Privacy Policy

This Privacy Notice describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you:

Visit our website at rhythm-mania.com or any website of ours that links to this Privacy Notice
Download and use our application (Rhythm Mania), or any other application of ours that links to this Privacy Notice
Use RhythmMania — a precision mania-style rhythm game that runs entirely in the browser
Engage with us in other related ways, including any customer support, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at yumo@ymspace.cloud.

◆

Summary of Key Points

This summary provides key points from our Privacy Notice. You can find more details about any of these topics by navigating to the corresponding section below.

What personal information do we process?

When you use our Services, we process information depending on how you interact with us, your choices, and features used (e.g. Google profile data, user profile details, avatars, and gameplay scores).

Do we process sensitive personal information?

We do not process sensitive personal information (such as racial/ethnic origin, religious beliefs, or health data).

Do we collect information from third parties?

We do not collect third-party personal data, except basic profile fields authorized by you during Google OAuth sign-in.

How do we process your information?

To provide, improve, and administer our Services, authenticate accounts, verify replay scores, prevent security fraud, and comply with law.

When and with whom do we share information?

We do not sell personal data. Data is shared only with core hosting/cloud infrastructure providers and in business transfer scenarios.

How do we keep your information safe?

We implement reasonable organizational and technical safeguards. However, no internet transmission can be guaranteed 100% secure.

What are your privacy rights?

Depending on your location (EEA, UK, Switzerland, Canada, US, Australia), you have rights to access, correct, export, or delete your personal data.

How do you exercise your rights?

You can manage profile data in-game or contact us directly at yumo@ymspace.cloud.

What information do we collect?

In Short: We collect personal information that you provide to us.

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services, or otherwise contact us.

The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the features you use. This may include:

Names and Usernames Display names, profile handles, and account names.

Email Addresses Primary email provided through Google Sign-In (kept private).

Authentication & Profile Data User avatars, profile biographies, social media links, activity status, and uploaded gameplay score/replay records.

Sensitive Information

We do not process sensitive information (such as racial or ethnic origins, sexual orientation, genetic data, or religious beliefs).

Social Media & Google Login Data

Our Services offer you the ability to register and log in using your Google account. When you do so, we collect authentication identifiers and profile details as described in Section 6.

Application & Device Data

When you access our application, we may automatically collect technical diagnostic information including browser type, operating system, version information, system configuration, hardware model, network identifiers, and Internet Protocol (IP) address. This information is needed to maintain security, troubleshoot performance, and prevent automated abuse.

Google API Limited Use Disclosure Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How do we process your information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons depending on how you interact with our Services, including:

To facilitate account creation and authentication: Managing your sign-in session and maintaining your account.
To deliver and facilitate delivery of services: Storing your public profile, rendering score rankings on leaderboards, and verifying competitive replay submissions.
To protect security and vital interests: Preventing cheating, mitigating DDoS or API abuse, and securing the platform against unauthorized access.

What legal bases do we rely on?

In Short: We only process your personal information when we believe it is necessary and have a valid legal reason under applicable law.

European Union & United Kingdom (GDPR / UK GDPR)

If you are located in the EU or UK, we rely on the following legal bases:

Consent: Where you have granted explicit permission for specific features. You may withdraw consent at any time.
Performance of a Contract: To provide you with requested gameplay, profile, and replay services under our Terms of Service.
Legal Obligations: To comply with legal requirements, regulatory requests, or litigation duties.
Vital & Legitimate Interests: To maintain game security, protect users from fraud, and ensure leaderboard integrity.

Canada

We may process your information based on express or implied consent under applicable Canadian privacy laws (including PIPEDA). In certain exceptional circumstances permitted by law (such as fraud investigations, legal subpoenas, or witness statements), data may be processed without explicit consent.

When and with whom do we share information?

In Short: We do not sell personal information. We share data only in specific operational or business transfer situations.

We do not sell personal data. We share information only in the following limited situations:

Service Providers: We may share data with cloud infrastructure, hosting, and database providers that perform technical processing on our behalf under strict confidentiality agreements.
Business Transfers: We may share or transfer information in connection with, or during negotiations of, any merger, sale of assets, financing, or acquisition of our operations.

Cookies and tracking technologies

In Short: We use essential cookies and browser storage to maintain sessions, prevent security vulnerabilities, and save game settings.

We use essential cookies (e.g. rm_session_token, rm_csrf_token, and OAuth state cookies) and browser storage (localStorage and IndexedDB) to keep you signed in, protect against CSRF attacks, save custom keybindings and offsets, and store downloaded beatmaps.

We do not use third-party behavioral advertising cookies or marketing tracking pixels. You can control or remove cookies through your browser settings.

How do we handle social logins?

In Short: If you choose to log in with Google, we receive basic identity information from Google.

When you authenticate via Google Sign-In, Google provides us with your account identifier (Subject ID), email address, display name, and avatar URL. We use this information solely to establish your RhythmMania account and authenticate your sessions.

How long do we keep your information?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this notice, unless otherwise required by law.

We retain your account records, profile details, avatars, and submitted replays for as long as your account remains active. Server sessions expire after 30 days. When there is no ongoing legitimate need to process your personal data, we will delete or anonymize it.

How do we keep your information safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate technical security measures including HTTPS transmission, signed CSRF double-submit tokens, HTTP-only session cookies, and input sanitization. However, no internet transmission or electronic storage technology is 100% secure, and we cannot guarantee absolute immunity from unauthorized access.

Do we collect information from minors?

In Short: We do not knowingly collect data from or market to individuals under 18 years of age.

RhythmMania is intended only for users who are at least 18 years old. By using the Services, you represent that you are at least 18. If we learn that personal data from a minor has been collected, we will deactivate the account and take reasonable measures to promptly delete the information from our databases. If you become aware of any minor data, contact us at yumo@ymspace.cloud.

What are your privacy rights?

In Short: In many regions, you have rights that allow you greater access to and control over your personal information.

Depending on your region (such as the EEA, UK, Switzerland, and Canada), you may have the right to (i) request access and obtain a copy of your personal information; (ii) request rectification or erasure; (iii) restrict or object to the processing of your data; and (iv) data portability. We do not make decisions with legal effects based solely on automated processing.

UK & European Supervisory Authorities

If you are located in the UK and are unsatisfied with our handling of your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint

Helpline: 0303 123 1113

Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Controls for Do-Not-Track features

Most web browsers include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference. Because there is currently no uniform industry standard for recognizing or implementing DNT signals, our system does not currently respond to automated DNT browser signals.

United States residents privacy rights

In Short: Residents of certain US states (e.g. California, Colorado, Connecticut, Virginia, Texas, and others) have specific rights regarding personal information.

Categories of Personal Information Collected (Past 12 Months)

Category	Examples	Collected
A. Identifiers	Real name, alias, unique personal identifier, IP address, email address, account ID	YES
B. California Customer Records	Name, contact information, authentication details	YES
C. Protected Classifications	Gender, race, religion, sexual orientation, marital status	NO
D. Commercial Information	Purchase history, financial transactions, payment details	NO
E. Biometric Information	Fingerprints, voiceprints, facial geometry	NO
F. Internet / Network Activity	Browsing history across third-party sites, consumer behavioral tracking	NO
G. Geolocation Data	Precise physical location coordinates	NO
H. Sensory Data	Audio recordings, video surveillance	NO
I. Professional Information	Employment history, job applications	NO
J. Education Information	Student records, directory information	NO
K. Inferences & Profiling	Behavioral profile generation, consumer scores	NO
L. Sensitive Personal Info	Government IDs, financial account pins, health data	NO

We have not sold or shared any personal information to third parties for a commercial purpose in the preceding twelve (12) months, and will not do so in the future.

California “Shine the Light” Law

Under California Civil Code Section 1798.83 (“Shine the Light”), California residents are entitled to request information concerning categories of personal information disclosed to third parties for direct marketing. We do not disclose personal information to third parties for direct marketing purposes.

Other regional privacy rights

Australia

We process personal data under the conditions set by Australia's Privacy Act 1988 (including the Australian Privacy Principles). If you believe we are unlawfully processing your personal information, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Do we make updates to this notice?

We may update this Privacy Notice from time to time to stay compliant with relevant laws. The updated version will be indicated by the “Last updated” date at the top of this document. We encourage you to review this notice periodically.

How can you contact us about this notice?

If you have questions, comments, or rights requests regarding this notice, you may contact us at:

YMSpace

Singapore

yumo@ymspace.cloud

Review, update, or delete collected data

Based on applicable laws in your jurisdiction, you may have the right to request access to the personal information we maintain, correct inaccuracies, or request the deletion of your account and personal data.

To submit a data access, correction, or deletion request, you may edit your profile directly in the game settings or contact us by email at yumo@ymspace.cloud. We will respond to and act upon your request in accordance with applicable data protection laws.

Ready to jump back into the rhythm?

Experience low-latency mania gameplay directly in your web browser.

Launch Rhythm Mania