Privacy policy

Last updated: May 31, 2026

Rankly is operated by Franck Ratier, based in Romania. This policy explains what data we collect, why, and what we do with it. The short version: we collect very little and share none of it.

This policy applies to the Rankly website (rankly.games), the web app (play.rankly.games), and the Rankly mobile apps for iOS and Android.

What we collect

When you use Rankly, we store:

• Account data — your email address (used for login) and display name
• Profile data — your avatar settings, site, and play area
• Game data — match results, ratings, league and tournament participation
• Push notification tokens — if you enable notifications, we store a device-specific token (from Apple or Google) so we can send you alerts about matches and challenges. The token identifies your device, not you personally
• Biometric login preference — if you enable fingerprint or Face ID login in the mobile app, we store only a flag indicating it's enabled. The biometric data itself never leaves your device — it stays in your phone's secure enclave
• Contact form data — if you fill out the contact form on our website, we store your company name, email, and message

That's it. We don't collect your IP address for tracking, we don't build profiles about you, and we don't use any analytics or advertising tools.

How we use your data

We use your data to:

• Run the service — authenticate you, display leaderboards, calculate ratings
• Send you login codes via email (passwordless authentication)
• Send you push notifications (only if you opt in) about matches, challenges, and invitations
• Respond to contact form submissions

We don't use your data for marketing, advertising, profiling, or anything else.

Cookies and tracking

Rankly does not use cookies for tracking or analytics. We use browser local storage (on the web) and the platform's secure storage (in the mobile apps) for authentication tokens only. There are no third-party trackers, no advertising pixels, and no analytics scripts on our website or in our apps.

Data sharing

We don't share, sell, or transfer your personal data to any third party for marketing or advertising. Your data stays in our systems.

We use the following processors to deliver the service:

• Amazon Web Services (AWS) — hosts our infrastructure in the EU (Frankfurt, Germany). All your account, profile, and game data is stored here. AWS acts as a data processor under GDPR.
• Apple Push Notification service (APNs) — delivers push notifications to iOS devices. If you opt in to notifications, the notification content passes through Apple's servers.
• Google Firebase Cloud Messaging (FCM) — delivers push notifications to Android devices. If you opt in to notifications, the notification content passes through Google's servers.

No data leaves the EU on our infrastructure. Push notification delivery (Apple/Google) may transit through their global networks; this is unavoidable for the feature to work.

Data retention

• Active accounts — your data is kept for as long as your account is active
• After subscription expires — your account is frozen for 30 days (data preserved, service inactive). After the grace period, your data is deleted
• Account deletion — if you request deletion, we remove your personal data within 30 days. See our account deletion page for instructions
• Push notification tokens — deleted when you disable notifications, uninstall the app, or delete your account
• Contact form submissions — kept for up to 12 months, then deleted

Your rights

Under GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and associated data — see our account deletion page
• Export your data in a portable format
• Object to processing of your data

To exercise any of these rights, email us at privacy@rankly.games. We'll respond within 30 days.

Children's privacy

Rankly is designed for workplace use and is not intended for anyone under 16 years of age. We do not knowingly collect data from children under 16.

Security

We use encryption in transit (HTTPS everywhere) and at rest (encrypted database and file storage). Authentication is passwordless — we send a one-time code to your email, so there are no passwords to steal or leak. On mobile, you can also enable biometric login (fingerprint or Face ID), which is processed entirely on your device.

Changes to this policy

If we make changes to this policy, we'll update the date at the top of this page. For significant changes, we'll notify you via email.

Contact

For any privacy-related questions or requests:

Franck Ratier
Email: privacy@rankly.games