Privacy Policy

This Privacy Policy explains how OOX Limited (“OOX”, “we”, “us”) collects, uses, shares and protects personal data when you:

• download, install or play any game or use any app we publish on the Apple App Store, Google Play or other platforms (together, the “Apps”);
• visit ooxlimited.com (the “Website”); or
• contact us, subscribe to our newsletter, or work with us as a client or partner.

It applies to all of these together (the “Services”). An individual App may show additional information in its store listing or in-app; where it does, that information supplements this policy.

1. Who we are

The data controller responsible for your personal data is:

OOX Limited
77 Lower Camden Street, Suite 7, Dublin 2, D02 XE80, Ireland
Registered in Ireland, company number 719529
Email: admin@ooxcit.com

For any privacy question or to exercise your rights, write to admin@ooxcit.com with “Privacy” in the subject line.

2. The data we collect

2.1 When you use our Apps

Our Apps do not require you to create an account, and we do not ask for your name, postal address or phone number to play. We, and the partners listed in section 5, collect the following automatically:

• Device identifiers – the advertising identifier of your device (Apple IDFA, only if you allow tracking; Google Advertising ID / App Set ID), the identifier for vendors (IDFV), and identifiers generated by the App or our partners’ SDKs.
• Device and network information – device model and manufacturer, operating system and version, language, time zone, screen size, mobile carrier, connection type, and IP address (from which an approximate, country- or city-level location can be derived). We do not collect precise GPS location.
• Usage and gameplay data – App version, sessions and session length, levels and progress, in-game events, settings, and the ads you see and interact with.
• Diagnostics – crash logs, performance data and error reports.
• Purchase information – if you make an in-app purchase, the store confirms the transaction (product, price, currency, transaction ID) to us. Payments are processed entirely by Apple or Google; we never receive your card or payment details.
• Consent choices – your privacy and tracking choices, so we can respect them.

2.2 When you visit our Website

• Technical data – IP address, browser and device type, pages visited, referring page and timestamps, recorded in server logs for security and operation.
• Analytics – only if you accept analytics cookies, we use Google Analytics to understand how the Website is used (see section 8).

2.3 When you contact us or subscribe

• Contact and support – your name, email address, company (if given) and the content of your message, plus any information you choose to send us, such as a device model or a screenshot when reporting a problem with an App.
• Newsletter – your email address and your confirmation of the subscription.
• Clients and partners – business contact details and the correspondence and project information needed to deliver our services.

We do not intentionally collect special categories of personal data (such as health, religious or biometric data). Please do not send it to us.

3. How we use your data and our legal bases

Under the EU and UK General Data Protection Regulation (“GDPR”) we must have a legal basis for each use of personal data:

Where we rely on legitimate interests, we have weighed them against your rights and you may object at any time (section 9). We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Ad selection by our partners is automated, but it does not have such effects.

4. Advertising, consent and tracking

Many of our Apps are free to play and funded by advertising. Ads are served by the third-party networks listed in section 5, which use device identifiers and the data described above to decide which ads to show, to cap how often you see them, to measure results and to prevent ad fraud.

• EEA, UK and Switzerland – before any personalised advertising, the App asks for your consent through a consent management platform (Google’s User Messaging Platform, which supports the IAB Transparency & Consent Framework). If you decline, you will see only non-personalised ads. You can change your choice at any time from the privacy or settings option in the App, or by deleting and reinstalling it.
• iOS – we only access your IDFA if you allow it through Apple’s App Tracking Transparency prompt. You can change this anytime under Settings › Privacy & Security › Tracking.
• Android – you can delete or reset your advertising ID under Settings › Privacy › Ads (or Settings › Google › Ads).
• United States – see section 11 for your right to opt out of targeted advertising.

5. Who we share data with

We do not sell your personal data for money. We share it only as follows:

5.1 Advertising and mediation partners

The networks below may receive the device, usage and advertising data described in section 2.1 from our Apps. Each acts as an independent controller of the data it receives for its own advertising purposes, under its own privacy policy:

Not every App uses every partner; an App only contains the SDKs it needs.

5.2 Service providers (processors)

We use carefully selected providers that process data only on our instructions and under a data-processing agreement, including:

• App analytics and crash reporting – Google Firebase (Google Analytics for Firebase and Firebase Crashlytics) (Firebase privacy);
• Website analytics – Google Analytics, only with your consent (Google privacy policy);
• Email and newsletter – Mailchimp (Intuit) (Mailchimp privacy) and our email provider;
• Hosting and infrastructure – the providers that host our Website and back-end services.

5.3 Platforms

Apple and Google operate the App Store and Google Play and process your purchases and downloads under their own privacy policies.

5.4 Third-party publishers

Our games are built with the Unity engine. Some of them are released in partnership with third-party publishers, who may operate the store listing and add their own analytics, attribution or advertising tools. For those games the publisher is an independent controller of the data its tools collect, and its own privacy policy, linked from the store listing or inside the game, also applies. Where OOX is the publisher, only the services described in this policy are used.

5.5 Other disclosures

We may disclose data where required by law or a valid request from a public authority; to protect the rights, property or safety of OOX, our users or others; or to a buyer or successor if all or part of our business is sold, merged or reorganised. In that case this policy will continue to protect your data.

6. International transfers

We are based in Ireland. Some of our partners and providers process data outside the European Economic Area, including in the United States. Where they do, we rely on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework for certified companies) or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. You can ask us for more information about these safeguards at admin@ooxcit.com.

7. How long we keep data

• App analytics and gameplay data – up to 26 months from collection, then deleted or anonymised.
• Crash and diagnostic reports – up to 90 days.
• Support and contact messages – up to 2 years after the conversation ends.
• Newsletter – until you unsubscribe.
• Client and accounting records – for as long as Irish law requires (generally 6 years).
• Server logs – up to 90 days, unless needed to investigate a security incident.

Advertising partners keep the data they receive according to their own policies.

8. Cookies and similar technologies

When you first visit the Website, a banner asks whether you accept analytics cookies. Nothing other than strictly necessary storage is used until you choose, and rejecting is as easy as accepting. You can change your choice at any time with the “Cookie settings” link in the footer of every page.

If you withdraw consent, Google Analytics stops loading and we delete its cookies from our domain. You can also block cookies in your browser settings or use the Google Analytics opt-out add-on. Inside the Apps, SDKs use device identifiers and local storage rather than browser cookies, as described in sections 2.1 and 4.

9. Your rights

If you are in the EEA, UK or Switzerland, you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict how we use it;
• data portability – receive it in a machine-readable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting processing that took place before; and
• complain to a supervisory authority. Our lead authority is the Data Protection Commission (21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland). You can also complain to the authority where you live or work.

To exercise a right, email admin@ooxcit.com. Because our Apps do not use accounts, please include your App name, platform and, where possible, your device’s advertising ID or the in-app user ID shown in the App’s settings, so we can find your data. We will reply within one month (extendable by two months for complex requests) and may need to verify your identity. Exercising your rights is free of charge.

10. Deleting your data

You can have your data deleted at any time:

1. Request deletion – email admin@ooxcit.com with the subject “Data deletion request”, naming the App and your platform and including the in-app user ID or advertising ID if you can. We will delete the personal data we hold about you within 30 days and confirm when it is done. Limited records we must keep by law (such as purchase records for tax purposes) are retained only for that purpose and period.
2. Stop new collection – uninstalling the App stops all data collection from it. You can also reset your advertising ID (section 4) so that past data can no longer be linked to your device.

Game progress stored only on your device is deleted when you uninstall the App.

11. Additional information for United States residents

Residents of California and other U.S. states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) have the right to know what personal information we collect, to access, correct and delete it, and not to be discriminated against for exercising these rights.

In the preceding 12 months we have collected the categories of information described in section 2: identifiers (such as device and advertising IDs and IP address), internet or other electronic network activity, approximate geolocation, commercial information (in-app purchase records) and inferences used for advertising. We collect them for the purposes in section 3 and disclose them to the categories of recipients in section 5.

Making device identifiers available to advertising networks for targeted (cross-context behavioural) advertising may be considered a “sale” or “sharing” of personal information under these laws. You can opt out by enabling “Limit Ad Tracking” / denying tracking on iOS, deleting your advertising ID on Android, or emailing admin@ooxcit.com with the subject “Do not sell or share my personal information”. We honour Global Privacy Control signals on the Website. We do not knowingly sell or share the personal information of consumers under 16. We do not use sensitive personal information to infer characteristics about you.

You may use an authorised agent to make a request; we may ask the agent for proof of authorisation and verify your identity. If we deny your request, you may appeal by replying to our decision.

12. Children

Unless an App’s store listing states otherwise, our Apps are intended for a general audience and are not directed at children under 13 (or under 16 in the EEA, where the age of digital consent in Ireland is 16). We do not knowingly collect personal data from children below these ages without verified parental consent.

Where an App is designed for or may appeal to children, we comply with the U.S. Children’s Online Privacy Protection Act (COPPA), the GDPR and the Google Play Families Policy and Apple’s Kids Category guidelines: we may use an age screen, we treat players identified as children as such, we do not show them personalised advertising, and we only use advertising and analytics SDKs that are certified for, or configured for, child-directed use.

If you believe a child has given us personal data, contact admin@ooxcit.com and we will delete it.

13. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), access controls limited to people who need the data, and contracts with our providers. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

14. Third-party links and services

Our Services may link to or display content from third parties (for example ads, app stores or social networks). Their handling of your data is governed by their own privacy policies, not this one.

15. Changes to this policy

We may update this policy from time to time, for example when we add a new App or partner or when the law changes. The “Last updated” date above shows when it last changed. Where changes are significant, we will give notice in the App or on the Website, and ask for your consent again if the law requires it.

16. Contact us

OOX Limited
77 Lower Camden Street, Suite 7, Dublin 2, D02 XE80, Ireland
Company number 719529
Email: admin@ooxcit.com