Privacy policy

Effective 25 Sep 2026 (updated 28 Sep 2026: nickname, reporting players and reminders) · Rare Leaf Tycoon (web, iOS, Android)

Operator

DeliSo s.r.o., company ID 24940801, Nové sady 988/2, 602 00 Brno, Czech Republic. Contact: [email protected].

What we store

Game progress, settings and purchased looks are stored only on your device. The game needs no account, and without one nothing is uploaded to our own server. Deleting the game or browser data removes everything. The only exceptions are anonymous daily return counts (no identifier) and features you turn on yourself (optional account, Neighbors), described below.

In-app purchases

Payments are processed by Apple (App Store) or Google (Google Play); we never see card details or your name. To know which looks you own and restore them on a new device we use RevenueCat, Inc. (USA), which receives an anonymous install identifier and purchase records from the store. Legal basis: performance of contract.

Gameplay measurement (consent only)

Only if you explicitly allow it in the game, pseudonymous gameplay events (no names, e-mails or free text) are sent to PostHog in the EU. Events are kept for 1 year and then deleted by PostHog. You can withdraw consent in Settings at any time.

Return counts (no identifier)

To know how many players come back to the game (for example on day two or day seven), once a day on launch the game sends our server only two things: that it was played today, and the day the game was first launched on your device; when you finish the tutorial it sends “tutorial finished” once. The server keeps only daily totals per first-launch day, with no player or device identifier. So that a day is not counted twice, your device remembers its first-launch day and the last day it reported. To prevent flooding we count how often the same event arrives from one IP address per day; we never store the IP itself, only a salted one-way hash that is deleted the next day. Legal basis: legitimate interest in improving the game.

Optional account (coming later)

The game does not offer accounts yet. When it does, an account will be optional — you will be able to play without one. If you create one, we will store your e-mail address (for sign-in with a one-time code, or via Google) and a copy of your game progress, looks and showcase identity so you can continue on another device. Data will be stored with our processor Supabase in an EU data center. You will be able to download it and delete your account with all data at any time in the game's Settings. Legal basis: performance of contract (providing the service you request).

Neighbors and leaderboard (only if you turn it on)

If you turn on “Show my greenhouse”, we store a randomly drawn name or the nickname you choose, your chosen looks, herbarium, species and slot counts and your rare-leaf and coin totals on our server (Cloudflare, EU). Other players can see them. For the neighbor market we also store your in-game market settings (the number used to draw prices and its start time); others only ever see your current price, never future ones. If you tick “I grow it at home” for species in the Journal, neighbors also see that list of species. For your showcase we count how many new players started through your link (just a number, nothing about them) and show it only to you. Your device gets a random identifier and secret key; we know nothing else about you. The record stays until you remove it: “Hide and delete” removes it immediately. Legal basis: consent.

Nicknames pass through a filter for inappropriate words. When visiting someone else's greenhouse you can report it (this opens an email containing the showcase identifier; nothing is sent without you) or hide it — hiding applies only on your device. We delete reported showcases that break the rules.

To prevent flooding the leaderboard we count how many showcases are created per IP address per day. We do the same so that one device can add at most one sale per day to someone else's market. To see whether the game spreads, we also keep daily totals of opened links, new players from invites and shares (totals only, with no player identifier); the same IP hash keeps one device from being counted twice. We never store the IP itself — only a salted one-way hash that is deleted the next day. Legal basis: legitimate interest in protecting the service.

Bug reports and ideas

The “Report a bug” and “Share an idea” buttons in the game (Settings → About) and on the Support page only open your email app with a prefilled message. Nothing is sent until you send the email yourself. From the game, the message includes technical details (game version, language, platform and device type), which you can delete before sending. The email arrives in our mailbox at Seznam and we use it only to handle and reply to it; we delete it once handled. Legal basis: legitimate interest in fixing and improving the game.

Reminders

In the app we can remind you that a plant has grown — only if you allow it. Reminders are scheduled by the phone itself (local notifications); nothing is sent to any server. Turn them off in the game's or the phone's settings.

What we don't do

No ads, no cross-app tracking, no location, contacts or photos, and we never sell data.

Website

The website is hosted by Cloudflare, which may process technical logs (IP address, request time). We count visits with Cloudflare Web Analytics, which sets no cookies, stores nothing on your device and does not track you across sites. Legal basis: legitimate interest in running and improving the site.

In addition, the website sends anonymous usage events to our own server (page viewed, clicks on “Play” or a store link, symptom-checker searches, load speed, referrer, device type, language and country). It sets no cookies; visitors are told apart only by a fingerprint that changes every week, and we never store your IP address or browser identifier. Data is processed by Supabase in an EU data center (Frankfurt). We keep these pseudonymous records (no IP address, no cookies) without a time limit, including encrypted backups, so we can compare traffic over longer periods. Legal basis: legitimate interest in improving the site.

Google Analytics (consent only). If you click “Allow” in the banner on the website, Google Analytics 4 (Google Ireland Ltd.) is loaded. It sets the _ga and _ga_* cookies (up to 2 years) and receives the pages you visit, your device type and approximate location from your IP address, which Google does not store. Advertising features and Google signals are off. Data may be transferred to the USA under the EU-US Data Privacy Framework. You can withdraw consent at any time via “Cookie settings” in the site footer; the cookies are then deleted. Legal basis: consent.

The “I want one at home” link on care cards leads to a partner online shop; what happens after you click is governed by that shop's own privacy policy.

Children

The game is suitable for all ages and does not require any personal data.

Your rights

You have the right to access, rectify, erase and object, and to lodge a complaint with the Czech data protection authority (uoou.gov.cz). Since we mostly keep data only on your device, the quickest way is to delete the game. Questions: [email protected].