Supplemental U.S. Privacy Statement

Introduction

We, Chalcedonx Yazılım Teknoloji Danışmanlık Sanayi ve Ticaret Limited Şirketi ("Chalcedonx"), issue this Supplemental U.S. Privacy Statement to individuals residing in the United States only. This document supplements our Chalcedonx Privacy Policy ("Core Privacy Policy").

1. Notice for U.S. Residents (Outside of California)

Please refer to the following sections of our Core Privacy Policy for information regarding the following topics:

• Section 2: Categories of personal data processed by us.
• Section 3: Our purposes for processing personal data.
• Section 4: The categories of third parties to whom we disclose personal data.

We also include details throughout our Core Privacy Policy that you may find relevant, including a description of the ways in which you can control how our Services process your personal data at Section 6.

State Privacy Rights

If you reside in certain states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have, or may soon have, the following rights under the privacy laws of your state, subject to the conditions under applicable laws:

• To confirm whether or not we process your personal data and obtain copies of such data (in some cases, in a portable format).
• To correct inaccuracies in the personal data we hold about you, taking into account the nature of the personal data and the purposes for which it is processed.
• To delete personal data that we hold about you.
• To opt out of targeted advertising. You can opt out in-game by going to Settings > Terms & Privacy. Opting out of personalized ads does not mean that you will no longer see ads because we may still deliver contextual ads to you.
• To opt out of the sale of your personal data, which may include our disclosures of personal data to advertising technology providers. You can opt out of such sales in-game by going to Settings > Terms & Privacy.
• To opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. We do not engage in such profiling.
• If you reside in Oregon, you may have the right to request from us a list of the specific third parties, other than individuals, to whom we have disclosed your personal data or any personal data.

Global Privacy Control

We do not process for targeted advertising personal data that we collect through our website; we only engage in such processing for personal data collected through our mobile games. If you activate Global Privacy Control signals and visit our website, we cannot link the browser or device you are using to access our website to your accounts in our mobile games, if you have any, so we do not respond to such Global Privacy Control signals.

Exercising Your Rights

You may submit a request to exercise your rights by contacting us using the information provided in Section 3 (Contact Us) of this Supplemental U.S. Privacy Statement. If we decline to take action on a request exercising one of your rights set forth above, you may have the right to appeal our decision. In these cases, we will notify you providing our reasons for denying the request and instructions for how you can appeal the decision.

2. Notice for California Residents

This Notice for California Residents provides details about how we collect, use, disclose and otherwise process California residents' personal information, and rights that California residents may have under the California Consumer Privacy Act ("CCPA").

This Notice for California Residents only applies to you if you reside in California, and does not reflect our processing of California residents' personal information where an exception under the CCPA applies. Personal information does not include publicly available information in government records or any data that has been deidentified, aggregated, or otherwise anonymized. When we use terms in this Notice for California Residents that the CCPA has defined, those terms have the meanings that the CCPA defined.

2.1. CCPA Notice at Collection

Collection

We may collect the following personal information about California residents:

• Identifiers such as pseudonymized numeric identifiers used for game progress, analytics, and support. We also collect hashed Internet Protocol addresses and similar online identifiers. Note: We do not collect real names, email addresses, or postal addresses unless you provide them through parental controls or customer support inquiries.
• Commercial information, including records of products or services paid for, obtained, or considered, specifically transaction IDs and purchase tokens for in-app purchases.
• Internet or other electronic network activity information, including information regarding your interaction with our games, such as analytics data about gameplay, levels completed, and in-game events.
• Geolocation data. We may infer your general location (country) based on your Internet Protocol address. We do not collect precise location information.
• Inferences drawn from any of the information identified herein to create a profile about a consumer reflecting the consumer's preferences and gameplay patterns.

Use

We may use personal information for the following purposes:

• To enable us to personalize your in-game profile, provide our games (including the competitive elements such as leaderboards), to ensure that the services you have paid for are activated in the games, and to provide you with player support if you need it;
• To enable us to optimize our games for you and for the device that you are using, as well as to deliver customized in-game events, offers and promotions;
• To manage our organization and its day-to-day operations;
• To verify your identity and entitlement to products or Services when you contact us or access our Services;
• To help maintain the safety, security and integrity of our property and Services, technology assets and business;
• To operate, improve and optimize our games and other Services;
• To personalize our Services, understand our users and their preferences to enhance user experience and enjoyment;
• To provide access to certain areas, functionalities and features of our Services, including leaderboard competitions;
• To communicate with you regarding Services-related information, including confirmations, technical notices, updates, security alerts and support and administrative messages;
• To respond to your comments and inquiries and provide customer support services;
• To prevent potentially prohibited or illegal activities, including cheating or fraud and to protect our players;
• To enable us to comply with laws that apply to us, to prevent fraud, to ensure compliance with our Terms of Service;
• To activate, verify and give effect to parental control settings;
• To comply with contractual and legal obligations and requirements;
• To conduct internal research and analytics;
• To evaluate and enter into a reorganization, restructuring, merger, acquisition, or whole or partial sale or transfer of our business or assets ("Business Transaction"); and
• To engage in the marketing activities described in our Privacy Policy.

2.2. Do Not Sell or Share My Personal Information

We do not "sell" personal information about California residents in the sense of exchanging personal information for money. However, we disclose certain personal information about players of our mobile games (collectively, "Users") to advertising networks and other advertising technology providers ("AdTech Providers") to provide Users with more interesting and customized information and advertising, which is considered "selling" and "sharing" under the CCPA.

Update: ChalcedonX has removed the AD_ID permission from its Android application and does not collect the Android Advertising ID. Our ad network is now configured to serve non-personalized rewarded ads only. As a result, the limited information we may share with ad networks no longer includes the Android Advertising ID.

Information that may still be shared to deliver and verify a rewarded ad includes:

• Limited, non-identifying device signals (device model, operating system version, language, country)
• Ad completion status (used for fraud prevention and frequency capping)

We do not share the Android Advertising ID, your Player ID, your Installation ID, your name, your email address or any directly identifying information with our ad network.

You can manage advertising and tracking preferences in-game by going to Settings → Terms & Privacy.

2.3. Retention

The length of time for which we retain personal data depends on the purposes for which we collect and use it and how long we need to retain it to comply with applicable laws (including for the purpose of satisfying any legal, regulatory, tax, accounting or reporting requirements), to establish, exercise or defend our legal rights, or to make the data available to judges and courts or the competent public authorities. Once personal data is no longer necessary for the purposes for which it was collected, to meet legal requirements, in connection with legal rights, or for courts or authorities, we delete it.

2.4. CCPA Rights

As a California resident, you have the following rights under the CCPA:

• The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. You may only exercise your right to know twice within a 12-month period.
• The right to delete personal information that we have collected from you, subject to certain exceptions.
• The right to correct inaccurate personal information that we maintain about you.
• The right to opt out of the sale or sharing of your personal information by us. We disclose the personal information of mobile game Users residing in California to advertising business partners for the purposes of supporting our advertising efforts and, as such, we "sell" and "share" personal information as these terms are defined under the CCPA. Please note that we do not monetize personal information in the sense of disclosing your personal information in exchange for money. Please also note that, if you exercise your right to opt-out of the "sale" and "sharing" of your personal information, we may still disclose your personal information to third parties for purposes other than cross-contextual behavioral advertising, as described in our privacy disclosures.
• The right to limit our use and disclosure of sensitive personal information to purposes specified at Section 7027(m) of the CCPA Regulations. We do not collect sensitive personal information as the CCPA defines this term.
• The right not to receive discriminatory treatment by the business for the exercise of privacy rights conferred by the CCPA, including the right not to be retaliated against for the exercise of CCPA rights.

2.5. How to Exercise CCPA Rights

Methods of Submission and Instructions:

• Do Not Sell or Share My Personal Information: To submit a request to exercise your right to opt-out of selling and sharing in-game, please go to Settings > Terms & Privacy. You may also email info@chalcedonx.com to submit an opt-out request.
• Global Privacy Control: We do not "sell" or "share" personal information that we collect through our website; we only "sell" and "share" personal information collected through our mobile games. If you activate Global Privacy Control signals and visit our website, we cannot link the browser or device you are using to access our website to your accounts in our mobile games, if you have any, so we do not respond to such Global Privacy Control signals.
• Other CCPA Rights: To submit a request to exercise your rights to know, delete or correct, please contact us at the contact information further below and describe your request.

Verification

Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. You may designate an authorized agent by taking the steps outlined under "Authorized Agent" further below. In your request or in response to us seeking additional information, you, or your authorized agent, must provide sufficient information to allow us to reasonably verify that you are, in fact, the person whose personal information was collected which will depend on your prior interactions with us and the sensitivity of the personal information being requested.

We may ask you for information to verify your identity and, if you do not provide enough information for us to reasonably verify your identity, we will not be able to fulfill your request. We will only use the personal information you provide to us in a request for the purposes of verifying your identity and fulfilling your request.

Important: how we identify you in our records. ChalcedonX is designed with privacy in mind. We do not collect your name, email address, phone number or other directly identifying information. The only way we can locate the data associated with you is through your Installation ID and Player ID.

• If you provide these IDs, we can locate your records and respond to your request within the timeframe required by applicable law.
• If you no longer have your IDs (for example, because you have uninstalled the game and have no record of them), we may be unable to identify your records. The CCPA permits a business to deny a request where it cannot verify a consumer's identity to a reasonable degree of certainty. In such cases we may be unable to fulfil your request — not because we are unwilling, but because we cannot link any record we hold to you. We will make reasonable efforts to help you locate your IDs (for example, by checking Google Play purchase records or screenshots you can provide) and will tell you clearly if we cannot.

Authorized Agents

You can designate an authorized agent to make a request under the CCPA on your behalf if:

• The authorized agent is a natural person or a business entity and the agent provides proof that you gave the agent signed permission to submit the request; and
• You directly confirm with us that you provided the authorized agent with permission to submit the request.

If you provide an authorized agent with power of attorney pursuant to Probate Code sections 4121 to 4130, it may not be necessary to perform these steps and we will respond to any request from such authorized agent in accordance with the CCPA.

2.6. Children Under 16

ChalcedonX is a primarily child-directed application designed for children ages 7–10. We do not "sell" or "share for cross-context behavioral advertising" the personal information of California residents under 16 years of age. We have removed the Android Advertising ID permission and the Privacy Sandbox AdServices permissions from our application, and our advertising partner is configured with child-directed treatment so that no behavioral advertising or interest-based profiling occurs for any of our users — including California minors. We may use deidentified information for any purpose, and we commit to maintaining and using deidentified information in deidentified form and not to attempt to reidentify the information, except for the purpose of determining whether our deidentification processes satisfy applicable legal requirements.

3. COPPA Compliance (Children Under 13)

ChalcedonX is a primarily child-directed application designed for children ages 7–10. We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and its implementing regulations (16 C.F.R. Part 312).

3.1. What we collect from children

From children under 13, we collect only the limited pseudonymized data necessary to operate the Services:

• Pseudonymized identifiers generated on the device (Player ID, Installation ID).
• Game progress, achievements, and statistics tied to those identifiers.
• Pseudonymized analytics about how the game is used.
• Hashed IP addresses for security purposes.
• Transaction validation data (purchase tokens) for in-app purchases made through the device's app marketplace.

We do not collect from children: real names, email addresses, phone numbers, postal addresses, photos, videos, voice recordings, precise location, the Android Advertising ID, or behavioral profiles for advertising.

3.2. Internal operations exception

Our limited collection of pseudonymized identifiers and analytics relies on the COPPA support for internal operations exception (16 C.F.R. § 312.5(c)(7)). Data is used only to maintain or analyze Service functioning, personalize in-game content for the device, protect security and integrity (anti-cheat, anti-fraud), authenticate users, and verify entitlements (such as in-app purchases).

3.3. Verifiable parental consent

For collection that goes beyond internal operations — for example, when a parent voluntarily provides their information through Parental Controls — we obtain verifiable parental consent at the time the parent enrols in Parental Controls inside the app. The parent provides their name, email address, and creates a PIN (we store only a cryptographic hash of the PIN, never the PIN itself).

3.4. No personalized advertising or behavioral tracking

For child users:

• The Android Advertising ID and the Privacy Sandbox AdServices permissions are removed from our application at the manifest level.
• Our advertising partner (Google AdMob) is configured with tagForChildDirectedTreatment set to TRUE and maxAdContentRating set to G.
• All advertising is non-personalized (contextual only).
• Only ad networks certified by Google for the Designed for Families program may serve ads.

3.5. No disclosure to third parties beyond service providers

We do not disclose children's data to third parties except service providers that operate under strict contractual data-protection obligations and that process the data solely on our behalf (such as our cloud hosting provider, analytics provider, and advertising partner with child-directed configuration).

3.6. Parents' rights under COPPA

Parents and guardians have the right to:

• Review the personal information we have collected from their child.
• Refuse to permit further collection of their child's information.
• Request deletion of their child's information.

To exercise these rights, please use the in-app Parental Controls support form (Settings → Support) or email us at info@chalcedonx.com. See Section 4 (Contact Us) below for the information we need in order to identify the relevant account.

3.7. Reporting concerns

If you believe a child has provided us with personal information without proper parental consent, or you have any concerns about our practices regarding children, please contact us immediately at info@chalcedonx.com. We will investigate promptly and take appropriate action, including deletion of any data collected without consent.

4. Contact Us

If you have any questions about our privacy practices, our processing of personal data, or would like to exercise your rights under privacy laws, you may contact us through the channels below.

In-App Contact Form (recommended)

If you still have access to the game, please contact us from inside the application:

1. Open ChalcedonX.
2. Go to Settings → Support.
3. Write your message and tap Send. You will see a confirmation message once it has been sent successfully.

Email

You can also reach us at info@chalcedonx.com. To help us locate your records, please include both of the following in your email:

1. Subject line — start the subject with [ installation_id ] [ player_id ] followed by a short description of your request, replacing the placeholders with your actual IDs.
2. Email body — include your installation_id and player_id again, clearly labelled, along with a description of your request.

Both IDs are visible inside the app under Settings → Support.

Account and Data Deletion

For details on how to request deletion of your account and associated data, see our Account & Data Deletion page.

5. Changes

From time to time, we may revise this Supplemental U.S. Privacy Statement. When we do so, the changes will be posted and the revised document will be available online and the "Effective Date" above will be revised. We encourage you to periodically review this page for the latest information on our privacy practices.