• Email address — to identify your account and send the game communications described below.
• Display name — the public name shown on the leaderboard.
• Chosen runner character — your in-game avatar selection.
• Run history — scores, level reached, and timestamps from your gameplay sessions.
• Consent metadata — the date you accepted these policies and the version you accepted.

We do not collect payment information, government identifiers, location data, or any sensitive categories of personal data.

Rosé Run sends three distinct categories of email. We disclose all of them here so that you can tell, at any time, which messages you can turn off and which are part of running the service.

1. Transactional and service messages. Lawful basis: GDPR Article 6(1)(b) — necessary for performance of the contract (running the game you signed up for). These messages are tied to a specific action you took and are not subject to opt-out:

• Welcome & account messages — confirming your signup and any account changes you make.
• Run recap — a short summary tied to a run you just completed.
• Milestone notices — sent when you cross a specific gameplay threshold you triggered (e.g. reaching the Top 10).

2. Promotional and schedule messages. Lawful basis: GDPR Article 6(1)(a) — your consent, given at signup via the Terms & Privacy checkbox alongside the inline disclosure on the signup form, and withdrawable at any time. You can opt out of these without affecting your account or the transactional category above:

• Launch-day announcements — when each festival level opens for play.
• Festival schedule reminders — time-sensitive nudges during the June 22–26 festival window.

3. Pre-launch “get notified” list. Lawful basis: GDPR Article 6(1)(a) — your consent, given when you submit your email on the pre-launch page. If you joined this list you don’t have an account yet; we hold only the email address you gave us, use it for the launch announcement and festival-week level drops, and nothing else. Every message includes an unsubscribe link, and unsubscribing removes you from the list.

We do not sell your email address, share it with advertising partners, or rent it to third parties.

You can withdraw consent for the promotional and schedule category at any time, and we make it the same number of clicks as a single tap:

• Toggle off “Game updates from Rosé Run” on the Settings page.
• Click the Unsubscribe link in the footer of any promotional email we send.

Either action removes you from our Resend audience within seconds and stops all future promotional and schedule emails. Transactional and service messages above are not affected — to stop those, delete your account.

• Supabase, Inc. (United States) — database hosting and authentication.
• Resend, Inc. (United States) — email delivery.
• Vercel, Inc. (United States) — web hosting and edge delivery.
• Functional Software, Inc. (Sentry) (United States) — runtime error monitoring (no email addresses sent; PII is scrubbed before transmission).

Each processor is bound by its own data processing terms and receives only the data needed to perform its function.

All four processors above are located in the United States. If you access Rosé Run from the EU, UK, or EEA, your personal data is transferred outside your jurisdiction. We rely on the EU Commission’s Standard Contractual Clauses (SCCs) — as incorporated into each processor’s data processing agreement — as the transfer mechanism under GDPR Articles 44–49. For UK transfers, the UK International Data Transfer Addendum applies in addition. We do not engage in any additional cross-border transfers beyond these processors.

We keep your personal data only as long as you have an active account. Specific retention periods:

• Account row (email, display name, character, consent metadata) — retained until you delete your account.
• Run history — retained until you delete your account, plus up to 30 days in encrypted backups.
• Email-send log — retained for 90 days for deliverability and abuse-prevention purposes, then purged.
• Anonymized festival aggregate (no email, no display name, no player ID) — retained indefinitely for internal analysis and post-festival reporting.

You can delete your account at any time via Settings → Clear my data. Deletion cascades across every system we control: your player row, run history, email-send log, and your Resend audience entry. Backups age out on the schedule above.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you (GDPR Article 22). Leaderboard rankings are a straightforward sort of run scores you submitted yourself.

If you are in the EU, UK, or EEA, you have the right to access, correct, port, or delete your personal data, and to object to or restrict processing. Email nate@palettegrp.com and we will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

The data controller for Rosé Run is:

Palette Group LLC
New York, NY, United States
Email: nate@palettegrp.com

EU representative (Art. 27 GDPR): Rosé Run is a short-window festival product not specifically targeted at the EU market and does not currently meet the Art. 27 threshold for a designated EU representative. If you are in the EU, EEA, or UK and want to exercise your rights or raise a concern, contact the address above and we will respond within 30 days.