Legal

Privacy Policy

Effective date: 5 October 2026 · App: Veyro Run (com.ferrabled.veyro.run), published by Fernando Rabasco ("ferrabled") · Contact: ferrabled+veyro@gmail.com

Camera (optional game mode)

Veyro Run has an optional "camera" control mode that uses your device's front camera to detect your head position so you can steer by moving your body.

• The camera is used only if you choose camera mode, and only after you grant the Android camera permission (on iPhone, camera access when iOS asks).
• Camera images are processed entirely on your device, in memory, by a local machine-learning model. They are never recorded, never saved to storage, and never transmitted anywhere. Each frame is discarded as soon as the next one is processed.
• Declining the camera permission loses nothing: the tilt & touch mode is the full game.

Motion sensors

Tilt mode reads your device's gyroscope/accelerometer to steer. Sensor readings are used in the moment, on the device, and are not stored or transmitted.

Data stored on your device

Your local game data — best scores, daily streak, recent run history, your equipped cosmetic, and preferences such as your last-used control mode — is saved in the app's local storage on your device only. Uninstalling the app removes it from the device; note that Android's automatic backup service may restore app data when you reinstall, depending on your device's backup settings — that is Android behaviour, not something the game controls. On iPhone, deleting the app removes this data too. It comes back only if you restore the whole iPhone from an iCloud or computer backup made while the app was installed, and offloading the app (in the iPhone Storage settings) keeps it.

In versions with online profiles, the device additionally stores the profile's session and a recovery code. The recovery code exists so that the same profile — name, progress, leaderboard entries — can come back after you reinstall: Android's backup carries it across, and on the next launch the game exchanges it for your profile. On iPhone, deleting the app deletes the code too. After a delete and reinstall the profile comes back only if you copied its code first (PROFILE → RECOVERY CODE → COPY) and use IMPORT PROFILE on the new install, or if you restore the whole iPhone from a backup that contains it. It is a random secret that unlocks only this game profile; the server keeps only a scrambled fingerprint of it, never the code itself. The game reads your clipboard only when you tap IMPORT PROFILE, to paste a recovery code; on iPhone, iOS asks you to allow that paste first.

The recovery code is written to the app's own storage folder, and on some Android versions and devices that folder — and therefore the code — survives uninstalling the app. That is what lets a profile come back on a reinstall even when device backup is off, but it also means uninstalling is not a reliable way to erase it. On iPhone the code does not survive: deleting the app deletes it from the device, although an iCloud or computer backup made earlier still contains it until that backup is replaced or deleted. To remove the code deliberately: use PROFILE → DELETE ONLINE PROFILE inside the game (which deletes the code along with the profile it unlocks), or clear the app's data from Android's app settings (on iPhone, delete the app). Treat the code like a password while it exists: anyone who has it can claim the profile. If automatic recovery cannot replace a profile you have already played, the older code is kept separately on this device for support, while the current profile receives its own code. Deleting the online profile or clearing app data (on iPhone, deleting the app) also removes these saved codes; removing a saved code does not delete the separate older profile.

Player profile and leaderboards

This section applies to versions with the shared leaderboard (the leaderboard update onward). If your PROFILE tab shows a generated player name, it applies to you.

• A profile is created automatically the first time the game goes online: a random player ID and a generated display name (like SWIFT-FOX-42). There is no sign-in, and no email, phone number, or real name is asked for or stored. You can generate a new name whenever you like; you can never type one, so no player's text is ever shown to others.
• Finished runs are uploaded automatically. When a run ends, the game sends its results — score, distance, coins, best combo, duration, the day's track seed, which control mode you used (tilt or camera — a yes/no fact, never any camera imagery), app version and platform — to our database provider Supabase, acting as our processor, so the daily and all-time leaderboards and your run history can exist. The device keeps up to eight of the most recent pending runs and retries uploading them when a connection returns; older pending runs are discarded when the queue is full. Uploads remain subject to server validation and submission limits. This upload is required for the leaderboard feature to work; it is not optional within these versions, and deleting the profile is the way to stop it.
• What other players see: your generated name and your scores, on the public leaderboards. Nothing else — never your player ID, and never anything from the camera or sensors.
• The profile ID is also your purchase identifier. The same random ID is used with RevenueCat (see Purchases below) so that your cosmetics and your profile belong to one identity. It remains a pseudonymous identifier: it is not linked to your name, email, or Google or Apple account by us, but records attached to it are your records, and we treat them that way — they are deletable, not "anonymous and unaccountable".
• Retention and deletion: profile and runs are kept while the profile exists. PROFILE → DELETE ONLINE PROFILE deletes the profile, every run, and every leaderboard entry immediately and permanently, and asks RevenueCat to delete its customer record for the same ID. Local device stats stay on the device (they are yours, on your hardware) until you clear the app's data (on iPhone, until you delete the app). Without the app, see data deletion on the support page.
• Fair-play and security processing: submitted runs are checked server-side against what the game can physically produce, and submission is rate-limited per profile. Implausible submissions are stored flagged (never shown on boards; entries over 30 days old are removed when the same profile submits another flagged run, and otherwise may remain until profile deletion). This processing exists to keep the leaderboard honest and the service available. For provider-deletion retries, former Player IDs may remain in a restricted cleanup queue until cleanup succeeds.

Sharing a run, and challenge links

This section applies to versions with a SHARE button on the run-over card (the challenge update onward).

• Sharing is your action, and the game sends nothing. Tapping SHARE opens Android's own share sheet — your phone's standard list of apps. The game hands that sheet one line of text and stops there (if the sheet cannot open, the same text is copied to your clipboard instead). On iPhone, SHARE copies that same line to your clipboard, and you paste it wherever you choose. Whether the message goes anywhere, and to whom, happens inside the app you pick, in your hands. We never see the message, the recipient, or which app you chose, and the game does not read your contacts or check which messaging apps you have installed.
• What the message contains. Your score, the distance, whether it was a new personal best, whether it was that day's Daily Run, and a link like https://veyro.ferrabled.com/challenge/?s=987654&v=greybox-1&w=greybox&p=4210&m=free. Those values are the track's random seed, the content version, the world name, your score, the run mode and, for a Daily Run, the date — they describe a run, so your friend plays exactly the track you played. Your player name, your Player ID, your device, and anything from the camera or sensors are not in it, and there is no box for you to type your own text.
• Opening someone's challenge link. The link opens the game directly where Android has verified it for Veyro Run; otherwise it opens a page on our website showing the score to beat, with a button that opens the game on the same track with the same seed, or takes you to the Google Play listing if you do not have the game. On iPhone the link always opens that page first, and its button opens the game if it is installed. That page sets no cookies, runs no analytics, and does not know who you are — it reads the score and the seed out of the link's own address in your browser. See "About this website" below for what happens at the infrastructure level.

Purchases (optional)

This section applies to versions that include the in-game shop (the September 2026 update onward). Earlier closed-beta versions contain no shop and contact no one.

Veyro Run is free, and the whole game is in the free download. You can optionally buy cosmetic items for your runner, which change how your runner looks and nothing else. Buying is optional; the check described in the first point below is not, because the game has to know what you already own.

• RevenueCat is contacted when the game starts, whether or not you ever buy. The game uses RevenueCat, a purchase-management service acting as our processor, to answer one question: which cosmetics does this device own? It asks that question when the game launches, when you return to it after switching away, and when you open the store screen — not only at the moment of a purchase. That is what makes a cosmetic you already own appear straight away instead of after a restart. On first launch RevenueCat generates an anonymous identifier for your installation, and each request carries basic technical details: app version, platform, and store country. If you never buy anything, that identifier simply has no purchases attached to it. Its policy is at revenuecat.com/privacy.
• Google Play handles the payment. Purchases are made through your own Google account under Google Play's terms. We never see or receive your payment details — no card number, no billing address, no name. Google's handling of the transaction is covered by Google's privacy policy.
• On iPhone, Apple handles the payment instead. Purchases are made through your own Apple Account under Apple's terms, and the same rule holds: we never see or receive your payment details. Apple's handling of the transaction is covered by Apple's privacy policy.
• Buying is what adds the purchase itself. When you buy or restore, RevenueCat also receives the purchase token and purchase history that Google Play issues for the transaction (on iPhone, the App Store's transaction and receipt details), and keeps them so your purchase can be given back to you when you reinstall or switch phones.
• That identifier is pseudonymous. It is not linked to your name or email. In shop-only versions it is generated per installation; in versions with online profiles it is your player profile's random ID (see the profile section above), so cosmetics and profile belong to one identity. Reinstalling normally produces a new one, though Android's backup service — or, in profile versions, the recovery code — can bring the previous identity back.
• Purchase records double as our sales statistics. RevenueCat shows us aggregate numbers derived from purchases — how many of each cosmetic have been bought, revenue totals. These statistics come from purchase records. Profile-enabled versions additionally send finished-run results as described above; notification-enabled versions also process sessions and notification interactions as described below. We do not serve ads or collect advertising identifiers. Buying a skin does not enable additional gameplay tracking.

Camera mode is unaffected by all of this: camera frames are never part of a purchase, never sent to Google Play, Apple or RevenueCat, and never transmitted anywhere at all.

Notifications (versions with PROFILE → NOTIFICATIONS)

The game uses OneSignal, with Firebase Cloud Messaging (FCM) for Android delivery and the Apple Push Notification service (APNs) on iPhone. Firebase and APNs are delivery services here; the profile database remains Supabase.

• Registration starts when the app starts, even before you allow notifications. OneSignal processes an installation/user identifier, push subscription identifier and device push token when available, notification permission/subscription state, app/device/OS information, language/time zone, sessions and notification interactions. In an app with purchases, OneSignal may also process purchase history for messaging statistics. This processing supports notifications and their delivery/engagement measurements.
• IP address and country (approximate location). Network requests expose your IP address to OneSignal. From the first launch, whether or not you allow notifications, OneSignal derives your device's country from that IP address and keeps the country with its record for your installation. This supports the notification service and its audience and engagement analytics. OneSignal's documentation states that it also stores IP addresses, except for users in the EU and UK. The game does not request GPS/location permission, and OneSignal's device-location feature is disabled; that does not prevent this country-level processing of the IP address.
• SDK crash and error reports. OneSignal's SDK can send crash reports and its own error logs to OneSignal when OneSignal enables diagnostic reporting remotely. Reports can include installation/subscription identifiers, device and operating-system information, app version, and technical details about the failure. OneSignal uses these reports to diagnose problems and maintain the notification service. Reporting can occur from app launch, independently of whether you allow notifications or enable the separate gameplay analytics option. We do not send camera frames, motion readings or run results to OneSignal.
• Receiving notifications is optional. A menu explanation lets you choose; Android (on iPhone, iOS) asks for permission when needed. PROFILE → NOTIFICATIONS → TURN OFF stops push delivery, and Android settings (on iPhone, the Settings app) also control permission. These actions do not delete the provider record or stop SDK registration/session processing, IP-derived country processing or remotely enabled SDK diagnostics while the app is used. Every run remains playable without notification permission or a network connection.
• No camera frames, motion readings or precise location are sent to OneSignal. Device-location sharing is disabled; the country derived from the IP address is described above. This first notification version does not send your Supabase player ID, email, phone number or custom run-result tags to OneSignal. Its installation record is separate from your online profile.
• Retention and deletion: the notification record, including its IP-derived country, remains with OneSignal until deleted. SDK diagnostic reports are kept under OneSignal's retention arrangements. To request access or deletion, copy PROFILE → NOTIFICATIONS → COPY NOTIFICATION SUPPORT ID and email ferrabled+veyro@gmail.com. The ID locates the notification record; we verify control before deleting and handle requests about diagnostic reports with OneSignal. We handle requests within 30 days, normally sooner. DELETE ONLINE PROFILE only deletes the profile-related records described above, not these separate OneSignal records. Using the app after deletion can create a new notification record; uninstalling stops further SDK activity but is not itself a provider-deletion request.

Gameplay analytics (optional, versions with PROFILE → GAMEPLAY ANALYTICS)

We use Layers to understand how players use the game and whether a notification leads to a played Daily Run. This is separate from notification permission and from the leaderboard service.

• Off until you choose. The Layers SDK does not start or contact Layers until you enable PROFILE → GAMEPLAY ANALYTICS. Your choice is remembered between launches. Declining has no effect on gameplay, purchases, leaderboards or notification delivery.
• What is sent after enabling. A random analytics support ID and SDK installation/device and session identifiers; app version and build type; device model, operating system, language, time zone and screen information; app visits; notification opens; and real run starts and results, including mode, control choice, track/day/version, score, coins, distance and duration. A notification may carry campaign and variant labels so we can connect that click to a later run. The SDK also reports delivery diagnostics, such as queued/delivered/dropped event counts, retry status, SDK version and consent state, and one measurement of how long the SDK took to start, to help detect delivery problems. We do not send the notification text or arbitrary notification payloads to Layers.
• Approximate location. Network requests expose your IP address to Layers. Layers' documentation states that it stores the IP address with the analytics events it receives, resolves it to an approximate country, region and city, and keeps these records while our Layers account is active unless they are deleted (see "Retention, access and deletion" below). This is approximate location processing; the game does not request GPS/location permission.
• What is excluded. In the Layers integration we disable advertising-ID and install-referrer collection, advertising consent, and Layers' automatic application crash/error reports and gameplay performance traces. OneSignal's separate SDK diagnostic reporting is described under Notifications. SDK delivery diagnostics described above remain enabled while analytics is on. No camera frames, motion-sensor readings, recovery codes, email addresses or phone numbers are sent. Choosing camera controls sends only the control-mode label, never what the camera sees. This version uses a separate analytics ID rather than your Supabase player ID. On iPhone the game never asks for tracking permission (App Tracking Transparency).
• Turning it off. PROFILE → GAMEPLAY ANALYTICS → TURN ANALYTICS OFF withdraws consent and shuts the SDK down, so nothing further is sent. While enabled, up to 200 pending events may be stored in the app's own storage area on your device (an app-specific folder that other apps cannot read) for delivery when connected. Events still unsent when you turn analytics off stay on the device and can never be sent while analytics is off; they are deleted the next time you enable analytics, or when you clear the app's data (on iPhone, delete the app). Events already delivered cannot be recalled by the switch. The support ID remains on the device so you can request deletion of earlier records.
• Retention, access and deletion. Previously delivered analytics remains with Layers until deleted under its retention arrangements or a verified deletion request; turning off or uninstalling does not itself delete provider records. Copy PROFILE → GAMEPLAY ANALYTICS → COPY ANALYTICS SUPPORT ID, then email ferrabled+veyro@gmail.com to request access or deletion. The ID locates records; we verify control before acting. Requests are handled within 30 days, normally sooner. DELETE ONLINE PROFILE does not delete this separate analytics record. Enable analytics again after deletion and new records can be created.
• Provider and international processing. Layers processes analytics for us and states that its primary processing region is the United States. Its data-protection documentation describes its processing, international-transfer arrangements and deletion process. Contact us with questions about our use of the service.

Provider information: Layers data protection.

Service providers, and how they protect your data

We share data only with the providers below, only for the purposes described in this policy, and only under terms that require them to protect it to at least the same standard as this policy and to use it only to provide their service to us. We do not sell your personal data, and we do not share it for advertising.

• Supabase: database for player profiles, runs and leaderboards (our processor).
• RevenueCat: purchase management and restore (our processor).
• OneSignal: notification registration, delivery and engagement measurement, IP-derived country, and SDK diagnostic reporting (our processor), delivering through Firebase Cloud Messaging on Android and the Apple Push Notification service on iPhone.
• Layers: optional gameplay analytics, only after you enable it (our processor).
• Google Play and Apple's App Store: payments, under their own terms and privacy policies (linked in the Purchases section).
• Cloudflare and Google Fonts: hosting and fonts for this website only (see "About this website").

International processing. Some of these providers process data outside your country, including in the United States. Where the law requires it, those transfers rely on the provider's safeguards, such as the European Commission's Standard Contractual Clauses.

How we protect your data

• Everything the game sends travels over encrypted HTTPS connections.
• The server never stores your recovery code, only a scrambled fingerprint of it, and a Player ID alone is never enough to act on a profile.
• Access to the provider accounts that hold your data is limited to the developer.
• We collect the minimum each feature needs: no real names, emails, phone numbers, contacts, precise location or camera images.
• No system is perfectly secure. If a breach affected your data, we would inform affected players and the authorities as the law requires.

Legal bases, and your rights

The developer, Fernando Rabasco, based in Spain, is responsible for the processing described here. Contact: ferrabled+veyro@gmail.com.

• Providing the game you use (profile, leaderboards, run uploads, purchases and restoring them): performance of our agreement with you.
• Optional gameplay analytics and receiving notifications: your consent, which you can withdraw at any time in PROFILE (this does not affect processing before the withdrawal).
• Fair-play and security checks, and notification registration and delivery measurement (including OneSignal's IP-derived country and SDK diagnostics): our legitimate interest in an honest leaderboard and a working, reliable service.

Depending on where you live, you have the right to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent. Use the in-game controls above or email us; we reply within one month. You can also complain to a data protection authority: in Spain, the Agencia Española de Protección de Datos (aepd.es), or the authority where you live. No decision with legal or similarly significant effects is made about you automatically; the fair-play checks only keep implausible runs off the leaderboards.

Children

Veyro Run is not directed at children under 13.

Your rights

In versions with online profiles, your profile and runs are yours to manage directly: rename in the PROFILE tab, delete profile-related records with DELETE ONLINE PROFILE (immediate and permanent), or email us. The PROFILE tab shows a Player ID (locates your records) and a recovery code (proves control of the profile — only your device holds it; the server keeps a fingerprint). An ID alone locates a record but does not authorize: before acting on an emailed request we verify control, and the recovery code is the way to demonstrate it. The same code also re-imports your profile on another install (IMPORT PROFILE on the PROFILE tab).

For versions without online profiles, purchases, notifications or gameplay analytics, no data leaves the game, so there is nothing held by our providers to request, export, correct, or delete — uninstalling removes the local scores and settings from the device (subject to Android's backup behaviour, or an iPhone restore from backup, above).

In shop-enabled versions, RevenueCat holds the anonymous identifier for your installation from the first launch onwards, and — if you have bought a cosmetic — the record of that purchase, which it keeps so the purchase can be restored. A purchase also appears in your own Google Play order history, which you see and manage in your Google account. On iPhone it appears in your Apple Account's purchase history instead.

To have the RevenueCat record deleted, email ferrabled+veyro@gmail.com. Two honest caveats:

• If you have bought something, include your Google Play order number (from your Google Play order history; on iPhone, the order ID from Apple's receipt email) so we can locate the record. Deleting it removes what RevenueCat holds, but the purchase itself remains in your Google Play account (on iPhone, your Apple Account) — that is Google's (or Apple's) record, not ours to delete — so restoring purchases on a later install can create a fresh RevenueCat record containing that purchase again.
• If you have never bought anything, the record is a random identifier that neither we nor RevenueCat can connect to you — the app does not display it, and it is not linked to your name, email, or Google or Apple account. It contains nothing about you beyond app version, platform, and store country. We will still help with any request, but we cannot single out which anonymous record is yours.

Any other privacy question or concern: email the same address, and a human will answer.

About this website

This website (veyro.ferrabled.com) sets no cookies and runs no analytics or trackers. Two things happen at the infrastructure level when you visit: the site is served by Cloudflare, which processes visitor IP addresses to deliver pages (as any web host does), and pages load their fonts from Google Fonts, which means your browser requests the font files from Google's servers. We never see or store any of this ourselves.

The challenge page (veyro.ferrabled.com/challenge/) works the same way: it reads the score and the track from the link's own address, in your browser, and stores nothing. As with every page here, the request itself passes through Cloudflare — which means the address you asked for, including the score and seed inside it, is handled by Cloudflare's infrastructure like any other URL. We add no tracking of our own and keep no logs.

Changes

The Purchases section was added on 29 August 2026 and revised on 15 September 2026, ahead of the first distributed version that includes the in-game shop. The Player profile and leaderboards section was added on 18 September 2026 and clarified on 19 September 2026, ahead of the leaderboard update. Closed-beta versions distributed before the shop update contain no purchases and collect nothing. The Notifications section was added on 20 September 2026, ahead of the notification-enabled update. The optional Gameplay analytics section was added on 21 September 2026, ahead of the analytics-enabled update, and its description of turning analytics off was corrected the same day, before distribution. The "Sharing a run, and challenge links" section was added on 28 September 2026, ahead of the challenge update. iPhone-specific wording (App Store payments, clipboard sharing, what deleting the app does to the recovery code, APNs delivery) was added the same day, ahead of the first iPhone version; it adds no new data collection. On 29 September 2026 the sections on service providers, how we protect your data, and legal bases and your rights were added, the description of how Layers handles IP addresses was corrected to match Layers' documentation, and the clipboard use of IMPORT PROFILE was stated; none of these changes adds data collection. On 5 October 2026 we clarified OneSignal's existing IP-derived country processing, SDK crash/error reporting, and the associated notification controls, purposes and retention. We also clarified that the gameplay-analytics exclusions apply to Layers. This corrects the description of the existing services and does not enable new collection. Future collection changes will be described here before distribution and reflected in the store listing.

Contact

Questions about this policy: ferrabled+veyro@gmail.com.