Molecule Privacy Policy

Last updated: October 19, 2026

Who we are

Molecule is made by Rogue Rock Labs LLC, a company based in Houston, Texas, USA. This policy covers the Molecule app and the molecule-game.com and roguerocklabs.com websites.

Questions, requests, or complaints about your data: support@roguerocklabs.com, or by phone at +1 (346) 291-3704 (a company line with voicemail; we call back). The person in charge of the protection of personal information at Rogue Rock Labs is its founder — the company's highest authority, in the words of Québec's privacy law — and that address reaches them directly.

Molecule is sold in 28 countries of the Americas — the United States, Canada, Mexico, the countries of Central America and the Caribbean, and Colombia — and nowhere else. This policy is written in English; the same policy is available in French (for Québec) and in Spanish (for Mexico and Colombia), and the "Where you live" section below adds what your country's law asks for.

We do not sell your personal information.

What we collect and why

Single-player (campaign) play sends our servers nothing about you unless you've turned on Cloud & Online — then your game progress (see the table), so it comes back after a reinstall or on a new device. Two reads carry nothing about you at all: once a day the game fetches the events calendar, and opening the feedback form wakes our server. Match, error, connection and push data only exist when you play online or turn on invites, and feedback only when you send it. Two things reach other companies in single-player too: RevenueCat is contacted when the game starts, to check and restore your purchases — under a random ID of its own, or under your Game Center player ID once you've turned on Cloud & Online, so your purchases stay with your account; and the ads you choose to watch come from Google AdMob, as described below.

Molecule itself does not create a user account of its own — your identity in the game is your Game Center account.

None of this is sensitive data: no health, finances, beliefs, precise location or biometrics. We never ask your age ourselves, and we never ask for identity documents.

Where your data is kept

Our servers run on Microsoft Azure in the United States (Central US), and every company that handles data for us — Microsoft, RevenueCat, Google and Cloudflare — processes it in the United States and in its other locations. If you play from Canada, Mexico, Colombia or anywhere else outside the United States, the data in the table is therefore communicated to, and kept in, a country other than yours, whose laws differ from yours. Before choosing each of these companies we assessed what the data is, how sensitive it is (it isn't — see above), what each company does to protect it, and the law it works under, and each of them is bound to us by a written agreement; what they may do with the data is limited to what this policy says. Google is the one company that also collects data on its own account (the advertising data in the table), under its own policy.

Ads and tracking

We show rewarded video ads through Google AdMob (you choose to watch one in exchange for an in-game reward). Ads are non-personalized by default. The first time it matters, Apple's App Tracking Transparency prompt asks whether we may track you; only if you choose Allow do we ask AdMob for personalized ads instead. If you choose not to allow tracking — or don't answer — every ad you see stays non-personalized.

Non-personalized does not mean nothing is collected: with every ad, Google's ad software gathers the data listed in the table (approximate location from your IP address, which ads you saw and how you interacted with them, identifiers limited to this app or developer, diagnostics) to serve and measure ads and to prevent fraud. Only the advertising identifier — the one used to track you across other companies' apps — waits for your Allow.

In plain terms, for the laws that ask us to say it this way: Google's ad software is a technology that can locate you approximately (from your IP address, with every ad) and, once you allow tracking, profile you — build a picture of your interests to choose ads. The profiling function is off until you turn it on by choosing Allow in Apple's prompt, and you can turn it back off at any time in your device's Settings → Privacy & Security → Tracking.

Google's own privacy and ad policies cover what Google itself does with this data: https://policies.google.com/technologies/ads.

We don't respond to a browser's "Do Not Track" signal: on iPhone and iPad the choice is Apple's tracking setting above, and our websites use only Cloudflare Web Analytics, which is cookie-free and does not identify you.

Children

Molecule is rated 13+ and is not directed to children under 13. If we learn that we've collected personal information from a child under 13, we delete it. A parent or guardian who believes their child's information has been collected can write to support@roguerocklabs.com and we will remove it, as described under "Access, correction, or deletion" below.

In Québec, the personal information of a child under 14 may be collected only with a parent's or guardian's consent: if you're 13 and in Québec, ask a parent before turning on Cloud & Online or match invites, and a parent can have anything collected removed by writing to us.

Apple's age check. Where a law requires it — today, in Texas — the game asks Apple, each time it starts, which age range your Apple Account is in (Apple's Declared Age Range). We never ask your age ourselves, and anywhere else the game doesn't ask Apple either. The answer is used on your device for two things only: if Apple says you're under 13, the game shows a "13+" screen and goes no further — before it signs you in to Game Center, starts Google's ad software or RevenueCat, or sends anything about you to anyone; if Apple says you're 13 to 17, the game never offers you match invites, and turns them off if they were on. The answer is never saved, on your device or on our servers, and never sent to anyone: the game forgets it when it closes and asks again the next time.

If Apple Game Center marks an account as underage (the flag doesn't say the player's age), we store that flag alongside your device info and use it only to withhold invite notifications from that account — never for ads or anything else.

How long we keep data

• Server logs (Azure Log Analytics) are kept for 30 days, and the error and connection reports (Azure Application Insights) for 90 days; then they are deleted automatically.
• Game Center identity, display name, saved game progress, match/gameplay history, push and device info, and feedback submissions are kept until you ask us to delete them — our systems do not currently delete these automatically. The one exception is your push token, which is deleted when you turn invites off, apart from its copy in the change history below, which goes when that history does. We also keep a limited history of changes to these records (90 days for match results and saved progress, one year for everything else) for auditing and fraud-prevention; that history is deleted automatically once its window passes, or sooner, together with the records, when you ask us to delete them.
• Purchase records are kept by RevenueCat — under your Game Center player ID once Cloud & Online is on, under a random ID of its own otherwise — so your purchases can be restored, until you ask us to delete your data; Apple keeps its own record of every purchase. We keep no purchase records of our own.

Your choices and rights

• Ads: control personalized vs. non-personalized ads through Apple's App Tracking Transparency setting, as described above.
• Invites: turn match-invite push notifications on or off at any time in the game's settings. Turning them off stops invites at once — your phone drops its push registration — and deletes your push token from our records as soon as the game can reach our servers; a copy stays in the change history for up to a year (see "How long we keep data").
• Cloud & Online: the game asks the first time you're signed in to Game Center, and you can switch it any time in Settings → Privacy. While it's off, the game sends our servers nothing that identifies you — no saved progress, no online play, no Game Center player ID on feedback — and what we already keep stays until you delete it. Invites need it on, so turning it off turns them off too.
• Access, correction, or deletion: email support@roguerocklabs.com and tell us your Game Center player name and roughly when you last played (several players can share a name), and, if relevant, the email you used on the feedback form. We'll find the data tied to it, your saved progress included, and on request send you a copy, correct it, or delete it, within 30 days — sooner where your country's law sets a shorter time (see "Where you live") — and email you when it's done. All of this is free. Deleting removes your profile and its link to your Game Center account, your saved progress, your push and device info, your feedback, and the earlier versions of all of these in our change history; asks RevenueCat to delete its record of your purchases; and unlinks your match results and lobby statistics from you, by replacing your player ID and nickname on them with a random code that we don't keep, so they only count toward totals. What remains after a deletion: those unlinked statistics; copies in our automatic database backups until they're overwritten, within 7 days; our server logs until they're deleted, within 30 days; Apple's own record of your purchases; the emails about your request; and a record that the request was handled — when it was made and completed, how, and what was deleted, with a one-way code derived from your Game Center player ID in place of the ID itself, and no name or email address — which we keep for 24 months because privacy laws require a record of such requests. If the game is still installed and you open it while signed in to Game Center, it saves your progress with us again and RevenueCat restores your purchases from Apple — delete the game first if you want nothing to come back.
• Deleting from inside the game: Settings → Privacy → Delete my data, while you're signed in to Game Center. The request carries your Game Center player ID and, if you've sent us feedback from that phone, the email address you used there, so we find those notes too. Your progress on that phone is deleted at once, and the rest is deleted from our servers within 30 days, as described above; the game tells you when it's done. Your Game Center sign-in itself belongs to Apple, not to us.
• Withdrawing consent: everything you turned on, you can turn off — Cloud & Online, invites, tracking — and from then on we collect nothing under it; what was collected before stays until you delete it, as above.
• Complaints: write to us first, at support@roguerocklabs.com, and we'll answer. If you're not satisfied, the section for your country below names the authority you can turn to.

Where you live

The whole of this policy applies to you wherever you are. These sections add what the law of each country Molecule is sold in asks us to say.

Canada and Québec

Rogue Rock Labs is accountable for the personal information it holds, and has made one person accountable for it: the person in charge of the protection of personal information named under "Who we are", whom you reach at support@roguerocklabs.com.

Your consent is how everything in this policy starts: you turn on Cloud & Online, you turn on invites, you answer Apple's tracking prompt — and each of these you can withdraw the same way. What is collected, by what means, for what purpose and who it is shared with is in the table above; your rights of access and rectification are under "Your choices and rights", and we answer a request within 30 days. On request we'll also tell you exactly which personal information we hold about you, who within the company has access to it (one person — the founder), and how long it is kept (see "How long we keep data").

Your information is communicated outside Québec and outside Canada: it is kept in the United States, by us and by the companies named under "Where your data is kept", which also says how we assessed that before choosing them.

Google's ad software can locate you approximately and, only after you allow tracking, profile you for ads; "Ads and tracking" says how those functions are activated and turned off.

If you're under 14 and in Québec, a parent's or guardian's consent is needed before your personal information is collected (see "Children").

If you believe we haven't handled your personal information properly, write to us first. You can also complain to the Commission d'accès à l'information du Québec (https://www.cai.gouv.qc.ca) or to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca).

Mexico — Aviso de privacidad

The Spanish version of this policy is our aviso de privacidad integral under Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares; this section summarizes what that law asks a privacy notice to say.

• Who is responsible: Rogue Rock Labs LLC, 4106A Purdue St, Houston, Texas 77005-1040, United States — support@roguerocklabs.com, +1 (346) 291-3704.
• The data we process is listed in the table; none of it is sensitive.
• Purposes. The purposes necessary for the game — running online matches and leaderboards, saving your progress, honouring and restoring your purchases, answering your feedback, fixing errors, keeping the service running and free of abuse — need no separate consent. The purposes that need your consent, and start only when you give it, are: saving your progress with us (Cloud & Online), match invites, and personalized ads (Apple's tracking prompt). You give that consent by turning each one on, and withdraw it by turning it off.
• Limiting use or disclosure: the switches above, Apple's tracking setting, and deleting your data — see "Your choices and rights".
• Transfers. Microsoft, RevenueCat and Cloudflare process data on our behalf and under our instructions, for the purposes in the table, and for nothing else; Google collects the advertising data under its own privacy notice. We transfer your data to no one else, and we never sell it. These transfers are necessary to provide the game you asked for; by using the game with each of the settings above turned on, you accept them, and you can withdraw that acceptance at any time by turning the setting off.
• Your ARCO rights — access, rectification, cancellation and opposition — and the revocation of your consent: email support@roguerocklabs.com with your Game Center player name, roughly when you last played and, if you've used the feedback form, the email you used there (these are the only things that identify your data; we never ask for identity documents), an address or email to receive our answer, and what you ask for. We answer within 20 days of receiving your request and, where it proceeds, carry it out within the following 15 days; where the case requires it, each period may be extended once by the same length. Exercising these rights is free.
• Changes to this notice are made here, with the "Last updated" date at the top; a significant change is also called out in the app's update notes.
• Authority. If you're not satisfied with our answer, or get none, you can file a solicitud de protección de datos with the Secretaría Anticorrupción y Buen Gobierno within 15 days of our answer.

Colombia

This section, with the rest of the policy, is our política de tratamiento de datos personales under Ley 1581 de 2012 and its regulations.

• Who is responsible: Rogue Rock Labs LLC, 4106A Purdue St, Houston, Texas 77005-1040, United States — support@roguerocklabs.com, +1 (346) 291-3704. The person who attends requests, queries and claims is the founder, at that address and number.
• The data and its purposes are in the table; its processing begins with your authorization, which you give by turning on Cloud & Online, invites, or tracking, and by sending feedback.
• Your rights: to know, update and rectify your data; to ask for proof of the authorization you gave; to be told, on request, how your data has been used; to revoke your authorization and to have your data deleted (unless a legal duty keeps it); to access your data free of charge; and to complain to the Superintendencia de Industria y Comercio (https://www.sic.gov.co) for a breach of the law.
• How to exercise them: email support@roguerocklabs.com with your Game Center player name, roughly when you last played and, if you've used the feedback form, the email you used there, and what you ask for. We answer a query within 10 business days of receiving it, and a claim within 15 business days; if we need longer, we'll tell you why and when, and the extension is at most 5 and 8 business days respectively.
• Your data abroad: your data is kept in the United States, as "Where your data is kept" says. That transfer is necessary to provide the game you use, and you authorize it expressly by turning the settings above on.
• Children: Molecule is 13+; we process no data of children, and the "Children" section applies.
• Validity: this policy applies from its "Last updated" date; the data stays in our databases for as long as "How long we keep data" says, and the databases exist for as long as the game is operated.

United States

This policy applies as written. We don't sell your personal information, and we don't share it for cross-context behavioral advertising beyond what "Ads and tracking" describes, which happens only after you choose Allow in Apple's prompt. California: we don't respond to a browser's Do Not Track signal (see "Ads and tracking"). Texas: Apple's age check (see "Children").

Central America and the Caribbean

The rights under "Your choices and rights" are yours wherever you play. Where your country's law gives you more — Costa Rica, Panama, the Dominican Republic and others have data-protection laws of their own — write to us and we'll honour it.

Security

We encrypt data in transit (HTTPS/TLS) between the app, our website, and our servers. Our backend runs on Microsoft Azure (Central US, USA) using Azure SQL Database with Microsoft Entra sign-in (no stored database password) and secrets held in Azure Key Vault. The molecule-game.com and roguerocklabs.com websites are served through Cloudflare. We never store the IP address from a feedback submission — only a salted, one-day hash of it, as described above. No method of transmission or storage is perfectly secure, but we take reasonable steps to protect the data described in this policy.

Changes to this policy

We may update this policy as the game changes. We'll update the "Last updated" date above, and if a change is significant, we'll call it out in the app's update notes or on our website.

Contact

Rogue Rock Labs LLC — 4106A Purdue St, Houston, Texas 77005-1040, USA support@roguerocklabs.com · +1 (346) 291-3704