Privacy policy

The short version

Who we are

Raw is made by 1% Labs, the trading name of 1PERCENTLAB SOLUTIONS LTD, a private limited company registered in England and Wales (company number 16817752). It's the company responsible for your data (the "controller"), and in this policy "we" and "us" mean it.

Write to us at hello@1percentlabs.com about anything in this policy. Raw's own emails, such as sign-in codes, come from raw@1percentlabs.com; that address doesn't receive replies, so please use hello@1percentlabs.com instead.

We follow UK data protection law (the UK GDPR and the Data Protection Act 2018) and, for people in the European Union, the EU GDPR.

What we collect

Your account

Your email address, which you sign in with using a one-time code (there's no password). The display name you choose. Your birth year, not your full date of birth: we use it to check you're 13 or over and to place you in an age group (13 to 17, or adult).

Trying Raw before you have an account

You can try Raw before giving an email. The app makes a trial account with no email that holds your track picks, settings and test answers. If you add an email, it becomes your account.

What you do in Raw

Your answers, including what you write; scores; how long you took; hints used; skill and battle ratings; streaks, XP and badges; league results; battle and duel history; your daily goals and training runs; and which questions you've seen, so you don't get repeats.

Fair-play signals

While a card is open, the app counts paste attempts and how often and how long you leave the app, and notes whether you're offline. These decide whether an answer counts for leagues. We don't record your keystrokes, your screen or anything in other apps.

Your settings

Tracks and coding languages, theme, text size, sounds, haptics, reduce motion, reminder time, daily goal, character, Raw mode, and which notifications you want.

Friends and social

Your friendships, the invite codes you make, nudges, battle reactions (presets, never free text), and your duel answers and votes.

Reports and moderation

Reports you make (the reason and any note you add), reports about your duel answers, and what our staff decided about them, including any warning.

Your device

Its platform (iOS or Android) and the app version, and, if you allow notifications, a push token: an address for sending notifications to that device.

Your time zone

Your device's time zone (for example, Europe/London), so your day and streak start at the right time. Not your location.

Sign-in and security records

Our sign-in provider records sign-ins and account changes with the IP address and device or browser details, to protect accounts from misuse.

Messages to us

Whatever you send to hello@1percentlabs.com, including waitlist emails, and our replies.

This website

No cookies and no analytics. Our host keeps standard request logs (IP address, browser, page requested and time) for security and to keep the site running.

What we don't collect

We don't ask for your real name (unless you choose it as your display name), your full date of birth, your contacts, photos, microphone, precise location or advertising ID. We don't build advertising profiles, and we don't sell or rent personal data. There are no analytics, crash-reporting or advertising SDKs in the app today; if we add any, we'll update this policy first.

How we use it

Under the UK GDPR (and the EU GDPR) we need a legal basis for each use. Here's what we do, and the basis for it.

• To run Raw for you: sign you in, build your daily set, mark your answers, and keep your ratings, streak, leagues, battles, friends and duels. Basis: our contract with you (the terms of use).
• To keep play fair: decide whether answers are ranked, and spot cheating. Basis: our contract with you, and our legitimate interest in fair competition.
• To keep people safe: the age check, age groups, checking duel answers before others see them, and handling reports. Basis: our legitimate interest in a safe community, and our legal obligations.
• To improve the questions: we combine answers from many players into statistics (how often a question is answered right, how long it takes, how hard it is) to set difficulty and fix bad questions. The statistics don't identify anyone. Basis: legitimate interests.
• To send what you asked for: sign-in codes by email, and notifications if you turn them on. Your device's permission is your consent, and you can switch them off in Settings at any time. We don't send marketing email. If you email us to join the waitlist, we use your address only to tell you when Raw is out. Basis: our contract with you, and your consent.
• To answer you when you contact us. Basis: legitimate interests.
• To meet legal obligations and enforce our terms. Basis: legal obligation and legitimate interests.

Where we rely on legitimate interests, we've weighed them against your rights, and you can object (see your rights).

AI and your answers

• Some written answers are marked by an AI model from OpenAI, against a marking guide. We send OpenAI the question, the marking guide and your answer text. We don't send your name, email, account ID or anything else that says who you are, and we ask OpenAI not to store the request. Under OpenAI's API terms, data sent this way isn't used to train its models, though OpenAI may keep it for a short time to check for abuse. Please don't put personal details in your answers.
• We also use OpenAI to help write and check questions. That uses no player data.
• AI marking is automatic and can be wrong. It affects your score, ratings and league points, nothing more. If a mark looks wrong, report the question from the result screen or email us, and a person will look at it.
• We don't use your answers to train AI models.

What other players see

There are no public profiles and no way to search for people. Other players see only this:

• In your league: your display name and points.
• In a battle: your display name and battle rating, and that you've answered a round (never what) until it ends.
• Friends you've added: your display name, the tracks you follow, your streak, and whether you've done today's set.
• People voting on a duel: your duel answer, never your name.

Nobody else sees your email, birth year, age group or other answers.

Who else handles it

We use these companies to run Raw. They handle data on our behalf, under contract, only to provide their service to us.

Supabase

Our database, sign-in and server functions, run on Amazon Web Services in Tokyo, Japan. It holds your account and everything you do in the app.

Amazon Web Services (AWS)

Sends Raw's emails, such as sign-in codes (Amazon SES, United States), and hosts this website (AWS Amplify).

OpenAI (United States)

Marks written answers and helps write questions, as described in AI and your answers.

Expo (United States)

Delivers push notifications to your device. It receives the push token and the notification's text.

Later, for purchases

When we add the optional Raw+ subscription, Apple (App Store) or Google (Google Play) will take payment, and RevenueCat will tell us whether you're subscribed. We'd get your subscription status, never your card details. We'll update this policy before then.

Apple and Google also run the app stores you download Raw from, under their own privacy policies. We may also disclose data when the law requires it, to protect someone's safety, or as part of a sale or reorganisation of our business, in which case we'd tell you first. We don't sell personal data or share it for targeted advertising.

Where it's stored

• Your account and app data are stored by Supabase in Tokyo, Japan (AWS ap-northeast-1). Both the UK and the EU recognise Japan as protecting personal data adequately, so moving data there needs no extra safeguards.
• This website is served through AWS's worldwide content delivery network, so a copy of each page is held near you.
• Emails, AI marking and push notifications are handled in the United States, by Amazon SES, OpenAI and Expo. Where data about you goes to a country without that recognition, we rely on the safeguards UK and EU law provide for such transfers.

How long we keep it

• Your account and app data: until you delete your account.
• Trial accounts: a trial that never added an email is deleted automatically after 30 days without activity.
• Under 13: if the birth year entered means someone could be under 13, the trial account and its answers are deleted straight away, and no email is asked for.
• When you delete your account: your account and everything linked to it is deleted from our database straight away. That includes your profile, answers, ratings, streaks, badges, league places, friendships, invites, battles, duels (a duel you were in is removed for the other player too), settings and devices. How to delete your account.
• Backups: backups are kept for 30 days, so deleted data can stay in them for up to 30 days before it's gone for good.
• What stays after deletion: reports you made, without your name, so moderation records stay complete; question statistics, which don't identify anyone; and records of what our staff did.
• Sign-in and server logs: kept by our providers for a limited time, for security and to fix problems, then deleted.
• Emails to us: as long as we need them to help you and follow up.

Your rights

Wherever you live, you can ask us to:

• show you the data we hold about you, and give you a copy you can take elsewhere;
• correct it (you can change most of it in the app);
• delete it (in the app, or by email);
• stop or limit some uses of it, such as those based on legitimate interests;
• and you can withdraw consent you've given, such as for notifications, at any time.

Email hello@1percentlabs.com from the address you sign in with. We may ask you to confirm it's you, then we'll reply within one month (45 days for California requests).

If you're in the UK or the EU

These are your rights under the UK GDPR and the Data Protection Act 2018, or the EU GDPR. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EU, to the data protection authority where you live. We'd appreciate the chance to sort it out first.

If you're in California

You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be treated differently for using these rights. You can use an authorised agent. We don't sell personal information or share it for cross-context behavioural advertising, and we don't use sensitive personal information to infer things about you.

In the last 12 months we've collected: identifiers (email, account ID, push token, IP address); your display name; your age (as a birth year); activity in Raw (answers, scores and play history); and inferences (your skill ratings). They come from you, your device and your use of Raw, for the purposes above, and go only to the providers listed above. Other US states give similar rights, and the same email works.

Children and teens

Raw is for people 13 and over. The app asks for a birth year before it asks for an email. If the year means someone could be under 13, it stops, deletes the trial account and its answers, and collects no email. We don't knowingly keep data about anyone under 13. If you think a child under 13 has an account, email hello@1percentlabs.com and we'll delete it.

For 13 to 17s: there's no public profile; battles, duels, duel voting and leagues are only with their own age group; there are no messages; and friends are added by invite code only. The safety page has the details.

Parents and guardians can email us about a teen's account, including to have it deleted. We'll confirm the account first, for example with a code sent to its email address.

Security

Data is encrypted in transit and stored with providers that encrypt it at rest. The database enforces access rules on every table, so each player can reach only their own data, and answer keys never leave our servers before you answer. Staff access is limited to the people who need it, and what they do is logged. No system is perfectly secure: if a breach puts your data at risk, we'll tell you and the authorities as the law requires.

Changes to this policy

If we change this policy, we'll post the new version here with a new date. If a change matters, we'll tell you in the app before it takes effect.

Contact

Questions or requests: hello@1percentlabs.com.