Privacy Policy

1. Who is responsible

Bruno Del Greco, acting as an individual developer established in Norway, is responsible for Surf Rush. For privacy questions and requests, contact bruno.dgreco@gmail.com.

2. Local game information

Surf Rush does not require a player account. The reviewed game code stores your score history on your device rather than sending it to a developer-operated online leaderboard.

Saved information includes your chosen three-character initials, scores, run durations, a randomly generated identifier for each run, ordering information and a creation time when present. It also stores your best score, preferred initials and technical information needed to keep the local file consistent. This information supports the local ranking, personal best and recovery of saved results.

The run identifier identifies a game result; it is not an advertising identifier. Initials and randomly generated identifiers do not by themselves guarantee that data is legally anonymous.

The reviewed ranking service does not send your initials or scores to Google. This statement concerns that service and is not a claim that advertising SDKs process no information.

3. Keeping and removing local results

The reviewed game keeps a local results file and recovery copies. Saved results do not expire automatically. The current version does not include an in-game button to delete the history. We cannot remotely access or delete that local history through a game account or online ranking service.

4. Advertising and Google services

Current development state: advertising is disabled by default in the reviewed source. Explicit development test modes are separate from a production advertising release. The presence of an SDK or a test advertisement does not mean that no data is processed.

Planned advertising-enabled release: Surf Rush is being prepared to use Google AdMob to show advertisements and Google's User Messaging Platform (UMP) to manage relevant privacy choices. The intended formats are a banner on results screens and an eligible full-screen advertisement between runs. Personalised advertisements may be served only when the user has given the required valid consent and the applicable platform and regional requirements are met. Gameplay remains available when advertising is unavailable or not permitted. Declining personalisation does not prevent you from playing; any alternative advertising must independently meet the requirements applicable to that mode.

Google documents that its advertising SDKs may process IP addresses, general location inferred from network information, device or advertising identifiers, advertising interactions, and diagnostic or performance information. These categories and their availability depend on platform, SDK version, settings and permissions. Documented purposes include advertising delivery and measurement, analytics and fraud prevention. This does not mean that Surf Rush has added a separate product-analytics service.

UMP also handles information needed for privacy-message functionality and choices. Its iOS manifest reviewed for this draft declares general location, performance information and product interactions for app functionality. A manifest is a declaration, not a recording of every network transmission.

See Google's Privacy Policy and how Google uses information from partner apps.

5. Your advertising privacy choices

The reviewed development interface includes an advertising privacy entry under the settings gear: Configuración → Privacidad. Whether a form can actually open depends on the native integration, configuration and applicable requirements. Permission to request an advertisement does not mean that every purpose, vendor or personalised advertising has been accepted. Its presence does not establish that a production consent flow has been completed.

For an applicable iOS tracking permission, the system permission and the advertising privacy choices are separate. This draft does not assert that Surf Rush currently requests permission to track or that an SDK manifest alone establishes tracking behaviour.

6. Website and support

This preview website is hosted on Cloudflare Pages. It has no player accounts or contact form, and does not add advertising, marketing pixels or its own analytics.

Cloudflare provides the hosting infrastructure for this preview. Hosting-specific processing and retention remain under review in this draft. Visiting this website exposes technical request information to its host even though the site does not use its own analytics. See Cloudflare’s Privacy Policy.

For support, you can also contact bruno.dgreco@gmail.com. If you email us, the information you choose to send can include your email address, message and attachments. We use this information to assess and manage your message and any related correspondence. Access to the support mailbox is limited to Bruno Del Greco; no other person has been authorised to manage it. The mailbox uses Gmail, provided by Google. Google processes email content and service information under the terms and privacy notices applicable to that service. This draft does not describe Gmail as a Google Workspace account or assume an enterprise data-processing agreement. Please avoid including information that is unnecessary for that purpose. Providing a support contact does not guarantee a reply to general support enquiries or a particular response time. This does not limit your statutory privacy rights or any applicable obligations concerning privacy requests.

Support correspondence is kept only while needed for the enquiry or another specifically documented, justified purpose. We review the support mailbox monthly and delete messages that are no longer needed, including closed enquiries. The monthly review is not a response-time commitment. Deleting correspondence from the mailbox does not establish immediate removal from every provider backup or retention system; see Google's retention information.

7. Purposes, legal grounds and international processing

The purposes identified in this draft are maintaining local results, providing permitted advertisements and privacy choices, operating this informational preview website and assessing and managing support or privacy enquiries and related correspondence.

Legal grounds must be considered separately for each purpose. Personalised advertising requires the valid consent described above. The grounds for other operations must be confirmed for the actual processing; an advertising consent does not automatically cover support, every diagnostic purpose or all third parties.

Google's published advertising terms generally describe AdMob as a service involving independent controllers, with exceptions for specified features. The Google contracting entity identified for our AdMob account is Google Ireland Ltd. The reviewed European AdMob account settings automatically include commonly used ad partners, with 198 partners selected on 18 October 2026. This selection can change automatically. The partners presented in the actual Surf Rush consent message and the recipients involved in the distributed release must be checked before this policy is finalised. The absence of additional mediation SDKs does not establish that Google is the only advertising recipient.

Google states that information can be processed internationally. Its general transfer information and advertising transfer information explain applicable adequacy frameworks and contractual safeguards. This is not a statement that all Surf Rush data stays in Norway or the EEA, or that every transfer uses the same mechanism.

8. Your rights

Under applicable data-protection law, you may have rights to access, correct or erase personal data, restrict or object to processing, and receive or transfer certain data. These rights depend on the processing and legal conditions involved. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

To make a privacy request, contact bruno.dgreco@gmail.com and explain what it concerns. If there are reasonable doubts about your identity, additional information may be requested only as necessary to verify it. Do not send identity documents unless an appropriate verification method has been agreed.

Requests concerning results stored only on your device must take account of the fact that we do not receive that local history through the reviewed ranking service. Contacting us does not automatically delete data held by Google or another provider.

Statutory privacy requests are subject to the applicable legal requirements and deadlines. Under the GDPR, information on action taken is generally due without undue delay and within one month; a permitted extension must be notified within that first month with reasons. This is distinct from general support enquiries, for which no reply or response time is guaranteed.

You may lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority, or another competent supervisory authority, including where you live or work where the applicable law permits.

9. Younger players

Surf Rush is intended for a general audience, mainly teenagers and adults. This description is not a store age rating and does not mean that every teenage player can legally consent as an adult. A person's ability to consent and the restrictions applicable to advertising can differ by age and region. The policy does not claim that Surf Rush verifies age or operates a parental-consent system.

Personalised advertising requires valid consent and compliance with the restrictions applicable to the player; selecting an acceptance option alone does not establish eligibility for personalised advertising.

10. Changes and contact

Privacy contact: Bruno Del Greco — bruno.dgreco@gmail.com.