Privacy Policy

This Privacy Policy explains how we collect, use, store, share and protect your personal information when you download, install or use our mobile games and related services (the "Service"), and describes the rights you have over your information. By using the Service, you acknowledge that you have read and understood this Policy.

1. Scope

This Policy applies to the mobile applications and games we develop and publish, our official website, our customer support channels, and related services we provide through social platforms and advertising channels. It does not apply to third-party websites, applications or advertisers, which are governed by their own privacy policies. We encourage you to read those policies separately.

2. Information We Collect

2.1 Information you provide to us

• Account information — nickname, avatar, email address, password (stored hashed), and third-party login identifiers returned by Sign in with Apple, Google Sign-In or Facebook Login.
• Support and feedback information — the description of your issue, contact details, device information, game account information, and any screenshots or videos you choose to upload.
• Event and survey information — responses and contact details you submit when participating in official events, surveys or beta programs.
• Transaction records — we do not collect or store your full card number, cardholder name or security code. Purchases are processed through Apple In-App Purchase or Google Play Billing; we only receive the order ID, purchased item, amount and transaction status returned by the store.

2.2 Information collected automatically

• Device information — device model and manufacturer, OS version, system language, time zone, screen resolution, network connection type, battery and performance state.
• Identifiers — advertising identifiers (IDFA on iOS, AAID on Android), our own app instance ID and user ID, and device fingerprints used only where necessary for anti-fraud purposes.
• Usage information — game progress, level and achievement records, login and logout times, session length, screen views and taps, feature usage frequency.
• Technical and diagnostic information — IP address, crash logs, error reports, performance traces and API request logs.
• Ad interaction information — ad impressions and clicks and the advertising identifier (cross-app tracking occurs only after you grant tracking permission on iOS).

2.3 Information from third parties

• App stores — subscription status, purchase history, refund notifications and subscriber identifiers provided by Apple and Google.
• Login and social providers — basic profile information you authorise us to receive.

3. How We Use Your Information

• Delivering and operating the Service — creating and verifying accounts, saving and syncing game progress, enabling social or multiplayer features, redeeming virtual items.
• Customer support — responding to and resolving your questions, complaints, disputes and refund requests.
• Security and anti-fraud — detecting and preventing cheating, hacks, account theft, fraudulent transactions and abuse, and keeping the Service safe and fair.
• Analytics and product improvement — measuring usage, analysing retention and level difficulty, fixing bugs, and improving performance and user experience.
• Advertising and monetisation — serving and displaying ads and measuring ad performance; personalised ads are shown only where we have the required consent.
• Marketing messages — sending update, event and promotional notifications where legally permitted (you can opt out at any time).
• Legal compliance and claims — meeting legal obligations, responding to lawful requests from authorities, and establishing or defending legal rights.

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following bases:

• Performance of a contract — to provide the game services and account features you request.
• Legitimate interests — to keep the Service secure, prevent fraud, and analyse and improve the product; we have balanced these interests against your rights and concluded they do not override them.
• Your consent — for personalised advertising, cross-app tracking, marketing push notifications and non-essential cookies; you may withdraw consent at any time.
• Legal obligations — to comply with tax, accounting and consumer protection rules, or to respond to lawful government requests.

5. Third-Party Service Providers and SDKs

To deliver the features above, we may engage the following categories of service providers. Each provider accesses data only to the extent necessary to deliver its service, and is bound by its contract with us and by its own privacy policy.

We share data with these providers only to the extent necessary, and we contractually require them to process data solely on our instructions, apply appropriate security measures, and not use the data for their own purposes.

6. Advertising, Tracking and Your Choices

• Apple App Tracking Transparency (ATT) — on iOS 14.5 and later we display the system permission prompt before any cross-app tracking, and we will not access the IDFA for cross-app tracking without your authorisation.
• Android advertising ID — you can reset or delete your advertising ID in system settings, and enable "Delete advertising ID" to opt out of personalised ads.
• Opting out of personalised ads — you can turn off personalised advertising in the in-game settings page, or manage it through each ad platform's user settings.
• We do not target advertising based on sensitive personal information such as race, religion, health or sexual orientation, and we do not serve behaviourally targeted ads to minors.

7. Sharing and Disclosure

Except as described below, we do not disclose your personal information to third parties:

• Service providers — partners processing data on our behalf to deliver the Service (see Section 5).
• Legal requirements — in response to a valid court order, government or regulatory request, or to protect the rights, property and safety of the Company, our users or the public.
• Corporate transactions — in a merger, acquisition, asset transfer or restructuring, data may transfer with the business; we will require the acquirer to protect your data to standards no less protective than this Policy.
• Aggregated statistics — we may publish aggregated statistics that cannot be used to identify any individual.

We do not sell your personal information, nor do we exchange it for monetary consideration, as "sell" is defined under the California Consumer Privacy Act (CCPA/CPRA).

8. International Data Transfers

Our Service may be processed and stored on servers located in Hong Kong, Singapore, the United States and/or other regions, so your personal information may be transferred outside your country or region of residence. Where required, we implement appropriate safeguards such as the EU Standard Contractual Clauses, due-diligence reviews of our vendors, and transfer of only the minimum data necessary for the processing purpose.

9. Data Retention

• Account and game progress — retained while your account remains active; once you delete your account, we delete or anonymise the related information within a reasonable period.
• Technical, analytics and diagnostic logs — deleted or aggregated into non-identifying statistics within a reasonable period after the processing purpose is fulfilled.
• Transaction and accounting records — retained for the period required by applicable tax and accounting law.

When the retention period expires or the processing purpose is fulfilled, we delete or anonymise your personal information. Where a longer retention is required by law or for dispute resolution, we retain only what is necessary.

10. Security

We apply technical and organisational safeguards consistent with industry practice, including transport encryption (HTTPS/TLS), encryption at rest, hashed passwords, role-based access control and data minimisation, audit logging, and periodic security reviews. However, no internet environment is completely secure and we cannot guarantee absolute security of transmission or storage. Please keep your account credentials safe and avoid disclosing personal information in public areas.

11. Your Rights

Where permitted by applicable law, you have the following rights regarding your personal information:

• Access — obtain a copy of the personal information we hold about you.
• Rectification — request correction of incomplete or inaccurate data.
• Account and data deletion — you can request deletion directly using the "Delete Account" option on the in-game settings page, or by contacting us as described in Section 16; we will delete your account and the personal information associated with it.
• Restriction / objection — request restriction of, or object to, processing in certain circumstances.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Opt out of personalised ads and tracking — as described in Section 6.
• No automated decision-making — we do not make decisions based solely on automated processing that produce legal effects concerning you.
• Lodge a complaint — file a complaint with the data protection authority in your jurisdiction.

To exercise these rights, contact us using the details in Section 16. To protect your account, we may ask you to verify your identity before we act. We will respond within the period required by applicable law, generally no later than 30 days.

12. Children's Privacy

• The game is rated 8+ (suitable for ages 8 and above), so children may be among our players. We therefore apply a higher standard of care to the protection of children's and minors' information.
• We collect only the minimum information necessary to deliver the game, and we do not ask users to provide directly identifying details such as name, postal address, telephone number, school or photographs.
• We do not serve behaviourally targeted advertising to, or run personalised ad campaigns against, users under 13 (the age covered by COPPA in the United States) or under the applicable age of consent in their jurisdiction.
• If we become aware that we have inadvertently collected personal information from a child below the applicable age, we delete that information promptly.
• If you are a parent or legal guardian and believe your child has provided personal information without your consent, contact us using the details in Section 16 and we will help you review, correct or delete that information.
• We comply with the US Children's Online Privacy Protection Act (COPPA), the GDPR provisions on children's age of consent, and the Apple App Store and Google Play rules on minors' accounts, advertising and spending.

13. Cookies and Similar Technologies

Our official website and campaign pages may use cookies, pixel tags, SDKs and local storage to keep you signed in, remember preferences, analyse traffic and measure advertising performance. You can refuse or delete cookies through your browser settings; disabling essential cookies may cause parts of the site to stop working. Where required (for example in GDPR jurisdictions), we ask for your consent to non-essential cookies via a banner on your first visit.

14. Regional Supplemental Terms

14.1 EEA and United Kingdom (GDPR / UK GDPR)

You have all the rights listed in Section 11. Our privacy contact is apple@calicogames.hk. You may also lodge a complaint with the data protection supervisory authority in your jurisdiction at any time.

14.2 California, United States (CCPA / CPRA)

California residents have the right to know the categories and sources of personal information we collect, the purposes of use and the categories of recipients; to request deletion and correction; to opt out of the "sale" or "sharing" of personal information and to limit the use of sensitive personal information; and not to receive discriminatory treatment for exercising these rights. We do not sell personal information, nor do we share it for cross-context behavioural advertising except where you have consented.

14.3 Brazil (LGPD) and other regions

If you are in Brazil or another jurisdiction with data protection legislation, you likewise have rights of access, correction, deletion, anonymisation, objection and withdrawal of consent. Contact us as described in Section 16.

14.4 Other jurisdictions

Where your jurisdiction imposes mandatory rules on cross-border transfer, data localisation or protection of minors, we adjust our handling accordingly and publish a notice where necessary.

15. Changes to This Policy

We may update this Policy to reflect changes to the Service, the law or our business. For material changes we will update the "Last updated" date and notify you through an in-app notice, our website or email. Where a change requires your consent, we will obtain it separately. We encourage you to review this page periodically for the latest version.

16. Contact Us

• Operator: Calico Games Limited
• Contact email: apple@calicogames.hk
• Official website: https://calicogames.hk
• Response time: we aim to reply within 30 days of receiving your request.