Privacy policy

Last updated: 2026-08-21

1. Data controller

Controller: Manuel Losada Rodríguez (trading as Bierzo Labs)
Address: Av. Miguel de Cervantes 13, bajo A — Villalbilla (Madrid), Spain
Contact and exercise of rights: manuel.losro@gmail.com

This policy covers both this website (https://reflexrivals.com) and the REFLEX RIVALS mobile app (Android and iOS).

2. The principle: your data is not the product

We do not use your data for commercial purposes. We do not sell, rent or share your data with third parties for advertising, and we do not build commercial profiles. Data is processed for one purpose only: so you can use the app with a verified account, to keep spam accounts out, and to keep rankings and challenges fair.

The app carries no ads, no analytics and no advertising identifiers. As of the August 2026 release we removed the analytics SDK from the app entirely: the device no longer sends any advertising identifier (AD_ID on Android, IDFA on iOS) or aggregated usage data. The only thing that leaves your phone is what your account, the rankings and the challenges actually need.

3. Data we process

3.1 In the app

Account data: when you sign in with Google or Apple we receive a user identifier and, depending on the provider, your name and email address. With Apple you can hide your real email using their private relay.
Gameplay data: match results, reaction times, scores, statistics and the challenges you take part in.
Player name and public profile: the alias you choose and, if you enter it, your country; both visible in rankings and challenges.
Notification token: a device identifier provided by Firebase Cloud Messaging so we can tell you about a challenge. It is deleted when you sign out or delete your account.
Social and moderation: your ⭐ friends list (private — nobody else can read it), the groups you belong to, the users you block and the reports you send.
What we do NOT process: no location, no contacts, no photos, no advertising identifiers, no browsing data outside the app.

3.2 On this website

Anonymous usage data through Google Analytics, only if you accept cookies (see the Cookie policy). If you decline, no measurement script is loaded at all. This applies to the website only, never to the app.

Public rankings and your scores. Your profile is private by default: in that state your gameplay data stays on your device and nothing is uploaded to our servers. If you choose to make your profile public in order to take part in global rankings and challenges, the app asks for your consent first; from then on your alias and scores are uploaded to our servers and shown publicly in the rankings to other players. You can switch back to private at any time from your profile, and we remove your entries from the public ranking.

4. Purposes and legal bases

Creating and verifying your account (performance of a contract — Art. 6(1)(b) GDPR).
Rankings, challenges, groups and sync (performance of a contract): your results are stored in the cloud so comparisons and challenges work.
Challenge notifications (performance of a contract, plus the operating-system permission you grant to receive them).
Spam, fraud and abuse prevention; content moderation (legitimate interest — Art. 6(1)(f) GDPR): verified accounts keep bots and fake accounts out, and blocking and reporting keep the environment healthy.
Anonymous website statistics (consent — Art. 6(1)(a) GDPR): only if you accept analytics cookies. You can withdraw consent at any time via "Manage cookies" in the footer.

5. Sign in with Google and with Apple

The app uses third-party authentication services. When you use them, the relevant provider processes your data under its own terms:

Google Sign-In

Sign in with Apple

From these providers we receive only the account identifier and, where applicable, name and email. We do not access your contacts, files or any other data in your account.

6. Processors

Google Ireland Limited / Google LLC — Firebase: authentication (Firebase Auth), database (Cloud Firestore), notifications (Cloud Messaging), server functions (Cloud Functions) and app integrity verification (App Check). Acts as a processor under the Firebase Data Processing and Security Terms. Privacy and security in Firebase.
Google Ireland Limited — Google Analytics (this website only, and only with your consent): see the Cookie policy.
Amazon Web Services: hosting of this static website.

There are no other recipients. We do not share data with third parties except where legally required.

7. International transfers

App data is stored and processed in Google Cloud's European region (Madrid, Spain). That said, Google LLC is a US company and certain support or maintenance operations may involve access from outside the European Economic Area. Those transfers are covered by the Standard Contractual Clauses approved by the European Commission and by Google's participation in the EU-U.S. Data Privacy Framework. You can ask us for a copy of these safeguards at the address in section 1.

8. Retention periods

Account, profile, scores, rankings, groups and friends: for as long as you keep the account. Deleting it removes them immediately (see section 12).
Notification token: until you sign out or delete your account.
Challenges you took part in: deleting your account removes your alias and your results. The challenge may continue to exist for the other participants, without any data of yours.
Moderation reports: as long as needed to resolve the case, and at most 12 months.
Website statistics: 14 months, per the Google Analytics configuration.

9. Children

REFLEX RIVALS is not directed to children under 14, the digital age of consent in Spain (Art. 7 LOPDGDD); in other EU countries that age ranges from 13 to 16. If you are below that age you need your parents' or guardians' consent to use the app. If we become aware of an account created by a child without such consent, we delete it.

10. Security

Access to data is controlled by server-side security rules: nobody can read another person's friends list, join a group without an invitation, or alter another player's result. The app verifies its own integrity (App Check) to block tampered clients, and sensitive on-device preferences are stored encrypted and excluded from cloud backups.

11. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to:

Manuel Losada Rodríguez (Bierzo Labs)
Av. Miguel de Cervantes 13, bajo A — Villalbilla (Madrid), Spain
manuel.losro@gmail.com

We reply within one month at the latest. To verify your identity we may ask you to write from the email linked to your account. If you believe your request was not handled properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with your local supervisory authority.

12. Account deletion

You can delete your account and all associated data from inside the app, under Settings → Delete account, without asking anyone. You can also request it in writing.

How to delete your account and what gets erased →

13. Changes to this policy

Any material change will be published on this page with an updated date in the header.