Privacy Policy

DATE: Dec 10, 2025

This Privacy Policy sets out how Dayu Zhou (hereinafter referred to as "we") collects and processes your personal data in connection with your use of our iOS mobile game [Brain Recall Cards]. Our collection and processing of your relevant information are solely intended to deliver high-quality game products and an optimal user experience for you.

1. Methods of Personal Data Collection

We obtain, utilize, and process your personal data through multiple channels, and we are dedicated to safeguarding the security of your personal data under all circumstances. The following sections detail the types of personal data we collect and the corresponding processing methods.

1.1 Types of Personal Data

When you access or use [Brain Recall Cards], we may collect the following general information related to you:

• Log Information: IP address, access timestamp, and device model.
• Device Information: Device brand, device type, operating system version (iOS version), device time zone, and device language settings.
• Device Identification Information: Unique online identifiers associated with the device you use to access the game, including IDFA (Advertising Identifier), Google Ads ID, Google Device ID, Game Center ID, and Google Play account ID.
• Usage Information: Game progression, in-game scores, achievement records, and history of interactions with other players.
• Commercial Information: Purchase transaction records, service usage history, preference configurations, and records of acquiring in-game virtual items.

1.2 Other Sources of Data

• If you log into the game via third-party platforms such as Apple Game Center, we will retrieve relevant information about you (including display name and profile details) from that platform in accordance with the platform’s prescribed authorization procedures, provided that you have granted the required authorizations to the third-party platform.
• You may review the privacy policies of third-party platforms to understand how they process your personal data:
• Apple Game Center: https://www.apple.com/legal/internet-services/itunes/gamecenter/

By logging into the game through a third-party platform, you represent and warrant that:

1. Your access to and use of game-related features comply with the current terms of service and policies of that third-party platform.
2. You have reached the minimum age threshold specified by the third-party platform in accordance with the laws of the applicable jurisdiction.

2. Purposes for Using Collected Information

We use your information for the following objectives, and the processing of each type of personal data adheres to the corresponding legal basis:

1. Fulfill product orders and other user requests, respond to your inquiries, and maintain communication with you; provide game services, enhance and customize your gaming experience; send you game-related notifications, technical updates, privacy alerts, and technical support assistance.

• The legal basis for the above data processing is Article 6(1)(b) of the General Data Protection Regulation (GDPR) (also known as the "balancing of interests principle"). This processing is essential for performing the contractual obligations you are party to, supporting game operations, delivering the products and services you have requested, and ensuring the ongoing maintenance and updates of the game.

2. Based on your marketing preferences, send you updates about Dayu Zhou or third-party promotions that may be of interest to you; optimize and personalize your gaming experience while preserving your preference settings; analyze game usage and operational data to develop new products or services and improve the quality of our software, content, marketing campaigns, support services, and overall offerings.

• The legal basis for this data processing is Article 6(1)(f) of the GDPR. We conduct such processing based on our legitimate interest in presenting you with advertisements and content that align with your interests and in enhancing the quality of our services.

3. Deliver personalized advertisements, marketing materials, and relevant promotional content to users who consent to share their advertising identifiers with our ad network partners.

• The legal basis for this data processing is Article 6(1)(f) of the GDPR. We carry out this processing based on our legitimate interest in providing you with targeted ads and content and in refining our service quality.

3. Data Retention Period

1. We will retain your information only for the duration necessary to provide game services to you, fulfill legal obligations, and/or exercise, defend, or establish our legal rights. For the purposes of resolving disputes, enforcing our terms and policies, managing game services, complying with technical and legal requirements, or due to constraints related to service security, integrity, and operational stability, we may retain certain personal information in our systems for a reasonable period.
2. We also retain Usage Data for internal analytical purposes. Generally, Usage Data is stored for a relatively brief duration, except in cases where the data is used to strengthen service security, improve service functionality, or where applicable laws mandate an extension of the retention period.

4. Information Sharing Practices

Subject to your legal rights and in compliance with Article 6(1)(b), 6(1)(c), and 6(1)(f) of the GDPR, we may disclose or permit you to share the information we collect about you with various third parties in the following manners:

1. Other Third Parties: For example, for the purpose of collaborative service provision, legal and security-related matters, in connection with the sale or transfer of a business or asset, or for other purposes with your explicit permission.
2. Relevant Authorities: If we determine that your actions conflict with the spirit or terms of our policies, or if disclosure is necessary to protect the rights, property, and safety of Dayu Zhou and other parties.
3. Other Users: For instance, when you participate in public game communities or events, or when your information is displayed on in-game leaderboards.

4.1 Sharing with Ad Network Partners

When you consent to information sharing in accordance with the relevant provisions of Article 6(1) of the GDPR, we will share your device identification information with ad network companies to facilitate the delivery of personalized advertisements to you. The ad networks we currently use or may use in the future are listed below:

• Applovin Corporation: https://www.applovin.com/privacy/
• AdColony: https://yandex.com/legal/international_ads_privacy_policy
• Amazon Publisher Services: https://www.amazon.com/privacyprefs
• Facebook, Inc.: https://www.facebook.com/about/privacy/
• Google LLC: https://policies.google.com/privacy
• Google Admob: https://support.google.com/admob/
• Unity Technologies: https://unity3d.com/legal/privacy-policy
• IronSource: http://www.ironsrc.com/wp-content/uploads/2019/03/ironSource-Privacy-Policy.pdf
• Vungle, Inc.: https://vungle.com/privacy/
• Fyber: https://www.fyber.com/privacy-policy/
• InMobi: https://www.inmobi.com/privacy-policy/

The use of disclosed information by third-party recipients is not governed by this Privacy Policy. For inquiries regarding the data processing practices of such third parties, please refer to their respective privacy policies.

4.2 Collaboration with Data Processors

In the course of data processing, we work with the following data processors, which include server hosting providers, technical service providers supporting internal operations, user login service providers, and analytics service providers:

• Firebase (Google LLC): https://firebase.google.com/support/privacy
• Adjust: https://www.adjust.com/terms/privacy-policy/

5. Protection of Children’s Personal Information

[Brain Recall Cards] is not intended for individuals under the age of 13. We do not knowingly collect personally identifiable information from children under 13 years of age. If we discover that we have inadvertently collected personal information from a child under 13, we will promptly delete such information from our servers. If you are a parent or legal guardian and become aware that your child has provided us with personal information, please contact us to take the necessary remedial measures.

6. Information Security Measures

We value the trust you place in us and endeavor to protect the personal information you provide using commercially reasonable security methods. However, it should be noted that no method of internet transmission or electronic storage can guarantee 100% security and reliability, and we cannot assure the absolute security of your information.

7. Push Notification Services

If you have consented to receive push notifications, we will send game-related announcements, service updates, promotional content, and other relevant messages to your iOS device. You may disable these push notifications by adjusting the notification settings on your device.

8. Your Rights

8.1 Rights of Residents in the European Economic Area (EEA)

We will process and respond to your requests in a timely manner, with a response provided no later than one month from the receipt of your request. If the processing timeframe needs to be extended due to the complexity of the request, in accordance with Article 12 of the GDPR, the maximum extension period is three months, and we will notify you of the reason for the extension and the extended timeframe at that time.

1. Right to Access DataPursuant to Article 15 of the GDPR, you have the right to request access to the personal data we are processing about you, including the following details:

• The purposes of data processing;
• The categories of personal data involved;
• The recipients or categories of recipients to whom the personal data has been or will be disclosed;
• The expected period for which the personal data will be stored.Additionally, you have the right to obtain a copy of the personal data being processed. Please note that your access rights may be restricted to protect intellectual property or trade secrets.

2. Right to Object to Processing

• Under Article 21 of the GDPR, when we process your personal data based on the "balancing of interests principle" (Article 6(1)(f) of the GDPR), you have the right to object to such processing based on your specific situation. In such instances, we will cease the relevant data processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.
• You have the right to object at any time to our use of your personal data for direct marketing purposes. Upon receipt of your objection, we will discontinue processing your personal data for this specific purpose.

3. Right to RectificationIn accordance with Article 16 of the GDPR, you have the right to request the correction of any inaccurate personal data held about you.
4. Right to Restrict ProcessingPursuant to Article 18 of the GDPR, in certain circumstances, you have the right to request the restriction of data processing. If this right applies, we will only process your data with your consent, for the establishment/exercise/defense of legal claims, to protect the interests of third parties, or based on important public interest grounds.
5. Right to Withdraw ConsentUnder Article 7 of the GDPR, if our data processing is based on your consent, you have the right to withdraw that consent at any time.

• After you withdraw your consent, we will stop processing the data associated with the withdrawn consent, unless required by law to retain certain data.
• The withdrawal of your consent does not affect the lawfulness of any data processing conducted prior to the withdrawal based on your consent.

6. Right to Data PortabilityPursuant to Article 20 of the GDPR, if data processing is based on your consent or the performance of a contract, you have the right to request that we provide the personal data you have submitted to us (and which we are processing) in a structured, commonly used, and machine-readable format, as well as the right to transmit that data to another data controller.

8.2 Rights of California Residents

1. Request Response TimeframeWe will make every effort to respond to a verifiable consumer request within 45 days of receipt. If an extension of the processing period is required (up to a maximum of 90 days), we will notify you in writing of the reason for the extension and the extended timeframe, and deliver the written response to you via mail.
2. Scope of Information DisclosureAny information we disclose will only cover data from the 12-month period preceding the receipt of your verifiable consumer request. If we are unable to fulfill your request, we will provide an explanation in our response. For data portability requests, we will provide your personal data in a user-friendly format that enables seamless transmission between entities.
3. Right to Opt-Out of Information SaleIn accordance with the California Consumer Privacy Act (CCPA), every California resident has the right to request that a business cease selling their personal information to third parties.
4. Right to KnowYou have the right to be informed of the categories of personal data we collect and the purposes of such collection, with relevant details available at any time in this Privacy Policy. We will update this Privacy Policy at least once every 12 months.
5. Right to Request DisclosureYou have the right to request that we disclose the personal data we have collected about you over the past 12 months.

• Details regarding the categories of personal data we collected about you in the past 12 months and plan to collect in the future, as well as data sources and usage methods, can be found in this Privacy Policy.
• You are entitled to obtain a free copy of your personal information (i.e., the right of access), and you may make such a request twice per year at no cost.
• When fulfilling an access request, we will provide you with the following: categories of personal data collected about you, categories of data sources, purposes of data collection, categories of third parties with whom data is shared, and the specific personal data collected about you.

6. Right to Request DeletionYou have the right to request the deletion of personal data we have collected about you over the past 12 months.

• We fully acknowledge your right to deletion, but it should be noted that in some cases, we are legally obligated to retain your personal data—for example, to provide you with services, detect or resolve security and functional issues, comply with legal regulations, conduct public interest research, protect freedom of speech, or perform internal operations that are reasonably expected. In the absence of such retention requirements, we will delete your personal information in accordance with your request.

9. Data Deletion Requests

When your personal data is no longer necessary for our retention purposes, you may request the immediate deletion of such data. To submit a data deletion request, please contact us at the email address [bonservice@bingthink.top].

10. Contact Us

If you have any questions or concerns regarding this Privacy Policy, please reach out to us via the following channel:

• Contact Email: [bonservice@bingthink.top]