Rich Score is committed to protecting your privacy. This policy explains what data we collect, why we collect it, and your rights as a user — including your rights under the EU General Data Protection Regulation (GDPR).
1. Who We Are
Rich Score ("we", "us", "our") is the data controller responsible for your personal data. Rich Score is operated by Hoovus Kinnisvara OÜ (registry code 16775200), Estonia.
Contact: support@listoflegacy.com
2. What Data We Collect
Account Data
- Email address (from registration or Google Sign-In)
- Display name and username
- Google account ID (if you sign in with Google)
- Apple ID (if you sign in with Apple)
- Email verification status
Profile Data (optional, provided by you)
- Profile photo and cover photo
- Bio and social links
- Country and company name
- Privacy setting (public / private profile)
Subscription and Financial Data
- Subscription tier and status
- Subscription start and end dates
- Contribution history (amounts, dates)
- Apple App Store or Google Play subscription/purchase ID (for in-app purchases; payment processing handled by Apple or Google)
- For payments made on our website, a Stripe customer ID and the billing country/region Stripe reports. Card and payment-instrument data is collected and processed entirely by Stripe — we only receive confirmation of payment and the billing country.
- We never store card details or full payment instrument data on our servers.
Content Moderation Data
- Profile photos and cover photos you upload are automatically screened for prohibited content using Google Cloud Vision API. The image is sent to Google for analysis and the result (safe / unsafe) is used to accept or reject the upload. Images are not stored by Google beyond the duration of the API call.
Report Data
- If you submit a report about another user, we store who submitted the report, who was reported, the reason, and the outcome of our review. This data is retained for safety and moderation purposes.
App Activity Data
- Leaderboard rank and Rich Score
- Followers and following list
- Activity events (contributions, rank changes)
- In-app notifications
Technical and Device Data
- Device and other identifiers provided by Google Play services when you sign in or make a purchase (used to authenticate you, process Google Play billing, and prevent fraud or duplicate subscriptions).
- Country/region, as reported by your app store (Google Play or the Apple App Store) or, for website payments, by Stripe at the time of a purchase. We use it to apply the correct VAT or local tax and to set the country shown on your profile and on our country leaderboards. This is derived from your billing region, not from your device's location — we do not access your device's GPS or location. If your country is ever shown incorrectly, contact support@listoflegacy.com and we will correct it.
- IP address and basic technical/log data, processed by our servers to operate the service securely.
- We do not use these identifiers for advertising, and we do not share them with third-party advertisers.
3. Why We Collect It (Legal Basis)
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account | Contract performance |
| Processing subscriptions, contributions and payments | Contract performance |
| Displaying your profile and rank publicly | Consent (you choose to join) |
| Sending transactional emails (verification, cancellation) | Contract performance |
| Improving the service and fixing bugs | Legitimate interest |
| Screening uploaded images for prohibited content | Legitimate interest (platform safety) |
| Processing and reviewing user reports | Legitimate interest (platform safety) |
| Complying with financial record-keeping obligations | Legal obligation |
4. Who We Share Data With
We do not sell your data. We share data only with the third-party processors necessary to operate the service:
| Processor | Purpose | Location |
|---|---|---|
| Apple App Store | In-app subscription and contribution processing (iOS) | USA (SCCs) |
| Google Play | In-app subscription and contribution processing (Android) | USA (SCCs) |
| Stripe | Card payment processing for website subscriptions and contributions | USA (SCCs) |
| Cloudinary | Profile photo and cover photo storage and delivery | USA (SCCs) |
| Google (OAuth) | Authentication via Google Sign-In | Ireland (EU) |
| Google Cloud Vision | Automated image safety screening on upload | USA (SCCs) |
| Railway | Backend server and database hosting | USA (SCCs) |
| Resend | Transactional email delivery | USA (SCCs) |
Transfers to the USA are covered by Standard Contractual Clauses (SCCs) as required by GDPR Chapter V.
5. How Long We Keep Your Data
- Active accounts: for as long as your account is active.
- Deleted accounts: account data is removed after 90 days, you can stop this by restoring your account. Contribution history may be retained in anonymised form for the integrity of the public leaderboard record.
- Financial records: subscription and payment records are retained for 7 years as required by Estonian accounting law.
6. Your Rights Under GDPR
As an EU resident, you have the following rights:
- Right of Access: request a copy of all personal data we hold about you.
- Right to Rectification: correct inaccurate data directly in the app, or by contacting us.
- Right to Erasure: request deletion of your account and personal data — see our Account Deletion page for step-by-step instructions.
- Right to Data Portability: receive your data in a structured, machine-readable format.
- Right to Object: object to processing based on legitimate interest.
- Right to Withdraw Consent: where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, email support@listoflegacy.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee.
7. Cookies and Tracking
The Rich Score website uses a cookie consent banner to obtain your permission before setting non-essential cookies. You can accept all, reject all, or customise your preferences. Your choice is saved in your browser's local storage.
We do not currently use third-party analytics or advertising cookies. The mobile app uses no advertising trackers. We may use anonymous crash reporting to improve app stability.
8. Children's Privacy
Rich Score is not directed at anyone under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
9. Security
We use industry-standard measures to protect your data: HTTPS encryption in transit, hashed passwords (bcrypt), JWT-based authentication, and access-controlled database hosting. Payment card data is handled entirely by our payment processors — Apple, Google, or Stripe (for website payments) — and never touches our servers. Uploaded images are screened automatically before being stored.
10. Changes to This Policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for significant changes, notify you via email or in-app notification.
11. Contact
For any privacy-related questions or requests:
Email: support@listoflegacy.com