This Privacy Policy describes how ANOMALY DEVELOPMENT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ ("we," "us," or "our") collects, uses, and shares your personal data when you play our tower defense game ("the Game"). We operate as the Data Controller under the GDPR and similar global privacy regimes.

1. Data Controller Information

Company Name: ANOMALY DEVELOPMENT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

KRS: 0000879054 | NIP (VAT): PL 7521461977 | REGON: 387965944

Address: ul. ŻWIRKI I WIGURY 3, 46-100 NAMYSŁÓW, OPOLSKIE, POLAND

Contact Email: td@anomalydev.pl

2. Data We Collect

We collect data through two primary methods: directly from you and automatically via integrated services.

A. Information You Provide (Optional Online Account)

If you choose to create an account for ranked play and seasons, we store the following in Google Firebase:

• Email Address: Used for authentication and account recovery.
• Username: A randomly generated or user-edited nickname.
• Game Performance Data: Best scores per map and season rankings.
• Transaction Records: Details of digital goods purchased (avatars, borders, backgrounds).

B. Automatically Collected Information

To provide services and ads, we use SDKs (Google Analytics and AdMob) that collect:

• Identifiers: IP Address (for general location), Android Advertising ID (AAID), and Firebase Installation UUID.
• Device Metadata: OS version, device model, and brand.
• Usage Data: App launches, screen views, and interactions with ads.

3. How We Use Your Data

We process your data for the following purposes:

• Service Delivery: Authenticating your account and maintaining leaderboards.
• Analytics: Understanding game performance and balancing.
• Monetization: Displaying personalized or non-personalized ads via AdMob.
• Security: Preventing fraud and abuse during account creation.

4. Lawful Bases for Processing (EEA/UK/Global)

We process data based on:

• Contractual Necessity: For online account features and purchased content.
• Consent: For personalized advertising and analytical tracking.
• Legitimate Interest: For security, fraud prevention, and basic app improvements.

5. Account Deletion and Forfeiture of Digital Goods

You may request account deletion at any time via the "Remove Account" button in the Game settings.

Data Erasure: Deletion will permanently remove your email, username, scores, and purchase history from our live and backup systems (backups may take up to 180 days to purge).

Forfeiture of Content: IMPORTANT: By deleting your account, you explicitly acknowledge and agree to the permanent forfeiture of all purchased digital cosmetics (avatars, borders, backgrounds). These items are linked to your account identifier and cannot be recovered, transferred, or refunded once the account is deleted.

6. International Data Transfers

Your data is stored on Google Firebase servers, which may be located in the United States. We rely on the EU-U.S. Data Privacy Framework (DPF) to ensure your data receives an equivalent level of protection when transferred from the EEA/UK to the US. The UK extension to the DPF (the "UK-US Data Bridge") applies equally to transfers from the United Kingdom.

7. Age Policy (Mixed Audience)

The Game is a "Mixed Audience" service. We implement a neutral age gate upon first launch:

• Under 13 (US/Global): We do not collect emails or show personalized ads without verifiable parental consent.
• Under 18 (India): Stricter protections apply in accordance with the DPDPA.

8. Jurisdiction-Specific Disclosures

A. India (DPDPA 2023)

Multilingualism: This notice is available in English. In accordance with Section 5(3) of the DPDPA, you may request this notice in any of the 22 languages specified in the Eighth Schedule to the Constitution of India.

Grievance Officer: For any concerns, contact our Grievance Officer at td@anomalydev.pl. We will respond within 30 days.

B. United States (California/CCPA)

We do not "sell" your personal data. However, sharing data for personalized advertising via AdMob may be considered "sharing" under California law. You can opt out via your Android device's "Opt out of Ads Personalization" setting.

C. Nigeria (GAID 2025)

We implement a strict duty of care regarding your data. In the event of a high-risk breach, we will notify the NDPC within 72 hours and alert you immediately.

D. Australia & New Zealand

We disclose that your data is stored in Poland (our HQ) and the United States (Firebase servers).

E. Philippines (Republic Act 10173 — Data Privacy Act of 2012)

We process your data in compliance with the Philippine Data Privacy Act of 2012 (RA 10173), overseen by the National Privacy Commission (NPC).

Your Rights under the DPA: In addition to the rights listed in Section 9, Philippine residents have the right to be informed prior to collection about what data is gathered and why; to object to processing based on legitimate interest and to any form of direct marketing; and to request erasure or blocking of data that was unlawfully obtained or is no longer necessary for the purpose it was collected.

Data Breach Notification: In the event of a personal data breach that poses a real risk of serious harm, we will notify the NPC and all affected users within 72 hours of becoming aware of the breach.

Complaints: You may file a complaint directly with the NPC at www.privacy.gov.ph.

F. Switzerland (Federal Act on Data Protection — FADP/nDSG)

For users in Switzerland, we process personal data in accordance with the revised Federal Act on Data Protection (FADP), which took effect September 1, 2023. The FADP applies alongside the GDPR standards described throughout this Policy, as our practices are designed to meet both frameworks.

Supervisory Authority: The Federal Data Protection and Information Commissioner (FDPIC) is the competent authority for Swiss residents. You may lodge a complaint at www.edoeb.admin.ch.

International Transfers: Where your data is transferred to the United States via Firebase, we rely on the Swiss-U.S. Data Privacy Framework in addition to the EU-U.S. DPF referenced in Section 6.

G. Singapore (Personal Data Protection Act — PDPA)

For users in Singapore, we process personal data in accordance with the Personal Data Protection Act 2012 (PDPA).

Supervisory Authority: The Personal Data Protection Commission (PDPC) oversees compliance. You may lodge a complaint at www.pdpc.gov.sg.

Withdrawal of Consent: You may withdraw consent for marketing communications or personalized advertising at any time by emailing td@anomalydev.pl or using your device's ad personalization settings. We do not send direct marketing communications outside the Game itself.

Data Breach Notification: We will notify the PDPC and affected users of any notifiable data breach as required under the PDPA's mandatory breach notification regime.

H. Israel (Protection of Privacy Law, 5741-1981)

For users in Israel, we process personal data in accordance with the Protection of Privacy Law, 5741-1981, and its associated regulations.

Supervisory Authority: The Privacy Protection Authority (PPA) is the competent regulator for Israeli residents. You may lodge a complaint at gov.il — Privacy Protection Authority.

Your Rights: In addition to the rights in Section 9, Israeli residents may request that we correct or delete information found to be incorrect, incomplete, unclear, or outdated.

9. Your Rights

Regardless of your location, you have the right to:

• Access a copy of your data.
• Correct inaccurate information.
• Delete your account and associated data.
• Withdraw Consent for tracking or ads.
• Lodge a Complaint with your local authority (e.g., UODO in Poland, NPC in the Philippines, FDPIC in Switzerland, PDPC in Singapore, PPA in Israel).

To exercise these rights, please email us at td@anomalydev.pl.