Privacy Policy

This Privacy Policy describes how Retro Drop (“we,” “us,” or “the platform”) collects, uses, and protects information about players. By creating an account or using the platform, you agree to the practices described here.

1. Information We Collect

1.1 Information you provide at signup

• Username (publicly visible)
• Display name (publicly visible; automatically set from your username and shown next to your scores)
• Email address (used for login recovery, verification, and optional notifications)
• Password (stored as a secure hash — we never store, see, or log your plaintext password)
• Date of birth (used to confirm you meet our minimum age requirement and to note whether you are a minor — see Section 11; the date is retained on your account)
• If you sign up from a referral link, a record of which member referred you (see Section 2)
• Your agreement to these Terms of Use and Privacy Policy, with a timestamp

1.2 Information we collect as you play

• Game scores and the best score you’ve achieved on each game
• Number of games played, total coins, fruit (apples, oranges, limes, grapes, strawberries), and other collectibles earned
• Trophies earned, XP, level, and bonus XP from boost items
• Daily streak, best streak, and the date you last played
• Tournament entries and tournament-specific scores
• Avatars you have purchased and the avatar you have equipped
• Games you mark as favorites
• In-game items you own (boosts, coin multipliers, streak freezes), including when they were acquired and whether they are active
• Referral activity: your personal referral link, who you referred, referral counts, and any referral rewards earned
• Certain account and lifecycle events (for example subscribing, pausing or canceling Pro, redeeming an offer, using a streak shield, or unsubscribing), kept as first-party product analytics to operate and improve the service
• Email notification preference and your local timezone offset (used so daily streak reminders fire at the right hour for you)

1.3 Technical and anti-cheat information

• IP address at registration and at the start of each game session
• Approximate country, derived from your IP address by our hosting/CDN provider’s edge network — we store only the country, never a precise or GPS-level location
• Browser user-agent string at the start of each game session
• Short-lived game session tokens (signed by the server — not personally identifying on their own)
• Anti-cheat flags raised against your account, including the reason, severity, and the IP address of the flagged submission

This information is kept solely to detect cheating, prevent account abuse, and protect the integrity of leaderboards. It is not used for advertising, and we do not sell it.

1.4 Subscription information

If you subscribe to Pro, we record your subscription type (monthly or annual), status (active, paused, canceled, etc.), and the start and renewal dates. Payment details (card numbers, billing address) are handled by our third-party payment processor and are never stored on our servers.

2. How We Use Your Information

• To create and authenticate your account and keep you signed in
• To display your username, display name, and scores on public leaderboards and in tournament standings
• To track your in-game progress: coins, trophies, level, streak, tournaments, and collectibles
• To send transactional and game-related email (verification codes, password resets, reminders and streak warnings)
• To detect and respond to cheating, automated play, abuse, and account compromise — which may include removing individual scores from leaderboards or suspending an account
• To provide customer support and operate the service: our authorized staff may access your account data (such as profile, scores, coins, anti-cheat flags, and subscription status) to assist you, investigate reports, or correct errors
• To grant promotional rewards (such as coins, in-game items, or complimentary Pro memberships) and to adjust or reverse rewards granted in error or obtained through prohibited activity
• To operate our referral program — crediting rewards to members who invite new players
• To manage Pro subscription state, billing renewals, and cancellation flows
• To enforce these Terms of Use and respond to safety reports

3. Legal Bases for Processing (EEA/UK Users)

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases of the GDPR / UK GDPR:

• Performance of a contract — to create your account, run gameplay, store progress, and operate Pro subscriptions (Art. 6(1)(b))
• Legitimate interests — to secure the platform, detect cheating, prevent abuse, maintain leaderboard integrity, and send optional game-related and re-engagement emails that you can opt out of at any time (every message includes an unsubscribe link), balanced against your rights (Art. 6(1)(f))
• Consent — where we specifically ask for it, such as any feature we describe as opt-in; you can withdraw consent at any time without affecting prior processing (Art. 6(1)(a))
• Legal obligation — to comply with applicable tax, accounting, and law-enforcement requirements (Art. 6(1)(c))

4. Information That Is Public

The following are visible to anyone who uses the platform:

• Your username and display name
• Your scores on leaderboards
• Your scores in tournaments you enter
• Your avatar, level, and certain trophy achievements where they appear next to your name

Everything else is private to your account.

5. Information We Do Not Collect

Retro Drop has no chat, no direct messaging, and no social communication features. We do not collect, store, or process:

• Private messages or conversations between players
• Precise location, GPS data, or device geolocation
• Contacts, photos, microphone, or camera data from your device
• Browsing history outside of the Retro Drop site
• Credit card numbers, CVVs, or banking details (handled by our payment processor)
• Biometric data of any kind

6. Cookies and Local Storage

We use only essential cookies and local storage. Specifically:

• pd_access — a signed access token, expires after 15 minutes, used to authenticate API requests
• pd_refresh — signed refresh token, expires after 7 days, used to silently renew your session
• A small amount of browser local storage to remember UI state (for example, whether you have dismissed a streak-shield notice for the day)

A few pages load third-party services that set their own strictly-necessary cookies or storage in order to function:

• Stripe — on the checkout page only, to process your payment and prevent fraud
• Cloudflare Turnstile — on the sign-up and login forms, to confirm you are human and block automated account creation and credential-guessing

These are functional and security cookies set by our processors to deliver features you request — not advertising or cross-site tracking. We do not use advertising cookies, analytics cookies, or third-party tracking or profiling cookies of any kind.

7. Email Communications

Some emails are transactional and required for the service to function: email verification at signup, password reset links, and important account or subscription notices (such as your subscription cancellation confirmation). You cannot opt out of these while keeping an active account.

Optional emails are on by default to give you the best experience, unless you opt out from your account settings, and are sent only while that preference is on. These include new-game reminders, streak warnings, occasional re-engagement reminders (if you canceled a Pro subscription or have not played in a while), win-back offers (for example, a reminder of the day’s game or a limited-time discount on Pro), plus occasional product announcements. You can turn all of these off at any time from your profile, and every one includes an unsubscribe link; unsubscribing does not affect your other account settings or any required transactional emails above.

8. Sharing With Third Parties

We do not sell, rent, trade, or share your personal information with third parties for marketing. We share information only in these limited cases:

• Payment processing. When you start a Pro subscription we create a billing customer record with our payment processor (Stripe) using your email and display name, and the card and billing details you enter on the checkout page go directly to Stripe, who handles them under their own privacy terms.
• Email delivery. Transactional and other emails are sent through an email service provider.
• Bot protection. Our sign-up and login forms use a third-party bot-detection service (Cloudflare Turnstile), which receives signals needed to tell humans from automated scripts.
• Approximate location. Your approximate country is derived from your IP address by our hosting/CDN provider’s edge network (see “Hosting infrastructure”); we store only the country.
• Hosting infrastructure. The platform runs on cloud hosting and database providers that may have incidental access to data needed to operate the service. Web fonts are loaded from a third-party font host, which receives your IP address as part of serving the font.
• Legal compliance. We may disclose information if required by valid legal process, or to protect the rights, property, or safety of players, the public, or ourselves.

9. Data Security

We use industry-standard safeguards including password hashing, short-lived signed session tokens, HTTPS-only cookies, rate-limited login, CAPTCHAs, account lockout after repeated failed logins, and signed game session tokens. No system is perfectly secure; we cannot guarantee absolute security, but we apply reasonable measures and update them as threats evolve.

10. Automated Decision-Making

Our anti-cheat system evaluates each score submission and each game session against a set of integrity signals (token validity, statistical outliers, submission velocity, server-side coin calculation, repeated flagging). Submissions that fail validation may be automatically rejected, excluded from leaderboards, or flagged on your account, and accounts may be automatically suspended after repeated serious violations. These are not legally significant decisions about you in the sense of GDPR Article 22; they govern access to gameplay features and leaderboards. In addition to these automated signals, our staff may manually review accounts and gameplay, remove individual scores from leaderboards, and suspend or ban accounts — a ban for cheating may include removing all of that account’s scores from public leaderboards. You may request human review of any anti-cheat decision by contacting support through your account settings, and we will respond in good faith.

11. Children’s Privacy

Retro Drop is intended for players who are 13 years of age or older. We do not knowingly collect personal information from children under 13. If we learn that an account was created on behalf of a child under 13, we will delete the account and any associated data. If you believe a child has registered without parental consent, a parent or guardian can report the account for deletion from our data-request page, or contact us, and we will remove it promptly. The platform has no chat, no social features, and no real-world gambling or microtransactions.

12. Data Retention

We retain personal data only for as long as needed for the purposes it was collected, then delete or anonymize it. Indicative retention periods:

• Account profile and gameplay data — for the life of your account
• Anti-cheat flags and game-session logs — up to 24 months from the event, longer if needed to investigate a confirmed pattern of abuse
• Email and login activity logs — up to 12 months
• Subscription and billing records — for the period required by applicable tax and accounting law (typically 7 years)
• Deleted accounts — profile, scores, tournament entries, trophies, avatars, and streak are removed promptly; aggregated, non-identifying statistics (e.g. play counts per game) may persist

13. Your Rights and Choices

You always have direct, in-app control over most of your data. From your account settings you can change your email and password, manage notification preferences, and permanently delete your account. To receive a machine-readable copy of the data we hold about you, contact us at support@retrodropgames.com; we verify your request against the account’s registered email and provide it within the timeframes below. If you can’t sign in and want to delete your account, you can request deletion from our data-request page, where we confirm you control the account by emailing a one-time verification link to its registered email address before acting.

Depending on where you live, applicable law — including the EU/UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and similar laws — gives you the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (subject to limited legal retention)
• Portability — receive a machine-readable copy
• Restrict or object to certain processing, including direct marketing
• Withdraw consent where processing is based on consent, without affecting prior lawful processing
• Opt out of “sale” or “sharing” of personal information — we do not sell or share personal information as those terms are defined under CCPA/CPRA, and have not done so in the preceding 12 months
• Non-discrimination for exercising any of these rights
• Lodge a complaint with your local data-protection or consumer-protection authority

To exercise any right you cannot complete from your account settings, contact us using the information in Section 16. We verify requests against the account’s registered email and respond within the timeframes required by applicable law (generally 30 days under GDPR; 45 days under CCPA, extendable once where permitted). You may authorize an agent to act on your behalf where local law allows; we will require proof of authorization.

14. International Data Transfers

Retro Drop is operated from the United States, and your data is stored and processed there. If you access the platform from the European Economic Area, the United Kingdom, or another jurisdiction with cross-border transfer restrictions, your data is transferred outside your region. Where required, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum) with our processors, together with supplementary technical safeguards including encryption in transit and at rest. You can request a summary of the safeguards in place by contacting us.

15. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes— including changes to what data we collect, the purposes for which we use it, the parties we share it with, or your rights — we will provide notice at least 30 daysbefore the change takes effect by:

• Posting the updated policy here with a new “Last updated” and “Effective” date
• Displaying an in-app banner or notice summarizing the key changes in plain language
• Emailing registered users a short summary with a link to the full policy

Non-material changes (typo fixes, clarifications, formatting) may take effect without advance notice but will still be reflected in the “Last updated” date. If you do not agree to a material change, you may close your account before the effective date.

16. Contact

Questions about this policy, or a request for a copy of your data, can be emailed to support@retrodropgames.com. To delete your account, use your account settings or our data-request page. We respond to verified requests within a reasonable timeframe.