Privacy Policy

1. Who We Are

This Privacy Policy describes how Rhyma ("we", "us", "our") collects, uses, and protects your personal data when you use our mobile application available on the Apple App Store and Google Play (the "App").

The data controller is Vitalii Samarskyi, individual entrepreneur, Ukraine. You can contact us at: support@rhyma.app.

Rhyma's backend services are hosted on Google Firebase, which acts as our data processor/service provider for authentication, data storage, messaging, and related infrastructure services.

2. Data We Collect

We collect account and profile data, authentication data, device and technical data, approximate location data, camera and gallery data, purchase and subscription data, and usage or diagnostic data when you use Rhyma.

This may include your name or nickname, email address, profile images, user identifiers, basic settings, device information, Firebase identifiers, approximate city or region, uploaded photos, purchase history and subscription status, in-app events, error information, crash information, and performance diagnostics.

We do not use precise GPS-level location for tracking your exact movements, and we do not access your photos or camera for any purpose other than allowing you to select or capture images for use inside the App.

3. How We Use Your Data

We use your data to create and manage your account, authenticate you, synchronize your profile and settings, operate collaborative poetry features, process purchases and subscriptions, provide notifications, protect the App from abuse, improve reliability and user experience, and comply with applicable legal obligations.

Approximate location may be used for gamification features, local content, and community-related elements without tracking precise movements.

4. Data Visible to Other Users and the Public

Rhyma is a collaborative game. Your nickname, avatar, public profile information, and certain activity details (such as contributions, achievements, and reactions) are visible to other users. The poem lines you submit become part of poems that are visible to other contributors and, once a poem is completed, to all of its participants.

When a completed poem is shared, it may become available on a public web page to anyone who has the link, together with the contributors' nicknames. Please keep this in mind when choosing your nickname and profile images and when submitting content.

We do not publish your email address, location data, or other non-public account information to other users.

5. Legal Bases for Processing

Where applicable law (such as the EU/UK GDPR) requires a legal basis, we rely on the following bases:

Performance of a contract: creating and managing your account, authenticating you, operating collaborative poetry features, synchronizing your profile and settings, and processing purchases and subscriptions.

Legitimate interests: protecting the App from abuse and fraud, securing our systems, diagnosing errors and crashes, and improving reliability and user experience.

Consent: approximate location features, optional rewarded ads, and non-essential analytics or tracking technologies where consent is required by law.

Legal obligations: complying with accounting, tax, and other legal requirements that apply to us.

You may withdraw consent at any time through device settings or by contacting us, without affecting processing that occurred before withdrawal.

6. Camera, Photos, and Location

The App requests camera and photo library access only so you can capture or select images for your avatar, cover image, or other user content.

The App may request approximate location to enable gamified features, local challenges, or region-based elements. You may disable these permissions at any time in your device settings.

7. Firebase, RevenueCat, and Other Processors

We use Firebase Authentication, Cloud Firestore, Cloud Storage for Firebase, Cloud Functions for Firebase, Firebase Cloud Messaging, and Firebase App Check as our primary backend infrastructure. Firebase and Google process personal data on our instructions and for the purposes described in this Policy.

We use RevenueCat to manage in-app subscriptions and purchases. RevenueCat processes user identifiers, device identifiers, purchase history, and subscription status on our behalf. Payment card details are handled by the Apple App Store or Google Play and never reach us or RevenueCat.

Except for Google AdMob as described in Section 10, we do not share your personal data with independent third-party controllers for their own marketing or advertising purposes.

8. Data Retention, Anonymization, and Deletion

We store account and profile data for as long as your account remains active or as necessary to provide the App's services. Technical and diagnostic logs are retained for up to 3 months unless a longer period is required for security or technical investigations.

To preserve the integrity of collaboratively created content, we may anonymize personal data instead of fully deleting all related records. If you request deletion, we will remove or anonymize personal identifiers in active systems while retaining anonymized collaborative content where necessary.

You can delete your account directly in the App under Settings → Delete Account, or follow the instructions at https://rhyma.app/account-deletion.

9. Your Rights

Depending on your location and applicable law, you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

To exercise these rights, contact us using the details below. We may need to verify your identity before processing your request.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with a data protection supervisory authority, you also have the right to lodge a complaint with your local supervisory authority.

10. Cookies, Analytics, Ads, and Tracking Technologies

The App and its backend infrastructure may use mobile SDKs and identifiers to provide core functionality, maintain authenticated sessions, perform analytics, measure usage, improve reliability, and diagnose errors or crashes.

Where required by law, we will obtain consent before using non-essential analytics or tracking technologies.

Optional rewarded ads are provided through Google AdMob. If you choose to watch an ad, Google may process advertising identifiers, consent signals, device information, ad interaction data, and related diagnostics to serve and verify the rewarded ad. For these purposes Google may act as an independent controller of that data under Google's own privacy policy.

Where consent is required, ads are served in accordance with your consent choices; depending on your choices and region, ads may be served in a non-personalized mode. You can avoid AdMob processing entirely by not watching rewarded ads, and you can limit ad tracking in your device settings.

11. International Data Transfers

Because we use Firebase, Google Cloud, and RevenueCat services, your personal data may be stored or processed outside your country, including in the European Union, the United States, and other jurisdictions where these providers maintain data centers.

Where required, we rely on appropriate safeguards such as standard contractual clauses and technical and organizational measures.

12. Data Security

We implement technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

These measures include encryption in transit and at rest, access controls, authentication mechanisms, Firebase security rules, Firebase App Check, and monitoring for unusual activity or potential security incidents.

13. Children's Privacy

Rhyma is not directed to children below the minimum age required by applicable law for independent consent to data processing (for example, 13 in the United States and between 13 and 16 in the European Union, depending on the member state). We do not knowingly collect personal data from such children.

If we become aware that we collected personal data from a child contrary to this Policy, we will delete or anonymize it as soon as reasonably possible.

14. Notice for U.S. and California Residents

We do not sell personal information for monetary consideration. If you choose to watch optional rewarded ads, Google AdMob's processing of advertising identifiers may constitute "sharing" for cross-context behavioral advertising as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, depending on your consent choices and ad personalization settings.

You can opt out of any such sharing by not watching rewarded ads and by limiting ad tracking in your device settings. California residents may also exercise rights of access, deletion, and correction by contacting us using the details below. We do not discriminate against you for exercising these rights.

If you are a U.S. or California resident and have questions about how your rights may apply to Rhyma now or in the future, contact us using the details below.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or operational needs.

When we make material changes, we will update the "Last updated" date and, where appropriate, provide notice within the App or by other reasonable means.

16. Contact

If you have questions about this Privacy Policy, our data practices, or wish to exercise privacy rights, please contact: Vitalii Samarskyi, individual entrepreneur, Ukraine.

Contact email: support@rhyma.app