Privacy Policy

1. Introduction and scope

DEVPLAY LTD (“DevPlay”, “we”, “us”, “our”) develops and publishes mobile applications and games. We respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains what personal data we collect when you use our mobile applications, games, websites (including devplay.mobi) and related services (together, the “Services”), why we collect it, the legal bases on which we rely, who we share it with, how long we keep it, and what rights you have.

This Privacy Policy applies to all Services that link to or reference it. It does not apply to third-party products, websites or services that we do not control, even where they are accessible through our Services — please read their own privacy notices.

Please also read our Terms of Service, which govern your use of the Services.

2. Who we are

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the UK GDPR and the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018), the data controller of your personal data is:

• DEVPLAY LTD
• Registration number: HE [registration number]
• Registered office: 1 Apriliou 21, Paramytha, Limassol, Cyprus, 4540
• Email: [email protected]

Some of our advertising and analytics partners act as independent controllers in respect of the data they collect through our Apps. In those cases, their own privacy policies govern their processing; the main partners and links to their policies are listed in section 7.

3. Personal data we collect

The data we collect falls into three categories: data you give us, data we collect automatically, and data we receive from third parties. The exact data collected depends on the App you use, your device, your operating system and the permissions and consents you have given.

3.1 Data you provide to us

• Account and profile data — where an App offers registration: username or display name, email address, password (stored in hashed form), avatar or profile picture, date of birth or age range, country, and any biographical details you choose to add.
• Support and correspondence data — the content of the messages you send us, your name, email address, the App and device concerned, purchase or transaction identifiers, and any attachments (such as screenshots) you provide, when you contact us by email or through the contact form on our website.
• Contact form data — the name, email address, subject and message you submit through devplay.mobi/contact-us.html, together with the date and time of submission and the IP address from which it was sent (the latter for the purpose of preventing spam and abuse).
• User-generated content — where an App offers such features: nicknames, chat and forum messages, comments, drawings, photos or other content you choose to share.
• Survey, competition and beta programme data — the responses and contact details you give us when you take part voluntarily.
• Marketing preferences — your consent to, or objection to, receiving newsletters, push notifications or promotional emails.

3.2 Data we collect automatically

• Device and technical data — device make and model, device name, operating system and version, screen resolution, device language and locale, time zone, carrier and network type (Wi-Fi/mobile), available and total storage and memory, battery status, CPU/GPU information, and whether the device is jailbroken or rooted.
• Identifiers — the Apple Identifier for Advertisers (IDFA) and Identifier for Vendors (IDFV) on iOS, the Google Advertising ID (GAID/AAID) and App Set ID on Android, an internal DevPlay app-installation identifier, session identifiers, and identifiers assigned by our analytics and advertising partners. The IDFA is collected only where you have granted permission through Apple's App Tracking Transparency prompt.
• Log and connection data — IP address (from which an approximate, city- or country-level location may be inferred), date and time of access, referring URL, HTTP request and response data, and user-agent string.
• Usage and gameplay data — installation, first launch, session start and end times, session length and frequency, levels started and completed, scores, progression, in-App events, features used, buttons tapped, settings changed, tutorial completion, and other interactions with the App.
• Advertising data — advertisements requested, shown, viewed, clicked or skipped, rewarded-video completions, ad network and placement identifiers, and inferred advertising interests or audience segments.
• Purchase and subscription data — see section 6.
• Diagnostic and performance data — crash reports, stack traces, error logs, load times, frame rates, latency and other technical performance metrics.
• Attribution data — the campaign, ad network, creative, publisher and referrer information associated with the click or view that led to your installation of an App.

Precise location. Our Apps do not require access to precise GPS location, and we do not collect precise geolocation data unless an App expressly asks for it and you grant the permission through your device settings. Where we refer to “location” in this Policy, we normally mean the approximate country or city inferred from your IP address or your device's regional settings.

3.3 Data we receive from third parties

• From App Stores — Apple and Google provide us with anonymised or pseudonymised transaction data (transaction identifiers, product purchased, price, currency, country, subscription status, renewal and cancellation events, refund events) and aggregated statistics about installations, ratings and reviews.
• From advertising and attribution partners — install attribution, campaign performance, audience segments and, where you have consented, advertising identifiers.
• From social networks — where you choose to sign in with, or link, a social account, we receive the data that network makes available in accordance with your privacy settings on that network, typically your identifier, display name and profile picture.
• From fraud prevention and security providers — signals indicating suspected fraudulent, automated or abusive activity.

We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation). Please do not send us such data through support requests or user-generated content.

4. How and why we use your data

5. Legal bases for processing

Where the GDPR applies to our processing, we rely on the following legal bases:

• Performance of a contract — where processing is necessary to provide the Services you have requested, to deliver purchased content, and to manage your Subscription under our Terms of Service.
• Consent — for personalised advertising and associated tracking, for certain analytics where local law requires consent, for push notifications and marketing emails, and for access to device features such as the camera, photo library or contacts. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Legitimate interests — for security, fraud prevention, product analytics, contextual advertising, service improvement and the defence of legal claims. Where we rely on legitimate interests, we carry out a balancing assessment to ensure that our interests are not overridden by your rights and freedoms. You have the right to object — see section 14.
• Legal obligation — where processing is required to comply with tax, accounting, consumer protection or other legal requirements applicable to us in Cyprus and the European Union.

6. Subscription and purchase data

When you make an In-App Purchase or take out a Subscription in one of our Apps, the transaction is processed by the App Store — Apple or Google — and not by DevPlay.

What we do receive and process in connection with purchases and Subscriptions:

• the transaction or order identifier, and the App Store receipt or purchase token, which we validate against Apple's or Google's servers to confirm that the purchase is genuine;
• the product identifier of the item or Subscription plan purchased, and the Subscription Period (for example, monthly);
• the price, currency and country of the transaction;
• the purchase date, the current Subscription expiry or renewal date, and the auto-renewal status;
• lifecycle events reported by the App Store, such as the start of a free trial, conversion of a trial to a paid Subscription, successful and failed renewals, price-change consent, grace periods, cancellations, refunds and chargebacks;
• the pseudonymous application account identifier that we associate with the entitlement, so that we can restore your purchases on the same App Store account.

We use this data to grant and maintain your entitlements, to restore purchases, to detect fraudulent or duplicated transactions, to provide support in relation to billing questions, to produce aggregate revenue analytics, and to comply with our accounting and tax obligations. Records connected to transactions are retained for the period required by Cypriot tax and accounting law (see section 12).

Please note that, because Apple and Google control the billing relationship, we cannot cancel your Subscription for you. Instructions are set out in section 12 of our Terms of Service.

7. Advertising, analytics and tracking

Our free Apps are funded by advertising. To display advertisements, to measure their effectiveness and to understand how our Apps are used, we integrate software development kits (“SDKs”) supplied by third parties. These SDKs may collect device and usage data, including advertising identifiers, directly from your device.

Depending on the App and on your consent choices, our partners may include the following. Each link points to the partner's own privacy policy:

The exact list of SDKs used in a particular App is disclosed on that App's App Store or Google Play listing, in the “App Privacy” (Apple) and “Data safety” (Google) sections. We keep this table up to date on a best-efforts basis; if you need to know precisely which partners are active in a specific App, contact [email protected].

Some of these partners act as independent controllers and may combine the data they collect in our Apps with data collected in other apps and websites in order to build advertising profiles. We do not control that processing; please review their privacy policies and use the opt-out mechanisms they provide.

8. Your advertising and tracking choices

You can control how your data is used for advertising in the following ways:

8.1 In-App consent

Where required by law, our Apps display a consent request the first time you launch them, using a Consent Management Platform compatible with the IAB Transparency & Consent Framework or an equivalent mechanism. You can change your choices at any time in the App's settings screen (typically under Settings → Privacy or Settings → Privacy settings). If you refuse or withdraw consent, our Apps will continue to work, but the advertising you see will be contextual rather than personalised.

8.2 iOS — App Tracking Transparency

On iOS 14.5 and later, we ask for your permission before accessing your IDFA for tracking. You can review and change your answer at any time in Settings → Privacy & Security → Tracking, and you can disable tracking requests for all apps by turning off “Allow Apps to Request to Track”. You can also limit ad targeting in Settings → Privacy & Security → Apple Advertising.

8.3 Android — advertising ID controls

You can reset or delete your advertising ID in Settings → Google → Ads (the exact path varies by device), where you can also opt out of ad personalisation. Deleting the advertising ID causes apps to receive a string of zeros instead of an identifier.

8.4 Push notifications

You can disable push notifications at any time in your device settings (iOS: Settings → Notifications; Android: Settings → Apps → Notifications) or, where offered, in the App's own settings.

8.5 Marketing emails

Every marketing email we send contains an unsubscribe link. You can also email [email protected] at any time to be removed from our mailing list. We will continue to send you essential service messages, such as security or billing notices.

8.6 Industry opt-outs

You may also use the opt-out tools provided by the DAA AppChoices app, YourOnlineChoices (EU) and the NAI opt-out page.

9. Cookies on our website

Our website devplay.mobi is a largely static informational site. It uses only what is strictly necessary for the site to function and to keep it secure, including:

• Strictly necessary cookies and local storage — used, for example, to remember that you have submitted the contact form, to maintain a session, and to protect the form against automated abuse. These do not require consent under the ePrivacy Directive.
• Server logs — our hosting provider records the IP address, date and time, requested URL, HTTP status and user-agent of each request, for security, abuse prevention and troubleshooting purposes.

Where we introduce analytics or advertising cookies on the website, we will do so only after obtaining your consent through a cookie banner, and this section will be updated accordingly. Most browsers allow you to block or delete cookies through their settings; blocking strictly necessary cookies may prevent parts of the site from working.

10. Who we share your data with

We do not sell your personal data for money. We share personal data only in the circumstances described below.

• Service providers (processors) acting on our instructions — cloud hosting and storage, content delivery, database and backup providers, email delivery, customer support tools, crash reporting and product analytics. They may process your data only for the purposes we specify and are bound by written data processing agreements meeting the requirements of Article 28 GDPR.
• Advertising, mediation, attribution and analytics partners — as described in section 7. Some act as processors; others act as independent or joint controllers.
• App Stores and platform providers — Apple and Google, in connection with distribution, billing, subscription management, receipt validation, refunds and crash reporting.
• Professional advisers — lawyers, auditors, accountants and insurers, where necessary for the establishment, exercise or defence of legal claims or for compliance.
• Public authorities — courts, law enforcement, tax and data protection authorities, where we are required by law to disclose data or where disclosure is necessary to protect our rights, our users' safety, or to prevent fraud or illegal activity. We review each request for validity and disclose only the minimum data necessary.
• Corporate transactions — if DevPlay is involved in a merger, acquisition, reorganisation, financing or sale of assets, personal data may be transferred to the counterparty or its advisers, subject to appropriate confidentiality safeguards. We will notify you of any such transfer that materially changes how your data is handled.
• Other users — where an App has social or multiplayer features, the profile information and content you choose to make public will be visible to other users. Do not publish information you would not want to be public.
• Aggregated and anonymised data — we may create and share statistics that do not identify you, for example aggregate engagement or revenue metrics.

11. International data transfers

We are based in Cyprus (European Union). Some of our service providers and advertising partners are located outside the European Economic Area, including in the United States, the United Kingdom and Israel.

Where we transfer personal data outside the EEA, we ensure an appropriate level of protection by relying on one or more of the following:

• an adequacy decision of the European Commission in respect of the recipient country (for example the United Kingdom, Switzerland, Israel, or the EU–US Data Privacy Framework for certified US recipients);
• the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented where necessary by additional technical, organisational and contractual safeguards identified through a transfer impact assessment; or
• another lawful transfer mechanism recognised under Chapter V of the GDPR, or your explicit consent where applicable.

You may request a copy of the safeguards we rely on by emailing [email protected].

12. How long we keep your data

We keep personal data only for as long as necessary for the purposes for which it was collected, and then delete or irreversibly anonymise it. Our typical retention periods are:

Where a longer period is required by law, or where data is needed for the establishment, exercise or defence of legal claims, we retain it for that longer period and restrict its processing to that purpose.

13. How we protect your data

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation and the risks involved. These measures include:

• encryption of data in transit using TLS, and encryption at rest where supported by our providers;
• storage of passwords using strong one-way hashing with per-user salts;
• role-based access control, the principle of least privilege, and multi-factor authentication for administrative access;
• network segmentation, firewalls, and regular patching of servers and dependencies;
• logging and monitoring of access to production systems;
• regular backups and tested restore procedures;
• contractual confidentiality obligations for staff and contractors, and data processing agreements with our providers;
• a documented procedure for detecting, assessing and reporting personal data breaches.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Office of the Commissioner for Personal Data Protection of Cyprus within 72 hours of becoming aware of it, and will inform you directly where the breach is likely to result in a high risk to you.

14. Your rights under the GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the following rights in relation to your personal data:

• Right of access (Art. 15) — to be told whether we process data about you and, if so, to receive a copy of it together with information about the processing.
• Right to rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed.
• Right to erasure (Art. 17), the “right to be forgotten” — to have your data deleted where it is no longer necessary, where you withdraw consent and there is no other legal basis, where you successfully object, or where the data has been processed unlawfully.
• Right to restriction (Art. 18) — to have processing limited in certain circumstances, for example while the accuracy of data is being verified.
• Right to data portability (Art. 20) — to receive the data you provided to us, in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to object (Art. 21) — to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests; and to object at any time and without giving reasons to processing for direct marketing purposes, including profiling for direct marketing, which we will then stop.
• Right to withdraw consent (Art. 7(3)) — to withdraw any consent you have given, at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint (Art. 77) — with a supervisory authority, in particular in the Member State of your habitual residence, place of work or of the alleged infringement. Our lead supervisory authority is set out in section 22.

15. How to exercise your rights

To exercise any of these rights, email [email protected] with the subject line “Data protection request”, or write to us at DEVPLAY LTD, 1 Apriliou 21, Paramytha, Limassol, Cyprus, 4540.

To help us locate your data and to prevent unauthorised disclosure, please tell us:

• the name of the App and the platform (iOS or Android);
• the right you wish to exercise;
• your in-App username or account email, if you have one;
• where relevant and available to you, the advertising identifier or app-installation identifier shown in the App's settings or “About” screen, and any purchase order number.

We will respond within one month of receipt of your request. That period may be extended by up to two further months where the request is complex or where we receive a number of requests; we will inform you of any extension and of the reasons for it. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, explaining why.

We may need to ask for additional information to verify your identity where we have reasonable doubts about it. Where we hold only pseudonymous data (for example an advertising identifier) and cannot link it to you, we may be unable to comply with a request unless you provide additional information that allows identification (Art. 11 GDPR).

16. California privacy rights (CCPA/CPRA)

If you are a resident of California, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the following rights:

• the right to know what personal information we have collected about you, the categories of sources, the business purposes for collecting it, the categories of third parties to whom it is disclosed, and the specific pieces of personal information collected;
• the right to delete personal information we have collected from you, subject to statutory exceptions;
• the right to correct inaccurate personal information;
• the right to opt out of the “sale” or “sharing” of personal information for cross-context behavioural advertising;
• the right to limit the use of sensitive personal information; and
• the right to be free from discrimination for exercising any of these rights.

In the preceding 12 months we have collected the following categories of personal information: identifiers (including advertising identifiers and IP address); commercial information (purchase and subscription records); internet or other electronic network activity information (usage and gameplay data, ad interactions); coarse geolocation data inferred from IP address; and inferences drawn to create advertising profiles. The sources, purposes and recipients are described in sections 3, 4 and 10.

We do not sell personal information for monetary consideration and we do not knowingly sell or share the personal information of consumers under 16 years of age. However, our use of third-party advertising partners to deliver personalised advertising may constitute “sharing” for cross-context behavioural advertising under the CPRA. You can opt out at any time by declining or withdrawing consent in the App's privacy settings, by using the iOS App Tracking Transparency and Android advertising ID controls described in section 8, or by emailing [email protected] with the subject “Do Not Sell or Share My Personal Information”.

We do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit under the CPRA. You may designate an authorised agent to submit a request on your behalf; we may require written proof of authorisation and verification of your identity.

17. Other US state privacy rights

Residents of other US states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana — have rights that are broadly similar to those described above, including rights of access, correction, deletion, portability, and the right to opt out of targeted advertising, the sale of personal data and certain profiling. Where such a law grants a right of appeal against our decision on a request, you may appeal by replying to our response or by emailing [email protected] with the subject “Privacy appeal”. We will inform you in writing of the outcome of the appeal and of your right to contact your state attorney general.

18. Children's privacy

Our Services are not directed to children under the age of 13, or under the higher minimum age applicable in your country (16 in a number of EEA Member States), and we do not knowingly collect personal data from such children.

Where an App is rated as suitable for children or participates in a family programme, we apply additional protections: we do not collect persistent identifiers for advertising purposes, we serve only contextual advertising, we disable social and user-generated content features or restrict them appropriately, and we comply with the requirements of the US Children's Online Privacy Protection Act (COPPA), the Apple Kids Category guidelines and the Google Play Families policy.

If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact [email protected]. We will verify the request and delete the data without undue delay.

19. Third-party links and services

Our Services may contain links to third-party websites, stores, social networks and advertisements. Clicking such a link takes you to a service we do not control, and this Privacy Policy no longer applies. We are not responsible for the privacy practices or content of third parties, and we encourage you to read their privacy notices before providing any personal data.

20. Automated decision-making

We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing within the meaning of Article 22 GDPR. We do use automated processing for advertising personalisation (where you have consented), for gameplay balancing and content recommendations, and for the automated detection of fraud, cheating and abuse. Where an automated anti-fraud or anti-cheat measure results in the restriction of your account, you may contact us to request human review of the decision, to express your point of view and to contest the decision.

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, in the partners we work with, in applicable law or in our practices. The “Last updated” date at the top of this page shows when the most recent changes were made.

Where changes are material, we will provide prominent advance notice, for example through an in-App notification, a notice on our website, or by email where we hold your address. Where a change requires your consent under applicable law, we will obtain that consent before the change takes effect. We encourage you to review this page periodically.

22. How to contact us and complain

For any question about this Privacy Policy or about how we handle your personal data, or to exercise your rights, please contact us:

• DEVPLAY LTD
• 1 Apriliou 21, Paramytha, Limassol, Cyprus, 4540
• Email: [email protected]
• Contact form: devplay.mobi/contact-us.html

If you are not satisfied with our response, you have the right to lodge a complaint with a data protection supervisory authority. Our lead supervisory authority is:

• Office of the Commissioner for Personal Data Protection (Cyprus)
• Iasonos 1, 1082 Nicosia, Cyprus (P.O. Box 23378, 1682 Nicosia)
• Telephone: +357 22 818 456
• Email: [email protected]
• Website: www.dataprotection.gov.cy

You may also lodge a complaint with the supervisory authority of the EU Member State in which you habitually reside or work.