Privacy Policy

Last updated: 22 October 2026

This Privacy Policy explains the handling of personal data in Real Coaster: Idle Tycoon (also named Real Coaster: Idle Game), its associated online game services, and this promotional website. A website visit does not automatically create a game account. This notice provides information; it is not a request for consent.

1. Controller and contact

Raventurn Games GmbH, Am Tabor 36, 1020 Wien, Austria, company register FN 488069 z, is the controller for the processing described here. Contact us at support@raventurn.com for support or privacy requests. Further company details appear in our Impressum.

2. Information used to operate the game

• Accounts and cloud saves: player/PlayFab ID, device-linked identifiers, authentication/session information, save files, parks, progression, inventory, virtual currency, rewards, settings and account-link status. An account may be created using a device identifier without requiring an email address.
• Optional account linking and social features: depending on your platform and choices, Apple sign-in/Game Center, Google Play Games or Facebook identifiers, authentication credentials/tokens, nickname, display name, avatar and permitted profile/friend information. We receive this information from the selected platform as well as from you. We do not receive your platform password.
• Events and leaderboards: player ID, nickname, avatar, scores, ranks and event progress. Other players can see the profile and ranking information shown by the relevant feature. Avoid putting sensitive information in your nickname or shared content.
• Purchases: product and transaction identifiers, receipts or purchase tokens, price/currency, purchase history, subscription status and entitlements. Apple or Google handles payment details; we do not receive full payment-card details through the in-app purchase flow.
• Technical operation and security: IP address, app/device/OS version, language, approximate country/region, timestamps, error/performance reports, network requests and anti-abuse information. Country/region information can be derived from an IP address; this is distinct from precise GPS location.
• Support: your email address, message, player ID, device details, purchase evidence and attachments you choose to provide. Send only information needed to resolve your request.

3. Purposes and legal bases

Where the GDPR applies, we distinguish the following purposes:

• Providing requested game functions and purchases: account access, saving/restoring progress, delivering items, subscription entitlements, requested social features and responding to contractual support requests — Article 6(1)(b) GDPR, to the extent objectively necessary for the contract.
• Reliability, fraud prevention and security: protecting accounts and purchases, investigating abuse, diagnosing faults and defending legal claims — Article 6(1)(f) GDPR. Our interests are a secure, reliable game and fair play; processing must be proportionate to those interests and your rights.
• Legal obligations: applicable accounting, tax, consumer-law and authority requirements — Article 6(1)(c) GDPR.
• Optional analytics, advertising measurement, personalised advertising and device access that requires consent: Article 6(1)(a) GDPR and, where applicable, § 165(3) Austrian TKG 2021. Consent must be separate from acceptance of the Terms and can be withdrawn. A general interest in funding the game does not replace legally required consent.

4. Analytics, advertising and attribution

The game integrates Google Analytics for Firebase for gameplay/usage analysis, Singular for campaign attribution, deep links and advertising/purchase measurement, and Meta/Facebook integrations for app events, attribution and optional social functions. Relevant data can include player and installation identifiers, device and advertising identifiers where available, IP-derived region, session/gameplay events, campaign/referral information, purchases and advertising interactions/revenue.

AppLovin MAX mediates advertising, including rewarded ads. Ad requests and measurement can involve a player ID, device/app information, IP address, available advertising identifiers, consent signals, ad impressions/clicks and revenue information. Rewarded ads are requested to obtain the reward shown in the game; agreeing to a reward is not by itself consent to unrelated tracking.

The current project contains mediation adapters for AppLovin, Google/AdMob, Meta Audience Network, Unity Ads, ironSource, Pangle, Chartboost, Digital Turbine/Fyber, InMobi, Mintegral, Moloco and Liftoff/Vungle. Actual delivery depends on the released version, platform, region, consent and mediation configuration. Advertising partners can act as independent controllers for their own advertising purposes, rather than solely as our processors.

Advertising and gameplay events may be used to group players by interests or behaviour and select ads or offers. This is profiling. It is distinct from a decision with legal or similarly significant effects under Article 22 GDPR.

5. Notifications and sharing

If you enable notifications, Firebase Cloud Messaging and Apple/Android notification services use installation/device push tokens to deliver game reminders or messages. You can disable notifications in the game options and/or your operating-system settings. Optional promotional notifications require consent where applicable; service messages needed for a requested function have the legal basis for that function.

When you use the game's recording, gallery or native sharing functions, the selected media is saved or passed to the app/service you choose. Relevant device permissions are requested where needed. Referral links can contain a referring player identifier and campaign information so that invitations and rewards can be attributed.

6. This website, hosting and YouTube

The static website serves its images, fonts and styles locally and does not include WordPress forms, reCAPTCHA or a website analytics script in the supplied export. The web host can process IP addresses, requested URLs, request times and browser/device information to deliver and secure the site, based on Article 6(1)(f) GDPR. The hosting provider acts as a recipient of those access data.

The home page currently loads YouTube video embeds automatically, including a youtube-nocookie.com embed and a standard youtube.com embed. These cause connections to Google/YouTube and can transmit IP address, browser/device details, referrer and video interactions; embedded services may access or store device information. The “no-cookie” domain does not mean that no personal data is transmitted. Where consent is required, the embeds must be blocked until that consent is given.

App download links lead through Singular's realcoaster.sng.link service, which can process click, device and campaign information when you follow a link. External stores and social sites apply their own privacy notices after you navigate to them.

7. Service providers and other recipients

• Microsoft PlayFab and Azure: player accounts, authentication, cloud saves, inventory, events, leaderboards, purchase validation and backend infrastructure.
• Google/Firebase: analytics, installations and push messaging; Google Play/Play Games for purchases and optional platform sign-in.
• Apple: App Store transactions, sign-in/Game Center and notification delivery where used.
• Singular, Meta and AppLovin/mediated partners: the purposes and categories described in section 4.
• Website hosting, email/support providers and professional advisers: information needed to provide their services or handle legal obligations and claims. Authorities receive information where legally required.

For provider information and privacy controls, see Microsoft, Firebase, Google, Apple, Singular, Meta and AppLovin. These notices supplement this notice and do not replace our responsibility to explain our own processing.

8. International processing

The providers above operate internationally, including in the United States and other countries outside the EEA. Transfers subject to the GDPR require an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses and any necessary supplementary measures. A US adequacy framework can be relied on only for a recipient certified for the relevant processing. Contact support for information or a copy of applicable safeguards.

9. Retention and account deletion

Retention is assessed by data category and purpose: account/save data is needed while an account is maintained; security records are limited to the period needed to investigate and prevent abuse; support records are kept to resolve requests and relevant follow-up or claims; transaction records can be retained for mandatory accounting/tax periods. After those purposes end, identifiable data should be deleted or anonymised, subject to specific legal holds. Backup deletion follows the applicable backup cycle.

You can request account deletion through the game's options → Delete Account flow, where available, or email support@raventurn.com with your player ID. The in-game flow submits a deletion request and removes local save data and account links. It does not establish that every server or partner copy is erased immediately. Uninstalling the app alone does not delete a cloud account. Deleting an account does not cancel an App Store/Google Play subscription; cancel that separately with the store.

10. Your choices and rights

You can use available in-game privacy/consent controls, operating-system advertising/tracking controls and notification settings. Apple App Tracking Transparency permission is separate from GDPR consent. Limiting an advertising identifier does not necessarily stop all analytics or data processing. Contact support if a privacy control is unavailable or you want to withdraw consent.

Under the GDPR, subject to its conditions, you can request access, correction, erasure, restriction and portability, and withdraw consent without affecting the lawfulness of earlier processing. You may object to processing based on legitimate interests on grounds relating to your situation, and to direct-marketing processing at any time, including related profiling. We may request proportionate information to verify an account owner and respond within the applicable statutory period, generally one month, with permitted extensions explained.

You can complain to the supervisory authority where you live or work or where an alleged infringement occurs. In Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien; dsb@dsb.gv.at; www.dsb.gv.at.

Data objectively needed for account authentication, online saves and purchases is required for those functions. Optional social linking, marketing consent and notifications are voluntary; withholding them can limit the corresponding optional features. Consent is not a condition for unrelated processing necessary to provide the game.

11. Children

The existing service terms set a minimum age of 13. A store content rating does not determine contractual capacity or the age for valid data consent. Where a child cannot give valid consent under local law, authorisation by a parent or guardian is required for consent-based processing; Austria's relevant digital-consent threshold is 14. Parents can contact support about a child's account or data.

12. Changes

We update this notice when the service or processing changes. The date above identifies this revision; publishing it does not retroactively authorise processing. Material changes must be communicated as required, and new consent obtained where necessary.