Privacy Policy

1. Introduction

This Privacy Policy explains how Vistaris Labs ("we", "us", "our", or "Developer"), an individual developer based in Uttar Pradesh, India, collects, uses, stores, shares, and protects personal data when you ("you", "User", or "Data Principal") use the Word Maze mobile application (the "App"), available on Google Play.

This policy applies to all users worldwide. It has been prepared with reference to:

• India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules);
• The European Union's General Data Protection Regulation (GDPR);
• The United States' California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA);
• The California Online Privacy Protection Act (CalOPPA);
• The U.S. Children's Online Privacy Protection Act (COPPA);
• Google Play's Data Safety and Families Policy requirements.

By using the App you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please do not use the App.

2. Data Controller / Operator Information

For the purposes of the GDPR, the Developer is the Data Controller. For the purposes of the DPDP Act, the Developer is the Data Fiduciary.

3. Personal Data We Collect

3.1 We Collect No Personal Information

We do not collect, request, transmit, or store any personal information about you. The App has no sign-in, no account creation and no user identifier of any kind. It contains no analytics SDK, no advertising SDK, and no crash-reporting, attribution or fingerprinting library. No data about you or your device leaves your device.

Specifically, we do not collect:

• Your name, email address, phone number, or postal address
• Any social-media profile information or account identifier
• Your Android Advertising ID, device advertising ID, or any other device or vendor identifier
• Any location data, including coarse location derived from an IP address
• Your IP address, as no network connection is made by the App
• Photos, camera data, contacts, SMS, or the phonebook
• App usage analytics, crash logs, or session data of any kind
• Payment, financial, health, or biometric information — the App has nothing to buy

3.2 Data Stored Only on Your Device

Although we collect nothing, the App does write a small amount of gameplay data to your device's local storage so that your progress and history are preserved between launches. This data stays on your device, is never transmitted, and is deleted by the actions described in Section 6:

None of this data is linked to you, to your device's identifiers, or to any account, and none of it is transmitted to us. Clearing the App's data, uninstalling the App, or using the Settings > Clear history action deletes it (see Section 6).

Android system backup. If you have Android's backup service enabled, the App declares an explicit backup policy so that you control what leaves the device. Your preferences (theme, sound, default difficulty) are eligible for backup and may be restored by the operating system onto a new device signed into your Google account. Your scores, streaks, word lists, Daily Challenge results and game history are explicitly excluded from backup and never leave the device. In both cases the backup is encrypted and operated by the operating system: we can neither read it, retrieve it, nor use it for any purpose, and it does not make any of this data accessible to us. Turning off Android backup for this App in your device settings stops even the preference backup. This is declared in the App's res/xml/data_extraction_rules.xml and res/xml/backup_rules.xml, and it is the reason the Data Safety section below records no collection and no sharing.

3.3 Permissions the App Requests

The App requests the VIBRATE permission for short haptic feedback while you play, and nothing else. It does not request location, contacts, camera, microphone, phone, storage or advertising permissions.

4. How We Use Your Personal Data

We use no personal data, because we hold none. There is no profiling, no behavioural targeting, no interest-based advertising, and no automated decision-making about you.

The only data the App processes is the on-device gameplay data listed in Section 3.2, which is not personal data in the sense of the GDPR or the DPDP Act because it is neither linked nor linkable to an identified or identifiable person.

5. Third-Party Services and Data Sharing

We share no personal information, because we have none to share. There are no third-party analytics, advertising, social login, payment or cloud services in this App, and no data ever leaves your device. There is no server operated by us.

The App is self-contained: it does not embed Firebase Analytics, Firebase Authentication, Firebase Crashlytics, AppLovin MAX, Google AdMob, or any other third-party SDK that could collect data. Because no data is shared, no international data transfer occurs — see Section 13.

6. Data Retention and Your Control Over It

Since we hold no data, we retain none. For completeness, this section covers the on-device data described in Section 3.2 and the controls you have over it.

Settings > Clear history permanently deletes every game you have played, together with your scores, streaks, Daily Challenge results and daily streak. Settings also offers a Run cleanup now action to trim history outside the 180-day window immediately. Uninstalling the App removes all of its local data.

Scores, streaks and history are excluded from Android system backup, so they do not survive onto a new device. Only your preferences are eligible, and they are covered by the deletion paths in the table above.

We cannot retrieve, restore, export or transfer any data about you, because we hold none.

7. Your Rights

You have the rights listed below under the GDPR, the CCPA/CPRA, the DPDP Act and the CalOPPA. As we hold no personal information, there is in practice nothing for us to disclose, correct, export or erase — but we will confirm this in writing if you ask, and we will honour any request to delete the support correspondence that your request itself creates.

7.1 Rights under the GDPR (Users in the EU, EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR:

• Right of Access (Art. 15): You may request a copy of the personal data we hold about you. We hold none.
• Right to Rectification (Art. 16): You may request correction of inaccurate personal data. We hold none.
• Right to Erasure / "Right to be Forgotten" (Art. 17): You may request deletion of your personal data in certain circumstances. We hold none.
• Right to Restriction of Processing (Art. 18): Not engaged, as no processing takes place.
• Right to Data Portability (Art. 20): Not engaged, as no processing takes place.
• Right to Object (Art. 21): Not engaged, as no processing takes place.
• Right to Withdraw Consent (Art. 7(3)): No processing relies on consent, so there is no consent to withdraw.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority (Data Protection Authority).

Note: the Android Advertising ID reset and opt-out controls described in the AppLovin-oriented variant of this policy are unnecessary here — the App neither reads nor transmits an advertising identifier. You may nonetheless reset or delete your Android Advertising ID through your device's privacy settings at any time.

7.2 Rights under the CCPA/CPRA (California Residents)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) grants you the following rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected, their sources, our business purposes, and the categories of third parties with whom we share them. We have collected no categories of personal information in the preceding 12 months and have shared none with any third party.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions. We hold none.
• Right to Correct: You may request correction of inaccurate personal information. We hold none.
• Right to Opt-Out of Sale/Sharing: You may opt out of the "sale" or "sharing" of your personal information for targeted advertising. We do not sell or share your personal information as defined under CCPA/CPRA, and the App runs no advertising or analytics SDK whose sharing could be opted out of.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

7.3 Rights under the DPDP Act (Users in India)

If you are located in India, the Digital Personal Data Protection Act, 2023 grants you the following rights as a Data Principal:

• Right to Access Information (Section 11): You may request confirmation that your personal data is being processed and a summary of such processing. No personal data is being processed.
• Right to Correction and Erasure (Section 12): You may request correction of inaccurate or incomplete personal data and erasure of data no longer necessary. We hold none.
• Right to Grievance Redressal (Section 13): You may file a complaint regarding a breach of your rights under the Act. We will respond within 90 days of receiving your grievance at the email address below.
• Right to Nominate (Section 14): You may nominate another individual to exercise your rights under the Act in the event of your death or incapacity.
• Right to Withdraw Consent (Section 6(4)): No processing is carried out on the basis of consent.

You may exercise any of these rights by contacting us at vistaris.labs@gmail.com.

7.4 Rights under CalOPPA (All Users)

Under the California Online Privacy Protection Act, you have the right to review and request changes to your personal information. We will respond to verified requests within 30 days. We hold no personal information.

8. Children's Privacy (COPPA & DPDP Act)

The App is playable by users of all ages, including children under 13, and because it collects no information from anyone, it collects no information from children.

Under the DPDP Act, 2023, a "child" is any individual who has not completed the age of 18 (Section 2(k)). We process no personal data of any child, so Section 9's verifiable parental or guardian consent requirement is not engaged.

We do not transmit the Android Advertising ID, SIM serial, build serial, BSSID, MAC, SSID, IMEI or IMSI from any user, children included, as no such identifier is read by the App.

9. California Privacy Rights — CCPA/CPRA Disclosure

This section applies exclusively to California residents and provides the disclosures required by the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), effective January 1, 2023.

9.1 Categories of Personal Information Collected (Past 12 Months)

None. We have collected no categories of personal information in the preceding 12 months.

9.2 "Selling" and "Sharing" of Personal Information

We do not sell your personal information for monetary consideration, and we do not share it for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA. The App contains no advertising SDK and no analytics SDK, so there is no pathway by which your identifiers or internet activity could be disclosed to an advertising partner. Consequently there is nothing to opt out of, and no "Do Not Sell or Share My Personal Information" link is presented in the App.

9.3 Categories of Third Parties to Whom Personal Information is Disclosed

None. We disclose personal information to no service providers, contractors or third parties of any kind.

10. CalOPPA Disclosure — Do Not Track

Under the California Online Privacy Protection Act (CalOPPA), we are required to disclose whether the App honors "Do Not Track" (DNT) signals or similar mechanisms.

Do Not Track: The App does not collect or transmit data of any kind, so it neither responds to nor is capable of acting on DNT signals, and none is needed. There is no advertising or analytics SDK whose tracking you would need to suppress through your device's advertising settings. You may nonetheless manage or reset your device's advertising identifier through your device's privacy settings at any time.

CalOPPA — Policy Changes: We will notify you of any material changes to this Privacy Policy by posting the updated policy within the App and on the Google Play listing, with the effective date updated at the top. Material changes will also be communicated via in-app notification at least 30 days before they take effect.

CalOPPA — Effective Date: This Privacy Policy is effective as of 15 September 2026 and was last updated on 15 September 2026.

11. Google Play Data Safety Disclosures

In compliance with Google Play's Data Safety requirements, the following is disclosed in the Data Safety section of the Play Console for this App:

No data of any type is collected by the App or shared with any third party, and no data is collected "off the device", encrypted in transit, or deleted on request, because no such processing occurs. The App may be used by all ages, so its Play Console target-audience declaration includes all applicable age groups.

The Android system backup described in Section 3.2 does not change any answer above. Google Play's Data Safety section asks what the developer collects and shares; storage handed to the operating system's own encrypted backup is neither, because we have no access to it, no ability to read it back, and no use for it. For the same reason, the local storage of scores, streaks and history — which the App excludes from backup entirely — is correctly recorded as neither collected nor shared. The App holds no user account, so there is no identifier under which any of it could be attributed to you even in principle.

12. Security of Your Personal Data

Because the App transmits no personal data, there is no personal data in transit or at rest on any server we control to secure. As a general matter we implement reasonable technical and organizational measures:

• The App makes no network connections, so there is nothing transmitted off your device.
• No personal data is stored on any third-party server; all storage is on your device.
• The App requests only the VIBRATE permission.
• We keep the developer toolchain and the App's dependencies under review, and remove any capability that would introduce collection we have not disclosed here.

Your device itself remains subject to its own protections (screen lock, encryption at rest). While we strive to protect data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

13. International Data Transfers

No international data transfer occurs. No personal data is transmitted from the App to us or to any third party, so nothing is transferred to or processed in any other country. There is no server, no cloud service and no third-party SDK in the App.

The App is distributed globally on Google Play; distribution through Google Play does not constitute a transfer of your personal data, as the App collects none.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes — including new data types collected, new purposes, or new third-party sharing — we will:

• Post the updated policy within the App with a new "Last Updated" date;
• Display an in-app notification informing you of the change at least 30 days before the change takes effect; and
• Where a change concerns children's data practices, obtain fresh verifiable parental consent if and when collection from children ever begins, as required by COPPA or the DPDP Act.

Non-material changes (such as typographical corrections) will be published without prior notice. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

For Indian users: You may file a grievance regarding your personal data at the email address above. We will acknowledge and respond to your grievance within 90 days as required by the DPDP Rules, 2025. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India (DPB).

For EU/EEA/UK users: You have the right to lodge a complaint with your local supervisory authority (Data Protection Authority).

For California users: You may submit a verifiable consumer request by emailing us at the address above. We will respond within 45 days as required by CCPA/CPRA.

16. Adherence to Google Play Families Policy

This App is a mixed-audience app under Google Play's Families Policy. We comply with the following Families Policy Requirements:

• Target audience declaration: We have accurately declared the App's target audience in the Google Play Console, including all applicable age groups.
• Data practices for children: We do not transmit the Android Advertising ID (AAID), SIM serial, build serial, BSSID, MAC, SSID, IMEI or IMSI from children or users of unknown age. No such identifier is read by the App at all.
• Ad SDKs: The App contains no advertising SDK of any kind, so no ad can be served to a child or to a user of unknown age, and no Families-certified or non-Families-certified ad SDK is present.
• Privacy policy: This Privacy Policy accurately discloses the App's data collection and handling practices, as required by the Families Policy.
• Legal compliance: The App complies with COPPA, GDPR, CCPA/CPRA, CalOPPA and the DPDP Act as applicable.