Skip to content

Privacy Policy

Effective date: 27 September 2026. This policy explains what personal data the CodeRiv app and the coderiv.com website process, why, who helps us, how long we keep it and what you can do about it.

1. Who we are

CodeRiv is run by Devs-Mentoring.pl Kacper Garbaciński, ul. Kwiatowa 8, Okup Mały, 98-100 Łask, Poland, NIP 8311641047, REGON 388216044 (“CodeRiv”, “we”, “us”). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the Polish data protection law. We have not appointed a separate data protection officer; for anything about your data, including questions, requests and complaints, write to contact@coderiv.com or to the address above.

2. The short version

  • You can play as a guest without giving us an e-mail address.
  • Your nickname, avatar, country flag and level are visible to other players, because CodeRiv is a game against other people.
  • Ads in CodeRiv are optional rewarded videos and are not personalised.
  • We never see your card details: subscriptions are paid through the App Store or Google Play.
  • We do not sell your personal data.
  • You can delete your account in the app (Settings › Delete account) or at coderiv.com/delete-account.

3. What we collect and why

Account. When you start, we create a guest account with a random id. If you create a profile, we store your e-mail address and a hash of your password, or your e-mail address as given by Sign in with Apple or Google (we do not keep the name or photo those services send). We use this to run your account, keep your progress across devices, reset your password and send you service e-mails (for example e-mail confirmation or a deletion confirmation). Basis: performance of our contract with you.

Game profile. Your nickname (generated for you until you change it), one of the built-in avatars, an optional country, your chosen level (Junior, Mid, Senior or Not sure), your time zone, your level, frame and premium badge (which you can hide). We use it to run matches, rankings and the Daily Commit reset at your local midnight. Basis: contract.

Gameplay. Your answers, matches, Daily Commit and practice results, XP, streaks, hearts, trophies, friends, challenge links and question reports (including any comment you write). We use it to play the game, pick questions that fit you, show your stats and skill map, keep rankings fair and prevent abuse. Basis: contract; for anti-abuse, our legitimate interest in a fair game.

Certificate. If you earn a certificate, we store a snapshot of the stats it is based on. It shows your nickname, or your real name only if you choose to add it. Basis: contract; your real name only with your choice to show it.

Purchases. If you subscribe to Premium, Apple or Google processes the payment. We receive and store the store's transaction records (product, transaction or order id, purchase token or receipt, price, currency, trial and renewal state) to give you your benefits and handle renewals, cancellations and refunds. Basis: contract and our legal accounting obligations.

Notifications. If you allow notifications, we store your device's push token and a random installation id to tell you when it's your turn, when a rival wants a rematch or when your streak is at risk. You can turn notification types off in the app or in your phone's settings. Basis: contract and your permission on the device.

Ads. Free players can choose to watch a rewarded video to refill a heart or repair a streak. The video is served by Google AdMob. We request non-personalised ads only. When an ad loads, the AdMob SDK processes data such as your device's advertising identifier, your IP address (from which an approximate location is derived) and how you interact with the ad. We receive only a confirmation that the ad was watched (with its transaction id), so the heart can be credited once. In the EEA, the UK and Switzerland we ask for your consent through Google's consent message before ads can use your device's storage. Basis: consent where required; otherwise our legitimate interest in funding a free game. No ad is requested before that choice is made, and CodeRiv does not track you across other companies' apps or websites (on iOS it never asks for the advertising identifier).

Analytics. We record how the app is used (for example which screens are opened and when a match ends) with PostHog, hosted in the EU. Events carry a random or account id, the app version and your device's operating system. They never carry your e-mail or nickname. You can switch analytics off in Settings › Privacy; the app and our servers then stop sending your events. Basis: our legitimate interest in improving CodeRiv; you can object at any time with that switch.

Crash reports and logs. When the app or our servers fail, we send an error report to Sentry (error type, a scrubbed message and stack trace, app and OS version, your account id; no e-mail and no IP headers). Our servers keep technical logs, including IP addresses and the app version of requests, to keep the service secure and to fix problems. We also use IP addresses to rate-limit requests. Basis: our legitimate interest in a secure, working service.

Support. If you write to us, we use your message and e-mail address to answer. Basis: legitimate interest (or contract, if it is about your account or purchase).

Website. coderiv.com processes the technical data every browser sends (IP address, browser, pages requested) to show the site and keep it secure. If you open a challenge link or a certificate page, the site shows the data that page is about. See section 13 for cookies.

We do not collect your phone number, birth date, contacts, photos, precise location, or payment card details. CodeRiv has no chat.

4. What other people can see

  • In the app: your nickname, avatar, country flag, level, frame and premium badge (unless you hide it) appear to your rivals, in rankings and in friends lists.
  • Challenge links: anyone with your link sees your nickname, avatar, level and the path you play. These pages are not indexed by search engines.
  • Certificates: anyone with the verification link sees your nickname (or your real name, if you chose to show it), the level, the path, your top topics and the stats at issue time. These pages are not indexed by search engines.

Your e-mail address is never shown to other players.

5. Who helps us (processors and recipients)

We use these service providers. They process data on our behalf under a data processing agreement, except where noted as independent controllers.

  • Hosting: a hosting provider running our servers and database, located in the European Union (EEA).
  • PostHog (EU hosting): product analytics.
  • Sentry (Functional Software, Inc.), EU data region: crash and error reports.
  • Twilio SendGrid (USA): sending service e-mails.
  • Google Firebase Cloud Messaging and Apple Push Notification service: delivering notifications.
  • Google AdMob: rewarded ads. Google acts as an independent controller for the data its SDK collects. See how Google uses data from apps that use its services.
  • Apple and Google (App Store, Google Play, Sign in with Apple, Google Sign-In): payments, subscriptions and sign-in, as independent controllers under their own privacy policies.

We may also disclose data when the law requires it, or to protect CodeRiv and its players against fraud or abuse. If CodeRiv is sold or merged, your data would pass to the new owner under this policy.

6. Transfers outside the EEA

Some providers above (for example Google, Apple, SendGrid and Sentry) may process data in the United States or other countries. Where they do, the transfer relies on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. How long we keep data

  • Account, profile and gameplay data: until you delete your account.
  • Guest accounts you no longer use: erased after 12 months without activity.
  • Purchase records: as long as accounting and tax law requires (in Poland, 5 years from the end of the year of the purchase), no longer linked to your account after deletion.
  • Push tokens: until you sign out, delete your account, or the token stops working.
  • Activity log with IP addresses: 30 days. Notification and e-mail history, ad confirmations: 90 days.
  • Analytics events: 12 months, and deleted with your account. Crash reports: up to 90 days.

8. Deleting your account

In the app, open Settings › Delete account. Your account is closed and you are signed out everywhere at once, and an automatic job erases your personal data within minutes: profile, sign-in details, progress, friends, certificates, challenge links, notifications, e-mails we sent you, the activity log and analytics data. If you no longer have the app, see coderiv.com/delete-account: we confirm the request with the e-mail address of the account and then delete it within 30 days. We keep only what the law requires or what no longer identifies you: purchase records without a link to you, and matches in your opponents' history shown as “Deleted player”. Deleting your account does not cancel a subscription: cancel it in your App Store or Google Play settings first.

9. Your rights

Under the GDPR you have the right to:

  • access your data and get a copy of it;
  • have inaccurate data corrected (you can change your nickname, avatar and country in the app);
  • have your data erased;
  • restrict or object to processing based on our legitimate interests, including analytics;
  • receive the data you gave us in a portable format;
  • withdraw consent at any time, without affecting processing before the withdrawal;
  • lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or the authority where you live or work.

To use these rights, write to contact@coderiv.com from the e-mail address on your account (guests: include your nickname). We answer within one month. California residents: we do not sell or share personal information for cross-context behavioural advertising, and you have the rights to know, delete and correct described above.

10. Age

CodeRiv is not meant for children. You may use it on your own from the age of 18. From the age of 14 you may use it with the consent of a parent or legal guardian, who can exercise the rights in section 9 for you. If we learn that an account belongs to someone younger than 14, or to a minor without that consent, we delete it.

11. Security

Data is encrypted in transit (HTTPS). Passwords are stored only as hashes. Access to production data is limited to the people who run CodeRiv. No system is perfectly secure: if a breach affects your data, we will tell you and the supervisory authority as the law requires.

12. Automated decisions

CodeRiv adapts which topics and questions you get and matches you with rivals automatically. None of this has legal or similarly significant effects on you.

13. Cookies on coderiv.com

The website only uses what it needs to run (your theme and your cookie choice are kept in your browser's storage). Google Analytics tells us how many people visit and which pages and links bring them. Until you choose “Accept” in the cookie banner it stores nothing on your device and sends Google only anonymous, cookieless signals (page, referrer, browser type); IP addresses are not stored. “Accept” lets Google Analytics set its cookies and loads the Meta Pixel, which measures our campaigns; “Reject” keeps both off. Change your choice at any time under “Cookie settings” at the bottom of every page. The app does not use cookies for tracking.

14. Changes to this policy

If we change this policy in a way that matters, we will tell you in the app, by e-mail or on coderiv.com at least 7 days before the change takes effect. The effective date at the top always shows the current version.

15. Contact

Devs-Mentoring.pl Kacper Garbaciński, ul. Kwiatowa 8, Okup Mały, 98-100 Łask, Poland. E-mail: contact@coderiv.com. Help with the app: coderiv.com/support.