RUNEMEISTER / APP PRIVACY POLICY
App privacy.
Last updated: 27 September 2026. This policy covers the RuneMeister game for iPhone. The website privacy page covers this site separately.
The short version.
Playing on your own collects nothing. There is no account, no sign-in and no network connection required, and nothing about your game leaves your phone. RuneMeister contains no analytics, no advertising, no trackers and no third-party software development kits other than the one that delivers push notifications. Nothing is ever sold or shared for advertising, and nothing is used to track you across other apps or websites.
You only give us data if you choose multiplayer, turn on turn reminders, buy something, or put your initials on the Hall of Fame.
Who is responsible.
The data controller is Oscar Bout, sole trader, the Netherlands. For anything in this policy, including access or erasure requests, write to privacy@runemeister.com.
Playing on your own.
Solo adventures are free, work offline and need no account. Your saved game and your settings are stored only in the app's own storage on your device. They are not uploaded, backed up to us, or readable by us. Removing the app removes them.
Playing with friends.
Multiplayer needs an account, because a party has to be able to find you between turns.
- A registered account stores the name you choose and your email address. Your password is never stored: the server keeps only a salted scrypt hash of it, which cannot be turned back into your password.
- A guest account stores only a name. Invited players can join a party this way with no email address and no password.
- While a party is running the server stores the state of the adventure, which seat you took, the hero you chose, and the optional display name you use in that party. A display name applies to one party only and never changes your account.
- Friends you add are stored as a link between two accounts, so you can invite them again.
- Sign-in issues a session token. The server stores only a hash of it; the token itself is held in your device's Keychain.
Turn notifications.
If you allow notifications, your device receives a push token which is stored against your account so we can tell you when it is your turn. Messages are routed through Firebase Cloud Messaging (Google) and Apple Push Notification service. The token identifies a device, not a person, and it is deleted when it stops working or when you sign out. Declining notifications does not affect play.
Purchases.
All payments are handled by Apple. We never see or store your card details, billing address or Apple Account. When you buy multiplayer access or the 16-bit skin, the app sends Apple's signed receipt to the server, which verifies it with Apple and stores the transaction identifier, the purchase and expiry dates, and whether it was refunded — enough to know what you are entitled to, and nothing more.
The Hall of Fame.
When an adventure ends you may enter three initials for the public score boards. This is entirely optional: skipping it records nothing. If you enter them, the initials, the hero you played, the four figures from that run and the date are stored and published publicly, both in the app and on this website. Please do not use initials that identify you. A run is kept only while it is at or near a board; older runs are deleted automatically. To have an entry removed, write to the address above.
Technical information.
Like any internet service, the server processes the IP address of a request in order to answer it, to apply rate limits and to resist abuse. The game server does not write authentication tokens or invitation links to its logs. Standard web server logs at the hosting provider may retain request information for a short period for security and diagnostics.
What we do not collect.
No location data. No contacts, photos, microphone or camera access. No advertising identifier, and no App Tracking Transparency prompt, because nothing here tracks you. No analytics or crash-reporting software is built into the app.
Who else processes it.
- Apple — the App Store, in-app purchases and push delivery. Apple's own privacy policy applies to your Apple Account.
- Google (Firebase Cloud Messaging) — routing turn notifications to your device.
- Amazon Web Services — hosting the game server and this website.
The game server runs in the United States. If you are in the European Economic Area, your account data is therefore transferred outside it, under the transfer safeguards those providers offer.
How long it is kept.
Account details are kept while the account exists. Finished adventures and expired invitations are cleared as parties end. Hall of Fame runs are kept only while they are at or near a board. Purchase records are kept as long as needed to honour what you bought and to meet tax and accounting obligations.
Your rights.
If you are in the EEA or the UK you may ask for a copy of your data, ask for it to be corrected, ask for it to be erased, object to how it is used, or ask for it in a portable form. The legal bases are performance of a contract (running your account, your party and your purchases), legitimate interests (keeping the service secure and working) and consent (push notifications, which you can withdraw in iOS Settings at any time).
To delete your account and everything attached to it, write to privacy@runemeister.com from the address on the account. Requests are actioned within 30 days. Deleting the app removes your solo saves from the device but does not by itself delete an online account.
You may also complain to your data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.
Children.
RuneMeister is not directed at children and we do not knowingly collect data from a child under 16. If you believe a child has created an account, write to the address above and it will be removed.
Changes.
If this policy changes materially, the date at the top changes with it and a notice appears in the app.