Google Firebase, to make it better — and if you are in Europe, we only measure with your permission.

This policy covers Rabbit Royale in the Google Play and App Store apps and on rabbit.rip (together, “the Game”). The Game is published by GRAVITY 5, a French simplified joint-stock company (SAS) registered in Créteil under number 931 799 860, 6 bis Rue Jean Mermoz, 94450 Limeil-Brévannes, France (“we”, “us”), which is responsible for your data.

1. What we collect

Your account

• Guest accounts. When you press Play, we create an anonymous account identified by a random ID. Nothing about you or your device is collected to do this.
• Sign in with Google. If you save your burrow with Google, Google tells us your Google account ID and your email address, which Google has verified. We do not receive your name, photo, contacts or password.
• Sign in with email. If you save your burrow with your email, we store that address and send it a six-digit code. The code expires after 10 minutes and is deleted once used. We send no other email: no newsletter, no marketing.
• Profile. Your rabbit name (random at first, you can change it), the rabbit you pick from the Game’s characters, when the account was created and when you last played.

Your game

Game progress and state: carrots and score, energy, items, your burrow layout, quests, seasons and rankings, and your interactions with other players (raids, traps, fences and other in-game actions).

Purchases

The Game sells nothing today. If in-app purchases are added to the store apps, Google Play or Apple will handle the payment: we will receive the item bought and a purchase ID to deliver it, never your card or bank details. This policy will be updated before that happens.

Technical data

Like any server, ours sees your IP address and device or browser details when you connect. They may appear in short-lived server logs used for security and debugging; we do not store them in your account or use them to track you.

How you play (analytics)

We use Google Analytics for Firebase to understand how the Game is played: which screens you open and for how long, where you tap (the position on the screen and the button touched), how far you get in the tutorial, your games, raids and defences, and when you pause or leave. These events are linked to your player ID, not to your name or email.

Firebase also collects, on its own, your device model, operating system, app version, language, screen size, a random app-instance ID and your approximate location (country and region, worked out by Google from your IP address — we never see a precise location). On Android it uses your device’s advertising ID; on the web it sets Google Analytics cookies (_ga, _ga_*). We do not show ads and do not use any of this to target ads.

In the European Union, the EEA, the UK and Switzerland, the Game asks for your consent the first time you open it, and nothing is measured unless you accept (refusing is as easy as accepting). Elsewhere, measurement is on by default. Everywhere, you can change your choice at any time in the Game’s settings.

Crash reports

When the Game crashes or hits an error, a report is sent so we can fix it: what went wrong and where in the code, the screen you were on, your level, the app version, your device model and operating system, and your player ID. This goes through Firebase Crashlytics in the apps and through Google Analytics on the web. Crash reports are sent whatever your analytics choice, because we need them to keep the Game working (our legitimate interest).

Push notifications

If you allow notifications — the Game asks after your first real game, never before — we store a device token from Google Firebase Cloud Messaging, with your language and your time zone offset, so we can write in your language and never at night. We use them to tell you that your burrow is being raided or was raided, that your garden or your energy is full, or, once or twice, that you have not played for a while. At most a few per day. You can turn them off at any time in your device settings; the token is deleted when you sign out, when it stops working, or with your account.

2. What stays on your device

The Game keeps a few things in the app’s local files or your browser storage: your session (so you stay signed in), your language, sound settings, your analytics and notification choices, and a few “already seen” flags for the tutorial. In a browser, our server also sets one cookie of its own, rr_session, which keeps you signed in for up to 30 days, and — only if measurement is on — the Google Analytics cookies described above. None of these are used for advertising or cross-site tracking. A guest account exists only through the session stored on your device: if you uninstall the app or clear its data, a guest account cannot be recovered. Save your burrow with Google or your email to keep it.

3. Why we use it

• To run the Game: save your progress, let you sign in again, match you with other players, keep the leaderboard.
• To send your sign-in codes and the notifications you asked for.
• To understand how the Game is played — where players get stuck, what they use — and improve it.
• To find and fix crashes and bugs.
• To keep the Game fair and secure: stop cheating, abuse and attacks.

We do not sell your data, share it with advertisers, or use it to build advertising profiles. Our legal bases are the performance of our agreement with you (running the Game, letting you sign in, sending the notifications you allowed), your consent for analytics in the EU, EEA, UK and Switzerland (you can withdraw it at any time in the settings), and our legitimate interest in measuring and improving the Game elsewhere, fixing crashes and keeping it secure.

4. What other players see

Rabbit Royale is multiplayer. Other players can see your rabbit name, avatar, score, burrow level and whether you are online, on the leaderboard and on the islands. Your burrow can be visited and raided. Other players never see your email address.

5. Who else processes data

• Hosting. The Game runs on servers we operate at Hetzner Online (Germany; servers in Finland) and, for players who play in Asia or the Americas, at OVHcloud (France; servers in Singapore and the United States). Your account and game live in the region you play in.
• Google (Firebase and Sign-In). Google Analytics for Firebase, Firebase Crashlytics, Firebase Cloud Messaging and Sign in with Google, as described above. Google may process this data outside your country, including in the United States, under the EU–US Data Privacy Framework and standard contractual clauses. See Firebase’s privacy information and Google’s privacy policy.
• Jenvoie (France) sends the sign-in code emails.
• Google Fonts serves the fonts of this website; your browser fetches them from Google.
• Google Play and Apple distribute the apps and have their own privacy policies, which apply to what you do in their stores.

6. How long we keep it

• Guest accounts are deleted automatically after 30 days without playing (after 1 day if you never finished a first game), or at once when you abandon them from the Game.
• Accounts saved with Google or email are kept while you play, and deleted when you ask (see below).
• Sign-in codes are deleted once used, and expire after 10 minutes anyway.
• Server logs are kept for a short period and then rotated.
• Analytics events are kept for 14 months by Google Analytics, then deleted.
• Crash reports are kept for 90 days by Firebase Crashlytics.
• Notification tokens are deleted when you sign out, when they stop working, or with your account.

7. Your rights

You can ask us for a copy of your data, to correct it, or to delete it. You can delete your account yourself from the Game, or by email: see Delete your account. You can withdraw your analytics consent at any time in the Game’s settings, and turn notifications off in your device settings. You also have the right to object, to restrict processing, to data portability, and to lodge a complaint with a data protection authority — in France, the CNIL.

8. Children

The Game is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has an account, contact us and we will delete it.

9. Security

Connections to the Game are encrypted (HTTPS), sessions are signed, and we store no passwords. No system is perfectly secure, but we keep what we hold to the minimum.

10. Changes

If this policy changes, we will update it here and change the date at the top. For significant changes, we will let you know in the Game.

11. Contact

Questions or requests: support@gravity5.pro, or by post to GRAVITY 5, 6 bis Rue Jean Mermoz, 94450 Limeil-Brévannes, France.