Nutty Puzzles Privacy Policy

Effective September 28, 2026. This is a translation of the Portuguese original; if the two differ, the Portuguese version prevails.

This policy explains what data the Nutty Puzzles game (Android and iOS) processes, why, who it is shared with and how you can exercise your rights. In it, "we" means the controller named in the box above and "you" means the player.

1. Data the game processes

1.1 Progress and settings (stay on the device)

Current level, coins, lives, stars, statistics, achievements, collection items, pets, the Premium purchase, language, sound, music, vibration, notification settings and your privacy choice are stored on the device itself. This data is not sent to us or to third parties. It is erased when you clear the app's data or uninstall it.

1.2 Global leaderboard (Nexeus Games server)

To show the leaderboard, the game signs in anonymously to the Nexeus Games server, which we maintain ourselves. This creates:

• an anonymous player identifier and a session key stored on the device (the server only keeps a cryptographic hash of it);
• a leaderboard name generated automatically by the server (a random name followed by digits). You do not type anything;
• the submitted scores: weekly league points, best daily challenge time and total XP;
• profile data attached to the scores: active pet, pet growth stage, pet scene, player level and the chosen style (accessories, frame and title);
• technical account data: system (Android or iOS), game version, creation date, days on which the game connected and last access. They are used to keep the service running and to know how many players use the game.

This anonymous account is created when the game starts, because the leaderboard is part of the game. The leaderboard name, scores, pet, scene, level and style are visible to other players on the leaderboard. Impossible scores are rejected and logged, to prevent cheating. As with any internet service, the server also receives your IP address and technical connection data, which are kept only in the access logs, not linked to the account, for the period required by Brazil's Marco Civil da Internet (Law 12,965/2014, art. 15).

1.3 Analytics (Nexeus Games server), only with your consent

If you tap "Accept" on the consent screen, the game sends usage events to our server that help us balance the game's difficulty and economy:

• level start and end: game, level number, game level, level type and difficulty, result, stars and whether you used help;
• booster use (type and payment method), help on a stuck level, ads watched (where in the game), purchases (which product), coin spending (on what and how much) and pet actions.

Each event carries the device's time and is linked to the anonymous leaderboard account; no other device data is sent with it. If you choose "Essential only", no events are sent. If you had accepted and switch to "Essential only", the game stops collection and deletes the events already sent from our server.

1.4 Advertising (LevelPlay and Unity Ads)

The game is free and shows ads through Unity LevelPlay (formerly ironSource), with the Unity Ads network. To show and measure ads, these services receive:

• the device's advertising identifier: the Google Advertising ID (GAID) on Android and the IDFA on iOS. The IDFA is only accessed if you allow it in the iOS tracking prompt (App Tracking Transparency);
• technical device and connection data, such as IP address, model, operating system, language, network type and approximate country;
• interactions with ads, such as impressions, taps and videos watched to the end.

Personalized ads, based on your interests and your activity in other apps, are only used if you tap "Accept". With "Essential only", ads still appear but are not personalized; the data above, including the advertising identifier on Android, is still used by the ad services to deliver ads, limit repetition, measure results and prevent fraud. Players who buy Premium no longer see ads.

1.5 Purchases (Google Play and App Store)

Purchases of coins, the starter pack and Premium are made through Google Play (Android) or the App Store (iOS), via Unity IAP. Payment is processed by the store, and we never receive your card number, name or any other payment details. The game only receives the purchase confirmation from the store (which product and the transaction record) to deliver the item and restore Premium. Unity IAP, which connects the game to the store, also processes technical purchase and device data (identifiers, approximate country, and performance and crash data), as described in Unity's policy.

1.6 Local notifications

Reminders (full lives and daily reward) are scheduled on the device itself by Android or iOS. No data leaves the device because of them. The game asks for notification permission after your first win, and you can turn reminders off in the game's Settings or in the device settings.

1.7 Unity engine technical diagnostics

The Unity engine, used to build the game, sends Unity technical crash and performance reports (device model, operating system, game version and error data) that do not identify you. They are used to find and fix problems.

1.8 Device permissions

The game uses internet access (leaderboard, ads, purchases and analytics), the notification permission (if you allow it), the advertising identifier on Android and, on iOS, the tracking prompt (ATT). The game does not access precise location, camera, microphone, contacts, photos or files.

2. What we do not collect

• Name, email, phone number, address, date of birth or ID documents.
• Typed text, messages, photos, voice or content you create.
• Payment details.
• Precise location (GPS).
• Sensitive data such as health, racial origin, religion or political opinion.

3. Your privacy choices

• Consent screen: on first launch, before ads and analytics start, the game asks for your choice. "Accept" enables personalized ads and analytics; "Essential only" keeps ads non-personalized and turns analytics off.
• Changing your choice: at any time in Settings > Privacy, inside the game. Withdrawing consent stops new data from being sent and deletes the analytics data already sent from our server.
• Tracking on iOS: you can allow or deny the iOS prompt and change it later in iPhone Settings > Privacy & Security > Tracking.
• Advertising ID on Android: you can reset or delete the ID in Settings > Google > Ads (the path varies by device).
• No ads: buying Premium removes all ads.
• Delete my data: in Settings > Privacy > "Delete my data", the game deletes from our server your anonymous account, your scores and the analytics data already sent, and erases the progress on this device. An internet connection is required. The server's backups are replaced within 14 days. Afterwards the game starts over from scratch, as on a fresh install.

4. Legal bases

We process data under the legal bases of Brazil's General Data Protection Law (LGPD, Law 13,709/2018, art. 7) and the EU and UK General Data Protection Regulation (GDPR, art. 6):

Consent (LGPD art. 7, I; GDPR art. 6(1)(a))

Analytics, personalized ads and access to the IDFA on iOS. You can withdraw consent at any time.

Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b))

Providing the game features you use, such as the global leaderboard, and delivering and restoring purchases.

Legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f))

Showing non-personalized ads to keep the game free, preventing fraud and abuse, and keeping the services working and secure. You can object to this processing through the contact shown at the top.

Legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c))

Keeping records when the law requires it and responding to requests from authorities.

5. Who the data is shared with

We do not sell your data for money. The data described above is processed by the partners below, each with its own policy. Some of them, such as ad networks and the app stores, also act as independent controllers of the data they receive. We only work with partners that commit, in their contracts and terms, to protect the data they receive at a level equal or equivalent to the one described in this policy and required by law.

The leaderboard, the anonymous account and analytics are kept on our own server, operated by us, and are not passed on to third parties.

• Cloudflare (protection and delivery of the connection to our server; receives the IP address and technical connection data): Cloudflare Privacy Policy.
• Infrastructure provider for our server, in Brazil, which only stores and processes the data on our behalf and according to our instructions.
• Unity Technologies (Unity Ads; Unity IAP; Unity engine technical diagnostics): Game Player and App User Privacy Policy and Unity Privacy Policy Hub.
• ironSource / Unity LevelPlay (ad mediation, with the Ad Quality module, which checks the quality of the ads shown): ironSource is part of Unity, and LevelPlay's data processing is described in Unity's Game Player and App User Privacy Policy.
• Google (Google Play: download, purchases and the advertising ID on Android): Google Privacy Policy.
• Apple (App Store: download and purchases; tracking prompt on iOS): Apple Privacy Policy.

We may also disclose data when required by law, by order of a competent authority, or to protect rights, player safety and the integrity of the game.

6. International transfers

Our server is in Brazil: if you play in another country, your leaderboard, anonymous account and analytics data are processed in Brazil. Cloudflare may handle the connection on servers close to you. The other partners above run servers outside Brazil and Europe, mainly in the United States and in other countries where Unity, Google and Apple operate. These transfers rely on adequacy decisions where available and otherwise on standard contractual clauses and other safeguards provided for in art. 33 of the LGPD and arts. 45 and 46 of the GDPR, as described in each partner's policy.

7. How long we keep data

• Data on the device: until you clear the app's data or uninstall it.
• Leaderboard and anonymous account: while the account exists, until you delete your data from within the game or request deletion. The weekly and daily leaderboards restart each period; previous results are kept linked to the account and are deleted along with it.
• Analytics: up to 24 months from when it is sent, or less if you withdraw consent or delete your data.
• Server access logs: 6 months, as required by the Marco Civil da Internet.
• Server backups: up to 14 days; after that they are replaced.
• Advertising: for the retention periods set by Unity and the ad networks in their policies.
• Messages sent to our contact: for as long as needed to handle the request and show that it was handled.

8. Your rights (LGPD, GDPR and CCPA/CPRA)

Brazil (LGPD, art. 18)

You may request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; deletion of data processed based on consent; information about who we share data with; information about the option of not consenting and its consequences; and withdrawal of consent. You may also file a complaint with the National Data Protection Authority (ANPD).

European Union and United Kingdom (GDPR)

You have the right of access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interests, and to withdraw consent at any time. You may complain to the data protection authority in your country (list of EU authorities) or, in the United Kingdom, to the Information Commissioner's Office (ICO).

California (CCPA/CPRA)

In the last 12 months, the categories of personal information processed were: identifiers (anonymous player identifier, advertising identifier and IP address), internet or other electronic network activity (game usage and ad interactions), approximate location estimated from the IP address, and commercial information (records of purchases made through the store). We do not process sensitive personal information.

We do not sell personal information for money. When you accept personalized ads, the use of the advertising identifier by ad networks may be considered "sharing" for cross-context behavioral advertising. To opt out, choose "Essential only" in Settings > Privacy; your choice is passed on to LevelPlay. You also have the right to know, access, correct and delete your personal information, you may use an authorized agent, and you will not be discriminated against for exercising these rights.

9. How to request deletion or exercise your rights

Because the game only uses an anonymous account, with no email, we do not know who you are. To find your data, we need the leaderboard name the game shows you (on the leaderboard and in your profile).

1. Data on the device: clear the app's data (Android: Settings > Apps > Nutty Puzzles > Storage > Clear data) or uninstall the game. Note: this erases your progress and coins; Premium can be restored through the store.
2. Leaderboard, anonymous account and analytics: to delete, use "Delete my data" in Settings > Privacy, inside the game: the anonymous account, your scores and the analytics data are deleted right away from our server (backups expire within 14 days). For other requests (access, correction or another right), or if you prefer, send an email to the contact shown at the top of this page with the subject "Privacy", stating your leaderboard name and what you want. Make the request before uninstalling: after a reinstall the game creates a new anonymous identity and you will no longer see the old name.
3. Advertising: withdraw consent in Settings > Privacy and reset or delete the advertising identifier in the device settings. You can also exercise your rights directly with Unity through the channels described in its policy.

We respond within the deadlines of the applicable law (for example, up to 15 days under the LGPD, one month under the GDPR and 45 days under the CCPA). We may ask for additional information to confirm that the request concerns your data.

10. Children

Nutty Puzzles is not directed to children under 13, and the game tells its ad services that it is not a child-directed app. We do not knowingly collect data from children. If you are a parent or guardian and believe your child used the game and had data processed, contact us through the contact shown at the top and we will delete the data we can locate. Where the law requires parental authorization for consent (for example, under 16 in some EU countries), players below that age should choose "Essential only" or ask a parent or guardian.

11. Security

Communication with our server, with Unity's services and with the stores uses encrypted connections (HTTPS). On the server, the account is identified only by an anonymous identifier, the session key is stored only as a cryptographic hash, administrative access requires a password and a second authentication factor, and every administrative action is logged. Saved progress is kept in the app's private storage on the device. No system is completely secure, but we limit the data processed to what is needed for the purposes described here.

12. Changes to this policy

We may update this policy when the game or the law changes. The new version is published on this page with a new effective date. When a change requires new consent, it will be requested before the change takes effect.

13. Contact

Privacy questions, requests and complaints: use the contact shown at the top of this page. This channel also serves as the channel for communication with the data protection officer (encarregado) required by the LGPD.