Stack Rush / 스택 러시
This privacy policy explains how Stack Rush handles information for the Android app published under package name com.makeitbetter.stackrush.
Effective date: 2026-10-12
Leaderboard data deletion · Support and publisher information
1. What the app does
Stack Rush is an all-ages single-player arcade game. It is playable without creating an account, signing in, or completing an age check. The app does not ask for, determine, or store a player's date of birth or age profile. Every player receives 10 plays per UTC day. After those plays are used, any player may voluntarily watch an optional rewarded ad to recharge 10 plays. The online daily leaderboard is a separate feature that is used only after the player explicitly chooses to join it.
2. Data stored on your device
The app stores a small amount of gameplay data locally on the device so the game can remember values such as your remaining plays, last recorded height, best recorded height, cumulative total height, and the UTC day used for the daily reset. The app does not store a date of birth, age, or age-profile result. If a player separately joins the daily leaderboard, the app stores the leaderboard policy version, whether a decision was made, the opt-in choice, the decision time, and a server-issued leaderboard identity consisting of a private player secret, player ID, and fixed game alias. A stable leaderboard player ID or secret is not created before opt-in.
Android backup and device-transfer backup are disabled for the app, so this local save data stays in the app's storage on that device unless you remove the app, clear its storage through Android settings, or the operating system removes the app data.
3. Online leaderboard
For players who separately choose to join, Stack Rush can submit daily leaderboard records to a hosted leaderboard endpoint. The score submission includes the server-issued player ID, UTC day key, total height, best run height, max combo, score, and app version. The service uses its own UTC day, submission time, and fixed alias rather than trusting those values from the device.
The service generates an alias in the fixed Rook-XXXXXXXX format; it is not a free-text profile field and cannot be changed by a score submission. Public leaderboard responses show ranked aliases and scores but do not expose the private authentication player ID. Choosing to use rewarded advertising does not also join the leaderboard. The app does not create a leaderboard identity or submit or retrieve leaderboard data before the player explicitly opts in.
The leaderboard issues a signed guest-session token containing the player ID, issuance and expiration times, and a random nonce. It expires after 10 minutes, is cached only in app-process memory, and is not written to device storage by the app or stored as a session row by the service.
The app sends the private player secret only to obtain a session or request deletion. The service does not store that raw secret. It stores a signing-secret HMAC credential hash, the internal player ID, the fixed alias, creation time, and last session time.
To prevent abuse, the leaderboard converts the request IP address into a secret-salted SHA-256 rate-limit key. The raw IP address is not stored. Rate-limit rows expire after one hour and are removed during later requests and by an hourly cleanup job, so deletion can occur up to the next cleanup run after expiration.
Daily score records are retained for up to 30 UTC days. A leaderboard credential that has not obtained a session for 180 days is deleted together with its remaining scores. The hourly cleanup job performs these removals, so deletion can occur on the next cleanup run after a retention threshold is reached.
4. Advertising
After the 10 daily plays are used, any player can voluntarily choose to use Google AdMob rewarded advertising to recharge 10 plays. The recharge is granted only after the rewarded-ad completion callback. Choosing not to watch an ad does not join the leaderboard or create an advertising account; the regular 10-play allowance returns at the next UTC daily reset.
Before the ads SDK is initialized or an ad is requested, Stack Rush applies one child-safe configuration to every player: ads are requested as non-personalized and child-directed, the request is tagged as under the age of consent, and the maximum ad content rating is G. The app then uses Google's User Messaging Platform where required to obtain or refresh privacy choices. The automatic AdMob startup provider is removed from the Android build so these settings can be applied before initialization.
Google and its advertising partners may process approximate location derived from IP address, app interactions, ad interactions, diagnostics, and device or other identifiers for ad delivery, measurement, security, and fraud prevention under their policies. The Android advertising ID permission (com.google.android.gms.permission.AD_ID) is removed from the app manifest, so Stack Rush does not request access to the Android Advertising ID. Removing that permission does not prevent Google from processing the other limited data described above.
5. Data the app does not intentionally collect
Based on the current app implementation, Stack Rush does not intentionally collect or transmit account information such as your name, email address, phone number, precise location, contacts, photos, microphone input, or in-app account credentials. The app does not include in-game account creation, chat, in-app purchases, or precise location sharing.
6. Permissions, network access, and platform services
The Android app manifest declares INTERNET, ACCESS_NETWORK_STATE, and WAKE_LOCK for the game engine and the optional online features. The Android advertising ID permission and the Android Privacy Sandbox ad ID, attribution, and topics permissions are explicitly removed from the merged app manifest. Stack Rush therefore does not request access to those advertising identifiers or interest-topic APIs.
The app manifest explicitly removes legacy shared-storage, phone-state, boot-completed, and foreground-service permissions contributed by transitive libraries. Stack Rush does not use those capabilities.
Based on the current implementation, the game code does not ask for camera, microphone, contacts, photo library, or precise location access, and it does not implement user accounts, chat, or in-app purchases.
If you download the app through Google Play, Google may process technical or diagnostic information under its own policies when handling downloads, updates, app signing, crash reporting, device compatibility, or store operations. Those platform-level processes are outside the direct control of Stack Rush.
7. Children
Stack Rush uses the same child-safe treatment for every player rather than asking for age. The app does not request, store, or transmit a date of birth or age profile. Every player receives the same 10-play daily allowance and may voluntarily choose the optional rewarded-ad recharge described above. All ad requests use the non-personalized, child-directed, under-age-of-consent, maximum-G configuration. Leaderboard participation remains a separate explicit choice, and no leaderboard identity is created before that choice.
8. Changes to this policy
This page may be updated if the app behavior changes, for example if online services, analytics, ads, or account features change in the future. The effective date at the top of this page will also be updated when material changes are published.
9. Data deletion requests
To request deletion of Stack Rush online leaderboard data, email support@mibstudio.top and include the app name and your Rook-XXXXXXXX leaderboard alias. The publisher can use the protected administrator deletion route to delete the matching credential and all of its leaderboard records without asking you to disclose the private player ID or secret.
Participants can also use the in-app leaderboard leave control. The app sends an authenticated request to delete the credential and all scores, then removes the local identity so it cannot be used again on that device. If the remote request cannot complete, you can use the email process above; the 30-day score and 180-day inactive-credential limits still apply.
Local gameplay data stored on your device can be deleted by uninstalling the app or clearing the app's storage in Android settings. Advertising data handled by Google AdMob or Google Play is controlled through Google's privacy and advertising controls.
10. Contact
For privacy questions, requests, or notices about Stack Rush, email support@mibstudio.top .
Publisher: 밉스튜디오 (Mibstudio), publicly listed as MAKE IT BETTER. Representative and privacy contact: 김성환 (Kim Sung-hwan). Business registration: 505-27-01893. E-commerce registration: 2026-경기하남-1760, Hanam City Hall. Address: 경기도 하남시 위례학암로 30, 7401동 1402호, 13010, Republic of Korea. Phone: +82 10-2692-0856.
Support emails are forwarded by Porkbun to the publisher's existing Naver inbox. You can also contact quxn6@naver.com. Do not send passwords, your private leaderboard player secret, payment card details, or identity documents. The publisher may need to verify that a deletion request concerns your own leaderboard identity.