Skip to content

Privacy Policy for Festival Rush

Last updated: 2026-10-24

1. Who we are

Festival Rush is made by ToDeX Interactive V.O.F., (Dutch Chamber of Commerce / KvK 42185631). We are the data controller for any personal data processed through Festival Rush, as described in this policy. You can reach us at info@todex-interactive.com.

2. At a glance

  • An account is optional — you can use the app without signing in.
  • Some data reaches our servers — listed in full below.
  • Anonymous analytics and crash reports via PostHog (hosted in the EU), only if you allow it.
  • Ads are shown via Google AdMob.
  • We never sell your data.

3. Data stored on your device

Your festival, settings and consent choices are saved on your device. Notification reminders are scheduled on your device too; no push token is sent to us.

4. Data we collect

Signing in is optional. If you create an account, you can sign in with: One-time code sent to your email, Sign in with Apple, Sign in with Google. We never ask for or store a password.

  • A guest player with a random festival name, created without an account, plus a hashed token for each of your devices. Backing up your festival so it survives a reinstall.
  • Game progress: festivals unlocked, stars, cash, play time and your saved festival. Backing up your progress and calculating what you earned while away.
  • Wristband balance and history, and purchases. Keeping the in-game currency fair and restoring what you bought.
  • Email address, plus the name and profile picture Apple or Google share if you sign in with them. Creating your account and sending sign-in codes.
  • One-time transfer codes, stored as hashes. Moving your festival to a new device.
  • Sign-in session details (IP address and device/browser type). Keeping you signed in and protecting accounts against misuse.

5. Analytics & crash reports

Only if you allow it. The first time you open Festival Rush, we ask whether you want to share analytics. Until you choose "Allow", nothing is sent. You can change your choice at any time in the app's Settings.

With your permission, we use PostHog, hosted in the EU, to understand how Festival Rush is used and to find bugs. PostHog receives: the screens you view and actions you take in the app (such as starting or finishing a game), app open/close events, crash and error reports, and basic device information (device model, operating system, app version, language). Events are linked to a random identifier stored on your device.

6. Advertising

Festival Rush uses Google AdMob to show ads (unless you've bought an ad-free option). To deliver and measure ads, AdMob and its ad-network partners may collect advertising identifiers — the Google Advertising ID on Android and the Identifier for Advertisers (IDFA) on iOS — along with device information (such as device type, operating system, and approximate location derived from your IP address) and ad-interaction data, under Google's own policies. We only receive aggregated reports on ad performance.

In the EEA, the UK, and Switzerland, you are asked for consent before personalised ads are shown; if you decline, you only see non-personalised ads. On iOS, Festival Rush also asks for App Tracking Transparency permission before the IDFA is used. You can change your choice at any time via your device's ad settings.

7. In-app purchases

Purchases are handled by the Apple App Store or Google Play — we never see your payment details. We use RevenueCat to verify purchases and restore them on your devices. RevenueCat receives your purchase receipts and a random app user ID (or your account ID, if you're signed in).

8. Device permissions

Festival Rush only asks for these permissions, and only at the moment they are needed. You can decline or revoke any of them in your device settings.

  • Notifications: Optional reminders when your cash box is full or a free chest is ready. Asked only after your first return..
  • Tracking (iOS): Optional, for more relevant ads. Festival Rush works the same if you decline..

9. Legal basis for processing

Where the GDPR applies, we rely on the following legal bases:

  • A guest player with a random festival name, created without an account, plus a hashed token for each of your devices: Performance of a contract (Art. 6(1)(b) GDPR).
  • Game progress: festivals unlocked, stars, cash, play time and your saved festival: Performance of a contract (Art. 6(1)(b) GDPR).
  • Wristband balance and history, and purchases: Performance of a contract (Art. 6(1)(b) GDPR).
  • Email address, plus the name and profile picture Apple or Google share if you sign in with them: Performance of a contract (Art. 6(1)(b) GDPR).
  • One-time transfer codes, stored as hashes: Performance of a contract (Art. 6(1)(b) GDPR).
  • Sign-in session details (IP address and device/browser type): Legitimate interests (Art. 6(1)(f) GDPR).
  • Analytics and crash reports: Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the app's Settings.
  • Personalised ads: Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Non-personalised ads: Legitimate interests (Art. 6(1)(f) GDPR) — funding the free version of Festival Rush.
  • Purchases: Performance of a contract (Art. 6(1)(b) GDPR).

10. Service providers

These companies process data for Festival Rush, each only for the purpose listed:

  • Render — Hosting our backend (EU).
  • Supabase — Database (EU).
  • Resend — Sending sign-in code emails (United States).
  • PostHog — Product analytics and crash reports, only if you allow it (EU (Frankfurt, Germany)).
  • Google AdMob — Showing and measuring rewarded ads (Global (Google)).
  • RevenueCat — Managing in-app purchases (United States).
  • Apple App Store / Google Play — Processing payments (Global).
  • Apple / Google — Sign-in, only if you choose Sign in with Apple or Google (United States).

11. Data sharing & disclosure

We do not sell or rent your data. Data is only shared with the service providers listed above or where we are required to by law.

12. International transfers

Our own servers and databases are hosted in the European Union. Some of the service providers listed above process data outside the European Economic Area, including in the United States. Where that happens, transfers are protected by an adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.

13. Security

We use reasonable technical and organizational measures to protect any data we hold, including encrypted connections (HTTPS) for all traffic between the app and our servers. Only our own team can access stored data, and only when needed for support, abuse reports or security. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Data retention

  • Your player, progress and purchases are kept until you delete them from the app's settings.
  • Sign-in codes expire after 5 minutes and transfer codes expire after use; sign-in sessions expire automatically.
  • Analytics data is kept in line with our PostHog retention settings, after which it is deleted.
  • Purchase records are kept by RevenueCat, Apple and Google as required for billing and tax purposes.
  • Data collected by Google AdMob is retained under Google's own policies.

15. Deleting your data

Use "Delete account" in the app's settings to erase your player and everything linked to it (progress, purchase history, devices and codes); Apple sign-in tokens are revoked too. You can also contact us and we'll do it for you.

16. Children's privacy

Festival Rush is not directed at children under 13, and we do not knowingly collect personal information from children under 13. In the EEA, children under 16 need permission from a parent or guardian before giving consent to any consent-based processing, such as personalised ads. If you believe a child has provided us with personal data, please contact us and we will delete it.

17. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. Users in the UK, California, and other regions may have similar rights under local law. You can exercise these rights for your Festival Rush account by contacting us below, or delete your account directly in the app.

You also have the right to lodge a complaint with a data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

18. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

19. Contact

Questions about this policy? Email us at info@todex-interactive.com, or for app support visit our Support page (support: support@todex-interactive.com).