PRIVACY POLICY

Last updated: September 29, 2026

This Privacy Policy explains how Rhythmic, Inc. ("Company," "we," "us," or "our") collects, uses, and discloses your information when you use our products, tools, and services, and outlines your rights and choices. It applies to Frella Trivia and to the other applications, websites, and tools we operate, generally hosted at rhythmicapps.com and its subfolders (for example, https://rhythmicapps.com/frella-trivia), and any other standalone tools or sites we operate (each a "Product" and collectively, the "Products").

Please read this Privacy Policy carefully.

1. INTERPRETATION AND DEFINITIONS

Words with initial capitalization have the meanings defined below. These definitions apply equally to the singular and plural forms.

• Account - A unique account created for you to access a Product or parts of it.
• Affiliate - An entity that controls, is controlled by, or is under common control with the Company.
• Application - Frella Trivia, provided by the Company.
• Company - Rhythmic, Inc., registered in Delaware, United States.
• Device - Any device that can access a Product (e.g., smartphone, tablet, or computer).
• Personal Data - Any information that relates to an identified or identifiable individual.
• Service Provider - A third-party company or individual that processes data on our behalf.
• Usage Data - Information collected automatically when using a Product (e.g., device type, session duration).
• You - The individual using a Product, or the legal entity represented by that individual.

2. INFORMATION WE COLLECT

We collect information you provide voluntarily and data collected automatically when you use a Product.

Information you provide

• Profile Data: an account identifier, any email address supplied through your sign-in method, and optional profile details. A password is processed only if the Product offers password sign-in.
• Payment Data: when you make a purchase in the native iOS app, Apple processes the payment. Google Play would process a purchase if an Android version is offered. We do not store your full payment credentials.
• Support & Feedback: any information you provide when contacting us for support, completing surveys, or giving feedback.

Data collected automatically

• Usage Data: how you interact with the Product, including features accessed, session duration, and frequency.
• Device & Browser Data: IP address, device type, OS version, time zone, and language settings.
• Referrer & Campaign Data: information on how you discovered the Product (e.g., ad source, referral link).

Advertising and analytics cookies (websites)

Rhythmic-hosted pages for this Product use the OpenAI Ads pixel to measure whether an advertising visitor clicks an app-download link. The pixel may process browser, device, referral, and interaction data for that purpose. It loads only after you accept optional advertising measurement and does not load when your browser sends a Global Privacy Control signal. You can reject or change this choice through the site's privacy controls.

Tracking and advertising identifiers

On iOS, with your permission through the App Tracking Transparency prompt and where otherwise permitted, we may collect your Apple Identifier for Advertisers (IDFA) for attribution. If an Android version is offered, where permitted we may collect its Google Advertising ID (AAID). The attribution partners listed in the Third-Party Services and SDKs section may use these identifiers to measure campaign effectiveness, attribute installs, and understand where users discover the Product. You can reset or disable these identifiers, and change your tracking choice, in your device settings.

Native daily identity and profile

The native daily game creates a Firebase anonymous account when you first open the app. You can optionally link it to Sign in with Apple so you can access that account on another device. Firebase stores the account identifier and, if Apple provides it, Apple account details such as an email address. Frella Trivia does not ask you to create a password. Your chosen display name, generated handle, daily progress, scores, streaks, balance and mode statistics are stored on Firebase servers. They are not limited to storage on your device.

Daily play, groups and leaderboards

Firebase stores the questions served to your account, your submitted answers and typed corrections, timing and results, the records used to prevent repeated questions and duplicate credits, and your score and balance history. These records let the server resume play, calculate points and enforce daily limits. Daily records do not have the multiplayer room's 24-hour expiry. In the current service they remain until account deletion, subject to the retention exceptions in this Policy.

If you create or join a group, Firebase stores its name, invite code, membership, ownership and activity times. Members can see the group name, your chosen display name and your score in that group's leaderboard. A group owner can also see opaque member management identifiers needed to manage the group, but not other members' Firebase account identifiers. The global leaderboard shows a generated handle and score, not your chosen display name or the names of your groups. Weekly and all-time boards are stored on the server. An invite code can be shared by anyone who has it, so share it only with people you want to invite.

Purchases and internal testing

The native iOS app uses RevenueCat to check subscription and trial status and sends your Firebase account identifier to RevenueCat for that purpose. Our server checks RevenueCat before granting premium access. It can also receive purchase-status webhooks from RevenueCat when that connection is configured. Apple processes the payment; deleting a Frella Trivia account does not cancel a subscription or remove Apple's purchase records.

For internal TestFlight access, Firebase stores that your account enrolled as a tester and may store rate-limit and quality-assurance settings. Internal testers can receive provisional draft questions. The enrollment code itself is checked against a server-held hash and is not stored in your profile.

When configured, Amplitude receives app events under your Firebase account identifier. Sentry receives limited diagnostics for failures. On iOS, AppsFlyer starts after the App Tracking Transparency choice has been resolved, including when permission is declined; in that case it does not receive an authorized IDFA, but it may still process permitted non-IDFA attribution data. Firebase App Check may process platform attestation data to help protect app requests. These services have the separate retention and privacy practices described in the Third-Party Services and SDKs section.

Account deletion

The native app's Delete account control removes the account's daily profile, days, attempts, answers, command and score records, group memberships, leaderboard entries, entitlement copy and tester settings from Firebase, then deletes the Firebase Authentication identity. If the account is linked to Apple, the app first asks you to reauthenticate and revoke its Apple authorization. A group can continue for its other members, with ownership reassigned when necessary. A temporary deletion marker may remain while Firebase's time-to-live cleanup runs. Deletion does not cancel an App Store subscription or automatically erase records kept by Apple, RevenueCat, analytics, attribution or diagnostic providers. Contact support@rhythmicapps.com for a request involving those records.

If you switch from an anonymous account to an existing Apple-linked account after the app's confirmation step, the anonymous account and its daily data are deleted rather than merged into the existing account. An anonymous account that was never linked to Apple may be difficult to recover after reinstalling the app or changing devices.

Existing multiplayer rooms

The earlier multiplayer app remains available while the native daily version is being introduced. When you create or join one of its rooms, Firebase anonymously associates your device with a room membership and display name. It processes the room code, answers, response times and scores to run the room. Other players in that room see your display name and scores; they see individual answers after a question closes.

Room cleanup removes live room data after play. An answer-free final summary, including display names, scores, correct-answer totals and the anonymous membership mapping used to authorize recovery, remains accessible to participants only until the room's original expiry, at most 24 hours after creation. Access then ends and scheduled cleanup removes the summary. Limited operational cleanup records and provider records can outlast that room window. This temporary room rule does not apply to native daily account data.

In that earlier app, all-time points, correct-answer totals, games won and the display name kept for local use are stored on your device. Its Erase app data control clears those local details and the local reconnect handle. It preserves purchase-access information, free-round usage, surprise-reward records and any enabled testing override. That local erase does not delete Firebase's anonymous identity, live rooms, retained final summaries, subscriptions or provider records. Contact support@rhythmicapps.com for a request beyond that local reset. The Expo disclosure in the Third-Party Services and SDKs section applies to this earlier app, not to the native daily build.

3. HOW WE USE YOUR PERSONAL DATA

We process your personal data for the following purposes:

• To provide and improve the Product: operate, maintain, and enhance the experience, enable core functionality, troubleshoot technical issues, authenticate users, and secure access to your account.
• To analyze and enhance the Product: we use aggregated and anonymized data to understand how users interact with the Product, run surveys, test features, and identify improvements.
• To customize your experience: for instance, to determine which payment options, promotions, or recommendations to display.
• To process payments: Apple processes purchases and subscriptions in the native iOS app. Google Play would process them if an Android version is offered. We do not store full payment details.
• To enforce terms and prevent fraud: enforce our Terms, prevent fraud, resolve disputes, and detect malicious activity. Where required by law or in cases involving fraud or legal claims, we may share relevant information with law enforcement authorities.
• To communicate with you: via email, in-app messages, or push notifications about your account, Product usage, or feature changes, including reminders or security notices.
• To send marketing communications: we may send messages about features, offers, and events. You can opt out of marketing emails at any time via the "Unsubscribe" link in the email footer.
• To provide customer support: respond to inquiries, confirm transactions, and send legal or status notices.
• To comply with legal obligations: process or share information when required by applicable law, regulation, legal process, or government request.

4. THIRD-PARTY SERVICES AND SDKs

The Product relies on the third-party services and SDKs listed below. Each acts as a service provider/processor on our behalf unless stated otherwise. This section is assembled from the processors this app actually ships.

Amplitude (Amplitude, Inc.)

Product analytics and event tracking, to understand how users navigate and interact with the Product so we can improve functionality and engagement. Amplitude does not sell user data or use it for advertising. Privacy Policy: https://amplitude.com/privacy

Sentry (Functional Software, Inc.)

Error monitoring and performance tracking. Collects crash reports, error logs, and device information to help us identify and fix issues. Sentry does not use advertising identifiers. Privacy Policy: https://sentry.io/privacy/

Expo (650 Industries, Inc.)

App development and over-the-air update infrastructure. May collect device identifiers when delivering updates. This Product does not use Expo's push-notification delivery service, and no push token is sent to Expo. Privacy Policy: https://expo.dev/privacy

RevenueCat (RevenueCat, Inc.)

Subscription and in-app purchase management. Processes purchase history and subscription status to validate receipts, prevent fraud, and sync purchases across devices. Acts as a data processor and does not sell or share personal data. If you request a refund from Apple or Google, the store may ask us, through RevenueCat, to confirm limited purchase and usage information (for example, whether a purchase was delivered or used), and we may provide that information to the store to help evaluate your request. Privacy Policy: https://www.revenuecat.com/privacy/

Payment Processors (Apple; Google Play if offered)

Apple processes subscription and in-app payments in the native iOS app. Google Play would process them if an Android version is offered. We never store full credit card data.

• Apple: https://www.apple.com/legal/privacy/
• Google Play, if offered: https://policies.google.com/privacy

AppsFlyer (AppsFlyer Inc.)

Our primary mobile attribution and marketing-measurement provider. Where permitted (including after you allow tracking through the App Tracking Transparency prompt), AppsFlyer may collect device identifiers such as the IDFA or AAID, IP address, and engagement and conversion data to attribute installs and measure campaign performance across our marketing channels (including Meta, Google, and TikTok). AppsFlyer processes this data on our behalf as a processor and does not use it for its own advertising purposes. Privacy Policy: https://www.appsflyer.com/legal/services-privacy-policy/

Firebase (Google LLC)

Firebase supports configured content and app features described in the Information We Collect section. Firebase App Check can validate app requests when enforcement is enabled. Requests may include ordinary connection and app/device metadata, such as an IP address and app or platform information. App Check may process attestation material from the configured platform provider and App Check tokens to help establish app or device integrity. Google generally acts as a processor or service provider for Firebase. Privacy and security information: https://firebase.google.com/support/privacy

Web advertising and measurement pixels

The OpenAI Ads pixel runs on Rhythmic-hosted pages and landing pages for this Product, not inside the app. It measures advertising performance by recording an app-download-link click after optional consent. OpenAI may process browser, device, referral, and interaction data for this purpose. Privacy Policy: https://openai.com/policies/privacy-policy/

5. APP TRACKING TRANSPARENCY (ATT)

In accordance with Apple's App Tracking Transparency framework, Frella Trivia may request your permission to track activity across apps and websites owned by other companies for advertising and attribution purposes. If you decline, we do not use your IDFA for cross-app tracking. Analytics and attribution that are permitted without that identifier may continue as described in this Policy.

6. LEGAL BASES FOR PROCESSING (EEA/UK USERS)

If you reside in the European Economic Area or the United Kingdom, our legal bases for processing include:

• Contract performance - to deliver the Product.
• Consent: for tracking, cookies, and marketing communications.
• Legitimate interests - to improve and secure the Product.
• Legal obligation - to comply with applicable laws.

You have the right to withdraw consent at any time.

7. YOUR RIGHTS AND CHOICES

Depending on your jurisdiction, you may have the right to access or request a copy of your data, request correction or deletion, withdraw consent for marketing or tracking, request data portability, and object to certain processing. To exercise these rights, email us at support@rhythmicapps.com.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to delete it (subject to exceptions); to correct inaccurate information; to opt out of the "sharing" of personal information for cross-context behavioral advertising; and to non-discrimination for exercising these rights.

We do not "sell" personal information for monetary consideration. However, our use of analytics and advertising identifiers with the attribution partners listed in the Third-Party Services and SDKs section may constitute "sharing" under California law.

To exercise these rights, email support@rhythmicapps.com. We will respond to verified requests within 45 days.

Our use of the OpenAI Ads pixel to measure download-link clicks may involve disclosing certain identifiers and activity for cross-context behavioral advertising, which may constitute "sharing" or a "sale" under some state laws. You can opt out through the site's privacy controls or by emailing support@rhythmicapps.com. We honor Global Privacy Control (GPC) signals where required.

Other U.S. state privacy rights

If you reside in a U.S. state with a comprehensive consumer privacy law (such as Virginia, Colorado, Connecticut, Texas, Oregon, and others), you may have rights similar to those above, including to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. To exercise these rights, contact us at support@rhythmicapps.com. You may also have the right to appeal a decision on your request.

8. DATA RETENTION

We retain your personal data only as long as necessary for the purposes stated in this Policy.

• Account data: retained until your account is deleted or as legally required.
• Attribution/analytics data: up to 24 months (aggregated data may persist longer in anonymized form).

9. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to and processed in the United States, the European Union, and/or other countries where we or our service providers operate. The primary processing location for Frella Trivia is the United States. These countries may have data-protection laws that differ from those in your jurisdiction.

When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission (and the UK Addendum where applicable), and we maintain data-processing agreements with our service providers requiring them to protect your data consistent with this Privacy Policy.

If you have questions about international transfers, contact us at support@rhythmicapps.com.

10. DATA SECURITY

We use encryption, access controls, and secure servers to protect your data. However, no internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

11. DATA BREACH NOTIFICATION

If a security breach results in unauthorized access to your personal data, we will notify the relevant supervisory authorities as required by applicable law (where required, within 72 hours of becoming aware), and we will notify affected users without undue delay where the breach is likely to result in a high risk to your rights and freedoms. We maintain incident-response procedures to detect, investigate, and respond to potential security incidents.

12. CHILDREN'S PRIVACY

Frella Trivia is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, please contact us at support@rhythmicapps.com and we will delete it.

13. LINKS TO OTHER WEBSITES

Our Products may contain links to third-party websites not operated by us. We are not responsible for the content or privacy practices of those sites. Please review their privacy policies before providing any personal data.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. The updated version will always be available at https://rhythmicapps.com/frella-trivia/privacy. We will let you know via email and/or a prominent notice in the Settings or Profile screen in the Product, and by updating the "Last updated" date above. Changes are effective when posted.

15. DELETE YOUR PERSONAL DATA

You have the right to delete, or request that we help delete, the personal data we have collected about you. You may update, amend, or delete your information at any time by signing in to your Account and visiting the account settings section, or by contacting us. Please note we may need to retain certain information where we have a legal obligation or lawful basis to do so. To make a request, contact support@rhythmicapps.com.

16. EU / UK CONTACT AND REPRESENTATIVE

For questions about how we process the personal data of individuals in the EEA and the UK, you can contact our EU-based point of contact:

Gabriel Kwakyi Schumanngasse 67 1/7 1170 Vienna, Austria support@rhythmicapps.com +43 699 8189 6557

EEA and UK data subjects may contact us at this address regarding the processing of their personal data.

CONTACT US

If you have any questions or requests regarding this Privacy Policy, please contact us:

Rhythmic, Inc. Attention: Privacy Officer Email: support@rhythmicapps.com Address: 251 Little Falls Drive, Wilmington, DE 19808, United States