Privacy Policy

Websites and Mobile Games

1. General Information

With this Privacy Policy, we inform you about how we process personal data when you use our websites and our mobile games.

This Privacy Policy applies in particular to:

• our websites sheronyx.com and sheronyx.de,
• our published mobile games, including Cuby Dreams,
• the features and services associated with our offerings.

Insofar as individual features or services are only available in certain games, the corresponding sections of this Privacy Policy apply exclusively when they are used.

Part D contains supplementary information for users in Switzerland, the United Kingdom, the United States, Canada, Brazil, China, Japan, South Korea, Singapore and India.

Personal data is any information relating to an identified or identifiable natural person. This may include, for example, IP addresses, technical device identifiers or pseudonymous player identifiers.

We process personal data exclusively within the framework of the applicable data protection laws, in particular the General Data Protection Regulation (GDPR).

2. Controller

The controller within the meaning of the GDPR is:

Pascal Scherrer und Marcel Scherrer GbR
Business name: SHERONYX
Schulstraße 17
76437 Rastatt
Germany
Email: info@sheronyx.com
Website: https://sheronyx.com

If you have any questions about data protection or wish to exercise your data protection rights, you can contact us at any time at the email address provided.

3. Legal Bases for Data Processing

We process personal data on the basis of the following provisions:

Art. 6(1)(a) GDPR – Consent
Where you voluntarily consent to data processing, for example for advertising, usage analytics, error diagnostics or push notifications.

Art. 6(1)(b) GDPR – Performance of a contract
Where processing is necessary to provide you with our games and their essential features. This includes in particular player identification and saving game progress.

Art. 6(1)(c) GDPR – Legal obligation
Where we are obliged by law to process or retain personal data.

Art. 6(1)(f) GDPR – Legitimate interest
Where processing is necessary to ensure the security, stability and functionality of our offerings or to handle general inquiries, and no overriding interests or fundamental rights of the data subjects conflict with it.

Where information is stored on or read from your device, we additionally comply with the requirements of Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Part A – Data Protection on Our Websites

4. Hosting and Server Log Files

Our websites are hosted and delivered by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, United States (“Netlify”). Netlify operates a global content delivery network, so requests to our websites may be answered by servers outside the European Union, including in the United States.

When you visit our websites, technically necessary information is processed. This may include in particular:

• IP address or its anonymized form
• Date and time of access
• Pages and files accessed
• Browser type and browser version
• Operating system used
• HTTP status codes
• Amount of data transferred

This data is used for the technical provision of our websites, error analysis and ensuring system security.

Legal basis: Art. 6(1)(f) GDPR.

Netlify processes this data on our behalf as a processor on the basis of a data processing agreement. Server log files are stored by Netlify for a limited period in accordance with its retention rules and then deleted. We do not combine this data with other data sources.

Further information on the transfer of data to the United States can be found in Section 22.3.

5. Cookies and Consent Management

Our websites use technically necessary cookies or comparable technologies, insofar as these are required for their provision and functionality.

In addition, we use consent-based technologies, in particular Google Analytics.

On your first visit to our websites, you can choose between the following options in our cookie banner:

• Accept all
• Necessary only
• Preferences

Non-essential technologies are only activated after you have expressly consented.

You can change your decision or withdraw any consent given at any time via the “Cookie Settings” link in the footer of our websites.

Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, insofar as consent is required.

The relevant statutory exemptions apply to strictly necessary technologies.

6. Google Analytics

We use Google Analytics, a web analytics service provided by Google, on our websites.

Google Analytics enables us to statistically evaluate the use of our websites and to improve our offering.

The following information may be processed in particular:

• Pages visited
• Interactions with website content
• Duration of use
• Browser and device information
• Approximate geographic information
• Technical identifiers and usage events

Google Analytics is only activated after your express consent.

If you decline the use of optional cookies, Google Analytics remains deactivated.

Legal basis: Art. 6(1)(a) GDPR.

Retention period
We have configured the following retention periods for Google Analytics:

If the user becomes active again, the retention period for user-level data may start anew.

Aggregated statistics without personal reference may persist beyond this.

Withdrawal
You can withdraw your consent at any time via the cookie settings of our websites.

The withdrawal applies to the future. Processing that has already lawfully taken place remains unaffected.

Further information on international data transfers can be found in Section 22.

7. Fonts

Our websites do not load fonts from external providers such as Google Fonts. Text is displayed using the fonts already installed on your device.

Therefore, no personal data is transmitted to font providers when you visit our websites.

8. External Links

Our websites may contain links to external offerings, for example to YouTube or social networks.

These offerings are only linked and are not directly embedded in our websites.

When you merely visit our websites, no personal data is transmitted to the respective external providers through these links.

The corresponding external website is only accessed when you click on such a link.

The privacy policies of the respective provider apply to the subsequent processing of personal data.

9. Contact and Support

If you contact us by email, we process the information you provide.

This may include in particular:

• Email address
• Content of your message
• Voluntarily provided contact details
• Technical details about the affected device or game
• Attachments, if submitted

Processing takes place in order to handle your inquiry and, if necessary, for any required follow-up questions.

We use the provider mailbox.org for our email communication.

Legal bases:

• Art. 6(1)(b) GDPR for contract-related inquiries
• Art. 6(1)(f) GDPR for general inquiries
• Art. 6(1)(c) GDPR for the fulfillment of legal obligations

Retention period
Support requests are generally deleted twelve months after processing has been completed.

Requests to exercise data protection rights are generally retained for three years after completion, insofar as this is necessary to document their proper handling.

Statutory retention obligations remain unaffected.

Part B – Data Protection in Our Mobile Games

10. General Information on Data Processing in Our Games

SHERONYX develops and publishes mobile games for Android and iOS.

To provide our games, we may use various technical services from Unity and Google.

The following sections apply to those games in which the described services and features are actually used.

Which personal data is processed depends in particular on the game features used and the consents given.

Our games can generally be used without linking a personal Apple or Google account, unless the respective game requires features expressly described otherwise.

Consent to advertising, usage analytics or error diagnostics is not required for basic playability.

11. Unity Authentication – Player Identification

In games with cloud-based player accounts, we use Unity Authentication, a service provided by Unity.

When the game is launched for the first time, an anonymous player identity is created automatically. A unique identifier, the so-called Unity PlayerID, is assigned for this purpose.

It serves in particular to:

• recognize players within the game
• clearly assign save data
• retrieve saved game content
• manage game progress

No name or email address is required to create this player identity.

The Unity PlayerID is a pseudonymous identifier and may constitute personal data under data protection law.

Legal basis: Art. 6(1)(b) GDPR.

Retention period
The player identity is stored for as long as the player account exists.

After 36 months of inactivity, the player account is deleted automatically.

Players can also delete their account themselves at any time using the “Delete Account” function in the game settings.

12. Unity Cloud Save – Storing Game Progress

In games equipped accordingly, we use Unity Cloud Save to store game progress.

The existing save data is loaded automatically when the game starts. Changes are saved during use.

The following data may be processed in particular:

• Game progress
• In-game currencies and balances
• Unlocked game worlds
• Unlocked and purchased items
• Achievements
• Tutorial progress
• Technical information for certain game features

The stored information is assigned to the respective player account via the Unity PlayerID.

In the games concerned, cloud storage is an integral part of save data management.

Legal basis: Art. 6(1)(b) GDPR.

Retention period
The stored save data is deleted together with the player account.

This takes place either automatically after 36 months of inactivity or immediately upon an account deletion initiated by the player.

13. Apple Game Center and Google Play Games

In games equipped accordingly, players can voluntarily link their player account with Apple Game Center or Google Play Games.

This link makes it possible in particular to restore save data after a reinstallation or a change of device.

Apple Game Center
When linking, an identity verification provided by Apple is processed.

It may contain in particular the following technical information:

• Platform player identifier
• Digital signature
• Public key URL
• Salt value
• Timestamp

Google Play Games
When linking, a time-limited authorization code is processed.

The respective identity verifications are transmitted to Unity Authentication for verification.

SHERONYX does not permanently store these verifications on its own servers.

Unity Authentication stores the association between the Unity PlayerID and the respective platform identifier.

In addition, the public Game Center alias or the Google Play Games gamertag may be stored in the Unity player profile and cached locally.

As part of this link, SHERONYX does not request access to email addresses, real names, profile pictures, dates of birth, friend lists or payment information.

Legal basis: Art. 6(1)(b) GDPR for the voluntarily requested account link.

Without a link, the respective game generally remains playable.

In the event of a reinstallation without a prior link, a new anonymous Unity PlayerID may be created. The previous save data may then no longer be accessible.

14. In-App Purchases

Our games may offer in-app purchases.

For the technical integration, we may use Unity Purchasing (Unity IAP).

Payment is processed by the respective app store operator:

• Apple App Store
• Google Play Store

The payment providers process the necessary payment and billing information under their own responsibility.

Unity Purchasing processes the technical information required to verify a purchase, including the purchase receipt provided by the app store.

SHERONYX does not store complete purchase receipts, transaction numbers, order numbers or payment method data on its own servers.

After a successful purchase, the corresponding game content and balances are stored locally or in the save data storage used.

Legal basis: Art. 6(1)(b) GDPR.

If corresponding consent has been given, a purchase event may additionally be recorded via Firebase Analytics. It contains the product identifier, the localized price and the currency code, but no transaction ID or payment information.

15. Google AdMob and Consent Management

In games with advertisements, we use Google AdMob to serve advertising.

The following data may be processed in particular:

• Device information
• IP address
• Advertising identifiers
• Information about ad delivery
• Interactions with advertisements
• Technical usage information

Processing may serve in particular the delivery of advertising, the measurement of its effectiveness and the prevention of abuse.

Consent and non-personalized advertising
With your corresponding consent, personalized advertisements may be served. Without consent, no personalization takes place.

If you decline in the Google UMP dialog, only non-personalized ads will continue to be served, provided that the UMP reports to the app that ads may be requested. If the UMP does not allow ad requests, no ads are requested. The special restrictions for players under 16 in accordance with Section 19 remain in place.

Non-personalized ads are not selected on the basis of an individual advertising profile. Their technical delivery may nevertheless involve the processing of personal data and the storage of or access to information on the device.

The term “non-personalized” here describes the exclusion of personalized selection. Google technically distinguishes between non-personalized ads and limited ads (“Limited Ads”). Which type of delivery can actually be used after a refusal depends on the consent signals transmitted and the respective configuration.

Legal bases for advertising processing
Where corresponding consent is given, the processing covered by it takes place on the basis of Art. 6(1)(a) GDPR and, for storage on or access to the device requiring consent, Section 25(1) TDDDG.

For processing operations without consent, Art. 6(1)(f) GDPR can only be considered if, in the specific case, there is a legitimate interest, the processing is necessary for this purpose and the interests or fundamental rights and freedoms of the data subjects do not override it. Possible interests include the financing of the game offering as well as security and abuse prevention in ad delivery.

Irrespective of this, Section 25 TDDDG must be observed for storing or reading information on the device. Without consent, this is only permissible if a statutory exemption under Section 25(2) TDDDG applies. A legitimate interest under the GDPR does not replace consent required under Section 25 TDDDG.

Independent consent for Analytics and Crashlytics
Firebase Analytics and Firebase Crashlytics remain completely deactivated if you decline. Both services are only activated if the respective consent has actually been given. The technical ability to request ads does not trigger the activation of these services. Sections 16 and 17 apply in addition.

Google User Messaging Platform
We use the Google User Messaging Platform (UMP) to obtain and manage consents.

The UMP provides the consent dialog and processes the information required to manage the consent decision.

You can access your privacy settings again within the respective game at any time and withdraw any consent given.

A withdrawal takes effect for the future.

Google may act as an independent controller for certain processing operations in the context of ad delivery.

16. Firebase Analytics

In games equipped accordingly, we use Firebase Analytics to statistically evaluate the use of our games and to further develop them.

The following events may be recorded in particular:

• Game start and game end
• Start and end of game sessions
• Scores achieved
• Completion of certain game actions
• Completion of advertisements
• Successful in-app purchases

For purchase events, only the product identifier, the localized price and the currency code are processed.

Transaction IDs and payment information are not transmitted to Firebase Analytics.

Firebase Analytics is only activated after your express consent.

If you decline, Firebase Analytics remains completely deactivated; no analytics events are collected or transmitted. Activation requires consent that has actually been given and is independent of whether UMP allows ad requests.

Legal basis: Art. 6(1)(a) GDPR.

Retention period
The following settings apply to Firebase Analytics:

If the user becomes active again, the retention period for user-level data may start anew.

Aggregated statistics without personal reference may persist for longer.

Withdrawal
You can withdraw your consent at any time in the privacy settings of the respective game.

Upon withdrawal, Firebase Analytics is deactivated immediately.

In addition, the corresponding Google consent signals are set to “denied”, locally cached analytics data is reset and the app instance ID is renewed.

The decision persists even after the game is restarted.

Data already transmitted to Google is not automatically deleted retroactively by the withdrawal.

17. Firebase Crashlytics

In games equipped accordingly, we use Firebase Crashlytics to analyze technical errors and crashes.

The following information may be processed in particular:

• Crash reports
• Technical error details
• Device information
• Operating system version
• App version
• Technical identifiers
• Information about the state of the app when an error occurred

Processing serves to detect and fix errors and to improve the stability of our games.

Firebase Crashlytics is only activated after express consent.

If you decline, Firebase Crashlytics remains completely deactivated; no crash reports are collected or transmitted. Activation requires consent that has actually been given and is independent of whether UMP allows ad requests.

Legal basis: Art. 6(1)(a) GDPR.

Retention period
In accordance with Google’s applicable retention rules, individual crash reports are generally stored for 90 days.

Withdrawal
You can withdraw your consent at any time in the privacy settings of the respective game.

Further collection of crash reports is deactivated immediately.

Reports already transmitted remain subject to the respective retention and deletion rules.

18. Push Notifications

In games with push notifications, we use Firebase Cloud Messaging (FCM).

Push notifications may, for example, inform you about new in-game events or available rewards.

We do not use these notifications for advertising messages.

Activation and deactivation
Players can manually activate or deactivate push notifications at any time within the game settings.

In addition, notifications can be deactivated via the settings of the respective operating system.

On iOS and Android 13 and later, a corresponding system permission is also required to display push notifications.

On older Android versions, technical registration may take place in accordance with the specifications of the operating system without a separate system prompt.

Registration for voluntary push notifications is based on your consent.

Legal basis: Art. 6(1)(a) GDPR.

Data processed
To deliver push notifications, we process in particular:

• Firebase Cloud Messaging token
• Unity PlayerID
• Time of the last update of the token record

The push token serves to technically identify a device for the delivery of notifications.

Storage
Push tokens are stored in Google Cloud Firestore.

The database is located in the Google Cloud multi-region nam5 in the United States.

For server-side processing, we also use Google Cloud services in the us-central1 region (USA).

Withdrawal and deletion
Players can deactivate push notifications at any time in the game settings.

Upon deactivation, the decision is stored permanently. From this point on, no further push tokens are requested, updated or transmitted to our servers.

The push token already stored is deleted immediately from our Firestore database.

Should deletion temporarily not be possible, for example due to a missing internet connection, it is carried out automatically at the next app start before the rest of the initialization continues.

Further transmission of push tokens remains deactivated in the meantime.

Irrespective of this, push token records are also deleted:

• when the player account is deleted via “Delete Account”
• when Google reports a token as invalid
• automatically after 730 days without an update

An automatic clean-up running daily removes corresponding outdated records.

In doing so, the stored push token and the associated Unity PlayerID are deleted from the Firestore record.

19. Protection of Minor Players

In our games equipped accordingly, players are asked when they first launch the game whether they are at least 16 years old.

This question serves to control the processing of personal data in an age-appropriate manner.

Players aged 16 and over
Players who state that they are at least 16 years old can decide via the regular consent dialog whether they consent to the processing of their data for advertising, usage analytics and error diagnostics.

Players under 16
For players under 16, the following services remain deactivated:

• Google AdMob
• Firebase Analytics
• Firebase Crashlytics

No corresponding advertisements are served and no consent-based analytics or Crashlytics data is collected.

Basic playability is maintained regardless of age group.

Storage of the age group
Only whether a player is at least 16 years old is stored.

This information is only stored locally on the device.

A full date of birth is not collected.

Part C – Retention Periods, Recipients and Data Protection Rights

20. Retention Period and Deletion of Player Accounts

20.1 Storage of account and save data
Account and save data is stored for as long as the respective player account exists.

To avoid indefinite storage of data that is no longer needed, we have implemented automatic deletion of inactive accounts for the corresponding Unity player accounts.

Player accounts are deleted automatically if they have not been used for 36 months.

Deletion includes:

• the player account in Unity Authentication
• the associated save data in Unity Cloud Save

Automatic deletion is based on the last use of the player account.

20.2 Manual account deletion
Players can delete their player account at any time within the game settings using the “Delete Account” function.

A confirmation prompt is displayed before final deletion.

After confirmation, the following data in particular is removed:

• Unity Authentication player account
• Associated Unity Cloud Save data
• Firestore records linked to the push token used
• Locally stored player data

Deletion is permanent and cannot be undone.

SHERONYX does not store this account and save data beyond this, unless statutory retention obligations apply.

Analytics or Crashlytics data already transmitted to other providers is not necessarily deleted immediately by the account deletion. The respective retention periods and deletion options apply to this data.

20.3 Uninstallation
Merely uninstalling a game does not immediately lead to the deletion of server-side player data.

Locally stored app data is generally removed by the operating system.

If a player account is linked to Apple Game Center or Google Play Games, the save data can be restored upon reinstallation.

In the case of anonymous use without a platform link, a new Unity PlayerID may be created after a reinstallation. The previous save data may then no longer be accessible.

Such inactive player accounts are also deleted automatically after 36 months of inactivity.

21. General Retention Periods

The following retention periods apply to the various data categories, insofar as the respective services are used:

Where statutory retention obligations exist, certain data may be stored for longer.

22. Recipients of Personal Data and Transfers to Third Countries

To provide our websites and games, we work with various external service providers.

Depending on the service, personal data is processed within the European Union or in third countries.

22.1 Google LLC
Google LLC
Mountain View, California
United States

Depending on the offering, we use in particular the following Google services:

• Google Analytics
• Firebase Analytics
• Firebase Crashlytics
• Google Cloud Firestore
• Google Cloud Functions
• Firebase Cloud Messaging
• Google AdMob
• Google User Messaging Platform

The Cloud Firestore database we use is located in the US multi-region nam5.

The cloud functions used are operated in the us-central1 region.

Roles under data protection law
For the corresponding Firebase and Google Cloud services, Google processes personal data within the framework of the applicable data processing agreements.

For certain processing operations in connection with Google AdMob, in particular personalized ad delivery, Google acts as an independent controller.

The consent requirements for advertising processing are implemented via the Google User Messaging Platform.

Safeguards for transfers to third countries
Google LLC is certified under the EU-U.S. Data Privacy Framework.

Insofar as the respective data transfer is covered by the adequacy decision and the certification, it takes place on the basis of Art. 45 GDPR.

In addition, or for other relevant transfers, the Standard Contractual Clauses of the European Commission agreed by Google may apply.

These are in particular part of the relevant Google Cloud data protection agreements.

22.2 Unity Technologies
Depending on the game, we use in particular the following services from Unity Technologies:

• Unity Authentication
• Unity Cloud Save
• Unity Purchasing

Unity processes the data required for these services in accordance with the respective contractual terms.

Roles under data protection law
Depending on the service used and the purpose of processing, Unity processes personal data as a processor or as an independent controller.

The contractually agreed data protection provisions apply to the corresponding processing on our behalf.

Safeguards for transfers to third countries
Insofar as personal data is transferred by Unity to third countries without an adequate level of data protection, the transfers concerned are based on the applicable Standard Contractual Clauses of the European Commission.

These are part of the relevant Unity data protection agreements.

This Privacy Policy does not presuppose a certification of Unity under the EU-U.S. Data Privacy Framework as a basis for transfers.

22.3 Other service providers
In addition, we use the following providers:

• Netlify, Inc. (San Francisco, USA) – website hosting and technical provision of our websites, see Section 4.
• mailbox.org – provision of our email communication.
• Apple – app store services, payment processing and voluntary Game Center linking.
• Google Play – app store services, payment processing and voluntary Play Games linking.

The respective providers process personal data in accordance with their role under data protection law and the applicable contractual terms.

Safeguards for transfers to third countries (Netlify)
Netlify processes personal data in the United States, among other places. Insofar as Netlify is certified under the EU-U.S. Data Privacy Framework and the transfer is covered by it, the transfer takes place on the basis of Art. 45 GDPR. In addition, the Standard Contractual Clauses of the European Commission included in Netlify’s data processing agreement apply.

23. Your Data Protection Rights

Subject to the statutory requirements, you have the following rights:

Access – Art. 15 GDPR
You can request information about which personal data we process about you.

Rectification – Art. 16 GDPR
You can request the correction of inaccurate or the completion of incomplete personal data.

Erasure – Art. 17 GDPR
You can request the deletion of your personal data under the statutory requirements.

Restriction of processing – Art. 18 GDPR
You can request the restriction of the processing of your personal data under certain conditions.

Data portability – Art. 20 GDPR
Under the statutory requirements, you can request to receive certain personal data in a structured, commonly used and machine-readable format.

Objection – Art. 21 GDPR
You can object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR.

Withdrawal of consent – Art. 7(3) GDPR
You can withdraw any consent given at any time with effect for the future.

The lawfulness of processing up to the time of withdrawal remains unaffected.

Contact for exercising your rights
Please send corresponding requests to:
info@sheronyx.com

We will process your request within the statutory deadlines.

24. Right to Lodge a Complaint with a Supervisory Authority

In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

The following supervisory authority is in particular responsible for SHERONYX:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW)
Website: https://www.baden-wuerttemberg.datenschutz.de/

You can also contact another competent data protection supervisory authority.

25. Data Security

We take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration and unlawful processing.

These include in particular:

• Encrypted data transmission
• Access restrictions to our systems
• Management of access permissions
• Use of established hosting and cloud service providers
• Technical measures for automatic data deletion
• Limitation of data processing to what is necessary

Despite appropriate security measures, completely risk-free data transmission and storage cannot be guaranteed.

26. Automated Decision-Making

In the processing described here, SHERONYX does not use solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

The automatic deletion of inactive player accounts serves to implement our retention and deletion rules.

27. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy if our offerings, the technologies used or the legal requirements change.

The current version will be published on our websites.

Where changes require renewed consent, we will obtain it before the corresponding processing.

Part D – Country-Specific Information

The following annexes supplement this Privacy Policy for users in certain countries. Unless stated otherwise below, the provisions of Parts A to C apply accordingly. In the event of a conflict, the annex applicable to your country takes precedence for you.

The controller for all annexes is the entity named in Section 2: Pascal Scherrer und Marcel Scherrer GbR (SHERONYX), Schulstraße 17, 76437 Rastatt, Germany, info@sheronyx.com.

Annex 1 – Switzerland (FADP / revDSG)

This annex applies to users located in Switzerland and addresses the Swiss Federal Act on Data Protection (FADP), which entered into force on 1 September 2023. Where the FADP provides for requirements equivalent to those of the GDPR, the provisions of this Privacy Policy apply correspondingly.

Cross-border data transfers
Personal data may be transferred to countries outside Switzerland, in particular to the United States (see Section 22). Where the recipient country does not provide an adequate level of data protection recognised by the Swiss Federal Council, transfers take place on the basis of the Swiss-U.S. Data Privacy Framework, where the recipient is certified, or on the basis of the Standard Contractual Clauses of the European Commission as recognised and adapted under Swiss law.

Your rights

• Right of access (Art. 25 FADP)
• Right to data portability (Art. 28 FADP)
• Right to rectification, erasure and restriction of processing (Art. 32 FADP)
• Right to object to processing

To exercise these rights, please contact info@sheronyx.com.

Supervisory authority
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Berne, Switzerland
https://www.edoeb.admin.ch

Annex 2 – United Kingdom (UK GDPR / Data Protection Act 2018)

This annex applies to users located in the United Kingdom. The legal bases set out in Section 3 apply correspondingly under the UK GDPR; references to the “GDPR” are to be read as references to the UK GDPR for users in the United Kingdom. As the controller is not established in the United Kingdom, users there can contact us directly at info@sheronyx.com.

International data transfers
Transfers of personal data from the United Kingdom to third countries, in particular the United States (see Section 22), take place on the basis of UK adequacy regulations (including the UK Extension to the EU-U.S. Data Privacy Framework, where the recipient is certified), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Your rights

• Right of access (Art. 15 UK GDPR)
• Right to rectification (Art. 16 UK GDPR)
• Right to erasure (Art. 17 UK GDPR)
• Right to restriction of processing (Art. 18 UK GDPR)
• Right to data portability (Art. 20 UK GDPR)
• Right to object (Art. 21 UK GDPR)
• Rights in relation to automated decision-making (Art. 22 UK GDPR); we do not carry out such decision-making (see Section 26)
• Right to withdraw consent at any time

Supervisory authority
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
https://ico.org.uk

Annex 3 – United States of America

This annex applies to users located in the United States and supplements this Privacy Policy with regard to applicable U.S. state and federal privacy laws.

Categories of personal information collected
Depending on the features used and the consents given (see Sections 4 to 19), we collect the following categories:

• Identifiers (e.g. IP address, device identifiers, advertising identifiers, Unity PlayerID, Apple Game Center or Google Play Games identifiers, push tokens, email address if you contact us)
• Internet or other electronic network activity information (e.g. website usage via Google Analytics with consent, game events, crash reports)
• Commercial information (in-app purchase events: product identifier, localized price and currency code)
• Approximate geolocation (derived from the IP address)

The purposes of collection are described in Sections 4 to 19, the retention periods in Sections 20 and 21, and the categories of recipients in Section 22.

Sale and sharing of personal information
We do not sell personal information for money. If you consent to personalized advertising in the consent dialog of a game, Google AdMob may serve personalized ads (see Section 15). This may constitute “sharing” for cross-context behavioral advertising or “targeted advertising” under certain U.S. state laws. You can opt out at any time by declining or withdrawing this consent in the privacy settings of the respective game. Players under 16 do not receive advertising (see Section 19). On our websites, Google Analytics is only used with your consent (see Section 6).

California privacy rights (CCPA / CPRA)
Residents of California have the following rights:

1. Right to know the categories and specific pieces of personal information we have collected, its sources, purposes and recipients.
2. Right to delete personal information we have collected from you, subject to certain exceptions.
3. Right to correct inaccurate personal information.
4. Right to opt out of sale or sharing – as described above, via the privacy settings of the respective game.
5. Right to limit the use of sensitive personal information – we do not process sensitive personal information within the meaning of the CPRA.
6. Right to non-discrimination for exercising your privacy rights.

To exercise your rights, please contact info@sheronyx.com. We will respond to verifiable requests within 45 days; this period may be extended by a further 45 days where necessary. You may designate an authorized agent to make a request on your behalf; we may require written proof of authorization.

Shine the Light
We do not disclose personal information to third parties for their own direct marketing purposes (California Civil Code § 1798.83).

Other U.S. states
Residents of other U.S. states with comprehensive privacy laws (e.g. Virginia, Colorado, Connecticut, Texas, Utah) may have similar rights, including the rights of access, correction, deletion, portability and to opt out of targeted advertising. To exercise these rights, please contact info@sheronyx.com. Where your state law provides for an appeal, you may appeal our decision by contacting us at the same address.

Children’s privacy (COPPA)
Our games and websites are not directed to children under 13. We do not knowingly collect personal information from children under 13 beyond what is technically necessary to provide the game. For players under 16, advertising, Firebase Analytics and Firebase Crashlytics remain deactivated (see Section 19). If you believe that we have collected personal information from a child under 13, please contact info@sheronyx.com so that we can delete it promptly.

Annex 4 – Canada (PIPEDA and Provincial Privacy Laws)

This annex applies to users located in Canada.

Accountability
We are responsible for personal information under our control. Our point of contact for privacy matters is info@sheronyx.com.

Purposes and consent
We collect, use and disclose personal information only for the purposes described in Sections 4 to 19 or for purposes that a reasonable person would consider appropriate in the circumstances. Where required, we obtain your consent. You may withdraw consent at any time, subject to legal or contractual restrictions.

Cross-border transfers
Your personal information may be processed in countries outside Canada, in particular in the European Union and the United States (see Section 22). We use contractual safeguards for such transfers. Personal information processed abroad may be accessible to the authorities of those countries in accordance with their laws.

Your rights
You have the right to access your personal information and to challenge its accuracy. Please contact info@sheronyx.com.

Supervisory authority
Office of the Privacy Commissioner of Canada (OPC)
30 Victoria Street, Gatineau, Québec K1A 1H3
https://www.priv.gc.ca

Annex 5 – Brazil (LGPD)

This annex applies to users located in Brazil and addresses the Lei Geral de Proteção de Dados (LGPD – Law No. 13,709/2018).

Legal bases (hipóteses legais)

• Performance of a contract (Art. 7(V) LGPD) – for player identification, save data and in-app purchases (Sections 11 to 14)
• Consent (Art. 7(I) LGPD) – for Google Analytics, personalized advertising, Firebase Analytics, Firebase Crashlytics and push notifications (Sections 6 and 15 to 18)
• Legitimate interest (Art. 7(IX) LGPD) – for the secure operation of our websites and handling of general inquiries (Sections 4 and 9)
• Compliance with a legal obligation (Art. 7(II) LGPD)

Your rights (Art. 18 LGPD)

• Confirmation of the existence of processing and access to your data
• Correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion of unnecessary or excessive data
• Portability of your data to another service provider
• Deletion of personal data processed on the basis of consent
• Information about the entities with which your data has been shared
• Withdrawal of consent at any time

To exercise your rights, please contact info@sheronyx.com.

International transfers
International transfers (see Section 22) are made subject to appropriate safeguards, in particular standard contractual clauses.

Supervisory authority
Autoridade Nacional de Proteção de Dados (ANPD)
https://www.gov.br/anpd

Annex 6 – People’s Republic of China (PIPL)

This annex applies to users located in the People’s Republic of China and addresses the Personal Information Protection Law (PIPL).

Legal bases

• Individual consent (Art. 13(1) PIPL) – for processing based on consent as described in Sections 6 and 15 to 18
• Performance of a contract (Art. 13(2) PIPL) – for data necessary to provide the games (Sections 11 to 14)

Cross-border transfers
Your personal information is processed outside the PRC, in particular in the European Union and the United States, by the recipients named in Section 22. Where required by the PIPL, we obtain your separate consent to the cross-border transfer and inform you of the recipient’s identity, the destination country, the purposes and means of processing and how to exercise your rights against the overseas recipient.

Minors
We do not knowingly process personal information of children under 14 beyond what is technically necessary to provide the game. For players under 16, advertising and consent-based analytics remain deactivated (see Section 19).

Your rights (Art. 44–50 PIPL)

• Access to and copies of your personal information
• Correction of inaccurate personal information
• Deletion of personal information under certain circumstances
• Withdrawal of consent (without affecting the lawfulness of prior processing)
• Transfer of your personal information (portability)
• Explanation of our processing rules

To exercise your rights, please contact info@sheronyx.com.

Annex 7 – Japan (APPI)

This annex applies to users located in Japan and addresses the Act on the Protection of Personal Information (APPI).

Purposes of use
Personal information is used for the purposes described in Sections 4 to 19.

Provision to third parties
Personal information is provided to the service providers named in Section 22, either as processors acting on our behalf or, where stated, as independent controllers.

Cross-border transfers
Personal information is transferred to countries outside Japan, in particular to EU member states and the United States. We ensure that recipients maintain a level of protection equivalent to the APPI, or we obtain your consent after providing information about the data protection system of the destination country.

Your rights

• Disclosure of retained personal data
• Correction, addition or deletion of inaccurate personal data
• Suspension of use or erasure of personal data processed in violation of the APPI
• Suspension of provision to third parties

To exercise your rights, please contact info@sheronyx.com.

Supervisory authority
Personal Information Protection Commission (PPC)
https://www.ppc.go.jp

Annex 8 – Republic of Korea (PIPA)

This annex applies to users located in the Republic of Korea and addresses the Personal Information Protection Act (PIPA).

Purposes and items of processing
The items of personal information processed and the purposes of processing are described in Sections 4 to 19.

Retention and destruction
Personal information is retained for the periods described in Sections 20 and 21 and is then destroyed without delay.

Entrustment and provision to third parties
Personal information is entrusted to or provided to the recipients named in Section 22.

Cross-border transfers
Personal information is transferred outside Korea, in particular to EU member states and the United States. Section 22 names the recipients, destination countries, purposes and items transferred; the retention periods are set out in Section 21. Transfers take place via encrypted network connections when the respective service is used.

Your rights

• Access to your personal information
• Correction of inaccurate data
• Deletion of personal information
• Suspension of processing
• Withdrawal of consent

To exercise your rights, please contact info@sheronyx.com.

Supervisory authority
Personal Information Protection Commission (PIPC)
https://www.pipc.go.kr

Annex 9 – Singapore (PDPA)

This annex applies to users located in Singapore and addresses the Personal Data Protection Act 2012 (PDPA).

Purposes of collection, use and disclosure
Personal data is collected, used and disclosed for the purposes described in Sections 4 to 19.

Consent and withdrawal
Where consent is required, we obtain it as described in this Privacy Policy. You may withdraw consent at any time via the cookie settings of our websites, the privacy settings of the respective game or by contacting info@sheronyx.com. Withdrawal may affect the availability of certain features.

Overseas transfers
Personal data may be transferred outside Singapore, in particular to EU member states and the United States (see Section 22). We ensure through contractual arrangements that recipients provide a standard of protection comparable to the PDPA.

Access and correction
You may request access to and correction of your personal data by contacting info@sheronyx.com.

Data breach notification
In the event of a notifiable data breach, we will notify the Personal Data Protection Commission and affected individuals as required by law.

Supervisory authority
Personal Data Protection Commission (PDPC)
https://www.pdpc.gov.sg

Annex 10 – India (Digital Personal Data Protection Act, 2023)

This annex applies to users located in India and addresses the Digital Personal Data Protection Act, 2023 (DPDPA).

Basis and purposes of processing
Personal data is processed on the basis of your consent or for legitimate uses permitted by law, for the purposes described in Sections 4 to 19.

Cross-border transfers
Personal data may be transferred outside India, in particular to EU member states and the United States (see Section 22), unless such transfer is restricted by the Central Government.

Your rights

• Right to access information about your personal data
• Right to correction, completion, updating and erasure of personal data
• Right to grievance redressal
• Right to nominate another person to exercise your rights in the event of death or incapacity
• Right to withdraw consent at any time

Grievance redressal
To raise a grievance or exercise your rights, please contact info@sheronyx.com. If your grievance is not resolved, you may approach the Data Protection Board of India.

Current as of: October 18, 2026