Privacy Policy

1. Intro

We, Chalcedonx Yazılım Teknoloji Danışmanlık Sanayi ve Ticaret Limited Şirketi ("Chalcedonx"), are a technology company that designs, develops and operates mobile games. With this Privacy Policy, we explain how and why we collect, store, use, disclose and otherwise process personal data that we collect via our website, online advertisements and mobile games (collectively, our "Services"). This Privacy Policy does not apply to any other data we collect, such as data we collect offline, from job applicants, or from employees.

If you reside in the United States, please also see our Supplemental U.S. Privacy Statement. If you reside in the European Economic Area (EEA), United Kingdom or Switzerland (collectively, "EEA+"), please also see our Supplemental EEA+ Privacy Statement. If you reside in Türkiye, please also see our Supplemental Türkiye Privacy Statement.

If you have concerns about providing data to us or it being used as described in this Privacy Policy, please see Section 6 (Control Over Your Information) and Section 7 (Requests to Exercise Privacy Rights) of this Privacy Policy, or contact our Data Protection Officer at info@chalcedonx.com.

2. What Types of Personal Data We Collect and How We Collect It

Personal Data Collected Directly from You

We may collect the following types of personal data from you depending on how you use our Services and where you are located:

Player Identity, which consists of pseudonymized numeric identifiers assigned at your first guest registration. We use different identifiers for different purposes: some are used internally for game progress, analytics, and support, while others may be displayed on leaderboards. We do not collect or store your real name or any direct identifiers.

Guest Registration & Progress: Please note that our Services currently support guest registration and login only. Your game progress is tied strictly to the pseudonymized player ID generated on your device. If you delete the application from your device, this ID and all associated game progress and virtual items will be permanently lost and cannot be reloaded, as a new pseudonymized ID will be generated upon a new installation.

Parental Information, only if you activate parental control settings. In such cases, we collect the parent's name, surname, e-mail address, and a hash of the created PIN.

Information We Collect Automatically

Depending on which of our Services you interact with and your location, we may automatically collect and process the following types of personal data:

Analytics Data, which is pseudonymized and includes details about how you interact with our games. This data is collected in a way that ensures it cannot be translated back to identify you personally.

Security Data, specifically hashed Internet Protocol ("IP") addresses. We use hashing to ensure that IP addresses are not reversible and cannot be used to identify you directly.

Device Data. ChalcedonX does not collect the Android Advertising ID (AAID). The AD_ID permission has been removed from our Android application, and our advertising partner is configured to serve non-personalized ads only. We may process limited non-identifying device signals (such as device model, operating system version and language) needed to deliver and render rewarded ads correctly.

Analytics Identifiers. Our analytics provider (Google Firebase) assigns an internal App Instance ID to each install. This identifier is generated on your device and is not linked to your real-world identity. We use it together with our own pseudonymized Player ID and Installation ID to attribute analytics events to a specific install of the game.

Location Data, specifically the country you are connected from, derived from your IP address. We do not collect precise or exact location information.

Transaction Information, specifically for validating purchases. We retain the platform's transaction ID, purchase token, and the platform name (e.g., Apple App Store or Google Play) where the transaction was made.

Personal Data Collected from Third Parties

Most of the personal data that we collect about you comes directly from you when you play our games or interact with our Services. However, we may also collect personal data from third parties in the following circumstances:

Social Media: When you interact with our Services through various social media networks, such as when you "Like" our official page on Facebook or follow us, we may receive some information about you. The data we receive depends on your privacy settings with the social network.

App Marketplaces: When you download our mobile applications or make in-app payments through the Apple App Store, Google Play or other app marketplaces, we receive personal data about your device, account and payments. We do not receive access to your credit card or bank account data when you make in-app payments through these app marketplaces.

Authentication Services: Some parts of our Services may allow you to log in through a third-party social network or authentication service, such as Facebook, Google and Apple. We recommend that you read Facebook's Privacy Policy and review your privacy settings.

Other Sources: We may also collect personal data from publicly available sources, third parties who obtain your prior consent to send us your personal data, or through transactions such as mergers and acquisitions.

3. Purposes for Processing Your Personal Data

We may use your personal data for the following purposes, depending on how you interact with our Services and your location:

• to enable us to personalise your in-game profile, provide our games (including the competitive elements of our games, such as leaderboards), to ensure that the services you have paid for are activated in the games, and to provide you with player support if you need it;
• to enable us to optimize our games for you and for the device that you are using, as well as to deliver customized in-game events, offers and promotions;
• to manage our organization and its day-to-day operations;
• to verify your identity and entitlement to products or Services when you contact us or access our Services;
• to help maintain the safety, security and integrity of our property and Services, technology assets and business;
• to operate, improve and optimize our games and other Services;
• to personalize our Services, understand our users and their preferences to enhance user experience and enjoyment;
• to provide access to certain areas, functionalities and features of our Services, including leaderboard competitions;
• to communicate with you regarding Services-related information, including confirmations, technical notices, updates, security alerts and support and administrative messages;
• to respond to your comments and inquiries and provide customer support services;
• to prevent potentially prohibited or illegal activities, including cheating or fraud and to protect our players;
• to enable us to comply with laws that apply to us, to prevent fraud, to ensure compliance with our Terms of Service;
• to activate, verify and give effect to parental control settings;
• to comply with contractual and legal obligations and requirements;
• to conduct internal research and analytics;
• to evaluate and enter into a reorganization, restructuring, merger, acquisition, or whole or partial sale or transfer of our business or assets ("Business Transaction"); and
• to engage in the marketing activities described in this Privacy Policy.

4. Disclosure of Your Personal Data

We may disclose personal data to the following types of third parties and in the below-mentioned circumstances.

Other Users: Our Services feature competitive leaderboards. Your leaderboard identifier (a pseudonymized numeric ID), along with your rank and in-game performance metrics (such as points or level progress), will be viewable by other players. Your internal identifiers used for support purposes are never displayed publicly.

Contests, Sweepstakes, and Survey Providers: We may disclose personal data to third parties who assist us in delivering our contests, sweepstakes, or survey offerings and processing the responses.

Service Providers: We may disclose your personal data to our service providers. The types of service providers (data processors) to whom we entrust personal data include companies that (i) provide us with IT and related services; (ii) assist us with customer service activities; (iii) provide analytics and search engine services that assist us in the improvement and optimization of our Services; and (iv) provide any supporting activities in connection with our Services.

Disclosures to Protect Rights: We may access, preserve, and disclose your personal data to third parties, such as legal advisors and law enforcement authorities, if we believe doing so is required or appropriate to comply with law enforcement or national security requests and legal processes.

Ad Networks (Rewarded Ads): Our games include rewarded video ads delivered through a third-party ad network. To serve and verify these ads, the ad network may receive limited, non-identifying signals (such as device model, operating system version, language, country and whether the ad was completed). We do not share the Android Advertising ID, your Player ID, your Installation ID, your name, your email address or any directly identifying information with the ad network. See Section 5 (Advertising) below for more information.

With Your Consent: We may disclose personal data about an individual to certain other third parties or publicly with their consent or direction.

Sale of Assets and Change of Control: We may disclose personal data to potential acquirers of our business assets and their representatives for the purposes of evaluating and entering into Business Transactions.

5. Advertising

Our games include rewarded video ads: short, optional ads that you can choose to watch in exchange for in-game tickets that let you continue playing. We do not show traditional interstitial or banner ads.

No personalized advertising. ChalcedonX does not engage in personalized or behavioral advertising. We have removed the AD_ID permission from our Android application, and our ad network is configured to serve non-personalized (contextual) ads only. This means:

• We do not collect your Android Advertising ID (AAID).
• We do not share advertising identifiers with our ad network.
• We do not build advertising profiles based on your in-game behavior.
• Ads are selected based on contextual signals (such as country, device model and language), not on your personal interests or browsing history.

What is shared to deliver an ad. To serve a rewarded ad and verify that it has been viewed, our ad network may receive limited non-identifying signals (such as device model, operating system version, language, country, and ad completion status), as well as technical data necessary for fraud prevention and frequency capping.

Note for Children. ChalcedonX is a primarily child-directed application (ages 7–10). Our advertising configuration applies the strictest possible child-safe settings: child-directed treatment is enabled (tagForChildDirectedTreatment), maximum ad content rating is set to G (suitable for general audiences and children), advertising identifiers are not collected at the manifest level, and only ad networks certified by Google for the Designed for Families program are permitted to serve ads. See Section 8 (Children & Family Privacy) for full details.

6. Control Over Your Information

There are a variety of ways in which you can control how our Services process your personal data.

Delete Your Account and Data. You may request permanent deletion of your account and the data associated with it at any time. The fastest way is from inside the game:

1. Open ChalcedonX on your device.
2. Go to Settings → Support.
3. Send a deletion request through the in-app form.

You will see a confirmation message once your request has been sent successfully. We will process verified requests within 30 days, in line with applicable privacy laws.

If you no longer have access to the game, you may also email us at info@chalcedonx.com. Please see Section 13 (Contact Us) for what information to include. Full details, including what is deleted and what we may retain for legal reasons, are available on our Account & Data Deletion page.

Save Your IDs. Because we cannot identify you in our records without your Installation ID and Player ID, we recommend keeping a copy in case you ever need to contact us after uninstalling the game. Both IDs are visible in the app under Settings → Support.

Uninstalling the Game. If you uninstall our games from your device, the game will stop collecting data on that device. Your Installation ID and Player ID, however, remain associated with the records we hold until you submit a deletion request as described above. We recommend submitting a deletion request from inside the game before uninstalling, so we can verify your identity automatically.

Change our Services' Access to Your Device Information: You may control our Services' access to your device information through your "Settings" app on your device.

Deactivate Push Notifications: If you activate our push notifications at the level of your device, you may at any time opt-out from receiving these types of communications by changing the relevant settings on your mobile device.

Targeted Advertising:

If you reside in the EEA, UK, Switzerland, Türkiye or South Korea, we request your consent to engage in the targeted advertising activities described in Section 5 when you first launch our games. You may subsequently withdraw your consent at any time by going to Settings > Terms and Privacy.

If you reside in the U.S., you can opt out of the targeted advertising activities by going to Settings > Terms and Privacy.

7. Requests to Exercise Privacy Rights

Depending on the privacy laws that apply to our use of your personal data, you may have some or all of the following privacy rights:

Access to personal data: You may have the right to access the data we associate with your Installation ID and Player ID. Because we do not collect names, email addresses or non-hashed IP addresses, we can only provide data that is linked to the IDs you supply.

Correction or deletion of personal data: You may have the right to ask us to correct or delete your data. When certain conditions apply, we will delete the data associated with your pseudonymized player ID.

Restriction on processing personal data: You may have the right to ask us to restrict the use of your personal data when certain conditions apply.

Object to processing of personal data: You may have the right to object to certain uses of your personal data by us when certain conditions apply.

Portability of personal data: You may have the right to receive your personal data in a structured and commonly used format so you can use this data with another company when certain conditions apply.

Right to opt out of:

Targeted advertising: If you play our games, we may use your personal data for targeted advertising purposes. If you reside in certain states in the United States, you have the right to opt out. You may opt out in-game by going to Settings > Terms and Privacy.

Selling: Some of the laws that apply to our processing of personal data qualify some of our disclosures of personal data to our AdTech Providers as "selling" personal data. You may have the right to direct us not to sell your personal data to third parties.

Right to non-discrimination: You may have the right not to receive discriminatory treatment for exercising these rights.

Right to appeal: If we decline to take action on a request exercising one of your rights, you may have the right to appeal our decision.

Right to Withdraw Consent: There are certain circumstances where we request your consent to process your personal data. If you have provided consent, you may have the right to withdraw your consent at any time.

How to submit a request

The fastest and most secure way to exercise your privacy rights is from inside the game, by going to Settings → Support and sending a request through the in-app form. Submitting from inside the game lets us verify your account automatically and respond more quickly. You may also email us at info@chalcedonx.com; please see Section 13 (Contact Us) for the information we need in order to locate your records.

How we identify you in our records

ChalcedonX is designed with privacy in mind: we do not collect names, email addresses, phone numbers or other directly identifying information. The only way we can locate the data we hold about you is through your Installation ID and Player ID.

• If you provide these IDs (in the in-app form, or by email), we can locate your records and respond to your request within 30 days.
• If you no longer have your IDs, we may be unable to identify your records. Under Article 11 of the General Data Protection Regulation, where a controller processes personal data in a form that does not require identification of the data subject, the controller is not obliged to acquire or maintain additional information solely to identify users. In such cases we may be unable to fulfil your request — not because we are unwilling, but because we cannot link any record we hold to you. We will make reasonable efforts to help you locate your IDs (for example, by checking Google Play purchase records or screenshots you can provide) and will tell you clearly if we cannot.

8. Children & Family Privacy

ChalcedonX is a primarily child-directed application designed for children ages 7–10. We take children's privacy very seriously and have designed our Services around data minimization: we collect only what is strictly necessary to operate the game and deliver a good experience.

8.1 What we collect from children

When a child plays ChalcedonX, we collect only:

• Pseudonymized identifiers (Player ID and Installation ID) generated on the device.
• Game progress, achievements, and statistics tied to those identifiers.
• Pseudonymized analytics about how the game is used (level completions, in-game errors, performance metrics).
• Hashed IP addresses for security and fraud prevention only.
• Transaction validation data (purchase tokens, transaction IDs) if in-app purchases are made through the device's app marketplace.

We do not collect from children:

• Real names, email addresses, phone numbers, or postal addresses.
• Photos, videos, or voice recordings.
• Precise (GPS-level) location data.
• The Android Advertising ID (AAID) — we have removed the com.google.android.gms.permission.AD_ID permission from our application.
• The Privacy Sandbox AdServices identifiers (ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_TOPICS) — we have removed all three from our application.
• Behavioral profiles for advertising or interest-based targeting.
• Contact lists, social network data, or device contact information.

8.2 Parental information

When a parent or guardian activates Parental Controls inside the app, we collect from the parent (not the child):

• The parent's name and surname.
• The parent's email address.
• A cryptographic hash of the PIN the parent creates.

We use this information solely to verify the parent when they change parental control settings, to send important communications about their child's account, and to process their requests regarding their child's data. Parental information is not shared with any third party for marketing or any purpose unrelated to operating the parental controls feature.

8.3 No personalized advertising for children

Our games show ads only as rewarded video ads (the child watches an ad in exchange for in-game tickets that let them continue playing). For children we apply the strictest possible ad configuration:

• The Android Advertising ID and the Privacy Sandbox AdServices permissions are removed from our application at the manifest level, so no advertising identifier is accessible.
• Our advertising partner (Google AdMob) is configured with child-directed treatment enabled (tagForChildDirectedTreatment) and maximum ad content rating set to G (maxAdContentRating = "G").
• All ads are non-personalized (contextual only) — selected based on country, device language and similar non-behavioral signals, not on the child's interests or activity.
• Ad creatives are restricted to family-safe content suitable for children.
• We do not build advertising profiles based on a child's in-game behavior, and we do not measure cross-app conversions for children.

8.4 COPPA (United States)

ChalcedonX complies with the U.S. Children's Online Privacy Protection Act (COPPA) and its implementing regulations.

For our limited collection of pseudonymized identifiers and analytics from children under 13, we rely on the support for internal operations exception under COPPA. The data we collect is used only to:

• Maintain or analyze the functioning of the Services (game progress, performance, error reporting).
• Personalize the in-game content for the device used.
• Protect the security and integrity of the Services (anti-cheat, anti-fraud, abuse-prevention).
• Authenticate users and verify entitlements (such as in-app purchases).

For any collection that goes beyond internal operations — for example, when a parent voluntarily provides their information through Parental Controls — we obtain verifiable parental consent at the time the parent enrols in Parental Controls inside the app.

We do not condition a child's participation in any activity on disclosing more information than is reasonably necessary, and we do not disclose children's data to third parties except service providers that operate under strict contractual data protection obligations.

8.5 GDPR-K (EEA, UK, and Switzerland)

For children located in the European Economic Area, the United Kingdom, or Switzerland, we comply with Article 8 of the GDPR (and the equivalent UK GDPR provisions). The age at which a child can consent to information society services varies by country (between 13 and 16). For children below the applicable age in their country:

• For processing necessary to provide the Service, we rely on legitimate interests carefully balanced against the child's rights, with privacy-protective safeguards (pseudonymization, no AAID, no behavioral profiling, no personalized advertising).
• For processing that requires consent, we rely on parental consent obtained through the in-app Parental Controls flow.

Please see our Supplemental EEA+ Privacy Statement for more on the rights of children and parents under GDPR.

8.6 Teenagers (ages 13–17)

If a user is between 13 and 17 (or below the age of majority in their jurisdiction, if higher), they are still required to obtain parental or guardian permission before using our Services. The same data collection limits, pseudonymization, and absence of personalized advertising apply. Once parental controls are activated, features cannot be changed without the pre-set parental PIN.

8.7 Parents' rights

Parents and legal guardians have the right to:

• Review the data we have collected from their child.
• Request correction or deletion of their child's account and data.
• Refuse further collection of data from their child (which can be exercised by deleting the account).
• Withdraw any consent previously given.

To exercise these rights, please use the in-app Parental Controls support form (Settings → Support) or contact us at info@chalcedonx.com. Please see Section 13 (Contact Us) for the information we need to identify the relevant account in our systems, and our Account & Data Deletion page for the deletion process.

8.8 Reporting concerns

If you are a parent or guardian and believe a child has provided us with personal information without proper parental consent, or if you have any concerns about our practices regarding children, please contact us immediately at info@chalcedonx.com. We will investigate promptly and take appropriate action, including deletion of any data collected without consent.

9. Security

We maintain physical, technical, electronic and procedural measures intended to protect personal data from unauthorized processing, including firewalls, data encryption technologies, internal data security protocols and data protection and processing agreements with organizations that receive your personal data from us. However, no server, computer or communications network or system, or data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your personal data, we cannot ensure or warrant the security of any personal data you transmit to us or through our Services.

10. Third-Party Websites and Services

Our Services may include links to third-party websites, plug-ins and applications. We use third-party service providers to help us provide and improve our Services, including Google Firebase for analytics and Google AdMob for advertising. These third-party services are governed by their own privacy policies:

• Google General Privacy Policy: Covers all Google services. https://policies.google.com/privacy
• Firebase Privacy and Security Documentation: Explains how Firebase specifically processes "End-User" data, including data retention and storage. https://firebase.google.com/support/privacy
• AdMob (Google Advertising) Privacy & Terms: Explains how Google uses data for advertising services. https://policies.google.com/technologies/ads

Our use of Google AdMob is configured to serve non-personalized rewarded ads only. We have removed the AD_ID permission from our Android application, and we do not share the Android Advertising ID, your Player ID or your Installation ID with AdMob.

Except where we post, link to or expressly adopt or refer to this Privacy Policy, this Privacy Policy does not apply to, and we are not responsible for, any personal data practices of third-party websites and online services or the practices of other third parties.

11. Retention

We retain your personal data only as necessary for the purposes for which the personal data is processed or for legal requirements. The length of time for which we retain personal data depends on the purposes for which we collect and use it and how long we need to retain it to comply with applicable laws (including for the purpose of satisfying any legal, regulatory, tax, accounting or reporting requirements), to establish, exercise or defend our legal rights, or to make the data available to judges and courts or the competent public authorities. Once the personal data is no longer necessary for the purposes for which we collected it, we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, and we will post the updated Privacy Policy on this page. When we make changes to this Privacy Policy, we will change the date at the beginning of this Privacy Policy. If we make material changes to this Privacy Policy, we will notify individuals by email to their registered email address, by prominent posting on our Services, or through other appropriate communication channels. Any new policy will be effective from the date it is published by us.

13. Contact Us

If you have any questions about our privacy practices, our processing of personal data, or would like to exercise your rights under privacy laws, you may contact us through the channels below.

In-App Contact Form (recommended)

If you still have access to the game, please contact us from inside the application:

1. Open ChalcedonX.
2. Go to Settings → Support.
3. Write your message and tap Send. You will see a confirmation message once it has been sent successfully.

Submitting through the in-app form lets us locate your records automatically and respond more quickly.

Email

You can also reach us at info@chalcedonx.com. To help us locate your records, please include both of the following in your email:

1. Subject line — start the subject with [ installation_id ] [ player_id ] followed by a short description of your request, replacing the placeholders with your actual IDs.
2. Email body — include your installation_id and player_id again, clearly labelled, along with a description of your request.

Both IDs are visible inside the app under Settings → Support.

Important: how we identify you in our systems

ChalcedonX is designed with privacy in mind. We do not collect your name, email address, phone number or other directly identifying information. The only way we can locate the data associated with you is through your Installation ID and Player ID.

• If you provide your IDs, we can locate your records and respond to your request within 30 days.
• If you no longer have your IDs — for example, because you have uninstalled the game and have no record of them — we may be unable to identify your records. Under Article 11 of the GDPR, where a controller processes data that does not require identification of the data subject, the controller is not obliged to acquire or maintain additional information solely to identify users. In such cases we may be unable to fulfil your request, not because we are unwilling, but because we cannot link any record we hold to you. If you have a copy of your IDs in screenshots, past correspondence, or Google Play purchase receipts, please share whatever you have — we will make reasonable efforts to help.

Account and Data Deletion

For details on how to request deletion of your account and associated data, including what is deleted, what we retain and the timeline, please see our Account & Data Deletion page.

Response Time

We will respond to verified requests within 30 days of receipt, in line with applicable privacy laws. If we need additional information to identify you in our records, we will contact you and the 30-day period will run from the date we receive that information.