Privacy

Version 4 · Last updated: 20 October 2026

This page tells you what Rexlings knows about you, why, and how to ask about it. It covers this website (rexlings.com) and the game, wherever you open it: in the browser (play.rexlings.com), on Telegram or in the apps. The rules of the game and of purchases are in the Terms.

1. Who is responsible

The data controller is Lorenzo Nannicini · VAT no. IT02583190463 · Via Tacca 4, 59100 Prato (PO), Italy · certified email (PEC) lorenzo.nannicini@legalmail.it. For anything about your data, write to privacy@rexlings.com.

2. This website

• No cookies, no analytics, no ads, no social buttons. We even serve the fonts ourselves: the page does not call Google or anyone else.
• If you use the IT/EN button, your browser remembers the language you picked (an rx.lingua entry in the browser's local storage). It never reaches us: it stays on your device and you can delete it whenever you like.
• Our server keeps no log of visits to this website.
• Cloudflare sits between you and our server to deliver and protect the pages, and processes your IP address to do so.

3. The game: what we store

So that you can get back to your farm, our server stores:

• Your account: your name, your friend code, when you created it and when you last came in.
• Your year of birth, which you tell us the first time you play, and nothing else (no day or month): it only tells us whether you are at least 14. Under 14, purchases are off, your farm has no public name and the ad messenger doesn't come: under 14, consent to online services is given by a parent (Art. 2-quinquies of the Italian Privacy Code), so we don't ask you for any. Until you tell us the year, purchases with real money and rewarded ads stay off as they do under 14. We delete it together with the account.
• How you sign in. From Telegram: your Telegram ID, your name (first and last name, or username) and your language, as Telegram passes them to us. With Apple or Google: your account ID and your name, if Apple or Google send it. As a guest: a random ID created by the game, plus the name you pick.
• Sessions, so you don't have to sign in every time: we keep only a fingerprint (hash) of the session code, not the code itself, plus where you play from (browser, Telegram, app) and the dates.
• Your game: the farm, harvests, dinosaurs, eggs, collection, friends, the notice board (for example who watered your ferns) and the game language.
• Purchases with real money. For each one we keep what you bought, how many gems it gave you, its status (open, paid, refunded…), the dates, the version of the Terms you had accepted, when you gave your consent to immediate delivery and the language. We never see your card details. The rest depends on how you paid (Terms § 6):
  • Stars, on Telegram. We are the seller; Telegram takes the payment. We also keep the Stars paid, the payment ID Telegram gives us, your Telegram ID (needed to refund your Stars), when the receipt was sent and delivered in the chat and, if we gave them back, the date of the refund.
  • Card, on the web. We are the seller; Stripe processes the payment on our behalf, on its own page. We also keep the amount in euros and the currency, the Stripe session and payment IDs, the e-mail address and country you gave Stripe (for the purchase and withdrawal confirmations we send you by e-mail, VAT rules and refunds), how much we refunded, whether the payment was disputed, when the receipt was sent and when the e-mail confirmation was sent.
  • App Store or Google Play, in the apps. Apple or Google take the payment; they sell under their own terms and are the controllers of it. We give them only a random code created for that purchase, which ties the payment to your farm. From them we keep the transaction ID (for Google a fingerprint of the purchase token, plus the order number), the price, the currency, the store's country, whether it was a test purchase, any refunds and, only until Google has closed the purchase, Google's purchase token.
• Your choices about purchases: the version of the Terms you accepted and when; your consent to immediate delivery and your acknowledgement that you lose the right of withdrawal, if you gave them (two boxes, one date); withdrawals, with date and time; your yes or no to contract messages in the bot chat (§ 9), every time you give or change it, with date and time; which receipts and confirmations the bot has already sent you, so it doesn't send them twice. Until 11/10/2026 the game had a "once for all" switch for small purchases with gems: if you used it, we keep when you turned it on or off, as proof of that consent.
• Help requests: if you write to /paysupport, your Telegram ID, what you write and the date.
• Codes to link or recover your farm: they last 10 minutes and work once. The Telegram bot sends you a recovery code only when you ask for one.

We do not store your email address, your phone number, your location or your contacts, unless you write them to us yourself in a help request or an email. The only exception is the e-mail you give Stripe when you pay by card on the web (above): we only use it to write to you about purchases (the purchase and withdrawal confirmations, refunds), never for anything else.

4. What other players see

Anyone who visits your farm, your neighbours and anyone who gets your invite see the farm, your friend code and your name. Your name is the one Telegram (first and last name, or username), Apple or Google gives us, or the one you pick if you play as a guest. If you give your farm a name of its own, others see that too, but your name stays visible: on the farm, in the neighbours list and on the invite page, which anyone with the link or your friend code can open. Nobody sees your Telegram, Apple or Google IDs.

All players can see the level leaderboard: rank, level, experience points and farm name. Your Telegram, Apple or Google name never shows up there: if you have never named your farm, you appear as «Farm no.» followed by a number that doesn't lead back to you: we compute it with a secret key that only our server holds, so nobody can work it out from your Telegram ID. You can leave the leaderboard at any time in the game settings («Show me on the leaderboard»): others no longer see you, and you can still see your own rank.

From the leaderboard you can report a farm's name (⚑). For each report we store who reported it, which farm was reported, the name that was showing and when, and we also write it in the technical logs: we need it to decide whether that name has to change. The reported player doesn't learn who reported them. Reports are deleted with the account of whoever made them or received them.

You can block another player (🚫, from the leaderboard or from their farm). For each block we store who blocks, who is blocked and when: we need it so that the blocked player no longer shows up in your leaderboard and can't visit or water your farm. The blocked player isn't told, and doesn't learn who blocked them. You can lift a block whenever you want (Settings → «Blocked users» → Unblock), and blocks are also deleted with the account of whoever blocked or was blocked.

Signing in with Apple or Google. If you choose «Sign in with Apple» or «Sign in with Google», Apple or Google confirm who you are with a signed message. From that message we keep only your account identifier with them and, if they send it, your name, which becomes your farm's first name (it goes through the same name filter). Your email address, even if it arrives, is not stored. With Apple we also keep a code Apple gives us so the access can be closed: when you delete your account we use it to ask Apple to revoke the game's access to your Apple ID, and then we delete it. If Apple doesn't answer at that moment, your account is deleted anyway. You can also remove Rexlings' access at any time from your Apple ID or Google account settings.

5. IP address and technical logs

The game server uses your IP address only in memory, to slow down anyone sending too many requests: it never goes into the database. The web server and the game program keep a technical log of requests (IP address, page requested and time) for security and to track down faults, and delete it after 30 days.

6. On your device

The game uses no cookies of its own. In the browser's local storage it keeps: your guest ID and name, if you play as a guest; a session code, if you sign in with Apple or Google (it goes away when you delete your account and stops working after 180 days without playing); your music and sound effect settings; a few screen preferences, such as tips you have already seen. If you play as a guest and clear your browser data, you lose the key to your farm: to keep it, link it to Telegram from the Friends sheet, "Link" row.

The game also loads Telegram's mini app script from telegram.org, which it needs in order to run inside Telegram: this means Telegram receives that request, with your IP address, even when you play in the browser.

The Apple and Google buttons only appear when you play in the browser on play.rexlings.com. If signing in with Google is turned on, Google's script, from accounts.google.com, loads only when you tap "Sign in with Google" or "Continue with Google", never before: from then on Google receives the request, with your IP address, and can read its own cookies if you are already signed in to a Google account in that browser. Apple's script, from appleid.cdn-apple.com, loads only when you tap "Sign in with Apple" or "Link Apple". In the Telegram mini app neither of them loads, and in the iPhone app Google's never does.

7. Advertising

Only if you choose it. Now and then a messenger visits your farm and asks whether you want to watch a short video ad in exchange for 5 gems, at most twice a day. If you say "No thanks" nothing happens and the game stays the same. No ad ever starts on its own, at launch or between screens. Under 14 the messenger doesn't come, neither in the browser nor in the apps, and we don't ask you for any consent; the same applies until you tell us your year of birth.

Who provides it. The ad network is Google: in the iPhone and Android apps through AdMob, in the browser through Google (AdSense, H5 Games Ads programme). In the browser, until Google approves the game, ads stay switched off, and the "In the browser" paragraph below describes how they will work once they are on. For the data it collects through ads, Google is an independent controller (for Europe, Google Ireland Limited, Dublin), with its own privacy policy: policies.google.com/privacy and policies.google.com/technologies/partner-sites.

No profiling. We ask Google for non-personalised ads only (in the apps also rated PG, suitable for most audiences): ads chosen by context (the game, the language, the approximate area), never by your interests or what you do elsewhere. On iPhone the app doesn't ask for Apple's tracking permission, so Google doesn't receive the iPhone's advertising identifier (IDFA). The game has no analytics or tracking tools of its own.

In the browser. Google's script, from pagead2.googlesyndication.com, loads only when you tap "Yes, watch", never before. From then on your browser talks directly to Google, which receives your IP address, your device and browser type and the game page; even with non-personalised ads Google may use cookies or identifiers to limit how often you see the same ad, to count views and to fight fraud. In the European Union, the United Kingdom and Switzerland, Google shows you its consent message before the first video. We do not give Google your name, your account, your farm code or anything else about you. From Google we receive only the outcome ("video watched to the end"): with that, and with a ticket signed by our server, we credit your gems.

In the apps: AdMob. Google's ads software (Google Mobile Ads, with Google's consent module) is inside the app. The app only contacts it at two moments: when you tap "Yes, watch" (first consent, then the video) and when you open Settings, to know whether to show you the consent option (below). On Android part of Google's software already starts when the app opens. At those moments your phone talks directly to Google, which receives your IP address (from which it estimates your area), your device and system type, a device identifier (on Android the advertising ID, which you can reset or delete in Android's settings, and an identifier shared by apps from the same developer; on iPhone an identifier tied to the app or to the developer, not the IDFA), how you interact with the ad (for example whether you watch the video to the end) and technical data about errors and performance. It uses them to show and count ads, to avoid showing you the same one too often, against fraud and for its own ad analytics.

Consent in the apps (European Union, United Kingdom, Switzerland). Every time you tap "Yes, watch", before the video, the app asks Google whether your consent is needed and, if it is (usually the first time), Google shows you its message with three choices: "Consent", "Do not consent" and "Manage options". If you consent, Google may store and read information on your device to show and measure the ad. If you don't, the video may still play as a "limited" ad: Google doesn't use your data to personalise the ad, and on your device it only uses what it needs against fraud. Google's module saves your choice on the phone. You can change it whenever you like: Settings → Privacy / ad consent (the option is there where Google asks for consent, and not under 14).

What we pass on in the apps. For each video our server tells the app to ask for non-personalised ads rated PG, and gives it two codes that the app passes to Google: the number of that video's ticket and your account's internal code. Usually that is a random code created with the account; only for a few farms created in the very first days on Telegram is it your Telegram ID. When the video ends, Google sends the two codes back to us in a signed confirmation, so we know who gets the gems. Nothing else about you goes from us to Google: not your name, not your friend code, not your other sign-in details. We keep Google's confirmation number for 90 days, so we don't pay out twice for the same video, and then we delete it with the next confirmation that arrives: if you delete your account it stays until then, but it no longer leads to you.

What we keep. For each video, in the browser and in the apps, we keep the day, the time and the gems given, to enforce the daily limit.

8. Why we process this data

To give you the game you asked for and what you buy (performance of a contract, Art. 6(1)(b) GDPR). The law requires us to confirm purchases and withdrawals on a durable medium (legal obligation, Art. 6(1)(c) GDPR, and Arts. 51 and 54-bis of the Italian Consumer Code). Technical logs and request limits keep the service secure (legitimate interest, Art. 6(1)(f) GDPR). We keep the accounting records of purchases because the law requires it (legal obligation, Art. 6(1)(c) GDPR, and Art. 2220 of the Italian Civil Code); consents, withdrawals and help requests we keep so that we can show what happened if a dispute arises (legitimate interest in defending legal claims, Art. 6(1)(f) GDPR), for the time in § 10. Contract messages in the Telegram bot chat are only sent with your explicit consent (Art. 49(1)(a) GDPR, § 9).

9. Who else processes it

• Hetzner (Hetzner Online GmbH, Germany): the server the game runs on, in a data centre in the European Union.
• Cloudflare: delivers and protects traffic to the website and the game.
• Zoho (Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands): our mailbox. If you write to ciao@rexlings.com or privacy@rexlings.com, including the withdrawal form, your message (address, name, text and attachments) is kept there; the e-mail confirmations for card purchases are also sent from there. Zoho processes it on our behalf, in its European Union data centres (Amsterdam and Dublin). The data processing agreement (Art. 28 GDPR) was requested from Zoho on 30 September 2026 and not signed yet: once it is, you will find the date here.
• Forward Email and Google: until the evening of 29 September 2026, mail for @rexlings.com addresses went through Forward Email, which forwarded it to the data controller's Gmail inbox (Google). We are moving those e-mails to the Zoho mailbox and deleting them from Gmail (see point 10).
• Google: if you sign in with your Google account, it confirms who you are; if you choose to watch a video ad, it acts as an independent controller (AdMob in the apps, AdSense in the browser) and is the ad network (§ 7).
• Telegram: if you play there, it passes us your sign-in details and handles payments in Stars, under its own privacy rules. If you say yes (below), in the Rexlings bot chat the game sends you receipts, confirmations of your consents, withdrawal notices and the Terms document: those messages also stay on Telegram's servers.
• Apple: if you sign in with your Apple account, it confirms who you are.
• Stripe (Stripe Payments Europe, Limited, Dublin, Ireland): if you pay by card on the web, it processes the payment on our behalf (Art. 28 GDPR, under the data processing agreement that is part of its services agreement): it collects your card, e-mail address, country and what it needs against fraud on its own page. From us it receives only the sale number, the product, the price and the page language and, if you withdraw, the refund request for that payment. For fraud prevention and its own legal duties Stripe is an independent controller, with its own privacy policy.
• Apple (Apple Distribution International Ltd, Cork, Ireland) and Google (Google Commerce Limited, Dublin, Ireland): if you buy in the apps, they sell under their own terms and are independent controllers of the payment data. From us they receive only the purchase's random code; from them we get the transaction and refund information in § 3.

We do not sell or hand over your data to anyone.

Outside the European Union. Cloudflare and Google are United States companies and the data they process may pass through servers in the United States. They take part in the EU-US Data Privacy Framework (list kept by the US Department of Commerce, checked on 29 September 2026): the transfer rests on the European Commission adequacy decision (EU) 2023/1795 (Art. 45 GDPR).

Zoho keeps the mailbox in its European Union data centres and the data does not leave them. On rare occasions Zoho staff in India (Zoho Corporation Private Limited) may access it to give us technical support: India has no adequacy decision, and the basis is the European Commission standard contractual clauses between Zoho's companies in the Netherlands and in India (Art. 46 GDPR).

Telegram Messenger Inc. is based outside the EEA and is an independent controller of the data it processes: it does not work on our behalf. According to its privacy policy, the data of people who signed up from the EEA is stored in data centres in the Netherlands, and Telegram may share it with its group companies in the British Virgin Islands and Dubai under standard contractual clauses. For the countries it takes data to there is no European Commission adequacy decision. That is why we send you contract messages (receipts, withdrawal confirmations, the Terms document) in the bot chat only if you say yes: we ask you on a separate sheet, before your first purchase in Stars, that explains this risk (explicit consent, Art. 49(1)(a) GDPR). You can say no, and you can change your mind at any time in Settings → Receipts and confirmations in the bot chat: from then on we send you no more. If you say no, you find them all in Shop → My purchases, to copy and keep (and, if you pay by card, by e-mail). Messages you ask for yourself, once (the reply to /paysupport, the /recupera code), are sent because you asked for them in that chat (Art. 49(1)(b) GDPR).

Forward Email is a United States company: mail that arrived until the evening of 29 September 2026 went through its servers before reaching Gmail.

Stripe processes payments through its company in Ireland, but the data may pass to Stripe, Inc. in the United States: Stripe takes part in the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795, Art. 45 GDPR) and otherwise uses the European Commission standard contractual clauses (Art. 46 GDPR). Apple and Google sell in the apps through their companies in Ireland; transfers to their companies in the United States they make as controllers, on the bases set out in their privacy policies: for Apple the standard contractual clauses, for Google the EU-US Data Privacy Framework and, where that is not enough, the standard contractual clauses. From us to them goes only the purchase's random code.

10. How long we keep it

Account and game data stay as long as the account exists. You can delete it whenever you like in the game (Settings → Delete account) or by writing to privacy@rexlings.com: if you write, we ask you to confirm from the game, so we know the farm is yours.

When you delete it, we immediately remove the account, the farm and everything in it, your sign-ins, sessions and friends. What stays, cut off from your account and tied only to a pseudonym (a random code created at deletion that does not lead back to your account), is the data the law requires us to keep or that a refund needs:

• purchases with real money, with the data in § 3 for each of the three ways to pay: Stars, card (including the e-mail address and country given to Stripe) and the apps;
• the version of the Terms you had accepted, your consents and withdrawals;
• help requests (/paysupport), only if you made purchases with real money: what you wrote and your Telegram ID. If you never bought anything, they are deleted with the account;
• your Telegram ID on purchases paid in Stars: without it, Telegram does not let us refund your Stars.

We don't keep all of it for the same time:

• the accounting records of each purchase (what, the price or amount and currency, the date, the payment IDs, the country and any refunds, with the date of a withdrawal) for ten years, as Art. 2220 of the Italian Civil Code requires for accounting records and sales records: the right to erasure does not apply to what the law requires us to keep (Art. 17(3)(b) GDPR);
• everything else (the e-mail address given to Stripe, your Telegram ID on purchases in Stars, the version of the Terms you accepted, consents, withdrawals and help requests) for 26 months from the purchase or, if later, from the last message about it: the legal guarantee covers faults for 2 years (Terms § 9) and we keep two more months for a dispute that arrives at the end, so we can show what happened (Art. 17(3)(e) GDPR). Then we delete it, every month, together with the e-mails below.

Link codes expire after 10 minutes; technical logs are deleted automatically after 30 days.

E-mails you send us stay in the Zoho mailbox as long as we need to answer you and then at most 24 months from the last message: every month we delete those that have gone past it. Those about a purchase, a withdrawal or a refund (including the withdrawal form) and the confirmations we send you by e-mail we keep for 26 months, like consents and withdrawals (above). E-mails that reached the Gmail inbox until the evening of 29 September 2026 we are moving to the Zoho mailbox and deleting from Gmail by 31 October 2026. Forward Email did not keep the e-mails it forwarded: it kept only delivery error logs (headers, no body or attachments) for 7 days.

11. Your rights

You can exercise your rights of access, rectification, erasure, restriction, objection and portability (Arts. 15-22 GDPR) at any time by writing to privacy@rexlings.com. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority where you live.