R3CK0N
Last updated 4 November 2026. Takes effect: 4 November 2026
This policy explains what R3CK0N collects when you use r3ck0n.com, why, who else handles it, and the choices you have. We have tried to keep it plain, and to describe how the app actually works rather than everything it might one day do. The rules for using R3CK0N are in the Terms of Service.
R3CK0N is run by 712 Capital (“we”, “us”). For anything in this policy, contact privacy@r3ck0n.com.
R3CK0N works completely without an account. Your run history, settings, theme and companion (your pet, Shells and cards) are saved in your browser's local storage, on your device, along with a random ID the app creates to tell this browser's history apart. The app sends none of it to our servers, except anonymous run results if you opt in (below). Otherwise, before you sign in, it contacts our API only to show you something that lives there (such as the list of sign-in options while a sign-in panel is on screen, or a player's public profile, the Supporters Wall, the merch shop or an invite link when you open one) and to send an error report if the site breaks (see Information collected automatically). Those requests carry nothing about your play.
Anonymous run results, only if you opt in. If you are signed out and switch Analytics on in the cookie banner (which asks your birth year first, unless this browser already has your age range, and never allows it for anyone under 13), the drills already in this browser's signed-out history and each one you finish from then on are sent to our servers so we can see how people play before they create an account. Results also count toward the totals on the About page, as whole-site sums only. A result carries the run details listed under Runs in What we collect when you have an account: the mode, difficulty and length, the day you played (the date in UTC, never the time), your score, speed and accuracy, and the per-problem log. It leaves out the random browser ID, the time of day you played, your theme, the random number a drill's problems are drawn from, the weights a Focus drill works out from your earlier runs, and for Zen runs the key-by-key timing log (per-key averages are kept). No cookie or account goes with it, and we store it without your IP address and without the time it was played or arrived (only the date). Once a day we shuffle and renumber all the results that arrived since the day before, so from then on nothing we store says which results were sent together. Until then the order they were stored in still does, and a result that reaches us while we are updating the site may still carry the times, theme and other details a result normally leaves out; our database provider's restore history keeps both for up to 7 days more. Nothing we store names you, and we don't try to group results by player, but results from the same day for the same drill, level and length with similar scores can look alike, and on a quiet day may all be one player's. If you later sign in and add these runs to your account, we delete their anonymous copies, so the two can't be matched up. (Like every request, it passes through our host's server logs; see How long we keep it.) Runs you play while Analytics is off wait on this device and go only if you switch it on later; runs that came from an account you have signed out of are never sent as anonymous results, and the iPhone app never sends any. Switching Analytics off (Settings → Privacy → Cookies & analytics → Change choices) stops it straight away. Each result keeps one thing your browser also holds: the random code the app gave that run, which stays in this browser's history and is in the file Settings → Data → Export data saves. Nothing else we store says which results are yours, so we can't pick them out ourselves, but if you send that file to privacy@r3ck0n.com, we will delete the results whose codes are in it, as we do when you add the runs to an account. Otherwise we delete every one within 12 months of receiving it. When a result is deleted this way, its numbers stay only inside combined anonymous running sums (how many results there were, and their playing time, problems and digits, each added together) that feed the whole-site totals; nothing else of it is kept.
Which features you used today, under the same choice. With that same Analytics opt-in, when you finish something signed out (a drill, an Arcade round, a flashcard session, a boss round or an Arena match), the app also tells our servers that one browser used that feature on that day (the date in UTC), so we can count how many signed-out players use each part of the site each day. To count you once for the day rather than once per feature, your browser makes up a random code for the day and sends it with each of these; it makes a new one at the next UTC midnight and forgets the old, and we store only a scrambled form of it (keyed with a server secret), so nothing we store says which days were the same browser, which browser sent a run result, or who you are. It carries no score, no run, no cookie and no time of day, and we add no IP address or browser details to it. Nothing is sent before you opt in, while Analytics is off, while you are signed in, or from the iPhone app. We delete these within 12 months.
Your history itself lives only in your browser: clearing the browser's site data deletes it, and we cannot restore it. Settings → Data → Export data saves a copy to a file.
A few technical requests happen whether or not you have an account: your browser loads the site through Cloudflare and the app's fonts from Google, and both see your IP address. See Information collected automatically.
If you use a phone as the keypad for a drill on another screen, the keys you press, and a small view of that drill (the problem and what has been typed), pass between the two devices through a relay run on Cloudflare. It needs no account and stores nothing: the connection ends when either page closes, and an idle session ends after two hours.
If you join a party game, the nickname you type, your answers and your score are sent to that game's relay on Cloudflare so it can check the answers and rank the players. Everyone in the game sees your nickname and score. The relay keeps the game only while it is being played and deletes it two hours after the last activity; it is never linked to an account. So that a reload rejoins the same game, your browser tab keeps a random player ID (mathemagician_party_player) in session storage, and the host's tab keeps the game code and a random host key (mathemagician_party_host); both are deleted when the tab closes. Use a nickname rather than your full name.
If you sign in with Google, Google asks your permission to share your basic profile and email address with R3CK0N. We receive your Google account ID, your email address and whether Google has verified it, and your name and profile picture link (and your language, if Google includes it).
We use the email address as your account's email address, and the Google account ID to recognise you when you sign in again. If an account with the same verified email address already exists, the Google sign-in is linked to it. The name, picture link and language are stored as Google sends them, with your sign-in record, but R3CK0N doesn't display them or use them for anything. We never see your Google password, we ask for no access to your contacts, files or anything else in your Google account, and we don't keep the access token Google issues once sign-in is complete. We use information from Google only to create your account and sign you in. We never sell it, share it for advertising, or use it to show you ads. Our use of information we receive from Google follows the Google API Services User Data Policy.
Google is the only sign-in provider we offer today. Apple, GitHub, Microsoft and Discord sign-in are built in but not switched on. If we enable one, it works the same way: we receive the email address and account ID that provider shares, and use them only to sign you in, and we will add it to this page.
While you are signed in, the app syncs the following to our servers so it can follow you across devices:
After you sign in, R3CK0N may ask a few optional questions: your age range, your country, what best describes you (for example student, teacher or a line of work), what brings you here, how confident you are with mental math, your education, your gender, and how you heard about R3CK0N. Every question can be skipped, and the personal ones offer “prefer not to say”.
With your answers, the form sends how long you took and how often you changed an answer, your device's time zone and language, and when you started. If your cookie choices allow analytics or advertising, we add how you first arrived in that browser tab: the campaign tags in the link you followed (the utm_ tags), the referring site's domain, the page you landed on, and when.
We use your answers to show you how you compare with players like you (comparisons are shown only for groups of at least 10 players, and your answers never appear on your public profile) and to understand who plays R3CK0N. To keep those statistics honest, each response gets an automatic quality score, based on signs such as answering faster than the questions can be read, answers that contradict each other, a device time zone on a different continent from the country you picked, or a throwaway email domain. A low score only keeps your response out of the group statistics. It never limits what you can do.
We keep each submission as its own record, alongside your current answers, so that improved quality checks can be run again later. Delete my answers, on your account screen, erases all of it. If you choose “Under 13”, or told the cookie banner or “Can we email you?” you are under 13, we keep only your age answer and discard the rest, from that submission and every earlier one: your other answers, the form's timing, time zone and language, and how you arrived. The form then asks nothing else. One exception: if your “About you” answers already say you are 13 or older, an “Under 13” from the cookie banner or “Can we email you?” doesn't erase them; we review the account instead (see Children).
For analysis, we may export answers with your identity replaced by a random code. These exports never include email addresses. Product news is sent only by our own servers, within the limit you chose and with its unsubscribe link (see Emails, below). We don't share these exports with anyone outside R3CK0N.
Once you have played on more than one day, R3CK0N may ask you for feedback after a drill, at most once every three months (Not now puts it off for a month, on every device you use). You can also give feedback at any time from Feedback on your account screen. The survey asks you to rate a few things from 1 to 5, pick what you would like most from a list, and, if you want, write what we should build next and anything else, up to 2,000 characters each. Every question is optional; you can tick a box to let us email you about what you wrote. Each submission is kept as its own record, with the drill it followed (if any), the app version, your device's platform and language, and how long you took. We read it to decide what to build. It is never shown to other players, it is in your data download, and it is deleted with your account. We don't ask players known to be under 13.
We email you sign-in, verification and password-reset codes, emails about your payments and membership, and notice of a significant change to this policy or our terms, whatever your email choices. Our other emails are about the game: a message when someone sends you a friend request or a challenge (it names them), the weekly recap, the weekly progress email (Pro and above), the Flashcards report, and email versions of our notices (Monthly Cup results, a members' drop, Season Pass rewards, a streak that still needs today's drill or Arcade round).
“Can we email you?” After you create an account, or the next time you use the app signed in if your account has never answered, the app asks “Can we email you?”, with Yes and No. Not now puts it off: in that browser it comes back at most once, on another day. After Yes, it asks how often at most: multiple times a day, daily, weekly, monthly, once a quarter or once a year. That is a ceiling, not a schedule: when there is nothing new, we send nothing. Then, unless we know you are under 18, it offers product news (below) as a separate box, which starts unticked and asks you to confirm you are 18 or over. If you say yes, we turn all of the game's emails on (the progress email if you are already Pro or above); if you say no, we send none of them. The unsubscribe link in one of the game's emails counts as saying no. Until you answer, each stays off until you turn it on. You can change any of these answers, and turn each email on or off, under Email on your account screen. If you first say yes there, the limit starts at weekly, as in “Can we email you?”, and you can change it there.
If we don't know your age range from the cookie banner or “About you”, the question first asks how old you are: under 13, 13 to 15, or 16 or older. Your answer is saved the same way as the cookie banner's age answer, as an age range in your settings (see Cookies and similar technologies), and counts the same everywhere that one does. Anyone who answers “Under 13” is told that accounts are for people 13 and older unless their class uses R3CK0N, and that they can keep playing without one; they are not asked about email, and are not shown “About you” or the new account's show-around. Players 13 to 15 are never offered product news.
However many emails are on, we never send them and product news together more often than the limit you chose (“multiple times a day” means at most four a day; “weekly” means none on the six days before, and so on), counting whole days in your own time zone when we know it; an email that would go over the limit is held back, and a notice still reaches your inbox in the app. When you say yes, the app also saves your device's time zone with your Flashcards report settings, if they still have the default (UTC), so the report and the limit follow your day; you can change it there. To make the unsubscribe link in each email work without signing in, we keep your email choices together with a secret code unique to you.
Product news (news and offers about R3CK0N, such as a single email a few weeks after a membership ends, telling you what has changed since) is a separate, single choice: that unticked box in “Can we email you?”, or the same box under Email on your account screen, where you can untick it at any time. It is never offered to anyone who has told us they are under 18. It goes only if you ticked it, and never if you said no to “Can we email you?”. Like our other emails, it is sent by Resend and every product-news email has a one-click unsubscribe link. Accounts known to belong to someone under 13 get only sign-in, account and payment emails. We keep a record of each answer you give to these questions (what you chose, when, where you were asked, and which version of the question you saw), and a log of the emails we send you or hold back, sign-in and verification codes included (which kind, when, and why one was held back), so we can show what you agreed to and keep to your limit; both are in your data download.
The weekly recap. It covers your last seven days: your drill runs and Arcade rounds, the days you practised, your minutes in all, new personal bests, the Dailies you played, your current streak and your flashcard reviews. It adds your place, division and League XP in last week's League, and whether you moved up or down, followed by a goal for next week (from the Coach goal you picked, and your test date for the GRE, or else the next speed tier on the math drill you played most in the last four weeks). It also lists your friends' activity, how many times you made the activity feed, your waiting challenges and your unread notifications. If you get the weekly progress email (Pro and above), the recap adds only your League line and the goal, since that email already covers your week. It is made from data we already hold, and nothing new is stored. It goes in a week with any of these, including a week with only your own practice and no friend activity; a week with nothing to report sends nothing, and you never get more than one every six days. Its button opens your Today page, and the link carries campaign tags (the utm_ tags) saying it came from the recap.
R3CK0N offers optional paid memberships: Supporter, Pro, Legend and Patron, and a one-time Lifetime Patron. Payment is handled entirely by Stripe, on Stripe's own pages, and we never see or store your card details. To set up a membership we send Stripe your email address and account ID. Stripe tells us the membership's status, tier, billing period, price and currency, when it started and when it renews, and whether it is set to cancel. If you cancel and answer Stripe's optional question about why, Stripe passes on the reason you picked and any comment you wrote, which we read to improve the memberships. We also record whether you joined in time to be a founding member. So the welcome screen after a purchase shows only once, your synced settings keep a short code for each purchase already welcomed, which carries nothing about the payment itself.
Payment history. For each membership payment, Stripe tells us the amount and currency, the plan, the billing period, when it was paid, whether it was refunded, and when a membership is cancelled. We keep this history with your account to run memberships and to understand how they do over time.
Thank-you month. If we refund your first month as a thank-you, we also keep the card fingerprint Stripe gives us for the card you paid with: an opaque code, not your card number, which lets us do it only once per card. We keep it, with the amount and the refund, after you delete your account, so that a refund we still owe you can be paid and the once-per-card rule still works. We email you to say your first month is on us, about a week before your first renewal, and when the refund is sent; these emails can't be turned off because they are about money taken and returned.
Gems and the shop. If you buy Gems, payment again happens on Stripe's pages, and Stripe tells us which bundle was paid for and whether a payment is later refunded or disputed. We keep a record of your Gem balance and every change to it (what it was for, and when), the cosmetics you own and have equipped, how many Prism Packs you have opened since your last epic item (for the guarantee), and the age category you confirmed before your first purchase (18 or over, or 13 to 17 with a parent's permission) with the date. To decide whether Prism Packs can be sold to you, we check the country your connection comes from (as reported by our network provider) and the country on your profile, at the moment you open the shop; we don't store the network country for this.
When you ask the AI coach for something, we send Anthropic (which runs the Claude model) only what that request needs: for interview feedback, the question, its worked solution and correct answer, your answer, what you typed while thinking aloud, any clarifying note, and how long you took; for an explanation, the question (with any reading passage), its choices, the correct answer, your answer and the worked solution; for flashcards, the notes you pasted. We never send your email address, username or account ID. We don't keep what you send or what comes back, only a count of how many coach requests you made each month. Cards you choose to keep become ordinary flashcards. The coach isn't offered to accounts we know belong to someone under 13. Under its commercial terms, Anthropic doesn't use what we send it, or what it sends back, to train its models, and deletes it automatically within 30 days, unless it must keep it longer by law or because a request was flagged as breaking its usage policy.
If you buy a gift, we keep the code, its tier, the Stripe payment it came from and its amount, and whether and when it was redeemed and by which account. The buyer never sees who redeemed a code, and the person who redeems it never sees who bought it. Codes are kept so the buyer can copy them again. Redeeming a gift records a membership grant on your account: its tier, when it starts and ends, and whether it was cancelled.
Season Pass XP is worked out from what we already hold: your synced runs, Daily results, Arena matches and Cup rounds. We record whether you bought a season's premium track (and the Gems it cost), which rewards you claimed, and which members' drop pieces you claimed and when.
Everything we tell you about (Monthly Cup results, a members' drop, Season Pass rewards, a streak that still needs today's drill or Arcade round) appears in your inbox in the app. If you allow it, we also send these as push notifications: in the iPhone app through Apple's push service (APNs), and in a browser through that browser's push service. For that we store your device's push token (or your browser's push subscription), which build of the app it belongs to, and your device's time zone, so that we never notify you between 9 pm and 8 am your time and send at most one push a day (Cup results and study reminders aside, as described below). Apple, Google, Mozilla or your browser's maker deliver the message; they see its text and your device's token, not your account. Email versions are off unless you turn them on (saying yes to “Can we email you?” turns them on), count toward how often you let us email you, and every email has a one-click unsubscribe link. We keep a record of which notices we sent you and how (push, email, or inbox only) for as long as you have an account; it's in your data download. You can turn each kind off for push or email in your account, or turn push off for a device there or in your device's settings, which removes its token from our servers. Accounts known to belong to someone under 13 get notices in the inbox only, never by push or email.
Study reminders. In Flashcards you can turn on a daily study reminder for each browser; we keep that choice, with the browser's time zone, with the browser's push subscription. That switch is all it takes, and the only thing that turns it on: you don't need the daily report, and turning on game notifications doesn't turn it on. If you have the daily report on, the reminder may already be on for your browsers, because the report used to be how you asked for it; turning the report off no longer stops it, so turn the reminder off in Flashcards. We send each browser where it is on one push on days you have cards due, at most once a day. With the daily report on, it goes at your report hour in the report's time zone, even an hour between 9 pm and 8 am if that is the one you picked, and counts the decks the report covers. With the report off, it counts all your decks and goes at your report hour (8 am unless you changed it) in the time zone of the newest of those browsers that told us one, or else in the time zone you picked for the report; if we know neither, we don't send it rather than guess, and it never goes between 9 pm and 8 am. The one-push-a-day limit never holds it back, but it counts toward that limit: once it has gone out, our other notices that day reach your inbox only. Accounts known to belong to someone under 13 never get it. The Flashcards report email itself goes only if you turn it on (saying yes to “Can we email you?” turns it on, daily or, if you chose to hear from us weekly or less, weekly), at the hour, days and time zone you pick (until you pick a time zone, your device's, if we know it), and covers the decks you choose.
Sign in with Apple in the iPhone app. Apple gives the app a one-time code that we exchange with Apple for a token. We store that token encrypted and use it for one thing: when you delete your account, we ask Apple to revoke our app's access to your Apple ID.
When you cancel, pause or change your membership from your account screen, we record what you chose, the reason you picked (if any) and any comment you wrote, and pass the reason and comment to Stripe with a cancellation. We also keep a history of changes to your membership (when it started, was set to cancel or resumed, paused, changed plan or ended), as Stripe reports them. We use this to run your membership and to understand why members leave; members who open the cancel page may be shown different options as part of a test. If a renewal payment fails, we record that and send you one email about it, to your verified address.
Your monthly and yearly Rewind is worked out on your device from your own history; nothing new is collected or sent to us. Which month's Rewind you were last offered is remembered in your synced settings. A share image is made on your device and leaves it only if you share or save it; your username is on it only if you turn that on.
Your username and avatar are shown to anyone who opens your invite link. If you join through an invite link, we record which link you used; the person who invited you sees only how many friends joined and finished their first drills, never who. When any account is created we store a one-way, keyed hash of the IP address it signed up from (not the address itself) for 30 days, only to stop people rewarding themselves with duplicate accounts. For a paid membership we compare Stripe's card fingerprint (not the card number) of the friend's first payment with those of the cards the inviter has paid with, for the same reason, and keep only the outcome. Whether the invite card after a drill has been shown is remembered in your synced settings.
Purchases in the iPhone app are made through Apple's App Store; Apple handles the payment and refunds, and we never see your payment details. RevenueCat keeps track of those purchases for us: we give it our account ID for you (a random identifier, not your email address), and its code in the app also sends it your purchases and basic device and app information. From RevenueCat we receive, for each purchase, the product, the store's transaction IDs, the purchase, renewal and expiry dates, renewal and billing status, refunds, the price and currency, and whether it was a test purchase. We keep these with your account to run your membership, Gems and Lifetime Patron. If you use Sign in with Apple, we receive the email address Apple shares (which may be a private relay address) and an Apple account ID, used only to sign you in. The app keeps your sign-in token in the iPhone's secure storage instead of cookies.
If you buy Lifetime Patron, we keep a record of the payment (its amount and currency, the Stripe checkout and payment it came from, when it was made, and whether it was later refunded or disputed) and the membership grant it gave your account. If you are a Patron and vote on the roadmap, we keep which items you backed and in which month; only the vote counts are shown, never who voted.
If you link Discord to get your members' role, Discord sends us your Discord user ID and username (we ask only for the identify permission); we keep those two and discard Discord's access token straight away. To give you the role, we tell Discord your user ID and which role to add or remove. Your role is visible to everyone in the R3CK0N Discord server. Unlinking, or deleting your account, removes the role and the link.
Your day streak counts every day you finish a drill or an Arcade round that passes the plausibility checks. Members' streak freezes are recorded as the dates they covered. Math runs now also record, per fact (a times-table or single-digit addition fact, for example 7 × 8, from any Math drill that asks one, the times tables and Sprint included), how many times it came up, how many you got right and how long you took; this travels with your runs like the rest of their details. Insights is worked out on your device from your run history. A tip on your home screen can name the fact or operation you have missed most in your recent runs, worked out the same way. If you turn on the weekly progress email (Pro and above), it summarises your past week's runs, streak, Daily, Arena, flashcards and GRE and Quant practice, sent by Resend like our other emails.
If you join a teacher's class, the teacher sees your username, avatar and when you joined, and your Math and Secrets drill results from the day you joined: how many runs, how recent, accuracy, best speed, and your progress on the drills they assigned. They never see your email, phone number, country, Zen runs, duels, friends, or anything from before you joined. Students in a class never see each other. Leaving the class removes you from the teacher's dashboard straight away, though a report the teacher already downloaded is in their hands. If the teacher's plan ends, they keep seeing results only up to that day.
Paying by school invoice. If a teacher has their school pay for the Classroom plan by invoice, we collect the school's name, its finance office's email address and postal address, and optionally a purchase order number, a tax ID and whether the school says it is tax-exempt. We send these to Stripe, which emails the invoice to that address and takes the payment, and Stripe tells us the invoice's number, amount, due date and whether it has been paid. We keep the request with the teacher's account, show the teacher the invoice and its payment link, and include it in the account export.
If you play the Monthly Cup, we keep each round you start and submit: the date, your answers' correctness and timing, your score, and any prize awarded. The public board shows your username, avatar, country, score and days played unless your profile is hidden.
Supporter badge and the Supporters Wall are off until you turn them on from your account screen; see What other players can see. Your merch member price is worked out from your tier when you check out in the merch shop; discount codes, where there are any, are the same for everyone on a tier and carry nothing about you.
The Legend T-shirt. If you claim the free T-shirt that comes with Legend, we collect the size, and the name and postal address to ship it to. We use them only to send you the T-shirt, you can change them until it ships, and they are included in your account export. We pack and post the T-shirts ourselves, so no printing or fulfilment company receives your details; the name and address appear only on the shipping label, where the postal carrier sees them. The claim, including the address, is kept with your account until you delete it, so we can answer questions about a delivery.
r3ck0n.com/profile/<username>) it includes that player's username, and on a Bring a friend invite link (r3ck0n.com/r/<code>) the invite code. It uses no cookies and stores nothing on your device.R3CK0N uses as few as it can. The cookie banner asks before anything optional runs, and you can change your answer at any time in Settings → Privacy → Cookies & analytics.
sessionid, from our API, once you start signing in: holds a sign-in while it is in progress, then keeps you signed in. Page scripts can't read it, and it expires 30 days after you last used the site.csrftoken, from our API, once you start signing in: protects your account from forged requests. It lasts up to a year.__cf_bm, only when Cloudflare needs to check whether traffic comes from a person or a bot.mathemagician_stats (run history), mathemagician_settings (settings, cookie choices and age range), mathemagician_theme, mathemagician_companion (your pet, its level and XP, your Shells, cards and items, which of today's quests you have claimed, the rewards record described under What we collect when you have an account, and a marker of the last version synced with your account), mathemagician_daily_attempt (today's Daily Challenge) and mm_profile_id (the random browser ID).mathemagician_flashcards: any Flashcards decks you create or import (including the Missed questions deck: GRE Prep and Quant Prep add the practice questions you get wrong to it, and Math drills the times-table and addition facts you miss, as just the fact and its answer, unless you turn that off), the cards in them, and your study history for them (when you answered each card and how it went). Signed out, it stays on your device and isn't sent to our servers. Once you sign in, this database is synced to your account the same way your runs are, so your decks follow you to your other devices — and it is deleted with your account.mathemagician_flashcards_media: any images you paste or drop into a card, and any images that came with a deck you imported. These stay on your device even when you are signed in — images are not part of what syncs to your account, and are never uploaded.mathemagician_cart (the merch shop cart on this device: which items and how many; prices are not stored and it is not synced), mathemagician_merch_moments (when this device last showed or hid a merch suggestion, such as the one after a personal best, so they stay rare; only timestamps, never synced),mathemagician_gre_practice (your GRE Prep history: which practice questions you answered, whether you got them right, how long they took, and your section-test scores; once you sign in, answers from then on are also saved to your account so they follow you to your other devices, and earlier ones only if you choose to add them), mathemagician_quant_prep (your Quant Prep history on this device: trading-sprint scores, market-making rounds and which interview questions you answered and got right; it stays on this device and is not synced), mathemagician_quant_free (how many of today's free trading sprints, market-making games and mock interviews you have used, if you don't have Pro; just today's date and three counts, never sent anywhere), mathemagician_arcade (your Arcade scores: best and recent scores, the days you played, each finished round's score and length, this week's practice-boss progress, community boss rounds waiting to be sent, and whether you chose not to add this device's earlier scores to your account; once you sign in, rounds from then on are also saved to your account so they follow you to your other devices and can appear on leaderboards, and earlier ones only if you choose to add them. Each round also keeps, on this device only and never uploaded, the details shown on its result card, up to 1 KB, such as Target's numbers and answer, Code Breaker's message or Cages' cell count; a round our server did not count also keeps the reason), mathemagician_codebreaker_daily (your guesses so far in today's Code Breaker puzzle, so a reload doesn't lose them; it stays on this device and is not synced), mathemagician_sudoku_daily (your board and time so far in today's Sudoku puzzle, so a reload doesn't restart it; it stays on this device and is not synced), mathemagician_equation_hunt_daily (your guesses so far in today's Equation Hunt, so a reload doesn't lose them; it stays on this device and is not synced), mathemagician_gre_claim_declined (set only if you decline adding this device's earlier GRE history to your account), mathemagician_fc_study_mode (whether you chose self-grading or multiple choice for each flashcard deck), mathemagician_fc_auto_missed (set only if you change, in GRE Prep, Quant Prep or Settings → Gameplay, whether practice questions and Math facts you miss are added to your Missed questions flashcard deck; the deck itself is kept in mathemagician_flashcards, above), and mathemagician_tour_armed (set while this browser has seen you, signed out or with a brand-new account, before your first finished drill, so a short show-around of the app follows that drill; it holds only the value 1, is removed once the show-around has been shown, and is never sent anywhere).mathemagician_auth_hint (so the app knows to check for your session), mm_outbox (runs waiting to upload), mathemagician_sync_runs_watermark and mathemagician_sync_account_runs (sync bookkeeping: which of your runs your account already has), mathemagician_sync_settings_pending (a settings change that has not reached your account yet, for example one made offline just before you signed out: your account ID, when you made the change and a fingerprint of your settings, so the change is sent the next time that same account signs in on this browser; it is dropped unsent if another account signs in here or your settings change in the meantime, and it is never sent anywhere itself), mathemagician_claim_declined (set only if you decline uploading this device's earlier runs, so you are not asked again), mathemagician_flashcards_claim_declined (the same thing for the decks you already had on this device), mathemagician_about_you_seen: followed by your account ID (whether “About you” was already shown to that account in this browser), mathemagician_email_step_skips: followed by your account ID (the dates and times, at most two, that you chose Not now on “Can we email you?” in this browser, so it asks at most once more, and not on the same day) and mathemagician_account_tour_due: followed by your account ID (set when this browser first sees that account as newly created, so the account's short show-around still comes if the page is reloaded before it is shown; it holds only the value 1, is removed once that show-around has been shown here or on another of your devices, and is never sent anywhere).mathemagician_guest_runs_watermark, the date of the newest run on this device that has already been sent, or that came from your account, so no run is sent twice and an account's runs are never sent as anonymous ones. It stays on this device. And mathemagician_guest_activity: today's date (UTC), the random code for the day described above, and which features this browser has already reported today, so each is reported once; it is replaced at the next UTC midnight and is never sent anywhere as a whole.mathemagician_push_prompt, which stays on this device and is never synced. In the app it counts the drills you finish (so notifications are only offered after your third), remembers when you answered or dismissed that offer and whether you turned notifications off for this phone in the app, and holds this phone's push notification token until it has been removed from our servers, which happens when you sign out or turn notifications off. In a browser it holds the address of this browser's push subscription while game notifications are on for it.mathemagician_attribution (how you arrived, described above, plus, if you came from one of our ads, that ad's click ID and which version of our landing page you saw; these two are never sent to our servers), mathemagician_auth_return (which screen to return to after signing in with Google), mathemagician_plan_intent (the membership tier and billing period you picked, so it survives signing in and the trip to Stripe; ignored after an hour), mathemagician_gift (a gift code from a gift link you opened, or the gift tier you are buying, so it survives signing in and the trip to Stripe; ignored after an hour) and mathemagician_referral (the invite code from a Bring a friend link you opened, so it survives signing up; deleted once used or after 24 hours).utm_ tags and ad-click identifiers), and events such as starting a drill (the mode and difficulty) and finishing one (the mode, difficulty, accuracy and duration), starting an Arcade game (which game) and finishing one (which game, your score, whether it was a new best, and how long it took), using Quick start, playing an Arena match, sharing a result card, changing theme, and signing up or signing in (only the method). It also receives opening the app each day (how many days since you first and last played), reaching a new level, earning Shells (how many, and from what), claiming a daily quest (which one, and its Shells), buying a Battle Pack or shop items, and reaching a daily XP or Shells limit. It also receives the day's quests becoming ready to open as a chest and opening the daily chest, being offered and claiming a welcome-back bonus (how many days you were away), seeing or tapping a suggestion (which kind), unlocking a trophy and opening the Trophy Room, opening the Today page (how many dailies you have done) and the archive of past dailies, replaying a past Daily Challenge, viewing a leaderboard (which board, and friends or global), and which daily a shared result card was for. It also receives viewing your league (your division), seeing last week's league result (division, place and whether you moved up or down) and changing how you take part in leagues, opening the Game of the Week, each community boss round (the damage it dealt and whether it counted) and claiming its reward, being shown the offer to turn on streak notifications in a browser, turning push notifications for study reminders or streaks on or off in a browser (and whether it worked), and which notification brought you back. It also receives starting to sign in (the method), picking a membership plan, turning your supporter badge on or off, opening membership management, claiming the Legend T-shirt (the size), importing Anki decks (the format and how many decks, cards and reviews), finishing a Flashcards session (how many decks, cards graded, the share you missed and your average time), and, from our landing page, which button brought you to the app and how you chose to sign up, plus three properties of your visits: your layout, whether you are signed in, and the week you first played. It also receives the app's show-arounds (which one opened, each stop shown, and whether you finished it or skipped it, and at which stop), your answer to “Can we email you?” (yes, no or not now, and after a yes, the most often you chose), and how you use the merch shop: opening it (and what led you there), the items you look at or add to your cart (and how many), checking out and your order's total, and seeing, tapping or dismissing a merch suggestion. While you are signed in, it also receives your random R3CK0N account ID, never your email address or username, so that your visits on different devices count as one person. If you arrived from one of our ads, it also receives that ad's click ID and which version of our landing page you saw, so we can tell which ads and pages lead to sign-ups; if you sign in with Google or another provider, we put the click ID back in the page address on your return so it is not lost on the way. Like any site you visit, it also receives your IP address, which Google uses to estimate your location, and your browser and device type._ga and _ga_ followed by an ID, which last up to two years. Switching analytics off deletes them._clck (up to a year) and _clsk (one day). Switching analytics off stops recording and deletes them.R3CK0N shows no ads and loads no advertising tags of its own. We do advertise R3CK0N in Google search results, and our Google Analytics property is linked to our Google Ads account so that we can see which of our ads lead to sign-ups. That is why Google Analytics receives the ad's click ID (described above): only if you opted into analytics, it reports to Google Ads that a visit from one of our ads ended in a sign-up. We don't send Google your email address or anything else that identifies you for this, we don't build remarketing audiences, and we don't use your activity on R3CK0N to target ads at you elsewhere. The cookie banner's Advertising choice is passed to Google's tags as a consent signal; if you leave it off, Google is told not to use advertising cookies or to personalise ads with this data.
R3CK0N makes no automated decisions about you with legal or similarly significant effects. Its automated steps (ratings, league promotions and demotions, fair-play checks and “About you” quality scores) only affect your standing in the game and whether a result or response is counted.
r3ck0n.com/profile/<username>, which anyone with the link can see, signed in or not: your username, avatar, country and bio; your member number and join date; your companion's level and XP; your totals (runs, correct answers, time played, and your longest streak of consecutive days you played a drill or an Arcade round, counting days a member's streak freeze covered); your best speed and average accuracy in each mode; your Arena tier and win, loss and draw record; how many Daily Challenges you have played and your best speed in them; your trophies, including Arcade trophies; your 10 most recent feed items; and how many friends you have. A signed-in visitor also sees your head-to-head record against them.r3ck0n.com/supporters lists your username, avatar, country, tier and when you joined, to anyone. A hidden profile keeps you off the wall. If you are a Patron, your username is also listed in the credits on the About page, to signed-in players. Turning the switch off, or your membership ending, removes all of them.We don't sell your personal information, and we don't share it for advertising. We share it only with the services that run parts of R3CK0N for us, listed here, each of which handles it under its own privacy policy, and in the situations described after the list.
Other players see what is described under What other players can see. We may also disclose information when the law requires it; to protect the safety, rights or property of our players, the public or R3CK0N; or as part of a merger, sale or other transfer of R3CK0N, in which case this policy continues to apply to your information.
Our servers and database are in the United States. Cloudflare and Fly.io carry traffic through data centres around the world on its way to and from them. If you use R3CK0N from outside the United States, your information is transferred to, stored in and processed in the United States. R3CK0N is offered worldwide. When information about people in the EEA, the UK or Switzerland is transferred to the United States, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum to them) in our service providers' data processing terms, or on a provider's certification under the EU–US Data Privacy Framework.
A few records outlive an account because they involve another player too. A notification in someone else's inbox, a report you filed, or a duel another player recorded against your run is kept, with your account removed from it. Groups you own pass to their longest-standing member, and a group with no other members is deleted.
Depending on where you live, you may have legal rights over your information, such as to access, correct, delete or port it, to object to or restrict some uses of it, and to withdraw consent at any time (which doesn't affect what we did before). To use any of them, contact privacy@r3ck0n.com. We will respond within 30 days, and we won't treat you differently for asking.
We rely on these legal bases: contract, to provide the service you signed up for; consent, for Google Analytics and Microsoft Clarity (and the anonymous run results that come with them), the “About you” questions and product-news email, which you can withdraw at any time; and legitimate interests, for security, fair play, preventing abuse, and understanding how R3CK0N is used. You can complain to your local data protection authority. R3CK0N is offered in the EEA and the UK. You can contact us about your rights directly at privacy@r3ck0n.com.
We don't sell your personal information or share it for cross-context behavioural advertising. We use Google Analytics only to measure R3CK0N and our own ads, with Google signals and ad personalisation off, and Google Analytics never loads unless you opt in. If you are in a state that gives you the right to opt out of “sharing” or targeted advertising, leaving Analytics and Advertising off in the cookie banner (or switching them off later) does that.
Anyone can play R3CK0N signed out. Nothing a signed-out player does is sent to our servers unless they opt into analytics, which the cookie banner never allows for anyone under 13, or before it knows an age range (it asks a birth year unless this browser already has one, for example from the age question in “Can we email you?”), and even then only run results with nothing that identifies them.
Accounts are for people aged 13 and older. If you are younger, please play without an account.
Some safeguards are built in. The cookie banner's age question keeps analytics and advertising off for anyone under 13, and advertising off for anyone under 16. The “About you” questions keep nothing but the age range from anyone who says they are under 13 there, or told the cookie banner or “Can we email you?” they are under 13: not their other answers, nor the form's timing, time zone, language or how they arrived (if “About you” itself already says 13 or older, its answers are kept for the review described below). Telling us you are under 13 in any of those places also stops a bio from being added to your profile. “Can we email you?” asks for an age range first when we don't know it, never asks anyone under 13 about email, and tells anyone who answers “Under 13” that accounts are for people 13 and older unless their class uses R3CK0N. And nobody who says they are under 18 is offered product-news email, and accounts known to belong to someone under 13 get only sign-in, account and payment emails.
Players who tell us they are under 16 (in the age question of the cookie banner or of “Can we email you?”, or in “About you”) never appear on global leaderboards, the Arcade's or the Daily Challenge's, whatever their profile setting. They can still see those boards, and they appear on their friends' boards. An “Under 13” answer in “About you” always counts, whatever the other age questions say.
In league tables and among the community boss's top contributors, players under 16 appear anonymously to anyone who is not their friend.
A student under 13 can have an account to join a class whose teacher is on an active Classroom plan. In that case the school or teacher, acting for the parents in an educational setting, consents to the student using R3CK0N for that class, as COPPA's school exception allows. The teacher sees only what is described under Classroom. Players we know are under 13 can't buy anything or use the AI coach. By creating a class, a teacher confirms they are authorised by their school to give that consent. A parent can ask the teacher, or us at privacy@r3ck0n.com, to review their child's information or have it deleted, and to stop any further collection; deleting it removes the student from the class.
If you believe a child has given us personal information without a parent's permission, contact privacy@r3ck0n.com and we will delete it. If an account tells us its holder is under 13 (in “About you”, in the age question of “Can we email you?”, or in the cookie banner on a browser signed in to it or before signing in there) and it isn't in a class on an active Classroom plan, we review it: we email the account's address and then delete the account, unless we hear back that the answer was a mistake. Until then it is treated as belonging to someone under 13, as described above. If that answer came from the cookie banner or “Can we email you?” but the account's “About you” answers say 13 or older (as can happen on a browser shared with a younger player), we don't erase those answers; the review decides which is right.
The site and API are served only over HTTPS. Your sign-in session is kept in a cookie that page scripts can't read, passwords are stored only as hashes, a passkey gives us only its public key, and card details never reach our servers. Sign-in attempts and API requests are rate-limited. No system is perfectly secure, so please look after your email account too: it is the key to your R3CK0N account.
When R3CK0N changes what it collects or how it uses information, we will update this page and the date at the top. If a change is significant, we will tell signed-in players before it takes effect. We announce a significant change with a notice in the app and an email to account holders at least 30 days before it takes effect.
Questions, requests or complaints about privacy: privacy@r3ck0n.com. R3CK0N is run by 712 Capital.
See also the Terms of Service.
JavaScript is needed to play.