This Privacy Policy describes how ANOMALY DEVELOPMENT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ ("we," "us," or "our") collects, uses, and shares your personal data when you play our tower defense game ("the Game"). We operate as the Data Controller under the GDPR and similar global privacy regimes.

1. Data Controller Information

Company Name: ANOMALY DEVELOPMENT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

KRS: 0000879054 | NIP (VAT): PL 7521461977 | REGON: 387965944

Address: ul. ŻWIRKI I WIGURY 3, 46-100 NAMYSŁÓW, OPOLSKIE, POLAND

Contact Email: td@anomalydev.pl

2. Data We Collect

We collect data through two primary methods: directly from you and automatically via integrated services.

A. Information You Provide (Optional Online Account)

If you choose to create an account for ranked play and seasons, we store the following in Google Firebase:

• Email Address: Used for authentication and account recovery.
• Username: A randomly generated or user-edited nickname.
• Game Performance Data: Best scores per map and season rankings.
• Transaction Records: Details of digital goods purchased (avatars, borders, backgrounds).

B. Automatically Collected Information

To provide services and ads, we use SDKs (Google Analytics and AdMob) that collect:

• Identifiers: IP Address (for general location), Android Advertising ID (AAID), and Firebase Installation UUID.
• Device Metadata: OS version, device model, and brand.
• Usage Data: App launches, screen views, and interactions with ads.

3. How We Use Your Data

We process your data for the following purposes:

• Service Delivery: Authenticating your account and maintaining leaderboards.
• Analytics: Understanding game performance and balancing.
• Monetization: Displaying personalized or non-personalized ads via AdMob.
• Security: Preventing fraud and abuse during account creation.

4. Lawful Bases for Processing (EEA/UK/Global)

We process data based on:

• Contractual Necessity: For online account features and purchased content.
• Consent: For personalized advertising and analytical tracking.
• Legitimate Interest: For security, fraud prevention, and basic app improvements.

5. Account Deletion and Forfeiture of Digital Goods

You may request account deletion at any time via the "Remove Account" button in the Game settings.

Data Erasure: Deletion will permanently remove your email, username, scores, and purchase history from our live and backup systems (backups may take up to 180 days to purge).

Forfeiture of Content: IMPORTANT: By deleting your account, you explicitly acknowledge and agree to the permanent forfeiture of all purchased digital cosmetics (avatars, borders, backgrounds). These items are linked to your account identifier and cannot be recovered, transferred, or refunded once the account is deleted.

6. International Data Transfers

Your data is stored on Google Firebase servers, which may be located in the United States. We rely on the EU-U.S. Data Privacy Framework (DPF) to ensure your data receives an equivalent level of protection when transferred from the EEA/UK to the US.

7. Age Policy (Mixed Audience)

The Game is a "Mixed Audience" service. We implement a neutral age gate upon first launch:

• Under 13 (US/Global): We do not collect emails or show personalized ads without verifiable parental consent.
• Under 18 (India): Stricter protections apply in accordance with the DPDPA.

8. Jurisdiction-Specific Disclosures

A. India (DPDPA 2023)

Multilingualism: This notice is available in English. In accordance with Section 5(3) of the DPDPA, you may request this notice in any of the 22 languages specified in the Eighth Schedule to the Constitution of India.

Grievance Officer: For any concerns, contact our Grievance Officer at td@anomalydev.pl. We will respond within 30 days.

B. United States (California/CCPA)

We do not "sell" your personal data. However, sharing data for personalized advertising via AdMob may be considered "sharing" under California law. You can opt out via your Android device's "Opt out of Ads Personalization" setting.

C. Nigeria (GAID 2025)

We implement a strict duty of care regarding your data. In the event of a high-risk breach, we will notify the NDPC within 72 hours and alert you immediately.

D. Australia & New Zealand

We disclose that your data is stored in Poland (our HQ) and the United States (Firebase servers).

9. Your Rights

Regardless of your location, you have the right to:

• Access a copy of your data.
• Correct inaccurate information.
• Delete your account and associated data.
• Withdraw Consent for tracking or ads.
• Lodge a Complaint with your local authority (e.g., UODO in Poland).

To exercise these rights, please email us at td@anomalydev.pl.