This Privacy Policy applies to the website rdd-labs.com, to the Color Drain mobile application, and to related services operated by Daniel Simonov (Osek Patur: 323812388), trading as RDD Labs, based in Israel ("RDD Labs", "we", "us", or "our").
For privacy-related inquiries, contact us at support@rdd-labs.com.
This policy is governed by the Israeli Privacy Protection Law, 5741-1981 and its regulations (including the Privacy Protection Regulations (Data Security), 5777-2017).
We collect the minimum data necessary to operate our services.
| Data | Source | Purpose | Retention |
|---|---|---|---|
| Email address, plus the date and time you signed up, which form you used (launch updates or Color Drain beta), and — on the beta form only — whether you confirmed you can test for 14 days | Beta sign-up / newsletter forms on our website | Send launch notifications, beta access details, and studio updates. The form you used tells us whether to contact you about closed testing or only about the launch, so we do not send beta requests to people who asked for release news. The 14-day confirmation tells us who to invite first. | Until you request deletion, or until we shut down the list |
| Name, email address and, if you choose to give one, company or fund name, plus the date and time of your enquiry | The “Request Pitch Deck” form on our homepage | Reply to your enquiry, send you our pitch deck, and keep a record of business conversations we are having. We do not add investor enquiries to any marketing or newsletter list. | Until you request deletion, or until the conversation is closed and the record is no longer needed |
| Usage & analytics data (pages viewed, referring page, approximate location, device and browser type, interaction events) | Google Analytics 4 (automatic) | Understand how the site is used and improve it | Up to 14 months (our Google Analytics retention setting); we see only aggregated reports |
| Cloudflare security data | Cloudflare infrastructure (automatic) | DDoS protection, bot mitigation, load balancing | Short-lived; governed by Cloudflare's Privacy Policy |
Beyond the analytics data described above, we do not collect addresses, payment information, or precise location data. The only name we ever hold is one you type into the “Request Pitch Deck” form yourself; the beta and newsletter forms ask for an email address and nothing else.
Providing your email address is entirely voluntary. You are under no legal obligation to do so. Choosing not to provide it simply means you will not receive our updates — it has no other consequences whatsoever.
Your email address is used only for the following purposes:
We do not use your email for profiling, automated decision-making, or any purpose not listed above.
Some of the emails we send — including game launch announcements and studio updates — may constitute advertising material under Section 30a of the Israeli Communications Law (Bezeq and Broadcasts), 5742-1982. In compliance with that law, every such email will: (a) clearly identify RDD Labs as the sender; (b) include a simple, one-click unsubscribe link. We will honour every opt-out request promptly and without conditions. We will never send advertising material to anyone who has opted out.
Under the Israeli Privacy Protection Law, we process your email address on the basis of your freely given consent, which you provide when you submit the sign-up form. You may withdraw consent at any time by contacting us at support@rdd-labs.com.
Cloudflare's security processing is carried out on the basis of our legitimate interest in protecting our website from abuse and ensuring its availability. Analytics processing (Google Analytics 4) is likewise based on our legitimate interest in understanding aggregate usage of the site.
Email addresses are stored in Cloudflare D1, a distributed SQLite database managed by Cloudflare. Data is encrypted in transit (TLS 1.3) and at rest. Cloudflare's infrastructure is SOC 2 compliant.
To protect our sign-up forms from abuse, our API applies per-IP rate limiting. It stores only SHA-256 hashes derived from the request's IP address — never the raw IP — and these hashes are automatically deleted within approximately two hours.
Access to stored email addresses is limited to authorised members of RDD Labs. We do not expose this data through any public interface.
No security system is impenetrable. If we become aware of a breach affecting your personal data, we will notify you at the email address you provided as required by applicable law.
We use the following third-party services, each of which has its own privacy policy:
We do not use Facebook Pixel, Google Ads, or any other advertising or retargeting technology. We do not sell or rent your data to any third party.
This section covers the Color Drain mobile application, separately from the website. Color Drain is built with Unity and its core gameplay runs fully offline — you can install and play every level without an account and without a network connection.
The app and its embedded third-party SDKs may collect the following:
Abuse prevention. To stop a single source flooding our sign-up form, we count submissions per hour against a SHA-256 hash of your IP address combined with the current hour. The raw IP address is never written to our database, the hash cannot be reversed to recover it, and these counters are deleted automatically after about two hours.
We do not collect precise location, contacts, photos, microphone or camera data, or the contents of any other app on your device. We do not sell your personal data, and we do not share it with data brokers or advertising networks beyond the ad-serving described above.
Closed testing. If you join the Color Drain beta, we store exactly four things: the Gmail address you submit, the date and time you submitted it, which form you used, and whether you ticked the box confirming you can test for 14 days. Nothing else — no name, no IP address, no device information. We use them for one purpose: granting Google Play closed-testing access and contacting you about the test. Google Play separately makes tester participation data available to us as the developer. Your record is deleted on request, and in any case once the closed test concludes.
Investor and partnership enquiries. The “Request Pitch Deck” form is a business-contact channel, not part of the game. If you use it we store exactly four things: the name you enter, the company or fund name if you give one, your email address, and the date and time you submitted it. We use them to reply to you and to send the pitch deck. Investor enquiries are kept separate from the player mailing list and are never added to it, never used for marketing, and never shared with anyone outside RDD Labs. Ask us at support@rdd-labs.com and we will delete your enquiry.
Signup alerts. So that we notice a beta signup or a pitch-deck enquiry without having to check a database, a short alert is sent to our own internal team channel. That alert contains a masked address (for example d*****@gmail.com) — never your full address — plus, for beta signups, a running total, and for enquiries, the company name you gave.
Deleting your app data. To request deletion of data associated with the app:
The permanent link for deletion requests is rdd-labs.com/privacy#data-deletion.
Google Analytics 4 sets first-party cookies (_ga, _ga_RKP260RWPQ) to distinguish visitors and sessions. These are used solely for aggregate usage measurement — no advertising features are enabled.
Cloudflare's infrastructure may set strictly necessary security cookies (e.g., __cf_bm) to protect the site from bot traffic. These are essential for site security and cannot be disabled without affecting functionality. They store no personal information about you.
See our full Cookie Policy for details.
Our website and the beta sign-up are directed to users aged 16 and older. We do not knowingly collect personal data from anyone under 16 through the website. If you believe a child under 16 has submitted their email address to us, please contact us at support@rdd-labs.com and we will delete it promptly.
Color Drain is not directed to children. The app's Google Play target audience is set to 13 and older, it is not enrolled in the Google Play Families programme, and it does not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data through the app, email support@rdd-labs.com and we will delete it promptly.
Under the Israeli Privacy Protection Law, you have the following rights:
To exercise any of these rights, send an email to support@rdd-labs.com. We will respond within 30 days.
If you believe we have not handled your data lawfully, you may file a complaint with the Israeli Privacy Protection Authority.
If you are a resident of the European Economic Area (EEA) or California, this policy respects and upholds your rights under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), respectively.
Cloudflare operates a global network. Your data may be processed on servers outside Israel, including in the United States and the European Union. Cloudflare maintains appropriate data-transfer safeguards. By using our services and submitting your email, you acknowledge this.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we will make reasonable efforts to notify you (for example, by sending an email to the address you provided). Continued use of our services after a policy change constitutes acceptance of the updated policy.
For privacy-related questions, data access requests, or deletion requests:
Email: support@rdd-labs.com
Operator: Daniel Simonov (Osek Patur: 323812388), trading as RDD Labs, Israel