Privacy Notice

WHO WE ARE

MotaMaze is published by Ingenious Crucible Studios LLC. Questions about this notice: contact@ingeniouscruciblestudios.com

DATA WE COLLECT

Account & authentication • Display name, email address, and profile photo from Google or Apple sign-in • Authentication provider and a unique identifier issued by Google or Apple for your account • If you use Apple “Hide My Email,” we receive and store the private relay email address Apple generates — not your real address • Internal identifiers used to operate your account, plus login/session timestamps used to keep you signed in and detect unauthorized use Age, jurisdiction & parental consent • Birth month and birth year (the day is discarded immediately after we calculate your age band — we never store your full date of birth) • Country, used to determine which age threshold and privacy rules apply to your account • Age-range information provided by the app store or operating system, where required by law (see “Brazil” below) • Status flags derived from the above, including whether your account receives additional protections, whether parental consent is required, whether it has been granted, and whether your account is in restricted mode • Where parental consent is required: a parent or guardian’s email address, and a record that consent was requested and/or granted Gameplay • Scores, level progress, session length, and match outcomes Device & diagnostics • OS version, device model, locale, and connection type • App version and build number • Application, installation, device, and session identifiers used for security, analytics, and crash reporting • IP address — used for security logging, jurisdiction verification, and normal server communication • Crash stack traces, diagnostic logs, and app state at the time of a crash (via Firebase Crashlytics) Advertising & attribution • Advertising ID (IDFA/GAID), where permitted by your settings and jurisdiction • Ad interaction records (which ads you saw and when), associated with an internal account, installation, or session identifier • Consent and ad-treatment status (for example, whether your account is in child-directed/contextual mode) • Install source, referring channel, and attribution timestamps from Tenjin Purchases • Purchase/transaction identifier, used to verify and grant your purchase • Platform, product purchased, and purchase status (verified/refunded) • Entitlement status (for example, which skins or passes you own, whether “No Ads” is active) • Order ID / original transaction ID, and refund or revocation date and reason, where applicable • We do not receive your complete payment card details — purchases are processed entirely by Google Play or the Apple App Store Sharing & leaderboard • Share links: when you tap Share Score, we create a short random token. The public URL does not contain your account ID; the token allows our servers to retrieve the score, level, season, and other match details you chose to share • Leaderboard: season points, display name, and cosmetic avatar shown to other players on the Global/Weekly ranking. Protected/restricted-mode users are excluded (see below)

HOW WE USE DATA

• Authenticate your account and persist your progress across devices • Determine your country and which age threshold and privacy rules apply to you • Determine whether your account receives additional protections and whether parental consent is required • Record and manage parental consent, where required • Place protected/restricted-mode users into contextual-only advertising, and restrict leaderboard, public display name, and score-sharing features until the required status is satisfied • Maintain your login session and detect unauthorized account use • Serve advertising via Google AdMob, using personalized or contextual treatment depending on your consent, age status, and jurisdiction (see “Advertising & Your Choices” below) • Measure install sources and attribution via Tenjin (aggregated) • Generate, host, and route score-sharing links • Verify and grant your in-app purchases, restore purchases across devices, and reconcile/revoke entitlements on refund • Deliver lives, skins, Season Pass content, and other entitlements • Operate in-game events, promotions, and store content • Detect cheating and abuse on the leaderboard • Diagnose crashes and monitor backend availability • Maintain security, audit, and anti-fraud records • Collect gameplay and analytics data, which we use to generate aggregated reports and improve the game • Comply with store, tax, accounting, and other legal obligations

AGE ASSURANCE, PARENTAL CONSENT & RESTRICTED MODE

MotaMaze targets players aged 8 and up. We collect limited information from children only as necessary to operate the game and, where required by law, only after obtaining appropriate parental or guardian consent. Protected users receive additional privacy safeguards and restricted features until that consent or status is confirmed: no personalized advertising, no public leaderboard or public display name, and no Share Score feature. Parents and guardians may review, request deletion of, and refuse further collection of their child’s information at any time by contacting contact@ingeniouscruciblestudios.com.

BRAZIL

In Brazil, additional protections apply for users under 18, including contextual-only advertising and feature restrictions (such as no public leaderboard or score sharing), where required by law.

ADVERTISING & YOUR CHOICES

The game uses several distinct advertising controls depending on where you are and who you are: • California and other applicable US-state users can exercise “Do Not Sell/Share My Personal Information” rights via Google’s consent tools and our in-app settings • iOS users see Apple’s App Tracking Transparency prompt before any cross-app tracking is requested • Protected/restricted-mode users — including all Brazilian users under 18 — always receive contextual-only, non-personalized advertising, regardless of any other setting You can manage personalized-advertising preferences through the privacy controls in the game (Settings → General → Ad Personalization) and, where available, through your device’s advertising settings. Turning off personalized ads reduces ad personalization; it does not necessarily remove all ads, contextual advertising, or analytics permitted under applicable law and your consent choices.

THIRD-PARTY SERVICES

• Google Cloud and Firebase services — our backend infrastructure, including Firestore (storage), BigQuery (analytics), and Crashlytics (crash reporting) — Google Privacy Policy • Google Identity / Google Sign-In and Sign in with Apple — used to create and authenticate your account • Google Play Store / Google Play Billing and Apple App Store / StoreKit — process all purchases; we never see your full payment card details • Google AdMob — advertising — Google Ads Privacy Policy • Apple and Google age-assurance services, where required by applicable law • Tenjin Inc. — mobile install attribution analytics (aggregated) • Cloudinary — hosts and generates the images used in Share Score cards. We do not intentionally include your name, email address, or account ID in the image sent to Cloudinary, though Cloudinary may receive standard request information (such as IP address) as part of delivering images • ChottuLink — short-link branding for shared score links We do not currently use AppLovin or any other ad mediation network. If we add one in the future, we will update this notice before it is activated. Each third party operates under its own privacy policy. Where applicable, we enter into appropriate data-processing agreements with our service providers and select providers that support applicable privacy laws, including LGPD.

DATA RETENTION

We begin processing your deletion request promptly. Your account, profile, and progress records are removed from our active systems, and access to account-specific entitlements (such as owned skins or passes) is removed. Copies of your data in our analytics systems are deleted or de-identified within 30 days. Some information may be retained longer where the law requires it or where necessary for legitimate business purposes, including: • Purchase and payment-related records — retained for accounting, fraud-prevention, and tax/legal purposes for as long as required by applicable law • Security, audit, and anti-fraud logs • Backups, retained on a rolling schedule and not immediately purged on request Analytics event data (gameplay, advertising, and attribution events) may be associated with an internal account, installation, or session identifier rather than fully anonymized. We retain this data in identifiable or pseudonymous form for up to 24 months, after which it is deleted or aggregated/de-identified. Share tokens expire 30 days after creation; after expiration, the link no longer resolves. The underlying record and any cached share-card image may persist for a short additional period before being purged from our systems and CDN caches. Advertising and attribution identifiers (such as IDFA/GAID) are retained by AdMob and Tenjin according to their own policies and our configuration, not a period we set unilaterally.

YOUR RIGHTS

Depending on your country, you may have the right to: • Access — request a copy of your data • Correction — update inaccurate information • Deletion — request account and data deletion, using the in-app “Delete Account” option in Settings or by contacting us • Withdraw consent — including parental consent — at any time, without affecting processing that already occurred • Object to or request restriction of certain processing, where required by law • Opt out of personalized ads, and, where applicable, opt out of the “sale” or “sharing” of personal information or targeted advertising under US state privacy laws — not only “personalized ads” generally • Data portability (LGPD) — structured, machine-readable export on request • Appeal our response to your privacy request, and lodge a complaint with your local data protection regulator (in Brazil, the ANPD) • If you are a parent or guardian: review, request deletion of, and refuse further collection of your child’s information We may need to verify your identity before completing certain requests. Where permitted by law, you may designate an authorized agent to submit a request on your behalf. Uninstalling the app does not delete your account — your data is retained until you submit a deletion request. If you delete your account, your public leaderboard entry and any active share links are removed or de-linked from your identity, subject to the retention exceptions above. Submit requests to: contact@ingeniouscruciblestudios.com We respond within 30 days.

COOKIES & WEB TRACKING

The game itself does not use browser cookies. The web pages at ingeniouscruciblestudios.com/motamaze use only strictly necessary cookies (session management) and no third-party advertising cookies or tracking pixels that we control. Even without advertising cookies, our web pages and the services behind them (hosting, content delivery network, Cloudinary image delivery, and any consent management tool) may automatically log IP address, browser, and device information, and request metadata as part of normal server operations.

CHANGES TO THIS NOTICE

We will notify users of material changes via an in-app banner before the change takes effect. The updated notice will also be published at the URL above with the revised date.

CONTACT

contact@ingeniouscruciblestudios.com Ingenious Crucible Studios LLC ingeniouscruciblestudios.com/motamaze/privacy