2048 Reborn / Ricaba
Privacy policy
1. About this policy
This privacy policy applies to 2048 Reborn, developed by Ricaba. Privacy and support contact: hello@ricaba.com. It describes the current Android versions 1.1.2 (offline), 1.2 (legacy challenges), 1.3 (optional normal-game rankings) and 1.4 (Guest, Google sign-in and local history), rather than planned online features.
2. Information used on your device
Your game board, score, local best score, undo state, daily challenge and history, and language, appearance, speed, sound, haptic and motion preferences. Your board is saved locally. When you enable Online in versions 1.3 or 1.4, normal-game moves and results are sent for ranking verification as described in the online section below.
Where automatic language or appearance is supported, the app reads the device’s language or light/dark preference locally. This does not send those preferences to Ricaba.
3. Device features and permissions
The game plays bundled sound effects and can use haptic feedback. It does not record audio, use the camera or request your location.
4. Accounts, advertising and online services
The offline 1.1.2 release has no online profile or leaderboard. Versions 1.2, 1.3 and 1.4 add the optional online features described below. These releases do not include advertising SDKs or analytics services. It does not sell or send your local app records to advertisers. Installing or updating through an app store is covered separately by that store’s own practices.
5. Storage, retention and deletion
Local records are stored in the app’s storage area, normally protected by the operating system’s application isolation. We do not claim that the SQLite database has additional application-level encryption. Records remain until you delete them using available app controls, clear app storage in Android settings, or uninstall the app. Files you export separately remain until you delete them at their destination.
Android app backup is disabled in the current signed Android release. Device vendors may still provide their own device-transfer features. Local boards do not have cloud restoration. Online profile recovery uses a separate private code and does not restore a local board.
Ricaba cannot remotely access or delete records that exist only on your device. You can contact us for help with deletion steps.
Ricaba account and Google sign-in: Reborn 1.4
Version 1.4 adds optional Google sign-in for a Ricaba player. Guest play and recent game history work locally without signing in. Google sign-in is implemented in the installed Android app; this website does not load Google sign-in scripts. Google handles your Google authentication under its own privacy policy; Ricaba does not receive your Google password. The service verifies Google-issued ID tokens, including signature, issuer, expiry and the Ricaba OAuth client identifiers. We may receive your Google identifier, name, email and profile-image URL when provided by Google. These identify and maintain your online account. Your Google email and Google profile picture are not published in the leaderboard. Public player names and generated avatars are separate from your Google profile.
The app keeps service session and refresh tokens in operating-system secure storage on Android, and uses them to remain signed in. The authentication SDK and operating system may also cache provider credentials. Signing out removes the app’s saved service credentials; it does not delete your Ricaba account. Switching to Offline retains your account on the phone but stops new community requests. Existing recovery-code profiles can link Google to their existing player identifier; the service does not merge players solely because their names or email addresses match.
Google sign-in on another phone restores your Ricaba identity and server-held ranked results. The current board, preferences and history of up to 100 recent rounds remain local to the original phone and are not backed up by Google sign-in. Local history records a round when you start a new game, with its date, score, highest tile and whether it ended or was restarted. Local history is not uploaded to the account service. Delete the shared Ricaba account through Account options in the app or request deletion through the account deletion page. Account deletion removes the account and its associated online scores; local records can be removed separately in Android app storage settings.
Optional online features and older Reborn versions
Normal play works offline without an account. With Online enabled in 1.3, normal-game results can join daily-best and all-time rankings. The app sends your public username, profile identifier, run identifier, starting board, moves and tile-spawn events over HTTPS to Ricaba's VPS. We replay legal moves to compute scores; we do not attest to a human player, device integrity or the randomness of client-generated tiles. Your username, ranked score and position are public in the app and on ricaba.com. Daily results use the UTC date when a new result is received; an unchanged retry keeps its earlier date. Scores use best-result scoring, not a sum of games.
Normal-game move logs are processed for verification. The service keeps compact run receipts containing hashes, action counts, the assigned date and identifiers until account deletion. These receipts allow safe retries and prevent overwriting newer progress. Raw normal-game move logs are not retained as server checkpoints by the current service. Local traces stay in the app's SQLite save. Daily board records are retained for up to 365 days; your profile and all-time record remain until deletion. Older 1.2 clients use the previous seeded challenge service, whose checkpoints are kept for up to seven days. Historical challenge results are separate from normal-game boards.
For profiles created with the older recovery-code flow, the recovery code is a secret sign-in credential. Authentication uses HTTPS and the service stores a derived hash, rather than the original code. Android and iOS use operating-system secure storage; web development previews use tab-scoped storage. The code enters your clipboard only when you request a copy. Keep it private. Rotating the code invalidates the old one. We cannot promise recovery if both your code and a signed-in device are lost.
Switching Online off stops new community requests; requests already sent may finish. It does not delete your profile or published results. Use Delete online profile in Profile or the account deletion page to remove the profile, results and verification receipts. Local board saves remain on your phone until removed separately. Rotating server backups expire within seven days. Reports about usernames are private to administrators and retained for up to 90 days. Server access logs are rotated daily with ten archives retained.
Current releases have no advertising SDK, analytics service or purchases. Advertising preparation remains disabled. Play Integrity attestation is not integrated. We will update this policy and relevant notices before activating features that change data handling.
Support and information you send us
If you email Ricaba, we and our email provider receive your email address, message and attachments. We use them to respond to your request and investigate reported issues. Avoid sending passwords, recovery codes or unrelated sensitive information. You may request deletion of support correspondence at hello@ricaba.com; any applicable retention obligations will be explained in our response.
Changes to this policy
Online profiles and normal-game rankings are optional. Version 1.4 adds Google sign-in and local history; older recovery-code profiles remain supported. Historical challenge data from 1.2 is separate. Advertising and multiplayer rooms are not active. Before introducing features that change data handling, we will update this policy and provide the relevant notices and choices. The effective date above identifies this policy version.