Privacy Policy: Are You Ready?
Effective date: June 21, 2026
Are You Ready? (the "App", "Service", "we", "us") is published by BAMF Apps LLC. This policy explains what data the App handles, why, and the choices and rights you have. We keep data collection to the minimum needed to run the game and deliver your prompts. We do not use advertising, third-party analytics, or tracking SDKs, and we do not sell your data.
The short version
- You can play as a guest with just a display name: no account, no sign-in.
- Signing in is optional and only unlocks saved stats, streaks, leaderboards, progression, and friends.
- The only device permission we request is notifications, because the game prompt is delivered as a push notification.
- We use no ads, no analytics, no tracking, and no advertising identifiers.
- There are no in-app purchases.
Data we collect and why
If you play as a guest (no sign-in)
We do not create an account for you and we do not write your data to our database. To run a live match, the game server processes, in memory and for the duration of play:
- Your chosen display name and room code.
- Your gameplay actions ("taps") and connection state.
- If you enable notifications as a guest, a push subscription/token for your device so we can deliver your prompt. For guests this is held in server memory and is not tied to an account.
The following are stored only on your device (not transmitted to us as profile data): your UI preferences (timer style, avatar visibility, prompt alarm), a guest name, a "resume this match" session pointer, a notification de-duplication key, and a first-run flag.
If you choose to sign in (optional account)
Accounts are provided through Supabase (our authentication and database provider) and can be created with Google, Apple, or an email magic link / one-time code. When you sign in we handle:
- Email address and an account identifier from your sign-in provider (used to identify your account and derive a username). For Sign in with Apple, this may be a private relay email if you choose to hide your address.
- Username and chosen avatar.
- Gameplay stats linked to your account: wins, losses, games played, current and best streaks, total prompts answered, fastest response time (in milliseconds), XP, level, in-game currency ("PowerPoints"), achievements, and power-up charges.
- Match records: matches you played in, your placement, whether you won, turns survived, and prompts answered.
- Friends: connections you create by username (requester/addressee and status).
- Push registrations: Web Push subscriptions (endpoint + encryption keys) and native push tokens (APNs for iOS, FCM for Android) with the platform, so prompts reach all your devices. These survive restarts and are removed when a device unsubscribes or a token is rejected.
We use this data solely to operate the game: run matches, save and show your stats and leaderboard position, run progression and friends features, and deliver prompts. We do not use it for advertising or tracking.
Data we do NOT collect
We do not collect or use: precise or coarse location, contacts, photos, camera or microphone input, files/media, health data, financial/payment data, advertising identifiers (IDFA/GAID), or any analytics, crash-reporting, or attribution data. The App contains no advertising SDKs and no third-party tracking SDKs.
On-device vs. transmitted
- On-device only: UI preferences, guest name, match-resume pointer, onboarding flag, notification de-duplication key, and (when signed in) your authentication session token, stored in your browser's local storage or the app's local storage.
- Transmitted to us: the gameplay and account data described above, sent over an
encrypted connection to our game server (
wss://ruready.app) and to Supabase (https://*.supabase.co).
Third parties and service providers
We share data only with the infrastructure providers needed to deliver the Service. They process data on our behalf as service providers, not for their own advertising:
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Authentication + database | Email/account ID, username, stats, friends, push registrations |
| Apple (APNs) | iOS push delivery | Device push token + the prompt notification |
| Google (Firebase Cloud Messaging) | Android push delivery | Device push token + the prompt notification |
| Browser push services (via Web Push/VAPID) | Web/PWA push delivery | Push subscription endpoint + the prompt notification |
| Google / Apple Sign-In (via Supabase) | Optional OAuth sign-in | Authentication handshake; we receive your email + account ID |
We use Firebase only for Cloud Messaging (push transport). We do not use Firebase Analytics, Crashlytics, or any other Firebase product. Push providers may process the notification payload to deliver it to your device.
Data retention
- Guest data is transient: it lives in server memory only for the active match and is not persisted to our database.
- Account data is retained until you delete your account (see "Your rights" and the account-deletion page). Push tokens/subscriptions are removed when you disable notifications, a device unsubscribes, or a provider reports the token as dead.
- Match history is retained to support stats and leaderboards for as long as your account exists.
Security
Connections to our server and to Supabase use encryption in transit (TLS/WSS). Account writes are performed by our server using a privileged key that is never exposed to the app or browser; the app uses only a public, restricted key. Authentication is verified server-side on every connection before any account is attributed. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.
Children's privacy (COPPA)
Are You Ready? is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at support@bamfapps.com and we will delete it.
Your privacy rights
California (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect, to access it, to request deletion, and to correct inaccurate information. We do not sell or share your personal information as those terms are defined under CCPA/CPRA, and we do not use it for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.
EEA / UK (GDPR)
If you are in the EEA or UK, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, and the right to data portability. Our legal bases are: performance of a contract (to run the game and your account), consent (for notifications, which you can withdraw any time in your device settings), and our legitimate interests in operating and securing the Service. You may also lodge a complaint with your local supervisory authority.
How to exercise your rights
Email support@bamfapps.com, or use the in-app account-deletion option, or visit https://bamfapps.com/apps/are-you-ready/delete-account. We will respond within the timeframe required by applicable law.
International data transfers
We are based in the United States, and our providers may process data in the United States and other countries. Where required, transfers are made under appropriate safeguards (such as Standard Contractual Clauses). By using the App you understand your data may be processed in the U.S.
Changes to this policy
We may update this policy from time to time. We will post the revised version here with a new "Effective date." Material changes will be reflected by updating the date at the top of this page.
Contact
BAMF Apps LLC Email: support@bamfapps.com Privacy policy: https://bamfapps.com/apps/are-you-ready/privacy