Privacy Policy

Yellow Umbrella Studios ("Yellow Umbrella", "we", "us" or "our") develops and publishes mobile games. Our games are published on the Apple App Store and Google Play under the developer name Yonatan Goldshtein and include, among others, Watch Box, Car Box, Word Box, Categories, Sort the words!, Emoji Jam, Footy Games, PinPoints, Combinations and Wordoku (collectively, the "Games").

This Privacy Policy explains what information we collect when you download, install or play any of our Games or visit our website at https://yellowumbrellastudios.com (together, the "Services"), how we use and share it, and the choices and rights you have. It applies to every game we publish, now and in the future, unless a specific game displays its own privacy notice.

By using the Services you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services. Our Terms of Service also apply to your use of the Games.

Most of our Games can be played without creating an account and without telling us who you are. The information we collect falls into three groups.

a. Information you give us directly

• Support and contact messages. If you email us, use a contact form on our website, or leave a review, we receive your name, email address and the content of your message.
• Optional account details. The Games create an anonymous player account for you automatically. If you choose to protect your progress by linking an email address and password, we store your email address, and Firebase Authentication stores your password in hashed form. We never see your plain-text password.
• Player profile. Some Games let you choose a display name, an avatar and a country flag. These are shown to other players on leaderboards, on marketplace listings you create, and on your public collection or garage page.
• In-game feedback. Bug reports and suggestions you submit through the Game's feedback form, together with basic technical details (app version, platform, language) that help us reproduce the issue.
• Referral and promo codes. Your referral code, any friend's code you redeem, and any promotional codes you enter.
• Surveys and reviews. Any information you choose to share in optional surveys, ratings or store reviews.

b. Information collected automatically

When you play the Games, we and our third-party partners may automatically collect:

• Device information such as device model, manufacturer, operating system and version, screen size, language, time zone, country or region, mobile carrier and network type.
• Identifiers including the advertising identifier of your device (Apple IDFA or Google Advertising ID, only where you allow tracking), vendor or app-set identifiers, push notification tokens, a random player ID assigned to your account by Firebase Authentication, and an opaque public ID we use to show you on leaderboards and marketplace listings without revealing your account ID.
• IP address and approximate (city-level) location derived from it. We do not collect precise GPS location.
• Gameplay and economy data such as levels played, scores, progress, achievements, experience points and season rank, your balances of virtual currency (coins, gems), the virtual items you own (for example cars, cards, boxes, passes), boxes you open, items you sell, trade or list on the in-game marketplace, mini-game results, quests and rewards claimed, session length, in-game settings, and how you interact with features and menus. Most of this is stored on our servers so that it can be restored and protected against tampering.
• Integrity and anti-cheat data such as device attestation results (Firebase App Check), the difference between your device clock and our server clock, and signals that help us detect fraud, cheating and abuse of rewards.
• Purchase information such as the items purchased, price, currency, and store transaction identifiers, subscription status and an anonymous subscriber ID generated by our purchase-management provider (RevenueCat). We never receive your full payment card details; these are handled by Apple or Google.
• Advertising data such as which ads were shown, viewed or clicked and whether a rewarded ad was completed.
• Diagnostics including crash reports, error logs, performance data and the state of the Game when a problem occurred.

c. Information from third parties

• App stores. Apple and Google provide us with aggregated download, retention and purchase statistics, and with the information needed to verify purchases and process refunds.
• Purchase management. RevenueCat confirms to our servers which purchases and subscriptions are active on your account so we can unlock what you paid for.
• Advertising partners may provide us with attribution data (which campaign led you to install a Game) and confirm that you completed a rewarded ad.

We do not knowingly collect sensitive information such as health data, biometric data, financial account numbers, government identifiers, or information about your religion, ethnicity or sexual orientation, and we ask that you do not send us such information.

We use the information described above to:

• Provide, operate and maintain the Games, including creating your player account, saving and restoring your progress and settings, and running the in-game economy;
• Process in-app purchases, deliver purchased content and handle refund requests;
• Show advertisements, including rewarded video ads, verify that rewarded ads were completed before granting rewards, and measure their effectiveness;
• Provide leaderboards, seasons, achievements, the player-to-player marketplace, public collections and other social features;
• Run referral programs and promotional codes and pay out the associated rewards;
• Remotely configure and tune the Games (for example prices, offers, events and difficulty) and run A/B tests of new features;
• Analyze how the Games are used so we can improve gameplay, balance difficulty and fix bugs;
• Detect, investigate and prevent fraud, cheating (including device clock manipulation, tampered builds and reward farming), abuse and security incidents;
• Respond to your support requests and communicate with you about the Games;
• Send push notifications and local reminder notifications (for example when your idle earnings are full or a daily reward is ready), if you have enabled them; you can turn them off at any time;
• Comply with legal obligations and enforce our Terms of Service; and
• Understand our audience in aggregate and develop new games and features.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects on you.

If you are located in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract – to deliver the Games and their features to you, process purchases and provide support.
• Legitimate interests – to analyze and improve the Games, ensure their security, prevent fraud and cheating, and show contextual (non-personalized) advertising. We balance these interests against your rights and freedoms.
• Consent – to use your advertising identifier for personalized advertising and cross-app tracking, and to send marketing communications. You may withdraw consent at any time as described in the "Your choices" section.
• Legal obligation – to keep records required by tax, accounting or consumer protection laws and to respond to lawful requests from authorities.

Our Games are free to play and supported by advertising and optional in-app purchases. To show ads and understand usage we integrate software development kits (SDKs) from the third parties listed below. These partners may collect your advertising identifier, IP address, device information and interaction data directly from your device and use it in accordance with their own privacy policies. The exact set of partners varies from Game to Game and may change over time.

Some advertising partners may use your data to build a profile of your interests and show you ads in other apps and websites ("interest-based" or "personalized" advertising). Where required by law, we ask for your consent before enabling personalized advertising, and we honor the consent signals you give through our in-game consent form, Apple's App Tracking Transparency prompt and your device settings.

We do not sell your personal information for money. We share information only in these situations:

• Service providers and partners that help us operate the Services, such as the advertising, analytics, crash-reporting, purchase-management, backend hosting and customer-support providers described in this policy. They may only use your information to perform services for us or as permitted by their own policies where they act as independent controllers (for example, advertising networks).
• App store operators (Apple and Google) to distribute the Games and process purchases.
• Other players, limited to your display name, avatar, country flag, rank and score on leaderboards, the items and prices on marketplace listings you create, and the contents of your public collection or garage. Your email address and account ID are never shown to other players.
• Legal and safety reasons: when we believe in good faith that disclosure is required by law, regulation, legal process or governmental request, or is necessary to protect the rights, property or safety of Yellow Umbrella, our players or the public.
• Business transfers: if we are involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.
• With your consent or at your direction.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you, for example overall download numbers or average session length.

Personalized advertising and tracking

• iOS: when a Game first asks, choose "Ask App Not to Track", or at any time go to Settings → Privacy & Security → Tracking and turn off tracking for the Game. You can also disable personalized ads under Settings → Privacy & Security → Apple Advertising.
• Android: go to Settings → Google → Ads (or Settings → Privacy → Ads) and choose "Delete advertising ID" or "Opt out of Ads Personalization".
• In-game consent: where we display a consent form (for example in the EEA or UK), you can change your choices at any time from the Game's settings menu.

Opting out of personalized advertising does not remove ads from the Games; you will still see ads, but they will be less relevant to you.

Push notifications

You can turn notifications off at any time in your device's notification settings for the Game.

Analytics

You can limit analytics collection through the consent options described above and through the "Limit Ad Tracking" / advertising-ID controls of your device. To stop all collection, uninstall the Game.

Profile and account

You can change your display name, avatar and country at any time from the Game's profile or settings screen. If you linked an email address, you can sign out from the settings screen; the Game will then continue with a fresh anonymous account.

Deleting your account and data

Games that store progress on our servers include a "Delete account" option in the settings menu. Using it permanently erases your player account, progress, virtual items, profile, leaderboard entries, marketplace listings and push token from our servers, and cannot be undone. Games that only store progress on your device delete that data when you uninstall the Game.

You can also ask us to delete any information we hold about you (for example support emails or in-game feedback) by emailing admin@yellowumbrella-apps.com with the subject line "Data deletion request" and the name of the Game. We will verify the request and respond within 30 days. Note that we cannot delete data held independently by advertising partners, Apple or Google; please use their tools linked in this policy.

Depending on where you live, you may have some or all of the following rights regarding your personal information. We extend these rights to all of our players where practical.

• Access – to obtain a copy of the personal information we hold about you;
• Rectification – to correct inaccurate or incomplete information;
• Erasure – to have your personal information deleted;
• Restriction – to limit how we process your information in certain circumstances;
• Portability – to receive your information in a structured, commonly-used format;
• Objection – to object to processing based on our legitimate interests, including profiling, and to direct marketing at any time;
• Withdraw consent – where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• Complain – to lodge a complaint with your local data protection authority.

European Economic Area, United Kingdom and Switzerland

You have the rights listed above under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection. You may contact your local supervisory authority; a list of EU authorities is available at edpb.europa.eu, and the UK authority is the Information Commissioner's Office (ico.org.uk).

California and other U.S. states

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another U.S. state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of the "sale" or "sharing" of personal information and of targeted advertising; and not to be discriminated against for exercising your rights. In the past 12 months we have collected the categories of information described in the "Information we collect" section and disclosed them to the categories of recipients described in the "How we share information" section for the purposes described in this policy.

Under the California Consumer Privacy Act (CCPA/CPRA), sharing your advertising identifier with advertising networks for cross-context behavioral advertising may be considered a "sale" or "sharing". To opt out ("Do Not Sell or Share My Personal Information"), use the device and in-game controls described in the "Your choices" section, or email us at admin@yellowumbrella-apps.com. We honor Global Privacy Control signals on our website where technically feasible. We do not knowingly sell or share the personal information of consumers under 16 years of age. You may designate an authorized agent to make a request on your behalf; we may ask for proof of authorization.

Israel

If you are located in Israel, you have the right under the Protection of Privacy Law, 5741-1981 to review information held about you in our databases and to request that it be corrected or deleted.

Brazil

If you are located in Brazil, you have the rights provided by the Lei Geral de Proteção de Dados (LGPD), including confirmation of processing, access, correction, anonymization, deletion, portability and information about sharing.

How to exercise your rights

Email us at admin@yellowumbrella-apps.com with the name of the Game and a description of your request. Because we usually do not hold information that identifies you by name, we may ask you to provide details (such as your advertising identifier, device model or a screenshot of your player profile) so we can locate the relevant records. We will respond within the time required by applicable law, generally within 30 days. We will not charge a fee unless your request is manifestly unfounded or excessive.

Our Games are intended for a general audience and are not directed to children under the age of 13 (or under 16 in the EEA and UK, or under the age at which parental consent is required in your country). We do not knowingly collect personal information from children.

Where a Game is included in a children's or "family" program of an app store, or where we have reason to believe a player is a child, we configure our advertising and analytics partners to treat the player as a child (for example, by requesting non-personalized ads only and by not collecting the advertising identifier), in line with the U.S. Children's Online Privacy Protection Act (COPPA), Google Play's Families Policy and Apple's Kids Category guidelines.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us at admin@yellowumbrella-apps.com. We will delete such information promptly.

We keep personal information only for as long as necessary for the purposes described in this policy, and then delete or anonymize it. In general:

• Gameplay and progress data stored on your device remains until you delete the Game or clear its data;
• Account and server-side game data (your player account, progress, economy, profile, leaderboard entries and marketplace history) is kept for as long as your account exists, and is deleted when you delete your account in-game or ask us to. We may also delete accounts that have been inactive for an extended period;
• Feedback and bug reports submitted in-game are kept for up to 2 years so we can track and fix the issues they describe;
• Analytics and crash data is retained by our analytics providers for a limited period (typically 2 to 14 months for user-level data) and thereafter only in aggregated form;
• Support correspondence is kept for up to 3 years after the issue is closed so we can refer back to it if you contact us again;
• Purchase records are kept for as long as required by tax and accounting law (typically 7 years).

We may retain information for longer if necessary to comply with legal obligations, resolve disputes or enforce our agreements.

We take reasonable technical and organizational measures to protect your information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These include encrypting data in transit (HTTPS/TLS), restricting access to personal information to those who need it, and relying on reputable cloud providers that maintain their own security certifications.

No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach that affects your personal information we will notify you and the relevant authorities as required by applicable law.

We are based in Israel, and our service providers are located in various countries including the United States and the European Union. Your information may therefore be transferred to, stored and processed in a country other than the one you live in, whose data protection laws may differ from those of your country.

Where we transfer personal information out of the EEA, UK or Switzerland, we rely on safeguards recognized by applicable law, such as adequacy decisions (the European Commission has recognized Israel as providing adequate protection), the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or the EU-U.S. Data Privacy Framework where the recipient is certified.

The Games store data locally on your device (for example, using app preferences or local databases) to remember your progress, settings and consent choices. Our advertising and analytics partners may use similar technologies, such as SDK-level identifiers, to recognize your device.

Our website may use cookies and similar technologies for essential functionality and, with your consent where required, for analytics. You can control cookies through your browser settings. Disabling cookies may affect some parts of the website.

The Games and our website may contain links to third-party websites, app stores, social networks and advertisements, and may offer features provided by third parties (such as app store purchase and review features). We do not control these third parties and are not responsible for their privacy practices. We encourage you to read the privacy policies of any third-party service you interact with.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or the Games we offer. When we do, we will revise the "Last updated" date at the top of this page. If the changes are material, we will provide more prominent notice, such as an in-game message or a notice on our website, and where required by law we will seek your consent. Your continued use of the Services after the updated policy takes effect means you accept the changes.

If you have questions, concerns or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

• Company: Yellow Umbrella Studios (Yonatan Goldshtein)
• Email: admin@yellowumbrella-apps.com
• Website: https://yellowumbrellastudios.com
• Location: Israel

Yellow Umbrella Studios is the data controller of the personal information described in this policy, except where our advertising and analytics partners act as independent controllers of the data they collect through their SDKs.