Privacy Policy
Short version: we collect as little as the game needs, we never sell or share your personal information, ads are non-personalised unless you turn them on, and you can export or erase everything yourself from inside the game or from this website.
1. Who is responsible
Apex City is developed and operated by Reallexi LLC ("we", "us"), postal address available on request from [email protected], whose website is https://reallexi.io. We are the data controller for the personal data described here, and the "business" for the purposes of the California Consumer Privacy Act.
- Privacy and data-protection enquiries: [email protected]
- General support: [email protected]
- Security reports: [email protected] (see security.txt)
- We have not appointed a separate EU representative; data-protection requests from the EEA and the UK are handled directly by our privacy team at [email protected].
We are not required to appoint a statutory Data Protection Officer. The named contact above performs that function in practice and is who you should write to.
Your acceptance of these documents
When you create an account we record that you accepted these Terms and this Privacy Policy: which documents, which published version of them, when, how the acceptance was collected (sign-up form, guest start, or a linked Google / Facebook / Apple account) and the IP address and browser that sent it. We keep that record for as long as the account exists because Article 7(1) of the GDPR requires us to be able to demonstrate it; it is included in your data export, so you can always see exactly what we hold about it.
2. What this policy covers
The Apex City web game at https://sim-apex.com, the Android app, the iOS app and the accounts, purchases and support that go with them. It does not cover third-party sites we link to, or the separate privacy policies of the stores you buy through.
3. What we collect, why, and for how long
| Data | Why we have it | Lawful basis | Retention |
|---|---|---|---|
| Email address (optional - guest accounts have none) | Sign in, receipts, account recovery | Contract | Life of the account |
| Password, stored only as a bcrypt hash | Sign in | Contract | Life of the account |
| Display name, city name, avatar | Shown to you and, if you play socially, to other players | Contract | Life of the account |
| Google, Apple or Facebook account identifier when you use that sign-in | Signing in across devices without another password | Contract | Life of the link; deleted when you unlink |
| Age band (a range - never your date of birth) | Protections for minors, ad and purchase gating | Legal obligation | Life of the account |
| IP address and app/browser version at sign-in | Rate limiting, fraud and cheat prevention | Legitimate interest | 30 days |
| Purchase records (amount, currency, store order id) | Delivering what you bought, refunds, tax and accounting | Contract; legal obligation | 7 years, pseudonymised once the account is deleted |
| Chat messages you send | Playing together; moderation | Contract; legitimate interest | 90 days, or until you delete your account |
| Gameplay events (buildings placed, levels reached, quests finished) | Balancing the game; first-party analytics | Legitimate interest | 13 months raw, then anonymous totals |
| Push notification token | Sending only the notifications you opted into | Consent | Until you turn them off, or 60 days unused |
| Advertising identifier, if you watch a rewarded ad | Serving and capping ads, fraud prevention | Legitimate interest (non-personalised); consent (personalised) | Held by Google AdMob under its own policy |
| Support emails | Helping you | Legitimate interest | 2 years |
We do not collect precise location, contacts, microphone or camera data, phone numbers, or payment card details. Our analytics events never contain free text, names or email addresses. We do not build advertising profiles and we run no third-party tracking scripts on our website.
4. What we use it for
- Running the game: saving your city, matching you with friends, delivering purchases.
- Keeping it fair: anti-cheat, rate limits, fraud and chargeback abuse detection, chat moderation.
- Improving it: aggregate, first-party analytics about which features are used and where players get stuck.
- Talking to you: receipts, service notices, and - only if you opted in - push notifications.
- Meeting our obligations: tax records, responding to lawful requests, enforcing our Terms.
We do not make decisions about you by automated means that produce legal or similarly significant effects. Automated anti-cheat may restrict a feature; a human reviews any account termination, and you can appeal to [email protected].
5. Who else sees your data
We never sell personal information and we do not share it for cross-context behavioural advertising. We use the following processors, each under a written data-processing agreement:
| Third party | What it does for us | What it receives | Where |
|---|---|---|---|
| Cloudflare, Inc. | Network edge, DNS, TLS, bot and DDoS protection for https://sim-apex.com and our API | IP address, request metadata | Global edge |
| Stripe, Inc. | Payments and subscriptions on the web | Email, purchase amount, payment details (we never see the card) | US / EU |
| Google LLC - Google Play Billing | Purchases inside the Android app | Play order id, purchase token | US / EU |
| Google LLC - Sign-In and Play Games | Optional sign-in and cross-device save | Google account id, email, display name | US / EU |
| Google LLC - AdMob | Optional rewarded video ads | Device advertising identifier, ad interaction (non-personalised by default) | US / EU |
| Meta Platforms, Inc. - Facebook Login | Optional sign-in and friend discovery | App-scoped Facebook user id, name, email if you allow it | US / EU |
| Apple Inc. | App Store payments and Sign in with Apple | App Store transaction id, Apple user identifier | US / EU |
| Expo (650 Industries, Inc.) with APNs and FCM | Delivering the push notifications you opted into | Push token, notification text | US |
| Resend / our SMTP provider | Receipts, data exports and sign-in links by email | Email address, message content | EU / US |
| Our hosting provider (EU data centre) | Running the game servers and database | Everything in section 3, at rest | European Union |
We also disclose data when the law requires it, to establish or defend legal claims, and to a buyer if the game is ever sold - in which case you would be told before your data moved.
6. International transfers
Our servers and database are in the European Union. Reallexi LLC is established in the United States, and the processors above may process data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework where the recipient is certified, and the UK Addendum for UK data. Ask [email protected] for a copy of the safeguards.
7. Advertising
Apex City shows only rewarded ads that you choose to watch, through Google AdMob. Ads are non-personalised by default. You may opt in to personalised ads, and opt out again at any time, in Settings → Privacy. Players whose age band is under 16 never see personalised ads and are always served in Google's child-directed treatment. There are no interstitials, no banners and no ads you cannot dismiss.
8. Your rights
Wherever you live, you can:
- Access and port: Settings → Account → Export, or
GET /api/account/exportwith your session. You get a JSON file containing your account, city, wallet and ledger, purchases, entitlements, friends, chat and settings. - Erase: Settings → Account → Delete, or the web deletion page, which works even after you uninstall the app. Deletion is immediate and irreversible.
- Correct your display name and city name in the game; anything else, write to [email protected].
- Object or restrict: tell us at [email protected] and we will stop the processing we rely on legitimate interest for, unless we must keep it for fraud or accounting.
- Withdraw consent for push notifications and personalised ads in Settings, at any time, without losing access to the game.
- Complain to your supervisory authority (in the EEA, the one where you live or work; in the UK, the ICO). We would rather you told us first.
We answer within 30 days and never charge for a request. We verify a request through the account itself: exporting and deleting require a valid session, which is why the buttons live inside the game.
9. California residents (CCPA / CPRA)
In the last 12 months we collected the categories of personal information described in section 3: identifiers, commercial information (purchases), internet activity (gameplay events), and inferences we do not draw. We collected them from you, from your device, and from the sign-in provider you chose, for the business purposes in section 4, and we disclosed them for business purposes only to the processors in section 5.
- We do not sell personal information and do not share it for cross-context behavioural advertising, including of anyone under 16. Turning off personalised ads in Settings is also your "Do Not Sell or Share" choice.
- We do not use or disclose sensitive personal information for any purpose that would require a right to limit.
- You may request to know, delete or correct your information using the in-game Export and Delete flows, or by writing to [email protected]. An authorised agent may act for you with written permission.
- We will never discriminate against you for exercising a privacy right.
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana have equivalent rights of access, correction, deletion, portability and opt-out, and may appeal a refused request by replying to our decision email.
10. Children
Apex City is not directed to children under 13, and we do not knowingly collect personal information from them. Accounts whose age band is under 13 run in limited mode. The full statement, and how a parent can review or delete a child's data, is on the children's privacy page.
11. Security
Traffic is encrypted with TLS end to end. Passwords are hashed with bcrypt and never logged. Sessions are random bearer tokens that expire and can be revoked. Purchases are verified server-side with the store before anything is granted. Administrative access to production data is restricted, protected by a second factor, and written to an audit log. We keep encrypted daily backups for 30 days. If a breach ever affects you we will tell you and the relevant authority without undue delay.
12. Cookies and local storage
We use no tracking cookies and no advertising cookies on our website, which is why you see no cookie banner. The web game stores your session token and settings in your browser's local storage. Details, including the cookies Stripe, Google and Facebook set when you use their sign-in or checkout, are on the cookies page.
13. Changes
When this policy changes materially we will ask you to review it the next time you sign in, and will update the effective date at the top. Previous versions are available from [email protected].
14. Contact
Reallexi LLC, postal address available on request from [email protected]. Privacy: [email protected]. Support: [email protected].