Ampe Rush · Legal

Privacy Policy

Last updated: 16 October 2026 · Effective: 16 October 2026

1.Who we are

Ampe Rush is made and operated by Adinan Alhassan, trading as Wontah, an individual developer based in Ghana ("we", "us", "our"). We decide how your personal data is used, which makes us the data controller (in South Africa, the "responsible party").

Contact

[email protected]. Please use the subject line "Privacy".

Written notices

If you need to send us a formal written notice, ask at [email protected] and we will give you a postal address for it.

Applies to

The Ampe Rush apps for iOS and Android (app ID com.wontah.amperush), the web game at ampe.wontah.com/play, the website at ampe.wontah.com, our game server at api.ampe.wontah.com, and any support conversation with us.

This policy is part of a set. More detail is in our Advertising, Cookies & Similar Technologies notice, our list of Service Providers, the Children & Families guide, and our account deletion page at ampe.wontah.com/delete-account.

2.What we collect

We collect only what the game needs to work, stay fair and get better. Here is all of it.

2.1 Player and device identifiers (everyone)

• Player ID: a random identifier our server creates the first time you play. It is shown at the bottom of the Settings screen. RevenueCat, our purchase provider, also uses it as your customer ID.
• Device ID: a random identifier the game creates once for each installation and stores on your device. Our server keeps only a one-way hash of it. It is not your phone's hardware ID or advertising ID.
• Session tokens that keep you signed in. Our server stores them only as one-way hashes.
• Basic profile and device details: platform (iOS, Android or web), app version, the date your account was created, your game language (English, or Twi, Ewe, Ga or Dagbani in beta) and your device's time zone. We use the time zone to work out your local day for goals and streaks, and to keep notifications out of the night.
• Country: when your account is created, we take it from your device's language and region setting (for example "en-GH" gives Ghana). We do not use GPS, and our server does not look up your location from your IP address. You can change your country in the game.

2.2 Sign-in (optional)

• Google or Apple: the service sends us a signed token. We check it and keep only the account identifier that service assigns to you for Ampe Rush. The token may also contain your email address or name. We do not store your email address. With Apple, if you choose to share your name the first time you sign in, we may use it as your display name (only if you still have the automatic "Player1234" name). You can change it at any time. For Apple, we also keep an encrypted Apple token. Its only use is to revoke your Apple sign-in when you delete your account. We never receive your password.
• Facebook: we receive your app-scoped Facebook ID (an ID Facebook creates only for Ampe Rush). If you allow it, we also receive the IDs of your Facebook friends who also play Ampe Rush and have allowed the same. On Android, on the web, and on iOS when you allow tracking, Facebook gives us an access token, valid for about 60 days. We store it encrypted so we can refresh that friends list. On iOS without tracking, Facebook Limited Login is used and we keep no access token. We do not store your Facebook name or photo, we never post to Facebook, and we read nothing else from your account.

2.3 Gameplay and ranked runs

• Runs: for each run, the random seed our server issued, the mode (endless or Daily Rush), the items you took in, when it started and ended, and the result summary: score, stage reached, challengers beaten, best combo, perfect reads, hearts lost, continues used, cowries earned, and items found or used. We also store whether the run was verified or rejected, and the reason for any rejection.
• Your tap inputs: to verify a ranked run, the game sends the timing of your taps to our server. The server replays them with the game's rules and the run's seed (see section 13). It then keeps only the result summary. The tap log itself is not stored.
• Leaderboards: your best verified score for all time, for each week and for each Daily Rush, together with your display name and country. Everyone can see these. Friends leaderboards are visible to your friends.
• Progress: daily goals and their progress, rewards claimed, your play streak and streak saves, stage milestones, your furthest stage, Daily Rush attempts, and the outfits and dances you own and wear. Our server works these out from your verified runs.

2.4 Currencies, items and purchases

• Medallions: your balance, held for us by RevenueCat, and a record of each grant (for example the welcome gift, goal rewards or ad rewards) and each spend on continues.
• Cowries: your balance and a ledger of every change. Each entry has the amount, the reason (a verified run, a reward, a shop purchase, a store purchase or a refund), the balance after it, and the time.
• Inventory and upgrades: kente shields, Adinkra artefact charges, power-up upgrade levels, and your Adinkra album (which symbols you have found and how often).
• Perks: whether you own Double Cowries, No Ads or the Starter Pack.
• Store purchases: Apple and Google handle payment. RevenueCat and our server receive the transaction details: product, price and currency, store, country of the store account, date, store transaction ID, and any refund. We use them to deliver each purchase exactly once and to handle refunds. For each transaction we keep the product, the transaction ID, the time, what it granted and whether it was refunded and reversed, plus a copy of the purchase notifications RevenueCat sends us. We never receive your card or bank details.
• Rewarded ads: a record of each ad reward (what it was for, the run if any, and Google's transaction ID). We use it to grant each reward once and to enforce the limits in our ads notice.

2.5 Friends and invites

• When you accept a friend's invite link (ampe.wontah.com/f/…), or when Facebook tells us which of your friends also play, we store a friend link between your player ID and theirs, with where it came from (invite or Facebook). We also store the invite codes you create.
• Your friends can see your display name, country and verified best scores. They may get a notification or inbox message when they beat your best score, and you may get one when they beat yours.
• We never upload your phone's contacts. When you share an invite or a score card, your device's share sheet (for example to WhatsApp) sends it. We do not receive the message, who you sent it to, or your contacts.

2.6 Notifications and inbox

• Push notifications (iOS and Android, only if you allow them): we store your device's push token from Google's Firebase Cloud Messaging, your platform, language, time zone, and your notification settings. There are three kinds: a friend beat your best, a weekly recap on Monday mornings, and "your streak is at risk" in the evening. We send at most three a day and hold them back between 21:00 and 08:00 your time. Google delivers them, and on iPhone, Apple delivers them too. Each one carries a short text, such as a friend's display name and scores.
• The inbox keeps a copy of each message, including on the web, where there are no push notifications. We also keep a short record of each notification we decided to send (sent, held back, or not sent and why).
• Local reminders are set on your device by the game itself. They are not sent from our servers, and we learn nothing when one appears. You can turn them off in Settings.

2.7 Analytics and feedback

• We use PostHog, hosted in the European Union, to understand how the game is played and where it goes wrong. The game sends events such as app opened, tutorial steps, run started and ended with the result, continue offers, items picked up or used, shop and store views, purchase results, ad results, sign-in results, notification opens, language changes and consent results.
• Each event carries a random analytics ID for your installation, your player ID, a session ID, platform, app version, screen and window size, device language, time zone, browser or webview user agent, and days since install. Events do not include your name, email or contacts. PostHog receives your IP address when the game connects to it. We have set our project not to store IP addresses.
• Feedback: if you answer the in-game question "Would you play again?", we receive your answer and any comment you type. Please do not put personal details in comments.

2.8 Advertising

Google serves the ads, and it collects data for them itself. See section 5 and our Advertising, Cookies & Similar Technologies notice.

2.9 Technical and security data

• Every connection passes through Cloudflare, our network and security provider. Cloudflare processes your IP address, request details and browser or app user agent to deliver the service, block attacks and limit abuse. Our server uses your IP address for rate limits while it handles your request. It does not write IP addresses to its logs.
• Our server's logs record the request method and path, the result, a request ID, and pseudonymous player and run IDs. They contain no IP addresses, request contents, tokens or email addresses.

2.10 Support

If you email us, we receive your email address, your message and anything you attach. We use them to help you.

2.11 Stored on your device

The game keeps your settings, device ID, session token, cached profile and scores, and a short queue of analytics events (up to 500) on your device, in app storage or your browser's local storage. On the web we set no cookies of our own. Google's ad script may use cookies or similar storage when an ad loads. Details and durations are in our cookies notice.

3.How we use it, and our legal bases

Data protection laws such as the EU and UK GDPR, Ghana's Data Protection Act, 2012 (Act 843), Nigeria's NDPA, Kenya's DPA and South Africa's POPIA require a lawful reason for each use. Here are ours.

We do not sell your personal data. We do not use it to build profiles for advertising, and we do not use it for anything not listed here without telling you first.

4.What other players can see

• Everyone: your display name, country and verified best scores on the global and country leaderboards (all-time, weekly and Daily Rush).
• Your friends: the same details on the Friends leaderboard, and messages when they beat your best, or you beat theirs.

Pick a display name that does not identify you if you prefer to stay private. Our name rules forbid putting phone numbers or addresses in names.

5.Advertising and your choices

• Ads only play when you tap to watch one, for example to continue a run or earn cowries. We do not show ads that interrupt play.
• In the apps, Google AdMob serves the ads. In the web game, Google AdSense (H5 Games Ads) serves them. When an ad loads, Google may collect your device's advertising ID (on iOS only if you allow tracking), IP address, device and app details, and how you interact with the ad. It uses them to show and measure ads and to prevent fraud. For personalised advertising, Google acts as an independent controller under Google's Privacy Policy.
• EEA, UK and Switzerland: Google's consent message asks for your choice before personalised ads. You can change it at any time in the app under Settings → Privacy options.
• iOS: we ask through Apple's App Tracking Transparency prompt. If you choose "Ask App Not to Track", your advertising ID is not shared.
• For a rewarded ad, the game gives Google your player ID, the run (if any) and what the reward is for. Google then sends our server a signed confirmation, so we can grant the reward exactly once.

All the details are in our Advertising, Cookies & Similar Technologies notice.

6.Who receives your data

• Service providers who host, deliver and support the game for us, under contracts that limit them to our instructions: Vultr (servers and database), Cloudflare (website, network and email routing), RevenueCat (purchases and medallion balances), PostHog (analytics) and Google Firebase Cloud Messaging (push delivery). The full list, with locations and transfer safeguards, is on our Service Providers page.
• Independent companies you use through the game: Apple and Google (app stores, payments, refunds, sign-in, push delivery), Meta (Facebook Login and friends) and Google (advertising). They handle your data under their own privacy policies.
• Other players, as described in section 4.
• Authorities, when the law requires it, or when it is necessary to protect someone's safety, to prevent fraud or to defend legal claims. We push back on requests that are not lawful.
• A successor, if the game is transferred to a company or a new owner. That company would have to keep this policy's protections, and we would tell you in the game first.

7.International transfers

Our game server and database are in London, United Kingdom. PostHog stores analytics in the European Union. Some providers (Cloudflare, RevenueCat, Google, Apple and Meta) also process data in the United States and other countries. So your data may be processed outside your home country, including outside Ghana, Africa, the EEA or the UK.

When the law requires safeguards for these transfers, we rely on adequacy decisions (for example the EU's decision for the UK, and the EU–US Data Privacy Framework where a provider is certified), on the standard contractual clauses in our providers' data processing terms (with the UK Addendum where relevant), or on other mechanisms your local law recognises. These include the transfer conditions in Act 843, the NDPA, the Kenya DPA and POPIA. You can ask us for more detail on the safeguard for any provider.

8.How long we keep it

We keep data only as long as we need it. Unless the table says otherwise, account data stays until you delete your account. When you delete it, the data is erased from our live database straight away (see section 9).

9.Deleting your account

You can delete your account at any time in Settings → Delete account. This works for anonymous and signed-in accounts and takes effect immediately. You can also ask by email, without the app. All the options are on our page at ampe.wontah.com/delete-account.

When you delete your account, our server:

• asks RevenueCat to delete your customer record, including your medallion balance and purchase history held there;
• revokes your Sign in with Apple token, if you used Apple;
• erases from our database your player record, hashed device IDs and session tokens, sign-in identities and stored tokens, profile, runs, scores and leaderboard entries, progress, outfits, medallion grant records, cowries and ledger, inventory, upgrades, album, perks, our purchase records and RevenueCat notifications, rewarded-ad records, push tokens and settings, friend links, invite codes and inbox.

We then delete the analytics linked to your player ID within 30 days. Backups expire within 7 days. We do not keep our own copy of your purchase records after deletion. Apple and Google keep the record of what you bought in your store account, under their own policies. A deleted account, and the currencies and items in it, cannot be restored.

10.Your rights

Wherever you live, you can ask us to:

• access the personal data we hold about you and get a copy, in a portable format where the law gives that right;
• correct inaccurate data (you can change your display name and country in the game yourself);
• delete your data (section 9);
• object to or restrict processing based on legitimate interests, including analytics;
• withdraw consent at any time: personalised ads in Settings → Privacy options, tracking in iOS Settings, and push notifications in your phone's settings (Settings → Notifications → Ampe Rush). Withdrawing consent does not affect what happened before.

To make a request, email [email protected] with the subject "Privacy" and your player ID. To protect your account, we may ask for details that show the account is yours, such as your display name, country, roughly when you last played and what you own in the game. We answer within one month. If a request is complex, we may extend that by up to two more months where the law allows, and we will tell you why. We do not charge for requests unless they are clearly unfounded or excessive. You may also use an authorised agent, who must show us your signed permission.

We will never treat you differently, or give you a worse game, because you used a privacy right.

11.Information for your region

11.1 Ghana

We process personal data in line with the Data Protection Act, 2012 (Act 843) and its data protection principles. You have the right to be told what we hold about you, to access it, to ask us to correct or delete it, and to object to processing, including for direct marketing (we do not send marketing). You can complain to the Data Protection Commission (dataprotection.org.gh). We would be glad to try to put things right first.

11.2 European Economic Area, United Kingdom and Switzerland

• The EU GDPR, the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection apply to our processing of data about people there. Section 3 lists our legal bases. Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds (preventing cheating and securing the service usually are).
• Storing or reading information on your device: in the EEA (under the ePrivacy rules) and the UK (under PECR), some storage needs your consent, unless it is strictly necessary for the service you asked for. See our cookies notice.
• You can complain to your local supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In Switzerland it is the Federal Data Protection and Information Commissioner (FDPIC).

11.3 United States

• Some US state privacy laws (for example in California, Virginia, Colorado, Connecticut, Utah and Texas) apply only to businesses above certain size thresholds, and may not apply to us. Even so, we give every US resident the rights in section 10: to know, access, correct and delete. Use the same email to make a request. If we deny a request, you can appeal by replying with the subject "Privacy appeal". We will answer within 45 days.
• Categories: in the last 12 months we collected identifiers (player ID, device ID, sign-in account IDs, push tokens), commercial information (purchases and in-game currencies), internet or other activity information (gameplay, analytics events), inferred approximate country, and the content of feedback and support messages. We do not collect sensitive personal information as those laws define it. We collected these from you and your device, from sign-in providers and from the app stores, for the purposes in section 3, and we disclosed them for business purposes to the providers in section 6.
• Sale and sharing: we do not sell personal information, and we do not share it with anyone for advertising ourselves. When an ad plays, Google may use data it collects for personalised advertising, and some state laws call that "sharing" or "targeted advertising". To opt out, use Settings → Privacy options in the app, decline tracking on iOS, delete your Android advertising ID, or turn off ad personalisation at myadcenter.google.com. You can also email us with the subject "Privacy".
• Do Not Track and Global Privacy Control: there is no common standard for Do Not Track, so we do not respond to it. The web game does not currently act on Global Privacy Control signals by itself, so please use the opt-outs above.
• Children: Ampe Rush is not directed to children under 13, and we do not knowingly collect personal information from them (see section 12). This is how we meet the Children's Online Privacy Protection Act (COPPA). We do not sell or share personal information of consumers we know are under 16.

11.4 Nigeria

Under the Nigeria Data Protection Act 2023, you have the rights in section 10, including the right not to be subject to decisions based solely on automated processing that significantly affect you (we make none; see section 13). You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

11.5 Kenya

Under the Data Protection Act, 2019, you have the rights to be informed, to access, correct and delete your data, and to object. You can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

11.6 South Africa

Under the Protection of Personal Information Act, 2013 (POPIA), you may ask whether we hold your personal information, ask for it, ask us to correct or delete it, and object to processing. You can complain to the Information Regulator (inforegulator.org.za).

11.7 Everywhere else

If your country's law gives you other rights, tell us and we will honour them.

12.Children

Ampe Rush is for players aged 13 and over. It is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 is using the game, email us and we will delete the account. In some countries, the age at which a young person can consent to optional processing alone is higher (up to 16 in parts of the EEA). Below that age, a parent or guardian must give consent for optional processing, such as personalised ads. Our Children & Families guide explains the controls parents can use.

13.Score verification and automated decisions

Our server replays each ranked run automatically, using the game's own rules. If the replay does not match the score the game reported, the run is not ranked and earns no cowries. Nothing else happens to your account automatically. These checks do not produce legal effects or anything similarly significant for you. Any wider step, such as removing scores or suspending an account, is decided by a person and can be appealed (see Fair Play).

14.Security and breach notification

• All traffic is encrypted in transit (HTTPS/TLS). Our server accepts connections only through Cloudflare. Device IDs and session tokens are stored only as one-way hashes, and Apple and Facebook tokens are encrypted (AES-256-GCM). Only the operator can reach the server, using keys.
• No system is perfectly secure. If a breach puts your personal data at risk, we will tell the relevant authority and the people affected, as the applicable law requires. That includes the Data Protection Commission in Ghana, and the 72-hour deadline under the GDPR where it applies. We will tell you as soon as reasonably possible, in the game or by any contact details we have.

15.Changes to this policy

When our practices change, we will update this policy and the date at the top. For material changes, we will tell you in the game before they take effect. If the law requires your consent to a change, we will ask for it. Every version is listed on our Changes page.

16.Contact

Adinan Alhassan, trading as Wontah, Ghana. [email protected] (subject "Privacy"). This policy is written in English, and the English version governs. The game is also available in Twi, Ewe, Ga and Dagbani (beta), but this policy is not translated.