PRIVACY POLICY

Last updated: September 13, 2026

This Privacy Policy explains how Rhythmic, Inc. ("Company," "we," "us," or "our") collects, uses, and discloses your information when you use Frella and its related pages at https://rhythmicapps.com/frella (the "Product" or "Products"), and outlines your rights and choices. Other Rhythmic apps have their own privacy policies.

Please read this Privacy Policy carefully.

1. INTERPRETATION AND DEFINITIONS

Words with initial capitalization have the meanings defined below. These definitions apply equally to the singular and plural forms.

• Account - A unique account created for you to access a Product or parts of it.
• Affiliate - An entity that controls, is controlled by, or is under common control with the Company.
• Application - Frella, provided by the Company.
• Company - Rhythmic, Inc., registered in Delaware, United States.
• Device - Any device that can access a Product (e.g., smartphone, tablet, or computer).
• Personal Data - Any information that relates to an identified or identifiable individual.
• Service Provider - A third-party company or individual that processes data on our behalf.
• Usage Data - Information collected automatically when using a Product (e.g., device type, session duration).
• You - The individual using a Product, or the legal entity represented by that individual.

2. INFORMATION WE COLLECT

Frella stores Offline gameplay data locally and processes temporary Online room data on Firebase servers. The following sections explain which information stays on the device, what Online participants share, and how other service providers support the app.

We collect information you provide voluntarily and data collected automatically when you use a Product.

Information you provide

• Payment Data: when you make purchases, payment information is processed by third-party providers (e.g., Apple, Google). We do not store your full payment credentials.
• Support & Feedback: any information you provide when contacting us for support, completing surveys, or giving feedback.

Data collected automatically

• Usage Data: how you interact with the Product, including features accessed, session duration, and frequency.
• Device & Browser Data: IP address, device type, OS version, time zone, and language settings.
• Referrer & Campaign Data: information on how you discovered the Product (e.g., ad source, referral link).

Advertising and analytics cookies (websites)

Rhythmic-hosted pages for this Product use the OpenAI Ads pixel to measure whether an advertising visitor clicks an app-download link. The pixel may process browser, device, referral, and interaction data for that purpose. It loads only after you accept optional advertising measurement and does not load when your browser sends a Global Privacy Control signal. You can reject or change this choice through the site's privacy controls.

Tracking and advertising identifiers

With your permission through the App Tracking Transparency prompt, and where otherwise permitted, we collect your Apple Identifier for Advertisers (IDFA) or Google Advertising ID (AAID) and use them, through the attribution partners listed in the Third-Party Services and SDKs section, to measure campaign effectiveness, attribute installs, and understand where users discover the Product. You can reset or disable these identifiers, and change your tracking choice, at any time in your device settings.

Offline play and local storage

Offline gameplay runs on your device. Crew names, play-history counters, question-selection history, purchase-access information, free-question usage and surprise-reward records are stored locally. The current Offline round and its answers are held in memory rather than saved as a round history. Offline gameplay does not send crew names or answers to Firebase. Catalog requests, purchases, analytics, diagnostics and advertising attribution are separate network uses described in this Policy.

Score and appearance preferences

Your appearance preference and Score totals are saved on this device. Score records completed games, the distinct modes played, and your right and wrong Do You Know Me guesses. Offline statistics use player one, matching Profile; Online statistics belong to your own room membership. These totals begin with the Score feature and do not reconstruct past answers. Frella does not store a permanent answer history to produce these totals.

Online play and anonymous authentication

When you open Online, Frella uses Firebase Authentication to create or reuse an anonymous identifier. You do not register with an email address or password, and Frella does not provide a user-facing account or cross-device recovery for gameplay. Firebase may retain the anonymous authentication identifier and credentials separately from temporary room data, including credentials managed by its SDK on your device.

For Online rooms of up to eight players, Firebase services process the room code, room and member identifiers, display names, membership and connection status, submitted answers, votes, scores and gameplay timestamps in the United States. Written submissions include Memory Lane answers, optional Hot Takes explanations and Hot Seat answer lists. Other participants in your room can see your display name and the answers, votes or results that the selected mode reveals. A room code can be used to request admission, so share it only with people you intend to play with. Do not include sensitive information or someone else's private information in a display name or answer.

The app keeps a limited reconnect handle and a host quota checkpoint locally. To avoid counting Online results twice and recover final totals after a room closes, it also keeps room/member identifiers, aggregate score checkpoints and the room's original expiry while synchronization is pending. It may save a typed draft for the active Online question with a 24-hour expiry. The draft is bound to that room, round and question. Most drafts clear after an acknowledged submission; Hot Seat drafts remain through partial submissions and clear when the question changes. Clearing the room also clears its draft. Frella does not save an Online room transcript on your device or provide a permanent archive of answers.

Room lifetime and deletion

Online rooms expire 24 hours after creation. Ending a room or reaching its expiry stops further play and access to its gameplay data; server cleanup removes room codes, membership and presence data, submitted answers and scores. Cleanup can require retries after service failures. Limited operational records, such as opaque room identifiers and cleanup timestamps, can remain after gameplay data is removed to finish cleanup and prevent a closed room from being recreated. Anonymous authentication records, diagnostic logs, analytics and purchase records have separate retention and are not governed by the room's 24-hour lifetime.

A separate private summary of each participant's aggregate Score totals may remain after they leave, lose membership or the room closes, but only until that room's original expiry, 24 hours after creation. Departure or closure does not restart this period. This summary contains counters, mode identifiers, reset-generation and expiry metadata, and opaque identifiers used to authenticate access; it contains no submitted answers, display names or room code. Only the same authenticated anonymous participant can retrieve their own summary. Retrieval stops at the original expiry, and the expiry task removes the summaries with a scheduled cleanup backstop and retries if a service fails. Successful final recovery updates the local Score totals and clears its pending recovery record. If the device does not recover the summary before expiry, unsynchronized results may be unavailable. Pending local identifiers can remain while the device is offline until the server confirms completion or expiry; they do not extend server access.

Erase app data also clears the local appearance preference, Score totals and pending score-recovery records. A non-identifying reset counter is retained and advanced to prevent pre-reset scores from returning when the same anonymous participant rejoins a room. It does not retain the erased totals or room identifiers, extend a server summary's lifetime, or restore pre-reset scores.

Profile's Erase app data control clears the local crew, play and question-selection history, reconnect handle, host checkpoint and typed draft. It preserves purchase-access information, free-question usage and surprise-reward records so that earned access is not revoked and a reset does not create another free allowance or prize. It also preserves any enabled testing override. Erase app data does not cancel subscriptions, delete purchases from your store account, delete Firebase's anonymous authentication record, or erase records held by analytics, attribution, diagnostics or payment providers. Clearing a local reconnect handle does not itself end a room on the server. Use the room's leave or end controls when available; server room expiry and cleanup still apply. Contact support@rhythmicapps.com for a personal-data request beyond this local reset.

Firebase catalog, app integrity and diagnostics

Frella also uses Cloud Firestore to retrieve a public, read-only question catalog and Firebase App Check to validate app requests. Requests may include connection and device metadata. App Check processes integrity or attestation material and tokens through the configured platform provider. Firebase Realtime Database and backend functions support Online gameplay, timers, access checks and cleanup.

Sentry receives app diagnostics and, when configured, backend error reports to help investigate failures. Reporting is configured to filter gameplay text, display names, room codes and authentication data from diagnostic events. Issue reports and feature requests you deliberately submit through the feedback form are sent to Sentry as feedback; avoid including other players' information or sensitive content. Analytics and attribution measure feature use and purchases separately from room answers. Frella does not request a push-notification token from Expo.

3. HOW WE USE YOUR PERSONAL DATA

We process your personal data for the following purposes:

• To provide and improve the Product: operate, maintain, and enhance the experience, enable core functionality, troubleshoot technical issues.
• To analyze and enhance the Product: we use aggregated and anonymized data to understand how users interact with the Product, run surveys, test features, and identify improvements.
• To customize your experience: for instance, to determine which payment options, promotions, or recommendations to display.
• To process payments: we rely on trusted third-party payment providers (such as Apple, Google) to process purchases and subscriptions. We do not store full payment details.
• To enforce terms and prevent fraud: enforce our Terms, prevent fraud, resolve disputes, and detect malicious activity. Where required by law or in cases involving fraud or legal claims, we may share relevant information with law enforcement authorities.
• To communicate with you: respond to support requests and feedback you send us.
• To send marketing communications: we may send messages about features, offers, and events. You can opt out of marketing emails at any time via the "Unsubscribe" link in the email footer.
• To provide customer support: respond to inquiries, confirm transactions, and send legal or status notices.
• To comply with legal obligations: process or share information when required by applicable law, regulation, legal process, or government request.

4. THIRD-PARTY SERVICES AND SDKs

The Product relies on the third-party services and SDKs listed below. Each acts as a service provider/processor on our behalf unless stated otherwise. This section is assembled from the processors this app actually ships.

Amplitude (Amplitude, Inc.)

Product analytics and event tracking, to understand how users navigate and interact with the Product so we can improve functionality and engagement. Amplitude does not sell user data or use it for advertising. Privacy Policy: https://amplitude.com/privacy

Sentry (Functional Software, Inc.)

Error monitoring and performance tracking. Collects crash reports, error logs, and device information to help us identify and fix issues. Sentry does not use advertising identifiers. Privacy Policy: https://sentry.io/privacy/

Expo (650 Industries, Inc.)

App development and over-the-air update infrastructure. May collect device identifiers when delivering updates. This Product does not use Expo's push-notification delivery service, and no push token is sent to Expo. Privacy Policy: https://expo.dev/privacy

RevenueCat (RevenueCat, Inc.)

Subscription and in-app purchase management. Processes purchase history and subscription status to validate receipts, prevent fraud, and sync purchases across devices. Acts as a data processor and does not sell or share personal data. If you request a refund from Apple or Google, the store may ask us, through RevenueCat, to confirm limited purchase and usage information (for example, whether a purchase was delivered or used), and we may provide that information to the store to help evaluate your request. Privacy Policy: https://www.revenuecat.com/privacy/

Payment Processors (Apple, Google)

Process subscription and in-app payments. We never store full credit card data.

• Apple: https://www.apple.com/legal/privacy/
• Google: https://policies.google.com/privacy

AppsFlyer (AppsFlyer Inc.)

Our primary mobile attribution and marketing-measurement provider, and the partner that presents the App Tracking Transparency prompt. Where permitted (including after you allow tracking through that prompt), AppsFlyer may collect device identifiers such as the IDFA or AAID, IP address, and engagement and conversion data to attribute installs and measure campaign performance across our marketing channels (including Meta, Google, and TikTok). AppsFlyer processes this data on our behalf as a processor and does not use it for its own advertising purposes. Privacy Policy: https://www.appsflyer.com/legal/services-privacy-policy/

Firebase (Google LLC)

Cloud Firestore delivers configured public content, and Firebase App Check validates app requests. Requests may include ordinary connection and app/device metadata, such as an IP address and app or platform information. App Check processes attestation material from the configured platform provider and App Check tokens to help establish app or device integrity. Google generally acts as a processor or service provider for Firebase. Product-specific Firebase uses and exclusions are described in the Information We Collect section. Privacy and security information: https://firebase.google.com/support/privacy

Web advertising and measurement pixels

The OpenAI Ads pixel runs on Rhythmic-hosted pages and landing pages for this Product, not inside the app. It measures advertising performance by recording an app-download-link click after optional consent. OpenAI may process browser, device, referral, and interaction data for this purpose. Privacy Policy: https://openai.com/policies/privacy-policy/

5. APP TRACKING TRANSPARENCY (ATT)

In accordance with Apple's App Tracking Transparency framework, Frella may request your permission to track activity across apps and websites owned by other companies for advertising and attribution purposes. If you decline, we respect your choice and disable tracking features not essential to operating the Product.

6. LEGAL BASES FOR PROCESSING (EEA/UK USERS)

If you reside in the European Economic Area or the United Kingdom, our legal bases for processing include:

• Contract performance - to deliver the Product.
• Consent: for tracking, cookies, and marketing communications.
• Legitimate interests - to improve and secure the Product.
• Legal obligation - to comply with applicable laws.

You have the right to withdraw consent at any time.

7. YOUR RIGHTS AND CHOICES

Depending on your jurisdiction, you may have the right to access or request a copy of your data, request correction or deletion, withdraw consent for marketing or tracking, request data portability, and object to certain processing. To exercise these rights, email us at support@rhythmicapps.com.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to delete it (subject to exceptions); to correct inaccurate information; to opt out of the "sharing" of personal information for cross-context behavioral advertising; and to non-discrimination for exercising these rights.

We do not "sell" personal information for monetary consideration. However, our use of analytics and advertising identifiers with the attribution partners listed in the Third-Party Services and SDKs section may constitute "sharing" under California law.

To exercise these rights, email support@rhythmicapps.com. We will respond to verified requests within 45 days.

Our use of the OpenAI Ads pixel to measure download-link clicks may involve disclosing certain identifiers and activity for cross-context behavioral advertising, which may constitute "sharing" or a "sale" under some state laws. You can opt out through the site's privacy controls or by emailing support@rhythmicapps.com. We honor Global Privacy Control (GPC) signals where required.

Other U.S. state privacy rights

If you reside in a U.S. state with a comprehensive consumer privacy law (such as Virginia, Colorado, Connecticut, Texas, Oregon, and others), you may have rights similar to those above, including to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. To exercise these rights, contact us at support@rhythmicapps.com. You may also have the right to appeal a decision on your request.

8. DATA RETENTION

We retain your personal data only as long as necessary for the purposes stated in this Policy.

• Attribution/analytics data: up to 24 months (aggregated data may persist longer in anonymized form).

9. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to and processed in the United States, the European Union, and/or other countries where we or our service providers operate. The primary processing location for Frella is the United States. These countries may have data-protection laws that differ from those in your jurisdiction.

When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission (and the UK Addendum where applicable), and we maintain data-processing agreements with our service providers requiring them to protect your data consistent with this Privacy Policy.

If you have questions about international transfers, contact us at support@rhythmicapps.com.

10. DATA SECURITY

We use encryption, access controls, and secure servers to protect your data. However, no internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

11. DATA BREACH NOTIFICATION

If a security breach results in unauthorized access to your personal data, we will notify the relevant supervisory authorities as required by applicable law (where required, within 72 hours of becoming aware), and we will notify affected users without undue delay where the breach is likely to result in a high risk to your rights and freedoms. We maintain incident-response procedures to detect, investigate, and respond to potential security incidents.

12. CHILDREN'S PRIVACY

Frella is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, please contact us at support@rhythmicapps.com and we will delete it.

13. LINKS TO OTHER WEBSITES

Our Products may contain links to third-party websites not operated by us. We are not responsible for the content or privacy practices of those sites. Please review their privacy policies before providing any personal data.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. The updated version will be available at https://rhythmicapps.com/frella/privacy with an updated "Last updated" date. Changes are effective when posted, subject to any additional notice or consent required by applicable law.

15. DELETE YOUR PERSONAL DATA

You have the right to delete, or request that we help delete, the personal data we have collected about you. Frella's Erase app data control performs the limited local reset described in Room Lifetime and Deletion above; it does not delete all personal data or identifiers held by Firebase or other service providers. Online rooms follow their separate expiry and cleanup process. We may need to retain certain information where we have a legal obligation or lawful basis to do so. To request deletion beyond the local reset, contact support@rhythmicapps.com.

16. EU / UK CONTACT AND REPRESENTATIVE

For questions about how we process the personal data of individuals in the EEA and the UK, you can contact our EU-based point of contact:

Gabriel Kwakyi Schumanngasse 67 1/7 1170 Vienna, Austria support@rhythmicapps.com +43 699 8189 6557

EEA and UK data subjects may contact us at this address regarding the processing of their personal data.

CONTACT US

If you have any questions or requests regarding this Privacy Policy, please contact us:

Rhythmic, Inc. Attention: Privacy Officer Email: support@rhythmicapps.com Address: 251 Little Falls Drive, Wilmington, DE 19808, United States