Tapugo FZCO - Privacy Policy

Tapugo FZCO (“Tapugo”, “we”, “us”) makes mobile games, including Card Factory, and runs this website. This policy explains what information we collect when you play our games or use tapugo.games, why we collect it, who receives it and the choices you have. We are the data controller for the processing described here. Capitalised terms have the meaning given in our Terms of Service.

1. Information we collect

Device and app information. Device model, operating system version, language, country or region, time zone, IP address, app version, screen size, network type and diagnostic data such as crash reports and error logs.

Identifiers. Random identifiers that we or our partners generate for your device or installation (for example a player ID for your saved progress, the Apple identifier for vendors, and analytics instance IDs). The Apple advertising identifier (IDFA) is accessed only if you allow tracking in the App Tracking Transparency prompt.

Gameplay and progression. Levels played, wins and losses, in-game currency and items, settings, rewards earned, ad views and similar events that let the game work, save your progress and let us understand how it is played.

Purchases. Which in-app products you bought, when, at what price and in which currency, together with Apple's purchase receipt so we can verify it. We never receive your card or bank details; Apple processes the payment.

Account information. Our games work without registration. If you choose Sign in with Apple to protect your progress, we receive the identifier Apple assigns to you for our app and, if you share it, your name or e-mail address. If you join a team or use social features, the nickname you choose is visible to other players.

Consent choices. Your answers to the privacy and tracking prompts, so that we and our partners honour them.

Support. Anything you send us when you contact support, including your e-mail address.

Website. If you join the waitlist, your e-mail address. The website also uses Vercel Analytics, which measures page visits without cookies or cross-site identifiers.

2. Why we use it and on what legal basis

• To run the game, save and restore your progress, deliver purchases and rewards, and provide support — performance of our contract with you.
• To keep the game secure, prevent cheating, fraud and abuse, and verify that rewarded videos were actually watched — our legitimate interests.
• To understand how the game is played and improve it — our legitimate interests, and your consent where the law requires it.
• To show advertising that funds our free games. Ads that are personalised to you are shown only with your consent; otherwise you see ads that are not based on a profile of you.
• To measure which advertising brought you to our games and how our campaigns perform — your consent where the law requires it (for example the tracking prompt on iOS), otherwise our legitimate interests.
• To comply with legal obligations and defend our rights.

3. Advertising, consent and tracking

Our games show ads through AppLovin MAX, which runs an auction between the advertising partners listed below. Ad partners receive device information, your approximate location derived from your IP address, and, with your permission, your advertising identifier and consent signals. Rewarded videos are optional: you choose to watch them in exchange for an in-game reward, and the reward is confirmed by our servers.

In the EU, EEA, UK and Switzerland the game asks for your consent before any personalised advertising or advertising measurement. The message is delivered through Google's consent framework (IAB TCF) and lists every ad partner. You can accept, refuse or manage purposes and partners individually.

On iOS Apple's App Tracking Transparency prompt asks whether the game may use your advertising identifier to link you across apps and websites. If you refuse, the identifier is not available to us or our partners; the game still works and you still see ads.

Changing your mind. You can reopen the consent message at any time from the game's Privacy Choices button, and change tracking permission in iOS Settings → Privacy & Security → Tracking. Withdrawing consent stops future personalised ads and measurement; it does not affect processing that already took place.

Apple SKAdNetwork. To measure campaigns without identifying you, Apple's SKAdNetwork sends anonymous, aggregated install signals to advertising networks and to Adjust. This works independently of the tracking prompt and contains no data that identifies you.

4. Who receives your information

We do not sell your personal information. We share it with the companies below because they provide part of the service on our behalf or, for advertising and attribution partners, because they act as independent controllers of the data they receive. Each of them is bound by contract or by the applicable framework to use the data only for the stated purpose. Where personalised advertising counts as “sharing” under US state privacy laws, the consent and tracking choices above are how you opt out.

This list covers all Tapugo games. Not every partner is present in every game: each game includes only the partners it needs, and the consent message inside a game lists the advertising partners that game actually uses.

The advertising partners may in turn work with the exchanges and demand partners listed in our app-ads.txt file. We may also disclose information when the law requires it, to protect our rights or players' safety, or as part of a merger or sale of our business.

5. International transfers

Tapugo is based in the United Arab Emirates and our servers run on Microsoft Azure in the United States. Our partners process data in the countries where they operate, including the United States. Where data leaves the EU, EEA, UK or Switzerland we rely on the partner's adequacy decision or on the Standard Contractual Clauses and equivalent safeguards.

6. How long we keep it

• Account and progress data: for as long as you play. If you delete your account, it is removed from our servers within 30 days, except for records we must keep for legal or fraud-prevention reasons.
• Purchase records: for as long as needed to honour your entitlements and for the retention periods required by tax and accounting law.
• Analytics and attribution data: retained by the partner according to its own policy, typically between 14 months and 3 years, in aggregated or pseudonymous form.
• Diagnostic logs: up to 90 days. Support e-mails: up to 2 years after the matter is closed.

7. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, receive a copy, restrict or object to its processing, withdraw consent, and have it deleted. You also have the right to complain to your data protection authority. We do not discriminate against you for exercising these rights.

Deleting your account and data. The fastest way is inside the game: open the settings screen and choose the account deletion option. This permanently removes your saved progress, purchases and team membership from our servers and cannot be undone. You can also e-mail chafik@tapugo.games from the address you want us to reply to; we may ask for information that lets us find your account, and we answer within 30 days.

Data held by our advertising, analytics and attribution partners as independent controllers must be requested from them directly using the contacts in section 4.

8. Children

Our games and this website are not directed to children under 13, or under the age at which your country requires parental consent for online services (16 in parts of the EU). We do not knowingly collect personal information from children below that age. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Security

Game progress and purchases are stored on servers protected by access controls, encryption in transit and audited administrative access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we act promptly on any incident and notify you where the law requires it.

10. Links to other sites

Our games and website may link to sites we do not operate. Their privacy practices are their own; please review their policies.

11. Changes to this policy

We may update this policy when our games or the law change. The date at the top shows the latest version. For material changes we will also inform you in the game or on this website before they take effect.

12. Contact

Tapugo FZCO, Dubai, United Arab Emirates. For any privacy question or request, write to chafik@tapugo.games.