1. Who We Are

This Privacy Policy applies to the website rdd-labs.com, to the Color Drain mobile application, and to related services operated by Daniel Simonov (Osek Patur: 323812388), trading as RDD Labs, based in Israel ("RDD Labs", "we", "us", or "our").

For privacy-related inquiries, contact us at support@rdd-labs.com.

This policy is governed by the Israeli Privacy Protection Law, 5741-1981, as amended by Amendment No. 13 (in force since 14 August 2025), and its regulations — including the Privacy Protection Regulations (Data Security), 5777-2017 and the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001. Under the amended law, online identifiers such as an IP address, a device or advertising identifier, and location data are personal data, and we treat them as such throughout this policy.

2. What Data We Collect

We collect the minimum data necessary to operate our services.

The table scrolls sideways — swipe to see Retention.

Beyond the analytics data described above, we do not collect addresses, payment information, or precise location data. The only names we ever hold are ones you type yourself — into the “Request Pitch Deck” form, or as a username in the player community (section 12); the beta and newsletter forms ask for an email address and nothing else.

Providing your email address is entirely voluntary. You are under no legal obligation to do so. Choosing not to provide it simply means you will not receive our updates — it has no other consequences whatsoever.

3. How We Use Your Data

Your email address is used only for the following purposes:

• Sending you one confirmation email immediately after you sign up. Until you open the link in it, your address is not confirmed and stays unused.
• Notifying you when Color Drain launches on Android, and again when the iOS date is set.
• Sending you the Google Play closed-testing link once you confirm a sign-up made on the Color Drain pages (the game page or the release-date page), and — historically — if you signed up through the closed-testing form while it was open.
• Studio updates about once a month — what we shipped, what we learned, new game announcements and major milestones.
• If you join the player community: the sign-in link, and the notifications you switched on there (section 12).

We do not use your email for profiling, automated decision-making, or any purpose not listed above.

Some of the emails we send — including game launch announcements and studio updates — constitute advertising material under Section 30A of the Israeli Communications Law (Bezeq and Broadcasts), 5742-1982. In compliance with that law, every such email: (a) carries the word פרסומת at the start of its subject line and body; (b) clearly identifies RDD Labs as the sender, with our contact details and postal address; (c) includes a one-click unsubscribe link, plus the standard header that lets your mail app show its own unsubscribe button. We honour every opt-out immediately and without conditions — including one sent to us as a plain reply — and we never send advertising material to anyone who has opted out. A confirmation email is not advertising material and is not marked as such.

4. Legal Basis for Processing

Under the Israeli Privacy Protection Law, we process your email address on the basis of your freely given consent, which you provide when you submit the sign-up form and confirm by opening the link we email you. You may withdraw consent at any time — with the unsubscribe link in any email, the deletion form in section 10, or by writing to support@rdd-labs.com.

Cloudflare's security processing is carried out on the basis of our legitimate interest in protecting our website from abuse and ensuring its availability. Analytics processing (Google Analytics 4) is likewise based on our legitimate interest in understanding aggregate usage of the site.

5. Data Storage and Security

Email addresses are stored in Cloudflare D1, a distributed SQLite database managed by Cloudflare. Data is encrypted in transit (TLS 1.3) and at rest. Cloudflare's infrastructure is SOC 2 compliant.

Email is delivered through Resend, Inc., from its European Union (Ireland) region. To deliver a message, Resend receives the recipient address and the message content and keeps its own delivery logs for a limited period under its privacy policy. We do not upload our list to Resend; each message is sent individually.

To protect our sign-up forms from abuse, our API applies per-IP rate limiting. It stores only SHA-256 hashes derived from the request's IP address — never the raw IP — and these hashes are automatically deleted within approximately two hours.

Access to stored email addresses is limited to authorised members of RDD Labs. We do not expose this data through any public interface.

No security system is impenetrable. If we become aware of a breach affecting your personal data, we will notify you at the email address you provided as required by applicable law.

6. Third-Party Services

We use the following third-party services, each of which has its own privacy policy:

• Cloudflare, Inc. — website hosting, CDN, DDoS protection, lead storage (D1 database). Privacy Policy
• Google LLC — website analytics (Google Analytics 4). Privacy Policy
• Resend, Inc. — email delivery (confirmation, launch and update messages), EU region. Privacy Policy

We do not use Facebook Pixel, Google Ads, or any other advertising or retargeting technology. We do not sell or rent your data to any third party.

7. The Color Drain Mobile App

This section covers the Color Drain mobile application, separately from the website. Color Drain is built with Unity and its core gameplay runs fully offline — you can install and play every level without an account and without a network connection.

The app and its embedded third-party SDKs may collect the following:

• Google AdMob (Google LLC) — serves the optional rewarded video ads. AdMob may access your Android Advertising ID, coarse device and app information, and IP address in order to serve and measure ads and to detect invalid traffic. Rewarded ads are always player-initiated; there are no interstitial ads. You can reset or delete your Advertising ID at any time in your Android settings under Settings → Privacy → Ads. How Google uses data from apps that use its services
• Firebase Analytics (Google LLC) — aggregate gameplay and product analytics, such as level starts and completions, session counts, app version, device model, operating system version, coarse region, and a Firebase-generated app instance identifier. Used to understand how the game is played and where players get stuck.
• Firebase Authentication (Google LLC) — only if you choose to sign in for cloud save. Stores an account identifier and, where you provide one, an email address. Signing in is optional and is never required to play.
• Cloud Firestore (Google LLC) — stores your cloud-save progress if you have signed in. Progress is otherwise held on your device only.
• Crash and performance diagnostics (Google LLC) — crash stack traces, device state at time of crash, and performance traces, used solely to diagnose and fix defects.
• Google Play Billing (Google LLC) — processes in-app purchases such as the ad-free upgrade and cosmetic items. Payment details are handled entirely by Google; we never receive or store your payment card information.

Abuse prevention. To stop a single source flooding our sign-up form, we count submissions per hour against a SHA-256 hash of your IP address combined with the current hour. The raw IP address is never written to our database, the hash cannot be reversed to recover it, and these counters are deleted automatically after about two hours.

We do not collect precise location, contacts, photos, microphone or camera data, or the contents of any other app on your device. We do not sell your personal data, and we do not share it with data brokers or advertising networks beyond the ad-serving described above.

Closed testing. If you joined the Color Drain closed test while recruitment was open, we hold the record described in section 2: the Gmail address you submitted, when, which form, whether you ticked the 14-day box, and — for records created after 11 September 2026 — the language, the consent-wording version and an IP hash. No name, no device information. We use it for one purpose: sending you the Google Play closed-testing link and contacting you about the test. Google Play separately makes tester participation data available to us as the developer. Your record is deleted on request, and in any case once the closed test concludes.

Investor and partnership enquiries. The “Request Pitch Deck” form is a business-contact channel, not part of the game. If you use it we store exactly four things: the name you enter, the company or fund name if you give one, your email address, and the date and time you submitted it. We use them to reply to you and to send the pitch deck. Investor enquiries are kept separate from the player mailing list and are never added to it, never used for marketing, and never shared with anyone outside RDD Labs. Ask us at support@rdd-labs.com and we will delete your enquiry.

Signup alerts. So that we notice a beta signup or a pitch-deck enquiry without having to check a database, a short alert is sent to our own internal team channel. That alert contains a masked address (for example d*****@gmail.com) — never your full address — plus, for beta signups, a running total, and for enquiries, the company name you gave.

Deleting your app data. To request deletion of data associated with the app:

• Email support@rdd-labs.com with the subject “Data deletion request”, from the address or account you used. We will confirm within 7 days and complete the deletion within 30 days.
• We delete your authentication record, any cloud-save data held in Cloud Firestore, and any beta-tester record we hold for you. Aggregate analytics that cannot be linked back to you may be retained.
• Uninstalling the app removes all locally stored progress from your device. If you never signed in, uninstalling is sufficient — we hold nothing to delete.

The permanent link for deletion requests is rdd-labs.com/privacy#data-deletion.

8. Cookies

Google Analytics 4 sets first-party cookies (_ga, _ga_RKP260RWPQ) to distinguish visitors and sessions — only after you accept them on the consent banner, and rejecting deletes any that exist. These are used solely for aggregate usage measurement — no advertising features are enabled. Three small settings (your consent choice, your language, and whether you paused the site's animations) are kept in your browser's local storage, not in cookies, and are never sent to us.

Cloudflare's infrastructure may set strictly necessary security cookies (e.g., __cf_bm) to protect the site from bot traffic. These are essential for site security and cannot be disabled without affecting functionality. They store no personal information about you.

See our full Cookie Policy for details.

9. Children's Privacy

Our website's sign-up forms are directed to users aged 18 and older. Under Israel's Legal Capacity and Guardianship Law, 5722-1962, a person under 18 is a minor, and consent given by a minor may be set aside — so we do not knowingly collect personal data from anyone under 18 through the website. If you believe someone under 18 has submitted their email address to us, please contact us at support@rdd-labs.com and we will delete it promptly. The player community is the one exception: it is open from 16, as section 12 explains.

Color Drain is not directed to children. The app's Google Play target audience is set to 13 and older, it is not enrolled in the Google Play Families programme, and it does not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data through the app, email support@rdd-labs.com and we will delete it promptly.

10. Your Rights

Under the Israeli Privacy Protection Law, you have the following rights:

• Right of inspection (Section 13) — you may request to review any personal data we hold about you in our records, and to receive a copy of it. We will respond to inspection requests within 30 days.
• Right of correction (Section 14) — if data we hold about you is inaccurate, incomplete, unclear, or no longer current, you may request that we correct, supplement, replace, or delete it. We will act on your request within a reasonable time and notify you of the outcome.
• Deletion — you may erase your personal data from our systems entirely, yourself, with the form below; we will comply unless we are required to retain it by law. What remains afterwards is an irreversible hash on our do-not-contact list and the dated record that the deletion happened.
• Withdrawal of consent and refusal of advertising — you may withdraw your consent to receiving communications from us at any time, without any conditions or consequences: with the unsubscribe link in any email we send (one click, honoured immediately), with your mail app's own unsubscribe button, by replying to any message, or by contacting us directly.

To exercise any of these rights, send an email to support@rdd-labs.com. We will respond within 30 days.

If you believe we have not handled your data lawfully, you may file a complaint with the Israeli Privacy Protection Authority.

If you are a resident of the European Economic Area (EEA) or California, this policy respects and upholds your rights under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), respectively.

11. International Data Transfers

Your data may be processed on servers outside Israel: Cloudflare (hosting and database) operates a global network including the United States and the European Union; Google (analytics) processes in the United States; Resend (email) processes in the European Union (Ireland).

The United States is not a country to which transfers are automatically permitted under the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001. We rely on two bases. First, each recipient is contractually bound to protect the data to a standard no lower than Israeli law requires — Cloudflare's, Google's and Resend's data-processing terms, which we have accepted. Second, for your own contact details, on your consent: you provide them after reading this notice, for exactly the purpose you requested, and you may withdraw at any time. Transfers to the European Union are to a jurisdiction whose protection is recognised as adequate.

12. The Player Community

If you join the player community, we keep a member record: it runs the community, gets the sign-in link to you, and sends the notifications you switched on. Joining is your consent to this, and you accept the community rules the first time you sign in. There is no password: you sign in with an emailed link, or with Google, from which we take only your verified address.

What we store. Your email address in clear and a SHA-256 hash of it; your username, plus a display name and a line about you if you add them; your avatar colour, language and notification settings; when you joined and were last seen; any suspension and why. Then what you post — threads, replies, votes and poll votes — the reports you file, your appeals, and the moderation log of what the studio did and why.

Who sees what. Your username, display name, bio, avatar and posts are public to anyone who can open the community. Your email address is never shown to other members; moderators can see it.

How long. As long as your account exists. Delete it from your profile and the personal fields are wiped, the address becomes a placeholder, and your posts stay up as “deleted member”. Reports and the moderation log are kept for 12 months.

Your rights. Read, correct and delete your details on your profile. Section 10 and support@rdd-labs.com cover everything else.

Age. The community is for people aged 16 and over. If you are under 16, do not join; if we learn that a member is, we close the account.

Where, and the cookie. Member data sits in the newsletter's Cloudflare D1 database, under sections 5 and 11. Signing in sets one cookie, rdd_member — HttpOnly, 30 days, deleted when you sign out (section 8).

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we will make reasonable efforts to notify you (for example, by sending an email to the address you provided). Continued use of our services after a policy change constitutes acceptance of the updated policy.