Privacy and Personal Data Policy

Roll App Privacy and Personal Data Policy
Revision date: 29 August 2026

This English version is provided for users who prefer English. Roll App is operated under the laws of the Russian Federation. If this translation differs from the Russian version, the Russian version prevails to the extent permitted by applicable law.

This Policy explains how individual entrepreneur Danila Sergeevich Lukyanov (Stray Token brand), INN 366234240541, OGRNIP 326366800075594 (the Operator), processes personal data in the Roll App mobile application, on roll-app.ru and through related server functions.

Personal data contact: support@roll-app.ru.

1. Scope and principles
The Policy applies to Roll App users, website visitors and people who contact the Operator. App stores, payment providers, advertising networks and other third parties may process data independently under their own documents.

The Operator processes data lawfully, fairly and only for specified purposes; limits data to what is necessary; takes reasonable security measures; and does not retain data longer than required by the stated purposes or applicable law.

The legal grounds may include the user's consent, performance of the Terms of Use, compliance with legal duties, handling user requests, service security, payment processing and accounting obligations.

2. Data categories
Technical data may include IP address, request date and time, requested resource, browser, device, operating system, application version, interface language, network diagnostics and server logs.

Author profile and template functions may use a technical installation or device identifier, device token or signature and their hashes, nickname, author avatar, template ownership data, profile transfer session data and server notifications.

Templates may include files, names, descriptions, settings, preview images, icons, author information, game parameters, moderation marks and reasons, technical copies and other information the user chooses to include.

Support and diagnostics may include the request text, voluntarily submitted logs, application and build version, platform, language, device identifier or its hash and contact information provided by the user.

After acceptance of the current consent revision and from the following launch, RuStore Tracer may receive crash or ANR time, stack information, app version, device model and manufacturer, Android version, supported ABI, CPU count and carrier name when available. Roll App does not intentionally send game profiles, templates, formulas, user files or its own user identifier to Tracer.

Advertising functions may process an advertising identifier, device and application information, ad placement, views, outcomes, frequency limits and temporary access grants through Yandex Mobile Ads SDK or Yandex advertising code on the website.

Premium and payment processing may use a device identifier or hash, plan, amount, currency, payment provider and method, order and payment identifiers, status, creation/payment/refund/cancellation dates, access expiry, activation code data and type, the basis and source for granting access, and information about an associated template, translation, support request or promotion where applicable. The Operator does not receive or store full bank card details.

Published-template management may use publication, moderation, approval, rejection, deletion and anonymization records; information linking a template to an author, device, technical identifier, nickname and avatar; and the template's anonymization status after profile deletion, consent withdrawal or discontinuation of author functions.

Local game sessions, local statistics and local achievements may be stored on the user's device to display progress, achievements, ranks and game history. The Operator cannot access this data unless it is transmitted through a separate function.

The application may locally store a record that legal documents were accepted, including the version, acceptance time, document URLs and whether an online or fallback document was shown.

3. Data the Operator does not request
The Operator does not request passport details, full bank card data, biometric data, special categories of personal data, health data, precise geolocation, contacts, SMS, photos or files except items the user deliberately selects for a template, avatar or support request.

Users must not include unnecessary confidential information or third-party personal data in a nickname, avatar, template, report or message without a lawful basis.

4. Processing purposes
Data may be processed to operate the application, website, local and server features; store, moderate, publish and delete templates; associate templates and authors with a device; transfer an author profile; prevent abuse; diagnose failures; provide advertising or temporary advertising access; create and verify paid or free Premium access, activation codes and payments; answer requests; secure the infrastructure; comply with law; and protect users' and the Operator's rights.

Data may also be processed to anonymize published templates when an author profile is deleted, consent is withdrawn or author functions are discontinued, and to retain anonymized templates for catalogue operation, continued availability of previously published materials, catalogue quality and protection of users' and the Operator's rights.

5. Processing operations and recipients
Processing may include collection, recording, organization, storage, update, retrieval, use, transfer, access, depersonalization, restriction, deletion and destruction by automated means. Authorized manual review may occur for moderation, support and diagnostics.

Data may be available, to the extent required for a function, to hosting and infrastructure providers located in the Russian Federation; technical support and security contractors; Yandex entities responsible for advertising or telemetry; CloudPayments and participating banks or payment systems; and public authorities where disclosure is legally required.

The Operator does not sell personal data. Public templates, nicknames, avatars and previews may be visible to catalogue users according to the selected publication mode.

When an author profile is deleted, consent is withdrawn or author functions are discontinued, the Operator deletes or anonymizes the nickname or author name, avatar, installation or device identifiers, tokens, identifier hashes, device associations and other technical data that could link a published template to a particular user.

After those identifiers are deleted or anonymized, a published template may remain in the Roll App catalogue without an author or with a neutral label such as “deleted user”, “unknown author” or “Roll App community” where retention is required for catalogue operation, download history, service quality or protection of users' and the Operator's rights, or where the user has not requested deletion of the template itself.

If the template content itself contains personal data of the user or another person, the Operator may delete the template, hide it from public access or request clarifying information needed to fulfil a deletion request.

6. Location, cross-border considerations and security
Core user template and service data is stored on infrastructure located in the Russian Federation. Third-party SDKs and services process data according to their applicable architecture and documents. Where legally required, the Operator takes measures necessary for lawful cross-border transfer.

Reasonable organizational and technical measures include access limitation, authentication or device signatures, transport encryption, logging, backups, software updates, moderation and incident response. No internet service can guarantee absolute security, and users should protect their devices and recovery information.

7. Retention periods
Personal data is processed no longer than required by the stated purposes unless a longer period is required by law or contract.

Uploaded templates, related nicknames and installation identifiers are kept until the user deletes the template, the function is discontinued or a lawful deletion request is fulfilled. A published template may remain after profile deletion only after information linking it to a particular user has been deleted or anonymized and only under the licence granted by the user. Associated active-system data is deleted or anonymized within 30 days. Backup copies may remain until the end of the rotation cycle, but no longer than 30 days, and are not used for unrelated purposes.

Voluntary error reports are kept for no more than 12 months. Server logs, including IP address, request time, requested resource and software information, are kept for no more than 30 days unless longer retention is necessary to investigate a security incident or comply with law.

Payment and accounting records are retained for periods required by Russian accounting, tax and payment legislation. Advertising and telemetry providers apply the periods stated in their documents.

When a purpose is achieved, consent is withdrawn or a lawful request is received, processing stops and data is deleted or destroyed within periods required by law, unless another legal ground permits or requires continued processing.

8. User rights and requests
The user may request information about processing; correction, blocking or deletion of inaccurate or unlawfully processed data; withdrawal of consent; termination of processing based solely on consent where applicable; and protection of their rights before the competent authority or a court.

Requests should be sent to support@roll-app.ru and include information sufficient to locate the data, such as nickname, available installation or device identifier, order/payment number, template identifier and relevant dates. Do not send passwords, full card data or excessive identity documents.

The Operator responds within 10 business days. This period may be extended once by no more than 5 business days when a justified notice explaining the reason is sent to the requester. After withdrawal of consent, data is deleted within 30 days unless another period or continued processing is required or permitted by law.

9. Children
Roll App is not intended for children and is not directed at a child audience. The application is intended for users who may independently use the service, accept its terms and provide the required consents under applicable law. If a user has not reached the age at which they may independently perform the relevant actions, functions involving data transfer, publication of materials, advertising or payments must be used by their legal representative or with that representative's consent.

10. Cookies, local storage and advertising on the website
The website uses necessary local storage to remember consent and interface settings. Yandex advertising code and advertising storage are loaded only after the visitor permits advertising. If the visitor selects necessary storage only, website advertising code is not loaded. The visitor may reopen cookie settings from the footer.

11. Changes and contacts
The current Policy is published at https://roll-app.ru/en/privacy-policy/. Material changes may require renewed acceptance in the application.

Personal data, deletion and consent withdrawal requests: support@roll-app.ru
General support: luckyanov.d@roll-app.ru
Website: https://roll-app.ru