Effective: September 6, 2026
This policy explains how Andrew Suiter (“we”) handles information for Honest Leaderboard Game.
If you participate, we handle the account identifier and any email address supplied by your Apple or Google sign-in provider; your public display name, aggregate USD leaderboard total, and a two-letter country code from the storefront of your first verified purchase; purchase product, price, currency, conversion, timestamps, and financial state; hashed transaction identifiers; reports and blocks; and limited security and diagnostic logs. The country is fixed for the account. We do not request GPS or precise location. The app does not ask you to type an email address. Apple or Google processes your payment details. We do not receive or store your card or bank details.
We use this information to run the global, same-country, and country-total leaderboards; verify purchases once; apply exchange rates; keep totals consistent with store records; prevent fraud and abuse; moderate public names; provide support; comply with law; and keep the service reliable.
Your display name, aggregate USD total, country flag, and country leaderboard totals are visible worldwide. Your email, individual purchase records, reports, and blocks are not public.
We use Apple App Store, Google Play, Supabase, Cloudflare, ExchangeRate-API, and Expo/EAS. They process information under their own terms. Non-USD quotes identify and link to ExchangeRate-API. We request its public daily USD rates server-side without sending your identity, purchase details, receipts, or device IP address. The indicative rate calculates only the USD leaderboard amount shown before purchase, not your card charge. Previously accepted quotes keep their original provider record. Information may be processed outside your country.
Account data is kept while your account is active. Short-lived FX quotes and abuse counters are routinely deleted. A minimized completed-purchase ledger supports exact-once accounting, fraud prevention, disputes, and legal obligations. It contains the product, original amount and currency, USD amount, timestamps, platform and environment, financial state, and a hashed transaction identifier—not a raw receipt, purchase token, email, card detail, or complete store response. When you delete your account, your public name is replaced with “Deleted player,” ordinary app access ends, public block state is cleared, and private block and report relationships enter bounded deletion. Deletion itself does not change an amount or rank already counted; a later authoritative store correction may change the anonymous amount and resulting rank. We remove the Supabase sign-in identity during deletion, so the same Apple or Google identity can create a fresh account but cannot restore the deleted one. If the sign-in provider is temporarily unavailable, the app reports that deletion is finishing and an automated queue retries while the old account remains unavailable. A temporary private mapping used to redact older leaderboard snapshots is removed after replacement snapshots are published. A separate identity-free private link needed for an unresolved store payment may remain only until settlement or the final retained-record purge, targeted no later than the recorded 31-day deadline. The anonymous monthly fact and minimized financial record do not retain the original account ID after that purge. A playerless quote reference may remain until bounded cleanup after the 62-day Apple or 61-day Google acceptance-retention boundary. Minimized completed rows may be retained longer while the documented accounting, dispute, fraud-prevention, or legal need applies. They are private and cannot restore your profile. The app may protect a limited deletion-retrieval authorization on your device while we keep only its bound hash so that device can retrieve the same deletion result. It cannot restore the account, read a profile, or authorize a payment. Limited device-held recovery authorizations and server hashes may exist only to finish unresolved receipts bound to their exact quote, product, platform, and store proof. They cannot create another credit or restore the account. Finalized state may remain for up to 24 hours to replay that exact response safely and never beyond the 31-day deadline.
For disaster recovery, we keep private, encrypted database backups in Cloudflare R2 with a 14-day expiry policy. A backup made before deletion may temporarily contain information already removed from the active service. Backups are restricted to recovery purposes, not ordinary use. If a backup is restored, later account deletions must be reapplied before the recovered service is reopened.
You may change your public name or delete your account in the app. You can also request account deletion by email without reinstalling the app or signing in to this website. We verify account ownership before completing a request. You may contact us about access, correction, or another right available where you live. Contacting support does not create a game session or by itself prove account ownership. Support correspondence includes information you choose to send and is used to handle your request; do not send passwords, verification codes, or payment credentials.
The service is for adults age 18 and over and is not directed to children. A parent or guardian who believes a child provided information should contact us.
We use technical and organizational safeguards, but no online service is risk-free. We may update this policy and will post the new effective date here.
Andrew Suiter
andrew@honestleaderboardgame.com