Privacy Policy

Effective date: October 7, 2026 · Applies to the Bruk It Up mobile game (iOS and Android)

We collect the minimum needed to run the game — your account identity, your game progress, and a virtual-currency (coins) ledger — plus limited usage and crash-diagnostic data to keep the game working and improve it. We do not run ads, we do not use advertising identifiers, and we do not track you across other apps or websites. We are not a payment processor: Apple and Google handle every purchase. You can export or delete everything at any time.

What we collect

Account identity. If you sign in with Apple or Google: your name, email, and profile image as shared by that provider. With an email code: your email address. As a guest: a random, device-scoped anonymous account with no email. Any account, guests included, can choose a display name (2 to 16 letters, numbers, spaces, or _ - .) and change it at any time; that is the name friends and other players see.
Profile snapshot (every signed-in account; not guests). The app uploads a small summary of your progress when you open the app (at most every ten minutes), after each finished game, and when an achievement tier rises: your level, a few lifetime stats (best score, Bruk Run floor, longest chain, wins, best streak, bosses beaten, games played, tiles broken) and your achievement tiers. It is uploaded whether or not you use friends, and only your accepted friends can see it.
Last active time (every account, guests included). While the app is open it tells our server you are active, about every 45 seconds. We keep only the most recent time, not a history. Only your accepted friends can see it, as online, in a match, or last seen.
Gameplay data. Your runs, stage results and scores, lives timer, and any power-up slots or quick-drop boosts you own.
Social data (only if you use friends or multiplayer). Your friend code, your friends list, and — if you invite someone by email — that person’s email address, used only to send them the invite. Every invite email has a one-click unsubscribe link; once used, we never email that address again (we keep only a one-way hash of it to remember). In a Versus or Teams match, your display name is shared with the other players in that match. Your accepted friends can see your display name, your profile snapshot and your last active time (both above).
Coins ledger. A record of each coin transaction (amount, reason, time, and the store transaction id for purchases). It runs the in-game economy — it is not a financial record about you.
Technical & security data. Your session token, the IP address and device/browser (user-agent) tied to a session, and short-lived (about five minutes) email verification codes.
Push token. Only if you turn on notifications for room and friend invites, we store the notification token your device provides so we can deliver those invites.
Usage & diagnostics (only if you opt in). At first launch, and any time in Settings, you can turn on Help improve the game. It is off by default and the game works the same either way. Only if it is on, we collect product-analytics events and crash reports. The analytics events include a fixed set we send explicitly — when a session starts, when a game starts and ends (with the stage, outcome, and score), when you make a purchase (the item bought), and when you send an invite (whether by email or in a room) — tied to your account identifier, never to your email or name; the analytics SDK may also capture app-interaction events automatically. Crash reports include your device model, operating-system and app version, and the technical details and stack trace of the error; they are configured not to attach your IP address or personal identifiers, and we do not use session replay. Analytics and crash data are processed on United States infrastructure by PostHog and Sentry (see Sub-processors). Our analytics provider receives your IP address and may use it to estimate approximate location.

We do not collect payment card numbers or bank details, precise location, contacts, photos, or audio, and the app never asks for the microphone. We use no advertising SDKs and no advertising identifiers (no IDFA / no cross-app ad tracking), so no App Tracking Transparency prompt is shown.

Google user data

If you choose Sign in with Google, Google shares your name, email address, and profile picture with us, and nothing else: we request only the basic openid, email, and profile scopes and have no access to your Gmail, Drive, contacts, or any other Google data.

How we use it. Only to create and sign you in to your Bruk It Up account, so your progress, lives, and coins follow you across devices, and to show your name on your profile and to other players in multiplayer.
How we store it. On our backend (Cloudflare D1), over HTTPS, for as long as your account exists. Deleting your account erases it.
Sharing. We do not sell it, use it for advertising, or share it with anyone except the infrastructure providers listed under Sub-processors that run the service for us.

Bruk It Up’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Payments

All in-app purchases are processed by Apple or Google, the merchant of record. Receipt validation is handled by our purchases provider, RevenueCat, to which we send your account identifier so a purchase credits the right account. We store only a coins-ledger entry keyed to the store transaction id — never your payment instrument. All purchases are one-time (consumable) items; there are no subscriptions.

Sub-processors

Apple / Google — sign-in identity and store purchases (merchant of record).
RevenueCat — purchase-receipt validation.
Cloudflare — backend hosting, database (D1), and content delivery, and bot protection (Turnstile) on the email sign-in flow. When a Turnstile challenge runs, your IP address is sent to Cloudflare to verify you are a person.
Resend — delivers sign-in codes, account-deletion confirmations, and friend-invite emails.
Expo — delivers room and friend-invite push notifications to your device (only if you enable notifications).
PostHog (United States) — product-analytics events used to understand and improve how the game is used.
Sentry (United States) — crash and error reporting used to diagnose and fix problems.

These providers process data only on our instructions, under their data-processing terms. Where data leaves the EEA or UK for the United States, the transfer is covered by Standard Contractual Clauses (EU) and the UK International Data Transfer Addendum.

Your rights

Export. In the app: Profile → Account → Export my data. We build a JSON file on demand and hand it to your device’s share sheet, so you can save or send it. You can export once every 30 days. It excludes secrets such as auth tokens and passwords. For anything the download doesn’t cover (such as your friends list or match history), email info@brukitup.com.
Delete. In the app, or from the public page at Data deletion. Deletion is immediate and permanent.

If you are in the EEA or UK, you have the right to access, correct, erase, restrict or object to processing of, and port your data, and to withdraw consent (for notifications) at any time. Most of these you can do in the app; for anything else, email info@brukitup.com. We reply within one month. You can also complain to your local data protection authority (in the UK, the Information Commissioner’s Office). Residents of California and other US states with privacy laws have equivalent rights to know, delete, and correct; because we sell no personal data and run no ads, there is nothing to opt out of.

Data retention

We keep your account and game data for as long as your account exists. Usage and crash-diagnostic data are retained by our analytics and error-reporting providers for their configured retention periods. Deleting your account erases your data in our own systems, but does not itself remove events already sent to PostHog or Sentry. If you want those records removed too, email info@brukitup.com and we will ask the providers to delete them. When you delete your account, we keep only the anonymized coins ledger (see below) for up to 400 days for refund and fraud reconciliation, after which a daily process purges it automatically.

What deletion does

In one step we erase your profile, sign-in credentials and sessions, email verification codes, all game data (runs, stage results, lives, and power-up entitlements), your friends and social graph, your profile snapshot and last active time (what your friends can see), and any push token; we anonymize your coins ledger (each entry re-keyed to a random, non-identifying token); and we write a deletion audit entry that contains no personal data (only a one-way hash, counts, and timestamps). Records of past multiplayer matches you hosted may retain the display name that was shown to the other players in that match.

Security

Data is transmitted only over HTTPS, with HTTP Strict Transport Security and hardened response headers. Access tokens used for export and deletion links are cryptographically signed and checked in constant time, every third-party integration fails closed if its secret is misconfigured, and audit records never contain personal data. If a breach affecting your data occurs, we will notify you and the relevant authorities as the law requires.

Children

Bruk It Up is not directed at children under 13, and we do not knowingly collect personal information from them. At first launch we ask for your birth year to confirm you are 13 or older. The check happens on your device; we never store or send your birth year, only whether the check passed. If you believe a child under 13 has created an account, email info@brukitup.com and we will delete it.

Contact

The data controller for Bruk It Up is IYBMSB LLC, c/o its registered agent at 5900 Balcones Drive, Suite 165, Austin, TX 78731, USA. Reach us on any privacy matter at info@brukitup.com.