Horush Privacy Policy

Effective October 11, 2026

Horush is a dance game for Android, Android TV and iOS (the “app”) with the website horush.ru. This policy explains what data the app collects, why, who receives it, how long it is kept and how to delete it. It applies to every version of the app and to the website.

1. Who processes the data

Operator

Tarasoft-A LLC (ООО «Тарасофт-А»)

Tax ID (INN) / OGRN

5047284734 / 1235000161439

Address

Nauchny per. 4 bldg. 1, premises 29, Dolgoprudny, Moscow Region, 141701, Russia

E-mail

t@andru196.ru — privacy questions and deletion requests

2. In short

• The camera works only on your device. Camera images and video never reach us.
• We don’t need your name, e-mail or phone number: an account is a username and a password.
• The game is for all ages (0+). On first launch it asks your year of birth — no name, day or month.
• Rewarded ads in the Android app are shown only from age 13 and only with your consent, which the app asks for before the first video. You give the consent to us, and it covers sharing data with our partner Yandex: its ad network and, if the device’s Google Play account is from Russia, also its AppMetrica statistics service. Children get no ads.
• Usage statistics and crash reports go to us. If the device account — Google Play or Apple ID — is not from Russia, they also go to Google’s Firebase service — without your username and without the advertising ID.
• We don’t sell data.
• You can delete your account and all data in the app or by e-mail — see section 7.

3. What data we process

3.1. Account

• Guest account. On first launch the server creates an account with a random name like “guest-…” and no password. It holds no information about you or your device — only game progress.
• Your own account — a username and a password. The password is stored only as a cryptographic hash. Other players can see your username in the leaderboard and in search.
• Sign-in with VK ID, Yandex ID, Google, Apple or Gosuslugi (where available). The service sends us your ID with that service and your name; Gosuslugi sends only the ID. We don’t request your e-mail or phone number from these services.
• Session. Sign-in tokens are stored on your device in the system’s secure storage; the server keeps only their hashes.
• Year of birth. On first launch the app asks your year of birth (no day or month); your age is the difference between the current year and that year. Your age is used to pick age-appropriate songs and to show no ads to children under 13. The chosen song age filter goes into usage statistics.
• Your answer about rewarded ads — consent or refusal and the date of the answer. Kept on your device and on our server with your account.

3.2. Camera and movement

• Camera video is processed on your device: a neural network finds 17 body points, and the game scores your moves from them. Frames and video are not sent to the server.
• In “phone as a camera” mode, frames go directly between your own devices over the local network and never reach us.
• In ranked mode the server receives the coordinates of those 17 points during the dance and the body proportions measured at calibration — to verify the score and protect the leaderboard from cheating. The coordinates are used only while the attempt is being checked and are not stored. We keep the attempt result, the check metrics and a random ID of the app installation.
• Gameplay recordings are created and stored only on your device; drafts older than 14 days are deleted automatically. Only you can share a recording — through the system share sheet.
• The app does not use the microphone.

3.3. Game data

Progress, scores and records, titles, quests, coins and their history (including rewards for watching ads), and dance ratings.

3.4. Social features

If you use them: posts (caption, visibility, score), comments, likes, post views, follows, blocks and reports. You choose who sees your posts: everyone, followers or only you.

3.5. Technical data

• Usage statistics: in-app events (for example, a screen opened, a dance started and finished, a setting changed), platform, app version and time. We don’t record device model, OS version or IP address in our statistics. Firebase or AppMetrica receives the same events and crash reports, depending on the country of the device account — see section 5.
• Crash reports: error type and message, the place in the code, platform and app version.
• Country. The app determines your country from the mobile network, SIM card or system language — without location access — and sends it to the server to show tracks available in your region. The server does not store it.
• IP address is used by the server to rate-limit requests and prevent abuse. IP addresses are not stored in the database.
• Notifications (where supported and if you turned them on): the device token for delivery, language, time zone, quiet hours and chosen notification topics.

3.6. Data on your device

Settings (including your year of birth and your answer about ads), downloaded dances, recognition models and gameplay recordings are stored on your device. “Settings” → “Reset the app” or uninstalling the app erases them.

3.7. The horush.ru website

The website uses no cookies, counters or ads. Your chosen site language is remembered in your browser. The camera demo on the website runs in your browser and sends nothing.

4. Why

• to make the game work: account, progress, the dance catalog available in your region;
• to pick age-appropriate songs and to show no ads to children;
• to keep the ranking fair: verifying scores and preventing cheating;
• to run social features;
• to find and fix bugs and improve the game — from usage statistics and crash reports;
• to show ads that you watch in exchange for an in-game reward — with your consent;
• for service security and to comply with the law.

5. Who receives the data

• Yandex (YANDEX LLC, Russia). The Android app includes the Yandex Mobile Ads library together with the AppMetrica analytics library. It does not start with the app: before the first video the app asks for your consent to showing ads and sharing data with Yandex, and only after that — and only if you are 13 or older — the library starts and receives the device advertising ID, device and network information (including model, OS version, language, mobile carrier, IP address) and ad impression data. If the device’s Google Play account is from Russia, after the same consent AppMetrica also receives game statistics — instead of Firebase: the same events as our server (section 3.5), crash reports and a de-identified player ID — a one-way hash of the username that does not contain the username itself; it does not receive location. Without consent, and for children, the library does not start and receives nothing. To withdraw consent: Settings → Rewarded ads. Yandex processes the data under its privacy policy and the AppMetrica terms. You can limit ad personalization by resetting or deleting the advertising ID in Android settings. Other versions of the app have no ads.
• Google (Google LLC, USA) — the Firebase Analytics and Firebase Crashlytics services in the Android and iOS app: usage statistics and crash reports. Only if the device account is not from Russia: the app learns the country of the Google Play account from the Google Play service on the device, and the country of the Apple ID from the App Store; if it is Russia or the country cannot be determined, Firebase does not start and receives nothing. Firebase receives the same events as our server (section 3.5); a de-identified player ID — a one-way hash of the username that does not contain the username itself; crash reports (error type and message, the place in the code, the screen where the crash happened); and data the library collects by itself: the app installation ID, device model, OS version, language, and country and region derived from the IP address. Firebase does not receive the device advertising ID, and this data is not used for advertising. The data is stored on Google’s servers, including outside Russia. Google processes it under its privacy policy and the Firebase terms.
• Sign-in services — VK, Yandex, Google, Apple, Gosuslugi — only if you choose to sign in with them: you confirm sign-in on their page, and they send us the data listed in section 3.1.
• The platform’s notification delivery service (for example, RuStore) — if you turned notifications on: the device token and the notification text.
• Hosting provider. The server and database are located in Russia (Moscow) on rented hardware. The provider runs the hardware and does not use the data for its own purposes.
• Other players see your username, rank and scores in the leaderboard, and your posts and comments — according to the visibility you chose.
• Government authorities — only when required by law.

We don’t share data with anyone else.

6. How long we keep data

• the account and data linked to it — for as long as the account exists, including a guest account;
• usage statistics and crash reports — 180 days;
• in Firebase: Analytics events — no longer than 14 months, Crashlytics crash reports — 90 days; in AppMetrica — under the AppMetrica terms;
• the log of sent notifications — 90 days;
• data of an unfinished sign-in with a third-party service — up to 10 minutes;
• body point coordinates in ranked mode — only while the attempt is being checked;
• server technical logs — limited in size: old entries are overwritten by new ones.

7. How to delete your account and data

In the app

1. On the main screen, tap the round avatar in the top left corner.
2. Open the “Account” tab.
3. In the “Danger zone” card, tap “Delete account…”.
4. Enter your password and tap “Delete forever”.

The account is deleted immediately and permanently.

If you play without signing in (as a guest), there is no delete button. First, on the same “Account” tab, tap “Save my progress” and choose a username and password — it’s the same account — then delete it as described above.

Without the app

E-mail t@andru196.ru with the subject “Delete my Horush account” and include your username. To make sure no one else deletes your account, we may ask you to confirm it is yours. We will delete the account and reply within 10 business days. Use this route too for an account you signed in to only with VK, Yandex, Google, Apple or Gosuslugi and that has no password, and for the account of an author of dances in the official catalog.

What is deleted

The account, username, password, links to sign-in services, progress, coins, ranked attempt history and leaderboard entries, posts and their files, comments, likes, views, follows, blocks, reports, ratings, your answer about ads, notification settings, usage statistics and crash reports.

What remains

• an entry in the server technical log with the ID of the deleted account — until the log overwrites it;
• data that Yandex received through the ad library and AppMetrica: it is not linked to your account (AppMetrica has only the de-identified ID), and its deletion is governed by Yandex’s rules;
• data in Firebase: it is linked only to the de-identified ID and is deleted on the schedule in section 6;
• data on your device — “Settings” → “Reset the app” or uninstalling the app erases it.

8. How we protect data

• the app talks to the server only over HTTPS;
• passwords and sign-in tokens are stored on the server only as hashes;
• on the device, tokens are kept in the system’s secure storage, and Android cloud backup of app data is turned off;
• access to the server and database is restricted.

9. Children

Horush is suitable for all ages (0+). To keep the game safe for children:

• on first launch the app asks only the year of birth — no name, day, month or other details about the child; it can be changed only via Settings → Reset the app;
• children under 13 see no ads, and the Yandex libraries — ads and AppMetrica — do not start;
• our statistics and crash reports, and those in Firebase, contain no username and no advertising ID;
• songs are picked by age: tracks with a higher age rating are hidden, and this limit cannot be lifted in settings;
• no name, e-mail or phone number is needed to play; the camera works only on the device.

If you are a parent and want to know what data of your child we keep, or to delete it, write to us — we reply within 10 business days.

10. Your rights

You can find out what data of yours we process, get a copy of it, correct it, ask us to delete it and withdraw your consent to processing. Consent to ads is withdrawn in the app: Settings → Rewarded ads. Write to t@andru196.ru — we reply within 10 business days. If you believe we violate your rights, you may complain to Roskomnadzor (the Russian data protection authority) or to the supervisory authority of your country.

11. Changes to this policy

A new version is published on this page with its date at the top. We will announce significant changes — for example, new recipients of data — in the app’s update notes.