Privacy Policy

EFFECTIVE DATE: July 22ND, 2025

Because you use the Puzzle Play app (“App”), we process your personal data. PuzzlePlay Limited (“PuzzlePlay”, "we", "our", or "us") respects your privacy and is committed to protecting your personal data. Below you will find information on why and how we do this. You will learn about your rights and how we ensure your data is protected.

If you are located in the United States, please refer to Section 9 and 13 for additional information specific to U.S. users.

Table of Contents

1. WHO ARE WE AND HOW TO CONTACT US?

1.1. PuzzlePlay Limited is a company incorporated in England and Wales, with company number 16306437. If you have questions about this Privacy Policy or data processing, you may contact us at: dataprotect@puzzleplay.app.

1.2. PuzzlePlay is the controller, within the meaning of applicable laws, with regard to the collection, processing and use of personal data in the context of the App and as described in this Privacy Policy. This means PuzzlePlay is responsible for deciding the purpose and the means of how your personal information will be used and processed.

1.3. This Privacy Policy applies to your use of the App and any related services or features we provide. It does not cover other websites or services that may be linked to from within the App.

2. INFORMATION WE COLLECT

We collect different types of information to run the App, process rewards, prevent fraud, and improve the experience. Here’s what we collect and why:

2.1. Information you provide:

2.1.1. Reward redemption details: when using Tremendous or third-party reward providers (e.g. PayPal, Amazon), we may collect your first and last name, email address, your unique user ID, and details about your reward history. This is so we can send you your rewards.

2.1.2. Support requests: if you contact us for help, we collect your name, email address, device ID, User ID and Install ID, and the message you send us. This helps us respond and solve the issue.

2.2. Information we collect from game publishers (when you play other games via the App):

2.2.1. When you click through to a participating game via the App, we may receive:

a. in-game actions: installation of a particular game, in-game purchase information and in-game advertising information, transaction types, events, actions, clicks, impressions, and use of virtual items, game achievements, statistics and information on bugs and malfunctions (“Gameplay Data”) so we can track your progress toward earning rewards;

b. identifiers: pseudonymous IDs like your user ID or advertising ID. These don’t directly identify you but help us know it’s the same person using different games;

c. engagement metrics: information used to help calculate your progress toward earning rewards, such as your engagement with games and ads);

2.2.2. This data is shared by the game publisher under a contract or technical setup. We use it only to track rewards properly, detect suspicious or fake activity, and improve our App.

2.3. Information we collect automatically (when you use the App):

2.3.1. device and usage info: we collect data such as your device type (e.g., iPhone, Samsung), operating system version, IP address, language, advertising ID (like GAID or IDFA), app version, screen views, button clicks, and timestamps of interactions;

2.3.2. reward tracking: data about your gameplay that helps us determine if you're eligible for a reward (e.g., how long you played, if you watched an ad);

2.3.3. attribution tools: we use tools like the Adjust SDK to understand which ads or campaigns led you to install or use the App, detect fraud, and ensure rewards are given fairly.

2.4. Cookies and similar technologies:

2.4.1. We use technologies similar to cookies, called SDKs (software development kits),provided by companies like Adjust and Google. These help us

     a. understand how users engage with ads and the App;

b. ensure rewards are granted fairly;

c. protect against fraud and misuse.

These partners may process limited technical and usage data to:

a. support performance measurement and reward allocation,

b. help prevent fraudulent activity,

c. ensure accurate reward attribution.

2.4.2. We use Firebase, a service provided by Google, to help us improve the App’s stability, performance, and user experience. Firebase may collect information such as your device type, operating system, app usage data (including crashes, screen views, and session durations), and other technical data. This information is used to monitor and fix technical issues, understand how users interact with the App, and optimize its functionality. Data collected via Firebase is processed in accordance with Google’s Privacy Policy, and we use these services in a way that does not allow us to directly identify you.

3. FOR WHAT PURPOSES AND ON WHAT LEGAL BASIS DO WE PROCESS YOUR PERSONAL DATA?

3.1. In the table below, we explain the purposes and legal bases for our processing of your data:

3.2. Where required by law (e.g., in the EEA), we will obtain your explicit consent before processing your data for direct marketing purposes. You may opt out of receiving certain promotional communications (emails) any time by following the instructions provided in emails to click on the “unsubscribe” link, or if available, by changing your communications preferences in your account settings. Please note that your opt-out is limited to the email address used and will not affect subsequent subscriptions. If you opt-out of only certain communications, other subscription communications may continue. Even if you opt out of receiving promotional communications, we may, subject to applicable law, continue to send you non-promotional communications, such as communications about your coin balance, reward redemptions, or our ongoing business relationship with you.

4. AUTOMATED DECISION-MAKING AND PROFILING

4.1. We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant impacts on you (as defined under the GDPR and UK GDPR). However, we may use limited forms of profiling to analyse user behavior (e.g., in-game activity, ad engagement) for the following purposes:

4.1.1. improving gameplay experience,

4.1.2. optimizing reward distribution,

4.1.3. detecting fraud or abusive use,

4.1.4. attributing advertising performance.

This processing does not result in decisions that legally or significantly affect you. If we introduce fully automated decision-making with such effects in the future, we will notify you and provide you with your rights under applicable law, including the right to human intervention.

You have the right to object to profiling in certain circumstances. To exercise this right, please contact us at: dataprotect@tripledotstudios.com.

5. HOW LONG DO WE PROCESS YOUR DATA (DATA RETENTION)?

5.1. The length of time we process your data depends on the purposes for which we use it and the legal basis for processing it. In order to determine appropriate retention and deletion periods for your personal data, we have also taken into account the extent, amount, nature and sensitivity of your data and the potential risk of harm.

5.2. We will process your data for as long as necessary to fulfil the purposes outlined above for which we collected it. In particular, we retain your data only as long as necessary to:

5.2.1. provide the App and services;

5.2.2. comply with legal obligations (e.g., tax regulations);

5.2.3. resolve disputes and enforce our agreements.

5.3. If you stop using the App or uninstall it, your data may be retained for a limited time, in accordance with our retention policy. If you do not use the App for at least 180 days, your account may be considered inactive and may be terminated. In such cases, any Coins earned may automatically expire, and your personal data may be deleted in line with applicable data protection laws and our internal policies. We will delete your data irretrievably only when it is no longer needed for any processing purpose. We may delete some of your data later than others. This may happen when we no longer need them for one purpose of processing, but they are still necessary for another purpose.

6. SHARING YOUR INFORMATION

6.1. We share your data with other entities in order to provide you with the best possible service or when we have a legal obligation to do so. In particular, these are entities that support us in providing our services, i.e. in particular technology and analytics service providers.

6.1.1. Game publishers – when you interact with games accessible via the App, we share your data with the respective game publishers. These publishers act as independent data controllers and process your data for the purpose of enabling in-game event tracking, ensuring correct reward allocation, and facilitating proper technical integration between the App and the games. Their use of your data is governed by their own privacy policies.

6.1.2. Reward provider (Tremendous) - we share your data with the reward provider for the purpose of processing rewards and ensuring that you receive the rewards you are entitled to. In some cases, we may also share additional data if required to support fraud investigation or prevention efforts initiated by the reward provider. The reward provider may use your data for its own purposes, which are described on its website here.

6.1.3. Affiliates and subsidiaries – we share your data only with subsidiaries of Tripledot Studios, as our game publishers are limited to internal studios that Tripledot Studios own. Where a subsidiary acts as a game publisher, the data processing and sharing practices described in Section 6.1.1. will apply accordingly. Apart from that, we may share certain data - primarily gameplay data related to user acquisition and fraud detection - with other companies in the Tripledot Studios group, a list of which is available here. These companies help us to improve our services, support our customers, conduct business analysis, ensure security and detect frauds. The transfer of data may be necessary for you to use our services.

6.1.4. Service providers - we use third parties to help us maintain and provide certain solutions related to our services. These are, for example, providers responsible for operating IT systems, analytics, attribution, accounting service providers, legal service providers, marketing agencies. These entities process the data in accordance with our instructions, only to the extent indicated by us.

6.1.5. Disclosure in corporate transactions - we may disclose or transfer your personal data as part of any merger, acquisition, reorganization, sale of assets, or other corporate transaction involving PuzzlePlay Limited or its affiliates. In such an event, we will ensure that the receiving party is committed to protecting your personal data in a manner consistent with this Privacy Policy and applicable data protection laws. We will notify you of any such changes as required by law.

6.1.6. Supervisory authorities, public authorities and legal process - we may also be obliged to provide certain information to public authorities for the purposes of their investigations, in particular with regard to adverse reaction reports. Additionally, disclosures may be required pursuant to legal process, such as court orders or litigation. In all such cases, information shall only be provided if there is an appropriate legal basis for doing so.

7. CHILDREN’S PRIVACY

7.1. The App is not intended for users under the age of 18. We do not knowingly collect personal data from children. If we discover such data has been collected, we will promptly delete it.  If you believe that we might have collected personal data from or about a child, please contact us at dataprotect@puzzleplay.app.

8. YOUR RIGHTS (EU/ UK RESIDENTS)

8.1. You have the following rights: to access your data and to receive a copy of your data, to rectify your data, to request erasure of your data, to request restriction of data processing, the right to data portability.

8.2. You also have the right to object to the processing of your data for marketing purposes if the processing is carried out on the basis of our legitimate interest and, for reasons related to your particular situation, in other cases where the legal basis for the processing is our legitimate interest.

8.3. If we process your personal data on the basis of your consent, you have the right to withdraw it at any time, which does not, however, affect the lawfulness of the processing carried out before the withdrawal. Please note that certain data processing operations may be necessary to provide you with the core functionality of the App (such as the rewards program). If you opt out of data sharing through your device settings or use tools like ad blockers, this may interfere with these functionalities — see our Terms & Conditions for more details.

8.4. In order to exercise the above-mentioned rights, please contact us by email at: dataprotect@puzzleplay.app.

8.5. If you have doubts about the lawfulness of our processing of your personal data, you have the right to lodge a complaint with a supervisory authority. In the United Kingdom, that supervisory authority is the Information Commissioner’s Office, which you can contact using the details provided on its website at https://ico.org.uk/make-a-complaint/.

9. U.S. STATE PRIVACY NOTICE

9.1. Residents of certain U.S. states may have specific privacy rights under applicable state laws, including the right to access, delete, correct, or opt out of certain processing of their personal information. These rights may vary depending on the state in which you reside and the applicable legislation in force at the time of your use of the App. We are committed to complying with all applicable state privacy laws. To see a current list of U.S. state privacy laws and their effective dates, please refer to par. 13. As used herein, “State Privacy Law” means one of the applicable laws identified below. If you are a resident of a state that has enacted such a law, you may exercise your rights by following the instructions in Section 9.4 of this Privacy Policy.

9.2. This Privacy Policy is designed to provide you with notice of our personal data processing practices over the 12 months prior to its Effective Date. However, this U.S. State Privacy Notice also applies to our current data practices such that it is also meant to comply with other requirements to provide current practices which under California’s law is referred to as “notice at collection”.

9.2.1. During the twelve (12) months prior to the Effective Date, we have collected and processed Personal Data as follows:

9.3. The Privacy Rights we will consider are as follows:

9.3.1. Right to Confirm Processing – You have the right to confirm we are processing your personal data, which you can request pursuant to the methods above, and to access your personal data as stated below.

9.3.2. Right to Know (categories) – If you are a California resident, you have the right to request that we share with you certain information about our collection, use, and disclosure of your personal data over the 12-month period prior to the request date, by category of personal data. You can request that we disclose to you: (1) the categories of personal data we collected about you; (2) the categories of sources for the personal data; (3) our business or commercial purpose for collecting or selling that personal data; (4) a list of the categories of personal data disclosed for a business purpose in the prior 12 months and, for each category of personal data, the categories of recipients; and (5) a list of the categories of personal data sold or shared about you in the prior 12 months and, for each, the categories of recipients. Oregon residents have the right to obtain a list of third- parties to which PuzzlePlay Limited has disclosed consumers’ personal data.;

9.3.3. Right to Delete – Some U.S. Privacy Laws (e.g., California) grant you the right to request that we delete any of your personal data that we have collected directly from you and retained, subject to certain exceptions which we will explain (if they apply), while other U.S. Privacy Laws (e.g., Texas) grant you the right to request that we delete any of your personal data that we have collected directly from you or personal data that we have obtained about you, such as from a source other than you. We will honor your deletion request as required by the laws of the State in which you reside. After we verify your identity, subject to permitted retention exceptions, we will carry out one or more of the following: (i) permanently erase your personal data on our existing systems with the exception of archived or back-up systems, (ii) deidentify your personal data, or (iii) aggregate your personal data with other consumers’ information. Where legal exceptions will apply to your request for deletion, we will tell you which one(s) and will limit retention to the permitted purpose(s).

9.3.4. Right to Correct – You have the right to request that we correct inaccuracies that you find in your personal data maintained by us. Your request to correct is subject to our verification (as discussed below) and the response standards under the applicable U.S. Privacy Laws. Right to Data Portability – You have the right to request a transportable copy of the specific pieces of personal data we collected about you. As legally permitted, based on your state of residence, we may apply a limit on the number of “right to know” requests you make over a particular time period.

9.3.5. Right to Opt Out of Sharing or Targeted Advertising – Under the State Privacy Laws, consumers have the right to opt-out of certain processing activities. California and certain other states have opt-outs specific to Targeted Advertising activities, which involve the use of personal data from different businesses or services to target advertisements to you. California’s law refers to these activities as “cross-context behavioral advertising” while other state laws refer to these activities simply as Targeted Advertising. California provides consumers the right to opt-out of Sharing, which includes providing or making available personal data to third parties for such Targeted Advertising activities, while other states provide consumers the right to opt-out of processing personal data for Targeted Advertising more broadly. There are broad and differing concepts of the Sale of personal data under the U.S. Privacy Laws, all of which at a minimum require providing or otherwise making available personal data to a third party.

We do not knowingly Sell or Share the personal data of consumers under 16.

9.3.6. Right to Limit Use of Sensitive Personal Data - With regard to personal data that qualifies as Sensitive Personal Data under U.S. Privacy Laws, if you elect to provide us with that Sensitive Personal Data you will have consented to such Processing. However, you can limit certain Sensitive Personal Data processing, and if you do so, we will explain in a response what processing purposes State Privacy Laws do not allow you to limit.

9.3.7. Right to Opt Out of Automated Decisionmaking – We do not engage in automated decision making or profiling, as these terms are defined under State Privacy Laws.

You can exercise these rights by contacting us at: dataprotect@puzzleplay.app. You can also opt out of Sharing or Targeted Advertising from within your phone settings. However if you exercise this opt out, it might result in losing the ability to get rewards.

We may verify your identity before responding to your request by confirming information related to your use of the App, such as your email address, device ID, user ID, or other interaction-related details. You can also designate an authorized agent to make a request on your behalf, subject to appropriate verification procedures. If we cannot verify your identity based on the provided information, we may request additional information necessary for verification.

9.3.8. If we deny your request, you may have the right to appeal our decision. To submit an appeal, please contact us at the same address with the subject line: “Privacy Appeal”.

9.3.9. We will not discriminate against you for exercising your privacy rights. Exercising your rights will not result in denial of services, charging different prices, providing different quality of service, or suggesting you will receive a different price or quality of service.

9.3.10. We do not use or disclose sensitive personal data for any other purpose without your explicit consent, unless permitted or required by law.

9.4. Retention. Because there are so many different types of personal data in certain categories, and so many purposes and use cases for different data, we are unable to provide retention ranges based on categories of personal data in a way that would be meaningful and transparent to you. Actual retention periods for all personal data will depend upon how long we have a legitimate purpose for the retention, consistent with the collection purposes and applicable law. For instance, we may maintain business records for as long as relevant to our business and may have a legal obligation to hold personal data for as long as potentially relevant to prospective or actual litigation or government investigation. We apply the same criteria for determining if we have a legitimate purpose for retaining your personal data that you ask us to delete. If you make a deletion request, we will conduct a review of your personal data to confirm if legitimate ongoing retention purposes exist, will limit the retention to such purposes for so long as the purpose continues, and will respond to you with information on any retention purposes on which we rely for not deleting your personal data. By deleting your account, however, any Coins that you have earned and not redeemed will be permanently deleted. Please note that account deletion may occur not only through a formal request but also if you uninstall the App without submitting such a request. In either case, your earned Coins will not be retained. Additionally, if a User does not use the App for at least one hundred eighty days, the User’s inactive account may be terminated automatically, Coins earned may expire, and personal data may be deleted in accordance with our retention policy.

9.5. Notice of Financial Incentive. We offer financial incentives to U.S. residents based upon the collection, retention, or sale of their personal data. The incentive is calculated based on a good faith estimate of the value of the personal data, which forms the basis for offering such financial incentives. We offer financial incentive payouts in the form of gift cards. The categories of personal data that are implicated by the financial incentive include: Identifiers, Service Usage Data, and Inferences. Factors we consider when calculating the value of a U.S. resident’s include: playtime within a game and revenue generated by us from the consumer's Personal Data. You may enroll in or withdraw from our financial incentive program at any time by following the instructions here. However, if you withdraw from the financial incentive program, you will no longer be eligible to receive reward payouts.

9.6. Do-Not-Track. Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no consensus among industry participants as to what “Do Not Track” means in this context. PuzzlePlay Limited currently does not alter its practices when PuzzlePlay Limited receives a “Do Not Track” signal from a visitor’s browser. To learn more about “Do Not Track,” you can visit http://www.allaboutdnt.com, but PuzzlePlay Limited is not responsible for the completeness or accuracy of this third-party information.

9.7. Shine the Light. California’s “Shine the Light” law (Civil Code section 1798.83) permits users of our Website who are California residents to request certain information regarding our disclosure of Personal Data to third parties for those third parties’ own direct marketing purposes. To make such a request, please send an email to dataprotect@tripledotstudios.com. You must put the statement “Shine the Light Request” in the body of your correspondence. In your request, please attest to the fact that you are a California resident and provide a current California address for your response. This right is different than, and in addition to, CCPA rights, and must be requested separately. However, a Do Not Sell/Share opt-out is broader than a Shine the Light request and will limit our disclosure to third parties for their own direct marketing purposes without the need for making a separate Shine the Light request. We will not accept Shine the Light requests by telephone or by fax and are not responsible for requests not labelled or submitted properly, or that are incomplete.

10. INTERNATIONAL TRANSFERS

10.1. Your data may be transferred to countries outside the UK or EU (e.g., the U.S.). Where this occurs, we implement necessary safeguards to protect your personal data in accordance with applicable law. To this end:

10.1.1. we cooperate with data importers in countries for which the European Commission has issued a decision finding an adequate level of data protection;

10.1.2. we use standard contractual clauses issued by the European Commission, together with the UK ICO’s published addendum in respect of transfers from the United Kingdom.

10.2. You can request further information about data transfers outside the EEA or United Kingdom and obtain a copy of the protection measures adopted by writing to us at dataprotect@puzzleplay.app.

11. SECURITY OF YOUR INFORMATION

11.1. We employ commercially reasonable security measures designed to protect your personal data and to ensure that access is limited to authorized personnel only, to the extent necessary for performing their duties.

11.2. While we strive to maintain the security of your information, no system can guarantee absolute security. Therefore, PuzzlePlay Limited does not represent or warrant that the services are completely secure.

11.3. We require our subcontractors and partners who process personal data on our behalf to implement appropriate security measures consistent with commercially reasonable standards.

12. CHANGES TO THIS PRIVACY POLICY

12.1. We may update this Privacy Policy from time to time. The latest version will always be posted in the App and/or on our website. We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices. Please note that if we need to adapt the Privacy Policy to legal requirements, the new Privacy Policy will become effective immediately or as required.

13. U.S. STATE COMPREHENSIVE PRIVACY LAW