Privacy Notice

WHO WE ARE

MotaMaze is published by Ingenious Crucible Studios LLC. Questions about this notice: contact@ingeniouscruciblestudios.com

DATA WE COLLECT

Account & authentication • Display name, email address, and profile photo from Google or Apple sign-in • Authentication provider and a unique identifier issued by Google or Apple for your account • If you use Apple “Hide My Email,” we receive and store the private relay email address Apple generates — not your real address • Internal identifiers used to operate your account, plus login/session timestamps used to keep you signed in and detect unauthorized use Age, jurisdiction & parental consent • Birth month and birth year (the day is discarded immediately after we calculate your age band — we never store your full date of birth) • Country, used to determine which age threshold and privacy rules apply to your account • Age-range information provided by the app store or operating system, where required by law (see “Brazil” below) • Status flags derived from the above, including whether your account receives additional protections, whether parental consent is required, whether it has been granted, and whether your account is in restricted mode • Where parental consent is required: a parent or guardian’s email address, and a record that consent was requested and/or granted Gameplay • Scores, level progress, session length, and match outcomes Device & diagnostics • OS version, device model, locale, and connection type • App version and build number • Application, installation, device, and session identifiers used for security, analytics, and crash reporting • IP address — used for security logging, jurisdiction verification, and normal server communication • Crash stack traces, diagnostic logs, and app state at the time of a crash (via Firebase Crashlytics) Advertising & attribution • Advertising ID (IDFA/GAID), where permitted by your settings and jurisdiction • Ad interaction records (which ads you saw and when), associated with an internal account, installation, or session identifier • Consent and ad-treatment status (for example, whether your account is in child-directed/contextual mode) • Install source, referring channel, and attribution timestamps from Tenjin Purchases • Purchase/transaction identifier, used to verify and grant your purchase • Platform, product purchased, and purchase status (verified/refunded) • Entitlement status (for example, which skins or passes you own, whether “No Ads” is active) • Order ID / original transaction ID, and refund or revocation date and reason, where applicable • We do not receive your complete payment card details — purchases are processed entirely by Google Play or the Apple App Store Sharing & leaderboard • Share links: when you tap Share Score, we create a short random token. The public URL does not contain your account ID; the token allows our servers to retrieve the score, level, season, and other match details you chose to share • Leaderboard: season points, display name, and cosmetic avatar shown to other players on the Global/Weekly ranking. Protected/restricted-mode users are excluded (see below) Offline play and progress validation • Records of levels you played while your device had no connection to us — the level, score, stars, how long it took, and that a life was used. These are held on your device until they can be sent to us, and are sent to us when you reconnect • A record of each time your offline progress is submitted for confirmation: what was submitted, what we confirmed, what we could not confirm, the reason we could not confirm it and the size of the difference, and the version of the rules we applied. Each of these records has its own reference number, which we show you in the Game if any of your progress could not be confirmed • Two separate counts held against your account: how many submissions contained progress we could not confirm, and separately, how many contained claims that met the standard described in “Automated decisions about your account” below. Only the second count is used to decide whether to restrict an account

HOW WE USE DATA

• Authenticate your account and persist your progress across devices • Determine your country and which age threshold and privacy rules apply to you • Determine whether your account receives additional protections and whether parental consent is required • Record and manage parental consent, where required • Place protected/restricted-mode users into contextual-only advertising, and restrict leaderboard, public display name, and score-sharing features until the required status is satisfied • Maintain your login session and detect unauthorized account use • Serve advertising via Google AdMob, using personalized or contextual treatment depending on your consent, age status, and jurisdiction (see “Advertising & Your Choices” below) • Measure install sources and attribution via Tenjin (aggregated) • Generate, host, and route score-sharing links • Verify and grant your in-app purchases, restore purchases across devices, and reconcile/revoke entitlements on refund • Deliver lives, skins, Season Pass content, and other entitlements • Operate in-game events, promotions, and store content • Detect cheating and abuse on the leaderboard • Diagnose crashes and monitor backend availability • Maintain security, audit, and anti-fraud records • Collect gameplay and analytics data, which we use to generate aggregated reports and improve the game • Comply with store, tax, accounting, and other legal obligations • Confirm progress you made while offline when you reconnect, and apply the progress we can confirm • Detect cheating, fraud, and abuse across the Game’s features, including the leaderboard and progress records, and apply feature restrictions where our rules have repeatedly not been met • Monitor our own compliance with data-protection and child-safety obligations — including counts of accounts by country and age band, the operation of feature restrictions, and the handling of requests you make to us — so that we can meet our legal duties and identify problems early

AGE ASSURANCE, PARENTAL CONSENT & RESTRICTED MODE

MotaMaze targets players aged 8 and up. We collect limited information from children only as necessary to operate the game and, where required by law, only after obtaining appropriate parental or guardian consent. Protected users receive additional privacy safeguards and restricted features until that consent or status is confirmed: no personalized advertising, no public leaderboard or public display name, and no Share Score feature. “Restricted mode” in this notice means only the age- and consent-based protections described above. It is a different thing from a restriction of online and premium features applied under our Terms of Service after repeated progress claims we could not validate, which is not related to your age or to parental consent. We keep the two separate in our records. Parents and guardians may review, request deletion of, and refuse further collection of their child’s information at any time by contacting contact@ingeniouscruciblestudios.com.

AUTOMATED DECISIONS ABOUT YOUR ACCOUNT

We use an automated check to decide whether to restrict an account’s access to online and premium features after repeated progress claims we could not confirm. Because that decision is made by automated means, we set out here how it works, so that you can read it without having to ask us. What is evaluated. We evaluate only the progress records your device submits to us for confirmation after offline play. We do not use financial, health, advertising, or unrelated account information to make this decision. The criteria we apply. Each claim we cannot confirm is evaluated using the reason it failed, the size of the difference between what was claimed and what our records show, and whether the difference can reasonably be explained by ordinary gameplay or technical circumstances — for example, playing on a second device, reinstalling the Game, an inaccurate device clock, or a connection lost partway through. Claims that an ordinary cause can explain are set aside and do not count toward a restriction. Only unexplained claims are counted. A single unexplained claim does not result in a restriction. A restriction is applied only when unexplained claims recur sufficiently within a rolling observation period to meet our integrity rule. We do not publish the numerical thresholds, time periods, or other security parameters used by that rule because doing so could enable circumvention of the Game’s anti-fraud protections. We record the rule version and parameters that applied when a decision was made so that we can review the decision and explain how the criteria were applied to your account. The process applied. The check runs when your device reconnects and submits offline progress. It produces a record for each submission, containing what was submitted, what we confirmed, what we did not confirm and why, the size of each difference, the limit and the version of the rules in force at that moment, and the outcome. We keep that record so that we can explain the decision to you later. The technological solution used. The check is performed by our own server software running on Google Cloud infrastructure, using the game records held in our databases. It is a rules-based check operated by us. It does not use profiling by a third party, and it does not use automated decision tools supplied by anyone else. Your rights over this decision. We tell you in the Game if a restriction is applied, and give you a reference number. You can ask us to review the decision, and a person will do so — see our Terms of Service. You can also ask us to explain the criteria, the process, and the technological solution applied in your own case. Where we remove a restriction and you lost access to paid content while it was in place, our Terms of Service set out what we will do to put that right. What we will not disclose. We will explain what happened to your account and why. We will not publish the complete set of detection rules or the underlying source code, because doing so would tell anyone who asked how to avoid the check.

BRAZIL

In Brazil, additional protections apply for users under 18, including contextual-only advertising and feature restrictions (such as no public leaderboard or score sharing), where required by law.

ADVERTISING & YOUR CHOICES

The game uses several distinct advertising controls depending on where you are and who you are: • California and other applicable US-state users can exercise “Do Not Sell/Share My Personal Information” rights via Google’s consent tools and our in-app settings • iOS users see Apple’s App Tracking Transparency prompt before any cross-app tracking is requested • Protected/restricted-mode users — including all Brazilian users under 18 — always receive contextual-only, non-personalized advertising, regardless of any other setting You can manage personalized-advertising preferences through the privacy controls in the game (Settings → General → Ad Personalization) and, where available, through your device’s advertising settings. Turning off personalized ads reduces ad personalization; it does not necessarily remove all ads, contextual advertising, or analytics permitted under applicable law and your consent choices.

THIRD-PARTY SERVICES

• Google Cloud and Firebase services — our backend infrastructure, including Firestore (storage), BigQuery (analytics), and Crashlytics (crash reporting) — Google Privacy Policy • Google Identity / Google Sign-In and Sign in with Apple — used to create and authenticate your account • Google Play Store / Google Play Billing and Apple App Store / StoreKit — process all purchases; we never see your full payment card details • Google AdMob — advertising — Google Ads Privacy Policy • Apple and Google age-assurance services, where required by applicable law • Tenjin Inc. — mobile install attribution analytics (aggregated) • Cloudinary — hosts and generates the images used in Share Score cards. We do not intentionally include your name, email address, or account ID in the image sent to Cloudinary, though Cloudinary may receive standard request information (such as IP address) as part of delivering images • ChottuLink — short-link branding for shared score links We do not currently use AppLovin or any other ad mediation network. If we add one in the future, we will update this notice before it is activated. Each third party operates under its own privacy policy. Where applicable, we enter into appropriate data-processing agreements with our service providers and select providers that support applicable privacy laws, including LGPD.

DATA RETENTION

We begin processing your deletion request promptly. Your account, profile, and progress records are removed from our active systems, and access to account-specific entitlements (such as owned skins or passes) is removed. Copies of your data in our analytics systems are deleted or de-identified within 30 days. Some information may be retained longer where the law requires it or where necessary for legitimate business purposes, including: • Purchase and payment-related records — retained for accounting, fraud-prevention, and tax/legal purposes for as long as required by applicable law • Security, audit, and anti-fraud logs • Records of offline-progress confirmation, including the reasons progress could not be confirmed — retained for up to 24 months. We keep them for this period because repeated claims can accumulate across more than one season, because we need to be able to audit and reverse a restriction decision, and because they are the records we rely on to explain a restriction to you or to answer a dispute. These records are deleted when you delete your account, subject to the exceptions in this section • Backups, retained on a rolling schedule and not immediately purged on request Analytics event data (gameplay, advertising, and attribution events) may be associated with an internal account, installation, or session identifier rather than fully anonymized. We retain this data in identifiable or pseudonymous form for up to 24 months, after which it is deleted or aggregated/de-identified. Share tokens expire 30 days after creation; after expiration, the link no longer resolves. The underlying record and any cached share-card image may persist for a short additional period before being purged from our systems and CDN caches. Advertising and attribution identifiers (such as IDFA/GAID) are retained by AdMob and Tenjin according to their own policies and our configuration, not a period we set unilaterally.

YOUR RIGHTS

Depending on your country, you may have the right to: • Access — request a copy of your data • Correction — update inaccurate information • Deletion — request account and data deletion, using the in-app “Delete Account” option in Settings or by contacting us • Withdraw consent — including parental consent — at any time, without affecting processing that already occurred • Object to or request restriction of certain processing, where required by law • Opt out of personalized ads, and, where applicable, opt out of the “sale” or “sharing” of personal information or targeted advertising under US state privacy laws — not only “personalized ads” generally • Data portability (LGPD) — structured, machine-readable export on request • Ask for human review of a decision we made about your account by automated means that significantly affects you — including a restriction of online or premium features — and ask us to explain the criteria and the process used to make that decision and, where applicable law requires it, information about the technological solution or program used. See “Automated decisions about your account” above, which sets this out without your needing to ask • Appeal our response to your privacy request, and lodge a complaint with your local data protection regulator (in Brazil, the ANPD) • If you are a parent or guardian: review, request deletion of, and refuse further collection of your child’s information We may need to verify your identity before completing certain requests. Where permitted by law, you may designate an authorized agent to submit a request on your behalf. Uninstalling the app does not delete your account — your data is retained until you submit a deletion request. If you delete your account, your public leaderboard entry and any active share links are removed or de-linked from your identity, subject to the retention exceptions above. Submit requests to: contact@ingeniouscruciblestudios.com We respond within 30 days.

COOKIES & WEB TRACKING

The game itself does not use browser cookies. The web pages at ingeniouscruciblestudios.com/motamaze use only strictly necessary cookies (session management) and no third-party advertising cookies or tracking pixels that we control. Even without advertising cookies, our web pages and the services behind them (hosting, content delivery network, Cloudinary image delivery, and any consent management tool) may automatically log IP address, browser, and device information, and request metadata as part of normal server operations.

CHANGES TO THIS NOTICE

We will notify users of material changes before the change takes effect, through the Game, our website, email, or another appropriate method, and where applicable law requires a particular method of notice, by that method. The updated notice will also be published at the URL above with the revised date.

CONTACT

contact@ingeniouscruciblestudios.com Ingenious Crucible Studios LLC ingeniouscruciblestudios.com/motamaze/privacy