PRIVACY POLICY
Privacy Policy
This policy explains how Doui Lab (“we,” “us,” or “our”) handles information in the iOS app RIICHI ORBIT (“the app”).
1. Information stored on your device
The app stores your player name, rank and learning level, practice-question progress, collected creature cards, match records, settings, Lumina and Concentrated Lumina balances, and records of credited purchases in its own storage area on your device. Section 3 describes what is sent when you use save-data transfer.
No account registration is required. Deleting the app deletes its local data. The in-app “Reset Progress” option resets the data listed on its confirmation screen.
2. Content delivery
We use Supabase to check for updates to practice questions and other content. These connections may involve ordinary technical information such as your operating system, app build number, and IP address. Your player name, progress, collected cards, and match records are not sent as part of content updates.
3. Transferring save data
In version 1.3 and later, when you create a transfer code, the app encrypts a snapshot of your save data on your device and stores it in Supabase. This includes your player name, lesson and route progress, rank, collected cards, match statistics, Lumina and Concentrated Lumina balances, and records of applied purchases and rewards. Replay files, images, 3D models, audio, and cached questions are not sent.
The transfer code itself and the decryption key are not sent to the server. The receiving device uses the code to decrypt the data. Codes are valid for seven days and can be claimed by one device. To include progress made after creating a code, create a new one; this invalidates the previous code.
To verify the receiving device and determine whether the original device has completed a transfer, a randomly generated device secret is sent over HTTPS and stored on the server as a hash. Salted IP-address hashes are also used for rate limiting. Transfer processing does not log transfer codes, decryption keys, device secrets, or unencrypted save data.
Transfer is a user-initiated move of saved data to another device, not automatic synchronization of progress or balances. Anyone with your code can claim the data, so keep it private.
3a. Friend matches (version 1.8 and later)
Online friend matches use servers hosted on Cloudflare. To provide play, reconnection, usage statistics, troubleshooting and abuse prevention, we process a random player ID and authentication information, display name, crew appearance and equipment, room participation, game actions, skill choices, scores, results and connection times. Other participants see your display name, appearance and the information needed to play. Unrevealed opponent hands and the wall are not shared during play. Technical information such as IP addresses may also be processed for security and troubleshooting. Contact us below for questions or deletion requests concerning online player records.
3b. Sharing with M-Nova
M-Nova is a separate game planned for a future release. Compatible versions on the same device can share crew appearance, owned and equipped accessories, cabin interiors, placements and furniture through a local shared container. Sharing is on by default and can be disabled in character editing. Display names, Lumina, cards, routes and records remain separate. Sharing does not synchronize different devices or send cosmetics to a remote synchronization server. Resetting either game does not delete the other game's saves.
4. Advertising
The app uses Google AdMob for optional rewarded ads. The Google Mobile Ads SDK may process approximate location inferred from your IP address, device identifiers, advertising data, interaction information, crash data, and performance data to deliver and measure ads, prevent fraud, and improve its services.
In applicable regions, Google User Messaging Platform provides ways to review and change consent choices. When available, you can update them under Settings → Ad Privacy Settings in the app.
5. In-app purchases
In-app purchases are processed through Apple’s App Store and StoreKit. We do not receive payment details such as credit card numbers. The app uses purchase information provided by Apple to restore purchase status.
Purchase history alone cannot restore your remaining Concentrated Lumina, which is a consumable item. To move a balance to another device, use Transfer Your Progress in Settings.
6. Camera access and information we do not use
With your permission, the app uses the camera only to scan a transfer QR code. Camera images are processed on your device and are not sent to a server. You can also enter the code manually without using the camera.
The app does not access your contacts, photo library, microphone, or precise location. It does not include chat or image posting.
7. Third-party services
Please refer to each service’s policy for details of how it handles information.
8. Security and retention
We restrict third-party service permissions to what is needed and take appropriate security measures to help prevent unauthorized access, disclosure, or alteration of information.
Encrypted save data in the transfer database is deleted when a transfer is claimed, a code is canceled, or a new code is issued. Expired codes cannot be used, and remaining encrypted data is removed by an hourly cleanup process. Records such as code hashes and claim status are removed by the same process once more than 30 days have passed since expiration.
Hashed device identifiers, transfer IDs, and transfer-completion timestamps used to recognize a completed transfer on the original device are retained separately from code records, with no automatic deletion deadline. Access-rate records expire after one minute and code-issuance-rate records after one hour; the hourly cleanup removes them after expiration.
Information processed by third-party services, including connection logs, is retained according to their settings and policies. This is separate from deletion of transfer-database data described above.
9. Children’s use
The app does not ask for a date of birth and does not knowingly collect children’s personal information. Parents or guardians with a question or deletion request can contact us below.
10. Changes and contact
We may update this policy as features, services, or applicable laws change. Important changes will be announced on this page or in the app.
Contact: support@doui-lab.com