Privacy Policy
Last Updated 24 October 2026
1. Introduction and who we are
This Privacy Policy explains what personal data we collect when you use Case Rush (the “App”), why we collect it, who we share it with, and the choices and rights you have. It applies to the App on iOS and Android. Effective date: October 24, 2026.
The party responsible for your personal data (the “controller”) is:
| Item | Details |
|---|---|
| Operator | Case Rush, Denmark |
| Contact email | hello@case-rush.com |
By using the App you confirm that you have read this policy. Where the law requires your consent (see Section 5), we only process your data for those purposes after you give it, and you can withdraw it at any time.
2. What the App is, and what it is not
Case Rush is an entertainment app that simulates opening virtual cases. Nothing in the App has real-world monetary value.
- There is no deposit, withdrawal, trading, cash-out or real-money purchase of virtual items, and we never ask for payment card or bank details to play.
- Virtual items, currency and results in the App cannot be exchanged for money, goods or items in any other game or platform.
- The App is an independent product. It is not affiliated with, endorsed by, sponsored by or connected to Valve Corporation, Counter-Strike 2 (CS2) or Steam. Counter-Strike, CS2 and Steam are trademarks of their respective owners, and any such names are used only to describe what the App simulates.
- The App does not connect to your Steam account and does not collect Steam credentials or inventory data.
3. Information we collect
We collect only what we need to run the App, keep your progress, and (with your consent where required) show personalised ads. We do not ask for your name, address, phone number or payment details.
| Category | Examples | Why we collect it |
|---|---|---|
| Game and save data | Virtual inventory, opened cases, in-app currency, stats, achievements, settings, progress timestamps | To keep your saves, restore them on reinstall or another device, and run the App |
| Account or save identifier | A randomly generated user ID linked to your save | To link a save to you and let you recover it |
| Device and technical data | Device model, operating system and version, app version, language, time zone, crash logs, performance data, IP address | To make the App work, fix bugs, secure it and detect abuse |
| Advertising identifiers | Advertising ID (Apple IDFA / Google Advertising ID), identifiers issued by our ad partners | To serve and measure ads, and to personalise them if you consent |
| Ad and usage activity | Ads shown, viewed or clicked, approximate location derived from IP (country/region), in-app events such as sessions and levels reached | To measure ad performance, limit how often you see an ad, and personalise ads where you consent |
| Consent records | Your consent choices, the time and the version of the consent notice | To prove and honour your choices |
| Messages you send us | Email address and the content of your message when you contact support | To reply to you |
We do not knowingly collect sensitive personal data (such as health, biometric or precise location data). Please do not send it to us.
We receive this data directly from you, automatically from your device when you use the App, and from our advertising and analytics partners listed in Section 7.
4. How we use your data and our legal bases
We are based in Denmark, so we process personal data under the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act. Storing or reading information on your device (for example advertising IDs or SDK identifiers) also follows the ePrivacy rules as implemented in Denmark.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Provide the App and keep your saves | Game and save data, save identifier, basic device data | Performance of a contract, Art. 6(1)(b) (you asked for the service) |
| Security, fraud and abuse prevention, bug fixing, stability | Device and technical data, IP address, crash logs | Legitimate interests, Art. 6(1)(f): keeping the App working and secure |
| Show ads that are not personalised (contextual ads, frequency capping, measurement) | Device data, ad activity, coarse location | Legitimate interests, Art. 6(1)(f), or your consent where the law requires it for device access |
| Personalised ads and related profiling and measurement | Advertising ID, ad and usage activity, ad-partner identifiers | Consent, Art. 6(1)(a), and consent under the ePrivacy rules for device access |
| Support requests | Email address, your message | Legitimate interests, Art. 6(1)(f), or performance of a contract |
| Keeping records of consent and complying with law | Consent records, relevant technical data | Legal obligation, Art. 6(1)(c), and legitimate interests |
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Ad personalisation only affects which ads you see.
5. Consent and how to change it
When you first open the App, and where required by law (in particular in the EEA, the UK and Switzerland), we show a consent notice before any advertising identifier is read or any personalised-ad SDK starts. We use a consent management platform to record your choices.
- Consent is optional. You can use the App if you decline personalised ads; you will then see non-personalised ads, which are less relevant to you.
- Declining is as easy as accepting. Each purpose can be accepted or declined separately.
- You can change or withdraw your consent at any time in the App’s privacy settings. Withdrawal does not affect processing done before it.
- On iOS, we ask for permission through Apple’s App Tracking Transparency prompt before tracking you across other companies’ apps and websites. On Android, you can also reset or delete your advertising ID in the system settings.
- In regions where the law does not require prior consent, we may show ads based on legitimate interests or provide an opt-out instead. You can still limit personalised ads in the App settings and in your device settings.
We keep a record of your choice, its date and the notice version. If we make material changes to purposes or partners, we ask for your consent again.
6. Advertising and personalised ads
Case Rush is free to play and is supported by advertising. With your consent, our advertising partners use your advertising ID, device data and your activity in the App (for example which ads you view or interact with, and your general interests inferred from play patterns) to choose ads and measure how well they work. Partners may combine this with data they hold from other apps, which can build a profile of your interests.
- No consent: you still see ads, but they are not based on your advertising ID or profile. We may still use basic device data, coarse location and frequency capping to deliver and measure them.
- Rewarded ads, if offered, are always optional and give only virtual in-app rewards.
- We show ads through Google AdMob. For ad serving, personalisation and measurement, Google generally acts as an independent controller, and its own privacy policy explains how it uses data. You can read how Google uses data from apps that use its services at https://policies.google.com/technologies/partner-sites.
- We do not sell your personal data for money. Where US state laws define sharing for cross-context behavioural advertising as a “sale” or “share”, you can opt out (see Section 10).
- We do not use sensitive data for advertising, and we do not target ads at users we know to be under the age set in Section 11.
To limit ad personalisation outside the App: iOS Settings > Privacy & Security > Tracking (or Apple Advertising); Android Settings > Privacy > Ads (delete or reset the advertising ID); and the industry opt-out pages youronlinechoices.com and optout.aboutads.info.
7. Who we share data with
We share personal data only as needed for the purposes above. We never sell it for money.
| Recipient | What they do | Data involved |
|---|---|---|
| Hosting and cloud-save providers | Store saves and run the App as our processors | Save data, identifier, technical data |
| Google AdMob (advertising network) | Serve, personalise and measure ads | Advertising ID, device data, ad activity, IP address |
| Consent management provider | Show the consent notice and store your choices | Consent records, device identifiers |
| Email and support tools | Handle your support messages | Email address, message |
| Authorities, advisers and courts | When required by law, to protect rights or in a legal dispute | Only what is necessary |
| A buyer or successor | If we merge, are acquired or sell the App, subject to this policy | Data held by us |
Processors act only on our instructions under data processing agreements. A current list of advertising and analytics partners, with links to their privacy policies, is available on request at hello@case-rush.com.
8. International transfers
Some of our providers, especially advertising and analytics partners, are located outside the EU/EEA, for example in the United States. When we or our partners transfer personal data out of the EEA, we rely on a valid safeguard: an adequacy decision (including the EU–US Data Privacy Framework for certified US companies), or the European Commission’s Standard Contractual Clauses with additional measures where needed. You can request a copy of the relevant safeguards at hello@case-rush.com.
9. How long we keep data
We keep personal data only as long as needed for the purposes above.
| Data | Retention |
|---|---|
| Save and game data | While your save is active, and for a limited period after your last activity, then deleted or anonymised |
| Advertising and analytics data | For as long as your consent applies and within the partner’s retention limits, unless you withdraw consent earlier |
| Crash logs and security logs | Only as long as needed to fix problems and keep the App secure, then deleted |
| Consent records | For as long as needed to prove your choice |
| Support emails | Only as long as needed to handle your request and any follow-up |
You can ask us to delete your save and data earlier (see Section 10). Where law requires us to keep something longer, for example accounting or legal-claim limitation periods, we keep it only for that purpose.
10. Your rights
If you are in the EEA, the UK or Switzerland, you have the right to:
- access your personal data and get a copy;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”);
- restrict processing;
- receive your data in a portable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting earlier processing.
To use any right, email hello@case-rush.com. We reply within one month, and may ask you to confirm your identity (for example by showing the save identifier). We may need more time for complex requests and will tell you why. Using your rights is free unless a request is clearly unfounded or excessive.
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk, or to your local supervisory authority. We would appreciate the chance to resolve your concern first.
If you live in a US state with a privacy law (such as California, Colorado, Connecticut, Texas or Virginia), you may also have the right to know and access, correct, delete, receive a copy, and opt out of targeted advertising or the “sale” or “sharing” of personal data. We do not sell personal data for money. You can opt out through the in-app consent settings or by email, and we will not discriminate against you for using your rights. We honour recognised opt-out preference signals where required.
Elsewhere (for example Brazil, Canada, Australia, Japan, South Korea), you have the rights your local law gives you, and we will handle your request under that law.
11. Children
Case Rush is not intended for children under 13, and we do not knowingly collect personal data from them. We do not show personalised ads to users we know to be under 18. If you believe a child under 13 has given us personal data, email hello@case-rush.com and we will delete it. Parents or guardians can also ask us to delete their child’s save data at any time.
12. Security
We use technical and organisational measures suited to the risk, including encryption in transit, access controls, and limiting access to personal data to people and providers who need it. No system is completely secure. If a breach is likely to put your rights at risk, we will notify the Danish Data Protection Agency within 72 hours where required and tell affected users without undue delay.
13. Changes and contact
We may update this policy when the App, our partners or the law change. We will post the new version in the App with a new effective date, and ask for your consent again where the law requires it. Material changes will be highlighted in the App before they apply.
Questions, requests or complaints: hello@case-rush.com.