Privacy Policy
Last updated:
Who we are
This policy explains how we handle personal data in the mobile games we publish, and applies to all of them on both Android and iOS. It does not cover any other company's games, or any website other than malviqstudios.com.
It also covers this website itself, which is a much smaller matter and is dealt with separately in section 24. The website shows no advertising, reads no advertising identifier, and sets nothing on your device unless you agree to it. Everything between here and section 23 is about the games.
The data controller is MALVIQ STUDIOS, a joint venture company registered in the Kingdom of Saudi Arabia.
Summary
The short version, with the detail in the sections that follow. This summary is not a substitute for them.
- Our games are free to play and funded by advertising and optional purchases.
- There are no accounts. We do not ask for your name, your email address or your postal address, and we do not want them.
- We do not collect your data ourselves so much as embed software from other companies that does. Those companies are named below.
- The most sensitive thing involved is your device's advertising identifier, which is used to choose which advert to show you. You can switch that off, and the games keep working.
- We never sell your data for money. We do share it to show you adverts.
- You can ask us to delete your data. Section 14 explains how.
Data we collect
We do not ask you to create an account, and our games have no login. We do not collect your name, email address, postal address, telephone number, photographs or contacts. What is collected is technical, and it is collected automatically.
Device and app identifiers
- Your device's advertising identifier: the Advertising Identifier (IDFA) on Apple devices, or the Android Advertising ID (AAID) on Android.
- Vendor and installation identifiers, which identify an installation rather than a person: the Identifier for Vendors (IDFV) on Apple devices, the App Set ID on Android, and Firebase installation identifiers.
- Your IP address.
Device and technical data
- Device make, model and hardware.
- Operating system and version.
- Screen, display, audio, battery, storage and memory characteristics.
- Language and country settings.
- An approximate location, at country or city level, derived from your IP address.
How you use the game
- Sessions, session length, first launches, app opens and updates.
- Progress events, such as levels reached and features used.
- Adverts shown, and whether you interacted with them.
Diagnostics
- Crash reports, including stack traces and, on Android, native crash dumps.
- Performance data.
Purchases
- Records of what you bought and when, and the receipt or purchase token issued by Apple or Google so we can confirm the purchase is genuine and deliver it.
- We never receive or store your payment card details. Apple and Google handle payment, and they do not pass those details to us.
How we collect it
Almost nothing here is typed in by you. The data described above is collected automatically by software development kits, or SDKs, which are components built by other companies and embedded in our games. They begin operating when you launch a game, and they read information from your device and send it to their own servers.
The SDKs in our games are AppLovin MAX for advertising, Google's User Messaging Platform for collecting your consent, Firebase for analytics and crash reporting, and RevenueCat for purchases. Each is described in its own section below.
Data that identifies you for advertising is only collected after you have been asked and have agreed, where the law requires us to ask. Section 8 explains that step.
Some data is also stored on your own device rather than sent anywhere, including your consent choices and your game progress.
Why we use it, and our legal basis
Where the law requires a legal basis for using personal data, these are the ones we rely on. We do not rely on legitimate interests for advertising or analytics, in the games or on this website, because the law governing access to identifiers on your device requires consent for those and a legitimate interests argument cannot substitute for it.
- To run the game. Loading your progress, serving content, keeping the game stable. Basis: performance of our agreement with you, and our legitimate interest in a working product.
- To show you personalised advertising. Basis: your consent. You can withdraw it at any time, and the game keeps working without it.
- To show you non personalised, contextual advertising. Basis: your consent, where reading anything from your device is involved. This is what we serve when you decline personalisation.
- To measure advertising. Confirming an advert was shown and counting revenue. Basis: your consent.
- To understand how the game is used. Basis: your consent.
- To count visits to this website. Basis: your consent, given through the cookie banner and withdrawable at any time. See section 24.
- To diagnose crashes. Basis: your consent, and our legitimate interest in fixing faults.
- To deliver and validate a purchase. Basis: performance of our agreement with you. This is the one thing we cannot switch off, because without it we cannot give you what you paid for.
- To prevent fraud and abuse, and to comply with the law. Basis: our legitimate interests, and our legal obligations.
Advertising
Our games are free, and advertising is how they are paid for. We use AppLovin MAX, an advertising mediation platform, to decide which advert to show you and to fill each advertising slot.
Mediation means AppLovin runs an auction among many advertising networks and picks a winner. Those networks are separate companies. When one of them wins, it receives data about your device in order to select and measure the advert, and it uses that data for its own purposes under its own privacy policy. In legal terms they are independent controllers, not our suppliers, and we do not direct what they do with the data.
For more information about AppLovin's collection and use of your information visit: https://legal.applovin.com/privacy/
The set of advertising networks in the auction changes over time, as networks are added and removed. Rather than publish a list here that would quickly become inaccurate, we point you to the live one. AppLovin publishes its current advertising demand partners, with a link to each partner's own privacy policy, at legal.applovin.com/applovin-partners-privacy.
The specific companies that may receive data from your device, and the purposes they rely on, are also shown to you in the consent screen described in section 8, and you can reopen that screen at any time.
Advertising identifiers
Your device has a resettable advertising identifier. It is a random string, it is not your name, and it exists specifically so that advertising can work without using your real identity. It is the single most significant piece of data our games handle, so it gets its own section.
What we commit to
- We and our advertising partners use the advertising identifier only for advertising and analytics.
- We do not connect it to personally identifiable information.
- We do not connect it to any persistent, non resettable device identifier, such as an IMEI, MAC address or serial number.
- We honour your device level opt out. If you reset or delete the identifier, or turn off advertising personalisation, we do not use it to build a profile or target you, and we do not link new data to data derived from a previous identifier.
On Apple devices
Apple requires us to ask your permission before our games may read the IDFA or combine data from our games with data from other companies' apps. That is the prompt you may have seen asking whether we may track you across apps and websites. If you decline, the IDFA is unavailable to us and we serve contextual adverts instead, chosen without it.
On Android
Our games read the Android Advertising ID unless you have deleted it or opted out of advertising personalisation in your device settings.
Consent
Where the law requires it, we ask for your consent before any advertising or analytics identifier is collected, and we do not start the advertising software until you have answered.
We collect and record that choice through Google's User Messaging Platform, a consent management platform certified by Google, which is presented to you inside the game by the AppLovin MAX software. It implements the IAB Europe Transparency and Consent Framework and Google's Additional Consent specification, which is how your choice is passed on to each advertising partner in a form they are obliged to respect.
We keep a record of the consent you gave. You can change your mind at any time, as easily as you gave it, and section 12 explains where.
Your device's own settings are separate from this consent screen, and we honour those too.
Analytics and crash reporting
We use Firebase, a Google service, for two things: understanding in aggregate how our games are used, so we can decide what to build, and receiving crash reports so we can fix faults.
For these purposes Google acts as our processor, which means it handles the data on our instructions and not for its own purposes. Google's Firebase privacy information is at firebase.google.com/support/privacy.
One honest caveat. Where we enable features that connect analytics to Google's advertising products, Google acts as an independent controller for those particular uses rather than as our processor. We tell you which posture applies rather than claiming the simpler one.
Analytics collects the identifiers and usage data listed in section 3. Crash reporting collects crash traces and installation identifiers, and on Android it may collect a native crash dump, which is processed and then discarded.
Purchases
Our games offer optional purchases, including one off purchases and subscriptions. Payment is handled entirely by Apple's App Store or Google Play. They are the merchants of record, they collect your payment details, and they do not share those details with us.
We use RevenueCat to check that a purchase is genuine and to record what you are entitled to, so that your purchase survives reinstalling the game or moving to a new device. RevenueCat receives the receipt or purchase token issued by the store, your device type and operating system, and the time the game was last used. RevenueCat acts as our processor and does not sell or share this data. Its privacy information is at revenuecat.com/privacy.
Third parties we share data with
We share data with the companies below and with no one else, except where we are required to disclose something by law or to protect our rights. We do not sell your personal data for money.
We require every third party with whom we share user data to provide the same or equal protection of that data as is set out in this policy. Where a company acts as our processor, that obligation is imposed by contract. Where a company acts as an independent controller, we require it to comply with applicable data protection law and to handle the data to a standard equivalent to this policy, and we tell you below which is which so you can read their terms yourself.
Independent controllers
These companies use the data for their own purposes, under their own privacy policies. We do not control what they do with it once shared.
- AppLovin, for advertising mediation. legal.applovin.com/privacy
- The advertising networks that win an auction, as a category. The current list is at legal.applovin.com/applovin-partners-privacy, and the specific vendors that may receive your data are shown in the consent screen.
- Google, but only in respect of any advertising features we enable that connect to Google's advertising products.
- Apple and Google, as the operators of the App Store and Google Play, in respect of payment.
Processors, acting on our instructions
- Google, for Firebase analytics and crash reporting.
- Google, for Google Analytics on this website, and only if you agreed to it. See section 24.
- RevenueCat, for purchase validation and entitlements.
Your choices, and how to change them
Nothing here requires you to contact us, and none of it stops the game working.
Change your advertising consent
Open the game, go to Settings, and choose Privacy or Ad Preferences. That reopens the consent screen described in section 8 and replaces your previous choice.
Stop personalised advertising at device level
- On iOS and iPadOS: Settings, then Privacy and Security, then Tracking. Turning off permission for a game withdraws its access to the IDFA.
- On Android: Settings, then Privacy, then Ads. You can delete the advertising identifier entirely or opt out of personalisation.
Object to advertising from a specific network
Most adverts carry an information icon that leads to the network's own preference controls. AppLovin also offers its own opt out at applovin.com/en/privacy-data-request.
Have your data deleted
See section 14.
Storage, retention and destruction
Data is stored on servers operated by the companies named in section 11, and on your own device. We keep personal data only for as long as the purpose we collected it for requires, and then it is destroyed or stripped of anything that could identify you.
Concretely:
- Analytics data: retained for a fixed window and then deleted automatically by Google.
- Crash reports and their identifiers: retained for 90 days, after which Google begins removing them from live and backup systems. This period is fixed and cannot be shortened by us.
- Installation identifiers: retained until deletion is requested, after which they are removed from live and backup systems within 180 days.
- Purchase records: retained for as long as your entitlement lasts, and afterwards for as long as we need them for accounting, tax and fraud prevention.
- Consent records: retained as evidence that we asked and what you answered, for as long as we may need to demonstrate it.
Destruction means deletion from live systems and from backups on their normal expiry cycle. Where full deletion is not technically possible within that cycle, the data is irreversibly stripped of identifiers so that it can no longer be connected to you or your device.
Requesting deletion of your data
Our games have no accounts, so there is no account for you to delete. You can still ask us to delete the data described in this policy, and we will.
Email privacy@malviqstudios.com with the subject line "Data deletion request", and tell us:
- The name of the game.
- Your device's advertising identifier, if you are able to find it in your device settings. Without some identifier we may not be able to locate any data relating to you, because we hold nothing else that points to you.
- Your device model and operating system version.
We respond within 30 days, and we will tell you if we need a further 30 days because the request is complex. We may keep a minimum record where we are required to for security, fraud prevention, accounting or legal compliance, and if we do we will say so and explain why.
You can also delete most of what is collected yourself, without contacting us, by deleting your device's advertising identifier in your device settings and then uninstalling the game.
International transfers
We are established in the Kingdom of Saudi Arabia, and every company named in section 11 operates outside it, principally in the United States. So data collected by our games is transferred out of the Kingdom, and out of whichever country you are in.
For transfers out of the Kingdom we rely on the safeguards permitted by the Saudi regulations on personal data transfer, which include the standard contractual clauses published by the Saudi Data and Artificial Intelligence Authority, and we assess each transfer before making it.
For transfers of data from the European Economic Area, the United Kingdom and Switzerland we and our partners rely on the European Commission's standard contractual clauses, with the United Kingdom addendum and the Swiss amendments where applicable.
Security
Data is transmitted from our games over encrypted connections using current cryptography. The companies named in section 11 hold the data on their own infrastructure under their own security programmes, and we assess that before we integrate them.
Because our games have no accounts, there is no password of yours for anyone to steal from us, and we hold no payment details.
If a breach occurs that is likely to harm you or affect your rights, we notify the Saudi Data and Artificial Intelligence Authority within 72 hours of becoming aware of it, and we notify you without undue delay, along with any other regulator we are required to inform.
Minimum age and children
Our games are not directed at children. They are rated and distributed for players aged 13 and over, and we do not knowingly collect personal data from anyone under 13.
If you are below the age at which you can consent for yourself under the law of your country, a parent or guardian must agree on your behalf before you use our games. That age is not the same everywhere: in the European Economic Area it is set nationally and is 16 unless your country has chosen a lower age, which may be as low as 13.
Where we know or reasonably should know that a player is under 18, we do not use their personal data for targeted advertising or share it for that purpose, and in some jurisdictions we are prohibited from doing so regardless of consent.
If you believe a child has provided us with personal data, write to us at the address in section 23 and we will delete it.
Your rights under Saudi law
We are subject to the Personal Data Protection Law of the Kingdom of Saudi Arabia. Under it you have the right to be informed about how we use your data, to access it, to obtain a copy of it in a readable and clear format, to have it corrected, and to have it destroyed.
Write to us at the address in section 23. We respond within 30 days, and we may extend that by a further 30 days where the request requires unusual effort or where you have made several requests, in which case we will tell you.
If you are unhappy with how we have handled your data you may complain to the Saudi Data and Artificial Intelligence Authority.
Your rights in the EEA, the UK and Switzerland
Although we are established outside these territories, we offer our games to people in them, so the General Data Protection Regulation and the United Kingdom's equivalent apply to us.
You have the right to:
- be told how we use your data, which is what this document is for;
- access the data we hold about you, and receive a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use it;
- object to our using it, including for direct marketing;
- receive it in a portable form, and have it sent to another provider where that is technically possible;
- withdraw your consent at any time, which is as easy as giving it and is described in section 12;
- not be subject to a decision made solely by automated means that has a legal or similarly significant effect on you. We do not make such decisions.
Providing this data is not a statutory or contractual requirement, and you are not obliged to provide it. If you decline consent for advertising and analytics, the game still works and you see contextual adverts instead.
Complain to us first, if you prefer. If you are in the United Kingdom you have a right to raise a complaint with us directly before going to the regulator. Write to the address in section 23 and we will deal with it.
You can also complain to your national supervisory authority, or in the United Kingdom to the Information Commissioner's Office.
Your rights in the United States
Most US states now have a comprehensive privacy law. Rather than write one section per state, we extend the following to residents of every state that has one.
What we want to be clear about
We do not sell your personal information for money. However, showing you personalised advertising involves disclosing information about your device to advertising companies for cross context behavioural advertising, and several state laws define that as a "sale" or a "share". So rather than claim we do not sell your data and leave it there, we tell you plainly: we share personal information for cross context behavioural advertising, and you can stop it.
Your rights
- to know what personal information we collect, use and disclose, and why;
- to access it and receive a copy;
- to have it corrected;
- to have it deleted;
- to opt out of its sale or sharing, and of targeted advertising and profiling;
- to appeal if we refuse a request;
- not to be discriminated against for exercising any of these rights.
How to opt out
The quickest route is inside the game: Settings, then Privacy or Ad Preferences. You can also delete or reset your device's advertising identifier, or turn off advertising personalisation in your device settings, and we honour that. Or write to us at the address in section 23.
Where your state requires us to recognise a universal opt out mechanism, we honour a valid signal we are able to receive. Note that the Global Privacy Control is a web browser signal, and there is no equivalent our games can receive on a mobile device, so in a game the controls above are the mechanism.
Residents of Maryland: we do not process personal data for targeted advertising, or sell it, where we know or should reasonably know the person is under 18.
Other regions
Our games are available in most countries, and other privacy laws may give you rights beyond those described above. If you are in Brazil, Canada, Australia, South Korea, Japan or elsewhere, the rights set out in sections 18 to 20 are extended to you as far as your local law requires, and you may contact your national data protection authority.
Whichever country you are in, you can always ask us to delete your data.
Changes to this policy
We update this policy when what we do changes, and the date at the top of the page records the most recent revision. If a change materially affects how we use your data we will tell you inside the game before it takes effect, and where the law requires it we will ask for your consent again rather than assume it.
Because our games are updated independently of this page, a change here may apply to a game before that game's next update, or after it. Where that matters we will say so.
Contact and complaints
For anything about this policy, about your data, or to exercise any right described above, write to privacy@malviqstudios.com.
For help with a game that is not a privacy question, use our support page instead.
If you are not satisfied with our response, you may complain to the Saudi Data and Artificial Intelligence Authority, to your national supervisory authority in the European Economic Area, or to the Information Commissioner's Office in the United Kingdom.