隐私政策生成助手

以下隐私政策为社交类移动互联网应用程序（“本App”）的标准化法律文本样稿，旨在为贵方建立符合适用法律的个人信息保护合规框架。请在发布前结合实际业务流程、技术架构、合作伙伴与所涉法域进行定制，并完成占位符替换。

隐私政策
版本号：[版本号] 生效日期：[YYYY-MM-DD]
最后更新日期：[YYYY-MM-DD]
运营者：[公司名称]（“我们”）
注册地址/联系地址：[地址]
个人信息保护负责人（或数据保护官）联系邮箱：[邮箱]
客服电话/邮寄地址：[电话/地址]

一、适用范围与法律依据
1.1 本政策适用于您在使用本App及相关网站、客户端、SDK、接口与服务时对与您相关的任何已识别或可识别的个人信息的处理活动。
1.2 我们承诺遵守并以如下法律为准据（如适用）：
- 中华人民共和国法律：个人信息保护法（2021年11月1日施行，下称“PIPL”）；数据安全法（2021年9月1日施行）；网络安全法（2017年6月1日施行）；儿童个人信息网络保护规定（2019年10月1日施行）；数据出境安全评估办法（2022年9月1日施行）；个人信息出境标准合同办法（2023年6月1日施行）等。
- 欧盟/欧洲经济区法律：通用数据保护条例（Regulation (EU) 2016/679，“GDPR”）。涉及跨境数据传输时，遵循欧盟法院C‑311/18（Schrems II）相关判例原则。
- 如服务面向加州居民：加州消费者隐私法（Cal. Civ. Code §1798.100 et seq.，经CPRA修订，“CCPA/CPRA”）。
- 如服务面向美国13周岁以下儿童：儿童在线隐私保护法（COPPA）。
1.3 如本政策与适用强制性法律发生冲突，以该强制性法律为准。

二、定义
除非另有约定，本政策所称“个人信息”“敏感个人信息”“处理（含收集、存储、使用、加工、传输、提供、公开、删除等）”“去标识化”“匿名化”等，依PIPL、GDPR及其他适用法律之定义解释。社交关系、社交图谱、用户生成内容（UGC）、算法推荐、定向推送等均属本政策下之业务场景。

三、处理原则
我们在处理个人信息时遵循合法、正当、必要、诚信、最小化与透明原则，确保目的限定、数据最小化、准确性、完整性与可用性，并实施相应安全保障措施（PIPL第5条、第51条；GDPR第5条、第32条）。

四、我们处理的个人信息类别与用途
我们按功能与场景收集和使用信息。您可拒绝提供非必要信息，但可能影响相关功能的实现。
4.1 账户与身份
- 基本信息：手机号/邮箱、用户名、头像、密码凭证、国家/地区、设备国家码，用于注册、登录、账户安全与找回（法律基础：履行合同/获得同意，PIPL第13条；GDPR第6条第1款(b)/(a)）。
- 实名或年龄校验（如法律要求或为防止未成年人不当使用的必要措施）：姓名、身份证明信息、出生日期（法律基础：法定义务/公共利益，PIPL第13条第3项；GDPR第6条第1款(c)/(e)）。
4.2 社交与互动
- 社交关系与通讯录（经您授权）：好友列表、关注/粉丝、邀请记录、通讯录匹配的哈希值，用于建立社交图谱与关系推荐（法律基础：同意/合法权益，PIPL第13条；GDPR第6条第1款(a)/(f)）。
- UGC：动态、评论、点赞、标签、话题、群组、直播弹幕、举报信息、互动时间戳、公开展示范围设置（法律基础：履行合同/合法权益）。
- 私信/音视频通话：消息内容、通话信令与必要元数据，用于传输与反垃圾、反滥用（端到端加密如适用）（法律基础：履行合同/合法权益）。
4.3 定位与推荐
- 位置信息（精确或模糊）：定位服务、附近的人/地点、基于位置的内容分发（法律基础：单独同意，PIPL第29条；GDPR第6条第1款(a)）。
- 画像与算法推荐：基于您的行为日志（浏览、停留、互动）与偏好构建画像，以进行信息流排序与个性化推荐（法律基础：合法权益/同意；PIPL第24条给予拒绝定向推送或限制个性化的权利；GDPR第6条第1款(f)/(a)）。
4.4 设备与日志
- 设备信息：设备标识符（如IDFA/AAID/IMEI/Android ID/IDFV/硬件序列号但将最小化与去标识化）、操作系统版本、网络类型、分辨率、崩溃日志、性能数据（法律基础：合法权益，确保服务安全与稳定，GDPR第6条第1款(f)）。
- 网络日志：IP、端口、访问记录、时间戳、错误码（法律基础：法定义务/合法权益；按网络安全法保留不少于六个月的网络日志）。
4.5 支付与交易（如适用）
- 交易信息：订单、支付时间、金额、支付渠道与结果、退款与申诉记录（法律基础：履行合同/法定义务，如反洗钱、会计税务留存）。
4.6 客服与合规
- 客服沟通与录音、工单、问卷与反馈、举报材料（法律基础：履行合同/合法权益/法定义务）。
4.7 敏感个人信息（仅在必要且充分论证之场景，经单独同意）
- 面部特征或生物识别（用于人脸识别登录或特效捕捉），精确定位、通讯内容、未成年人信息、金融账户标识等（PIPL第28条；GDPR第9条）。对于非必要敏感信息，我们不以默认勾选或捆绑同意的方式处理。

五、Cookie、SDK及同类技术
5.1 我们使用Cookie、SDK、本地存储与像素标签以实现登录保持、偏好设置、统计分析、广告归因与防欺诈。对非必要Cookie/SDK，我们在取得您的明示同意后启用，并提供撤回机制。
5.2 我们将公示第三方SDK清单、收集的个人信息类型、目的、提供方名称、官网链接与退出指引，并与其签订数据处理协议，进行安全评估与最小化配置（PIPL第21、59条；GDPR第28条）。

六、处理的法律基础与合规说明
6.1 中国境内用户（PIPL）
- 合法性基础包括：履行合同、履行法定职责或法定义务、应对突发公共卫生事件、在合理范围内为维护自然人生命财产安全所必需、在合理范围内为新闻报道舆论监督等公共利益开展、依照法律在合理范围内处理公开信息、取得个人同意（PIPL第13条）。对于敏感个人信息须“具有特定目的且充分必要，并采取严格保护措施”，并取得单独同意（PIPL第28、29条）。
- 自动化决策应保证透明与公正，不得实施不合理差别待遇；对个性化展示，提供非定向选项或关闭选项（PIPL第24条）。
6.2 欧盟/EEA居民（GDPR）
- 主要法律基础：合同履行（Art.6(1)(b)）、同意（Art.6(1)(a)）、法定义务（Art.6(1)(c)）、合法利益（Art.6(1)(f)，并进行利益衡量）、重大利益（Art.6(1)(d)）。
- 特别类数据（Art.9）仅在法律允许的情形并采取补充保障措施时处理。
- 针对直接营销的画像与定向广告，您有权随时反对（Art.21）。如存在仅基于自动化决策且产生法律或类似重大影响的场景，我们将确保不适用或提供人工干预、表达意见与申诉的权利（Art.22）。
6.3 加州居民（CCPA/CPRA）
- 如构成“出售”或“分享”（用于跨情境定向广告）的个人信息处理，我们将向您提供“拒绝出售或共享我的个人信息”的选择，并在法定范围内尊重Global Privacy Control信号；对于敏感个人信息的使用，将提供限制使用与披露的机制；不实施差别待遇或报复性定价（Cal. Civ. Code §1798.120、§1798.121、§1798.125）。

七、信息共享、委托处理、转让与公开披露
7.1 共享与委托处理
- 我们可能向以下类型第三方共享或委托处理您的信息：云与CDN服务商、消息与音视频服务商、风控与反作弊服务商、支付与结算机构、数据分析与广告服务商、客服外包方、审核与合规服务商。我们将依据PIPL第21、59条与GDPR第28条签署数据处理协议，明确处理目的、期限、类型、安全措施与审计权，并对其进行安全评估与监督。
7.2 转让与公开披露
- 非因并购重组等变更而转让个人信息的，将另行获取您的同意。因并购重组等发生的个人信息转移，我们将要求受让方继续受本政策约束或重新取得您的同意（PIPL第22条）。
- 仅在符合法律规定或为履行法定义务、司法程序、行政执法或公共利益之必要时，方可公开披露（PIPL第13条第3项等）。

八、跨境提供个人信息
8.1 若发生跨境提供（例如境外托管或让境外第三方访问），我们将依法开展个人信息保护影响评估，采取以下一种或多种合规路径：（1）通过国家网信部门组织的安全评估（数据出境安全评估办法）；（2）与境外接收方签署个人信息出境标准合同并备案（个人信息出境标准合同办法）；（3）依法取得个人信息保护认证；并征得您的单独同意（PIPL第38、39条）。
8.2 向欧盟/EEA以外传输欧盟居民个人数据时，我们将使用经GDPR批准的标准合同条款（SCCs）并采取补充措施以应对第三国法律访问风险（依据CJEU C‑311/18及EDPB指南）。

九、存储地点与期限
9.1 存储地点：依法在境内存储或按跨境合规措施存储。具体地点以公示为准。
9.2 保存期限：为实现处理目的所必需的最短期间，且不超过法律法规或监管要求的最长期限（例如按网络安全法保留网络日志不少于六个月；按税务/会计留存要求保留交易与发票信息）。届满后将删除或匿名化处理（PIPL第47条）。

十、您的权利与行使
在不违反适用法律的前提下，您享有以下权利：
- 知情权与决定权：有权了解处理规则、目的、方式与范围，有权不同意或撤回同意（PIPL第14、15条；GDPR第12—14条）。
- 查阅、复制与可携权：向我们请求查阅、复制您个人信息；在GDPR适用范围内，有权请求数据可携（PIPL第45条；GDPR第20条）。
- 更正与补充权：如信息不准确或不完整，有权请求更正或补充（PIPL第46条；GDPR第16条）。
- 删除权：在目的达成或保存期限届满、撤回同意、违法处理等情形下，您可请求删除（PIPL第47条；GDPR第17条）。
- 限制与反对处理权（GDPR）：在特定条件下请求限制处理或反对基于合法利益或用于直接营销之处理（GDPR第18、21条）。
- 自动化决策相关权利：对仅通过自动化决策作出的决定要求解释，并有权拒绝我们对其采取仅以自动化决策为基础的决定（PIPL第24条；GDPR第22条）。
- 注销账户：您可通过[App内路径/客服]申请注销账户。注销后，我们将删除或匿名化您的个人信息，法律另有规定的除外。
- 投诉申诉：我们将在合理期间内处理您的请求（通常不超过15个工作日，复杂情形可适当延长并告知理由）。如您对我们的答复不满意，您可向有管辖权的监管机构投诉或依法向法院提起诉讼（PIPL第65条；GDPR第77条）。

十一、未成年人保护
11.1 我们不以未成年人为主要服务对象。对于中国境内用户，处理不满14周岁未成年人个人信息的，我们将取得监护人同意并实行专门保护（PIPL第31条；儿童个人信息网络保护规定）。对于欧盟居民，将遵守GDPR第8条及成员国设定之同意年龄。对于美国用户，将遵守COPPA之父母同意与可验证机制。
11.2 如您认为我们在未获监护人同意的情况下收集了未成年人信息，请及时联系我们以删除或采取必要措施。

十二、算法推荐与公共展示
12.1 我们将对信息流排序与推荐算法进行合理性评估与测试，避免基于种族、民族、宗教、性别、年龄等形成不当歧视或差别待遇。
12.2 您可在设置中关闭或限制个性化推荐，或选择“按时间排序/非个性化推荐”（如该选项在您所在法域为强制性要求）。
12.3 您可通过隐私设置控制动态、资料的公开范围（公开、仅好友、私密）。对公开发布的信息，第三方可能复制、保存、索引或再分享，您应谨慎选择发布内容。

十三、安全保障措施
13.1 技术措施：加密存储与传输（TLS/HTTPS，敏感字段加密）、访问控制与最小权限、口令与密钥管理、审计日志与异常检测、反爬虫与反DDoS、数据分类分级与脱敏、备份与灾备、漏洞管理与渗透测试。
13.2 组织措施：个人信息保护制度与最小化策略、员工背景审查与分级授权、隐私影响评估（PIA）、供应商管理与安全评估、开发全流程隐私设计（Privacy by Design/Default）。
13.3 安全事件响应：发生或可能发生个人信息泄露、篡改、丢失等事件时，我们将立即启动应急预案，采取补救措施，并按PIPL第57条、GDPR第33—34条等要求向监管机构与受影响个人履行通报义务。

十四、第三方服务与链接
本App可能包含第三方网站或服务之链接。该等第三方独立承担个人信息保护责任。我们建议您在使用前阅读其隐私政策并谨慎授权。

十五、政策的更新与通知
我们可能因业务、技术或法律变化更新本政策。对重大变更（如处理目的、类型、共享对象、权利救济方式的变化），我们将通过App内显著位置弹窗或其他合理方式通知，并在必要时再次征得您的同意。

十六、联系与投诉
如您对本政策或个人信息处理有任何疑问、请求或投诉，请通过以下方式联系我们：
- 个人信息保护负责人/数据保护官： [姓名/职务]，邮箱：[邮箱]，电话：[电话]
- 客服通道： [App内路径/网站链接/客服电话]
- 如GDPR适用：欧盟代表（GDPR第27条）：[名称与地址]，联系邮箱：[邮箱]
我们将在合理期限内予以处理。您亦有权向有管辖权的监管机构投诉。

十七、适用法律与争议解决
本政策之订立、履行与争议解决，优先适用您所在法域的强制性法律。无强制性规定的，以[指定法域]法律为准据法。因本政策引发的争议，由[约定仲裁机构/法院]管辖，或依与消费者保护相关的强制性管辖规则确定。

附录A（示例）第三方SDK类别与目的（需发布前填充）
- 分析统计类：[提供方名称]（用途：崩溃分析/性能监控；收集信息：设备标识符、日志；退出方式：…）
- 广告与归因类：[提供方名称]（用途：广告投放与归因；收集信息：广告标识符、受众分段；退出方式：…）
- 即时通讯/音视频类：[提供方名称]（用途：消息/通话；收集信息：信令、设备参数；…）
- 地图与定位类：[提供方名称]（用途：位置展示；收集信息：定位；…）
我们将持续更新并在App内公示完整清单。

附录B（示例）加州隐私声明要点（若适用）
- 我们在过去12个月内收集、使用与披露的个人信息类别、来源、商业/业务目的、第三方类别。
- 您的CCPA权利：知情、删除、纠正、限制敏感信息、拒绝出售或共享、非歧视；提交请求的方式与身份验证流程；GPC信号尊重。

合规提示与定制指引（非政策正文）
- 请核实：数据处理活动清单（RoPA）、数据流向图、跨境路径、SDK清单、敏感信息场景、未成年人机制。
- 落地项：同意与撤回界面、Cookie偏好中心、非个性化推荐开关、数据主体请求入口、数据保留与删除策略、应急预案演练、供应商DPA与安全评估、跨境SCC备案/网信评估。
- 文本占位符替换并与用户协议、社区规则、内容审核规范、广告政策协同一致。

免责声明
本文本为通用合规模板，不构成或替代针对特定业务的正式法律意见。请在应用前由贵方法律顾问结合具体业务、适用法域与最新监管要求进行审阅与调整。

Privacy Policy for [Game App Name]

Effective Date: [Month Day, Year]
Version: [v1.0]

This Privacy Policy describes how [Company Legal Name], a [jurisdiction of incorporation and company form, e.g., Delaware corporation] with registered address at [Address] (referred to as “Company,” “we,” “us,” or “our”), collects, uses, discloses, and safeguards personal information in connection with the [Game App Name] mobile application and related services (collectively, the “Services”).

Scope and Roles
- Controller/Business: For purposes of the EU/UK General Data Protection Regulation (EU/UK GDPR), we act as a “controller” of personal data processed through the Services. For purposes of the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), we act as a “business.” For other U.S. state privacy laws (e.g., Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA), we act as a “controller.”
- Processors/Service Providers: We engage third-party vendors that process personal information on our behalf under written contracts limiting their processing to specified purposes and requiring appropriate safeguards.

1) Categories of Personal Information We Collect
We may collect the following categories of personal information, depending on how you interact with the Services and your platform settings:

- Identifiers: Account username, display name, user ID, platform IDs (e.g., Apple Game Center ID, Google Play Games ID), device identifiers (e.g., IDFA/AAID where permitted), IP address.
- Contact Information: Email address (e.g., for support, newsletters), optional profile information.
- Commercial Information: In-app purchase history, transaction identifiers (from app stores), virtual goods balance and inventory.
- Internet/Network Activity: App usage data, gameplay events, session logs, crash logs, performance data, referral/attribution data, in-app navigation, interaction with ads (e.g., ad impressions and clicks).
- Geolocation Data: Approximate location inferred from IP address; precise location only if you grant permission for features that require it.
- Inferences: Segments or profiles derived from gameplay or app interactions to customize gameplay difficulty, content recommendations, or advertising (where permitted).
- User-Generated Content: Chat messages, usernames, avatars, forum posts, support tickets, feedback, and bug reports.
- Device and Technical Data: Device type/model, OS version, language, time zone, network type, app version, SDK versions, diagnostic information.
- Sensitive Personal Information: We do not seek to collect sensitive personal information (e.g., precise geolocation, biometric identifiers, health data) unless a specific feature requires it and you provide consent or enable the feature. If collected, such use is restricted to purposes permitted by applicable law and this Policy.

We do not intentionally collect special categories of personal data under GDPR (e.g., health, biometric, religious, union membership) in connection with the Services.

2) Sources of Personal Information
- Directly from you: Account registration, gameplay, in-app chat, customer support requests, surveys, and beta testing programs.
- Automatically from your device: Through SDKs, cookies or similar technologies embedded in the App (e.g., analytics, crash reporting, attribution, ad measurement).
- Third parties: Platform operators (Apple/Google), authentication providers (e.g., Game Center/Play Games), payment processors (App Store/Google Play billing), ad partners, analytics providers, user acquisition and attribution partners, and social features you authorize.

3) Purposes and Legal Bases for Processing
We process personal information for the following purposes and, where required, under the specified legal bases:

- Provide and Operate the Services: Create and manage accounts, enable gameplay, matchmaking, leaderboards, social features, save state synchronization, and in-app purchases.
  • Legal bases (EU/UK): Performance of a contract (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f)) to ensure service functionality; Legal obligation (Art. 6(1)(c)) for payments/records.
- Personalize Gameplay and Content: Adjust difficulty, recommend content, optimize progression.
  • Legal bases: Legitimate interests (Art. 6(1)(f)); Consent (Art. 6(1)(a)) where required.
- Analytics and Service Improvement: Measure performance, fix bugs, detect fraud/cheating, enhance stability and features.
  • Legal bases: Legitimate interests (Art. 6(1)(f)) to improve and secure the Services.
- Customer Support and Communications: Respond to inquiries, provide notices regarding changes, send service-related messages.
  • Legal bases: Performance of a contract (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f)).
- Marketing and Promotions: Send newsletters or in-app marketing; deliver contextual or interest-based advertising (including cross-context behavioral advertising) where allowed.
  • Legal bases: Consent (Art. 6(1)(a)) where required; Legitimate interests (Art. 6(1)(f)), subject to opt-out rights.
- Security and Fraud Prevention: Monitor and prevent cheating, hacking, unauthorized transactions, spam, and abuse; ensure integrity of leaderboards and multiplayer.
  • Legal bases: Legitimate interests (Art. 6(1)(f)); Legal obligation (Art. 6(1)(c)).
- Compliance and Corporate Activities: Regulatory compliance, tax and accounting, enforcing terms, responding to lawful requests, defending legal claims, or in the context of a merger or acquisition.
  • Legal bases: Legal obligation (Art. 6(1)(c)); Legitimate interests (Art. 6(1)(f)).

Where we rely on consent, you may withdraw it at any time via in-app settings or by contacting us, without affecting processing prior to withdrawal.

4) Targeted Advertising; “Sale” or “Share” of Personal Information
- Targeted Advertising: We may allow ad partners to collect or receive data (e.g., device identifiers, app interactions) to display ads tailored to your interests across apps and websites. In jurisdictions that require consent, we request your consent before enabling such tracking (e.g., Apple AppTrackingTransparency on iOS 14.5+). You can opt out in-app and, where applicable, via device settings.
- “Sale” or “Share” (California CPRA): We do not exchange your personal information for money. However, certain disclosures for cross-context behavioral advertising may be deemed a “sale” or “sharing” under California law. California residents can opt out of “sale”/“sharing” via the “Do Not Sell or Share My Personal Information” link and in-app controls.
- Other U.S. States: Where required (e.g., VA, CO, CT, UT, TX), you may opt out of targeted advertising or the “sale” of personal data, if applicable, through our in-app controls or by contacting us.

5) Disclosures of Personal Information
We disclose personal information to the following categories of recipients under appropriate contracts and safeguards:

- Service Providers/Processors: Cloud hosting, analytics, crash reporting, customer support tools, email/SMS vendors, QA/testing, security vendors.
- Advertising and Attribution Partners: Ad networks, mediation platforms, demand-side platforms, ad measurement and attribution providers, subject to consent/opt-out mechanisms.
- Platform Operators and Payment Processors: Apple App Store, Google Play, and other platforms that process purchases, entitlements, refunds, and fraud prevention.
- Social/Identity Providers: If you link accounts (e.g., Game Center, Play Games), we receive and disclose limited identifiers to enable such features consistent with the provider’s terms.
- Other Players: Your user-generated content (e.g., display name, avatar, chat messages) may be visible to other players as part of the game.
- Corporate Transactions: Prospective or actual acquirers, assignees, or successors in connection with mergers, acquisitions, financings, or asset transfers, subject to confidentiality.
- Legal and Safety: Law enforcement or regulators where required by law or to protect rights, safety, and property, prevent fraud, or enforce our terms.

We do not permit service providers to use your personal information for their own independent purposes.

6) International Data Transfers
If you are located in the EEA, UK, or other regions with data transfer restrictions, we may transfer personal data to countries that have not been deemed to provide an adequate level of protection by the European Commission/UK authorities. In such cases, we rely on appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) adopted by the European Commission and, where applicable, the UK International Data Transfer Addendum/Agreement;
- Data Transfer Impact Assessments and supplementary measures where necessary.
You may request a copy of the relevant transfer safeguards by contacting us.

7) Data Retention
We retain personal information for as long as necessary to fulfill the purposes outlined in this Policy, including:
- Account and gameplay data: For the duration of your account and for [X] months thereafter for backup, dispute resolution, and fraud prevention.
- Transaction records: For [X–Y] years to comply with tax/accounting obligations.
- Analytics and logs: For up to [X] months unless a longer period is needed for security or legal purposes.
We will delete or de-identify data when it is no longer needed, subject to legal retention requirements.

8) Your Rights
Your rights depend on your jurisdiction. Subject to applicable law and certain exceptions, you may have the right to:

EU/UK (EU/UK GDPR):
- Access your personal data and receive a copy.
- Rectify inaccurate or incomplete data.
- Erase personal data (“right to be forgotten”).
- Restrict processing.
- Data portability.
- Object to processing based on legitimate interests and to direct marketing.
- Withdraw consent at any time (without affecting prior processing).
- Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22), unless permitted by law and subject to safeguards.
- Lodge a complaint with a supervisory authority (e.g., your local data protection authority).

United States:
- California (CCPA/CPRA): Know/access specific pieces and categories, correct, delete, opt out of sale/sharing, limit use/disclosure of sensitive personal information (if applicable), and be free from discrimination for exercising your rights. We provide a Notice at Collection within this Policy. You may use an authorized agent subject to verification.
- Other States (e.g., VA, CO, CT, UT, TX): Access, correct, delete, data portability, and opt out of targeted advertising, the sale of personal data, and certain profiling. You have the right to appeal our decisions regarding your requests.

Brazil (LGPD), Canada (PIPEDA), and other jurisdictions:
- Rights may include confirmation of processing, access, correction, deletion, portability, and revocation of consent.

Exercising Rights:
- Submit requests via: [Web form/DSAR portal URL] or [privacy email].
- Verification: We may request information to verify your identity and authority. We will respond within statutory timeframes.
- Appeals (U.S. states requiring appeal): If we deny your request, you may appeal by [email/portal]. You may also contact your state attorney general if you have concerns.

9) Children’s Privacy
Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it and, where applicable, terminate the child’s account.
- COPPA: If we offer features directed to children under 13 in the United States, we will implement verifiable parental consent mechanisms and limit data collection to what is reasonably necessary.
- EU/UK: Where consent is the legal basis for processing and the user is below the age of digital consent established by local law (between 13 and 16), we will obtain consent from a parent or guardian.

10) Security
We implement appropriate technical and organizational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including access controls, encryption in transit, network monitoring, and security reviews of third-party SDKs. No method of transmission or storage is fully secure; we cannot guarantee absolute security.

11) Cookies, SDKs, and Tracking Technologies
We and our partners may use software development kits (SDKs), cookies, device identifiers, and similar technologies to:
- Enable core app functions (e.g., login, save states).
- Perform analytics and measure performance.
- Deliver and measure advertising (subject to consent and opt-out).
- Prevent fraud and ensure security.
Platform Controls:
- iOS: You can manage tracking permissions via AppTrackingTransparency and reset the advertising identifier.
- Android: You can reset or delete the advertising ID and opt out of ad personalization.
- You may also control notifications, location, camera, microphone, and other permissions via device settings.

12) Social Features and User-Generated Content
If you choose to participate in chat, leaderboards, multiplayer, or social sharing, information you post (e.g., display name, avatar, messages) may be visible to other users. Do not share information you do not wish to be public.

13) Payments and In-App Purchases
Purchases are processed by the platform operator (e.g., Apple App Store, Google Play). We do not receive your full payment card details. We receive transaction confirmations and receipts needed to grant entitlements, prevent fraud, and comply with accounting obligations.

14) Automated Decision-Making and Profiling
We may use limited profiling to personalize gameplay or ads. We do not engage in automated decision-making that produces legal or similarly significant effects within the meaning of GDPR Article 22 without your consent or as otherwise permitted by law and subject to appropriate safeguards.

15) Do Not Track and Global Privacy Control
Our Services currently do not respond to browser-based “Do Not Track” signals. Where required by applicable law, we honor Global Privacy Control (GPC) or similar opt-out signals for “sale”/“sharing” and targeted advertising.

16) California Notice at Collection
- Categories Collected: Identifiers; contact information; commercial information; internet/network activity; geolocation (approximate); inferences; device/technical data; user-generated content. We do not intentionally collect sensitive personal information except as disclosed and only for limited, permitted purposes.
- Purposes of Use: See Section 3.
- Retention: See Section 7.
- Sale/Share: Certain disclosures for cross-context behavioral advertising may be considered a “sale” or “share.” You may opt out via our “Do Not Sell or Share My Personal Information” link or in-app settings.
- Financial Incentives: We do not offer programs that constitute “financial incentives” under CCPA/CPRA. If we launch such a program, we will provide a separate notice describing material terms and how to opt in.
- Non-Discrimination: We will not discriminate against you for exercising CCPA/CPRA rights.

17) Third-Party Links
The Services may link to third-party sites or services. We are not responsible for the privacy practices of such third parties. Review their privacy policies for more information.

18) Changes to This Policy
We may update this Policy from time to time. We will post the updated version with a revised Effective Date and, where required by law, will notify you and/or seek your consent for material changes.

19) How to Contact Us
- Controller/Business: [Company Legal Name], [Address], [Email], [Phone, if applicable].
- Data Protection Officer (if appointed): [Name/Title], [Contact].
- EU Representative (GDPR Art. 27, if applicable): [Representative Name and Address].
- UK Representative (if applicable): [Representative Name and Address].
- Complaints: EU/UK users may contact their supervisory authority. California residents may contact the California Privacy Protection Agency (CPPA). Residents of other U.S. states may contact their state attorney general.

20) Jurisdiction-Specific Disclosures
- EEA/UK: We rely on consent, contract necessity, legitimate interests, and legal obligations as described above. Marketing communications will be sent in accordance with applicable ePrivacy rules; you may opt out at any time.
- Brazil (LGPD): Our legal bases include consent, performance of contract, and legitimate interests. You may contact us to exercise LGPD rights and to request information about processors.
- Canada (PIPEDA/Provincial Laws): We obtain consent as required and limit collection to reasonable purposes. Contact us to access or correct your information.

21) Your Choices and Controls
- Tracking/Ads: Use in-app privacy controls and device settings to manage tracking and ad personalization.
- Marketing: Unsubscribe via the link in our emails or in-app settings.
- Permissions: Manage location, notifications, camera, microphone, and contacts permissions in your device settings.
- Account: You may request account deletion via in-app settings or by contacting us.

Important Notices and Implementation Guidance for Your Team (Non-substantive to users; remove before publishing if desired)
- Replace placeholders (company name, address, email, DPO, representatives, retention periods, DSAR portal).
- Inventory SDKs and ensure your disclosures match actual data flows (analytics, ads, crash reporting, attribution).
- If you engage in targeted advertising or cross-context behavioral advertising, enable opt-out mechanisms and GPC handling and maintain records of consent where required.
- For iOS: Implement AppTrackingTransparency where tracking occurs; ensure purpose strings are accurate. For Android: Honor “opt out of Ads Personalization.”
- Maintain records of processing activities (GDPR Art. 30), data processing agreements with vendors (Art. 28), and SCCs/IDTA for international transfers where applicable.
- If the game is directed to children or mixed audience, consult COPPA/GDPR-K requirements and use age screens and verifiable parental consent where required.

By installing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not install or use the Services.