Privacy notice

Effective 29 October 2026 · Versione italiana

In short. Sonarush collects only what it needs to let you play online. We don't ask for your real name, date of birth or where you live; if you buy something, payment details are handled by Stripe, not by us. There are no ads and no tracking, and we never sell or share your data. If you only play offline, no data leaves your computer.

1. Who is responsible

The data controller is Vincenzo Abate, who develops Sonarush under the name Vabax. For any question about your data, write to sonarush@vabax.it.

2. If you play offline

Your progress, settings and name stay in a file on your computer. If the game closes because of an error, it writes a report in the same folder: it stays there and is not sent to anyone, unless you choose to send it to us.

3. If you use the online account

The online account is created automatically, with no email and no password, and is used for online matches, friends, clubs, leaderboards, the daily gift and cloud save. To make it work we process the following data:

The account: Your tag (an 8-character code), the name you choose, the country set on your computer (for the national leaderboard) and the list of linked devices, with their system type and last sign-in date.
Access codes: Your recovery code and device keys are stored only in a form that cannot be reversed: not even we can read them.
Progress: Trophies, characters, resources, game statistics and results of online matches.
Other players: Friends and friend requests, blocked or recently met players, your club and role, club chat messages (ready-made phrases only: there is no free chat) and the reports you make or receive.
Presence and notifications: Whether you are online or in a match, and notifications about you, such as an invite or a friend request.
Your email, if you link one: It is optional and used only to send you the codes you request to recover your account. Other players cannot see it, and you can remove it at any time.
Purchases, if you buy something: What you bought, when, the price, the currency, the outcome of the payment and what arrived in your account, together with your account's email for the receipt. The country set on your computer is used to choose between euros and dollars. We never see your card details.
Technical data: The IP address of requests to the server, used to protect it from abuse, and an identifier of the installed game, used only to understand technical problems.

4. What other players can see

Your name and tag, trophies, level, favourite character, some statistics, your club and whether you are online. With "Do not disturb" nobody can invite you or listen to your matches.

5. Why we use this data

To provide the service you ask for when you use the online account (Article 6(1)(b) of Regulation (EU) 2016/679, the "GDPR").
To sell and deliver what you buy and to keep the payment records required by law (Article 6(1)(b) and (c)).
To keep the game safe and fair: protecting the server and moderating offensive names, cheating and misconduct. Here the legal basis is our legitimate interest (Article 6(1)(f)).

We do not use your data for advertising or profiling, and we make no automated decisions about you beyond those of the game itself, such as trophies or matchmaking.

6. Where it is kept and who helps us

The game server and its backups run on Oracle Cloud, in a data centre in Milan, in the European Union. Oracle provides the infrastructure and does not use the data for its own purposes.
Emails with codes are sent from the vabax.it mailbox, provided by Aruba, which receives only the address and the message.
Game downloads and updates go through itch.io, which has its own privacy policy.
Payments are handled by Stripe (Stripe Payments Europe, in Ireland), which also processes payment data as an independent controller, for example to prevent fraud, under its own privacy policy. Stripe may transfer data outside the European Union with the safeguards required by the GDPR. We receive from Stripe only the outcome of the payment and the purchase details.

We ourselves do not transfer data outside the European Union.

7. How long we keep it

Data	Kept for
Account and progress	As long as the account exists. After you ask to delete it, it stays suspended for 14 days so you can change your mind, then it is deleted.
Backups	Up to 60 days, then they delete themselves. They are used only to recover from a failure.
Notifications	7 days.
Online presence	About a minute after you close the game.
IP address	One hour for abuse protection; 14 days in the server's technical logs.
Codes sent by email	15 minutes.
Purchase records	For as long as tax and accounting law requires (in Italy up to 10 years), even after the account is deleted, no longer linked to the account.

8. How we protect it

Communication between the game and the server is encrypted. Access codes are never stored in plain text: not on the server, and not on your computer, where they live in the system's protected store. The server is updated regularly and only its administrator can access it.

9. Your rights

You can ask at any time to access your data, get a copy, correct or delete it, restrict its use, and object to processing based on legitimate interest. Many things you can do directly in the game:

delete your account: Settings, Online account, Delete the account;
change your name: from your Profile;
remove your email, sign out or unlink a device: Settings, Online account.

For anything else write to sonarush@vabax.it with your account tag: we reply within one month. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority of the country where you live.

10. Children

Anyone under 14 may use the online account only with the consent of a parent or guardian. To buy anything with real money, anyone under 18 needs the permission of a parent or guardian.

11. Changes

If this notice changes significantly, we will say so in the game's What's new screen and update the date at the top of this page.