Privacy Policy

This Policy applies to all users of the Services worldwide. It covers information processed through the public website, backend APIs used by the Android app, email correspondence with us, and data stored on your device by the app.

The website is primarily informational: it describes WhizArc and links to Google Play. Gameplay occurs in the Android app unless otherwise stated. We do not operate browser-based games on the website.

This Policy is written to address requirements under the U.S. Children’s Online Privacy Protection Act (“COPPA”), the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), among other applicable laws. It does not constitute legal advice.

• “Personal Data” / “Personal Information” means information that identifies or can reasonably be linked to an individual, directly or indirectly.
• “Child” means an individual under the age of 13 (COPPA), or under the age applicable in your jurisdiction (for example, under 16 in some EU member states for certain processing, or under 18 under the DPDP Act for certain provisions relating to children).
• “Gamer Tag” / “Display Name” means a nickname you choose in the app (letters, numbers, and underscores; 3–24 characters). We instruct users not to use their real full name.
• “Player ID” means a randomly generated identifier assigned to an app installation (for example, prefixed with pgs_ on Android) used to associate scores and profile data with a device installation.
• “Run Data” means gameplay records submitted after a round, including mode, score, duration, streak, platform, and timestamp.
• “Process” / “Processing” means any operation performed on information, including collection, storage, use, disclosure, and deletion.

For purposes of the GDPR, UK GDPR, and DPDP Act, the data controller / data fiduciary is:

Kabir
D-83, Gulmohar Park, New Delhi, India
Email: kabirsingla1106@gmail.com

Canonical URLs: https://www.whizarc.com/privacy | https://privacy.whizarc.com

WhizArc is designed for users approximately 8–14 years old. Because this range includes children under 13, we treat the app as directed to children for purposes of COPPA and apply heightened protections accordingly.

4.1 No account or email required to play. The Android app does not require registration with an email address, phone number, or password. A user chooses a Gamer Tag and receives a Player ID on the device. We do not knowingly require children to submit personal contact information as a condition of playing.

4.2 COPPA (United States). Under COPPA, we may collect persistent identifiers (such as Player ID) and gameplay information without parental consent when such collection is limited to what is reasonably necessary to support the internal operations of the Services — for example, maintaining leaderboards, saving progress, preventing abuse, and operating the game. We do not condition a child’s participation on disclosing more personal information than is reasonably necessary. We do not knowingly collect personal contact information from a child under 13 without appropriate parental involvement. If you believe we have collected such information from your child, contact us at kabirsingla1106@gmail.com and we will delete it.

4.3 GDPR / UK GDPR (children in the EEA & UK). Where GDPR or UK GDPR applies, we process data relating to children in accordance with applicable age thresholds and lawful bases described in Section 9. Parents or guardians may exercise data subject rights on behalf of a child as permitted by law.

4.4 India DPDP Act. Under the DPDP Act, certain processing of personal data of children may require verifiable consent from a parent or lawful guardian. WhizArc minimizes personal data collection and does not require children to provide contact details to play. Parents or guardians in India may contact us regarding access, correction, or erasure requests relating to their child’s data.

4.5 Parental & guardian rights. A parent or legal guardian may review information we hold about their child (to the extent we can reasonably associate it with a request), request deletion, or ask questions about our practices by emailing kabirsingla1106@gmail.com. Please include sufficient detail for us to locate the relevant Player ID or Gamer Tag if known.

5.1 Information you provide.

• Gamer Tag: A nickname chosen in the app, stored locally and synced to our servers when gameplay data is submitted.
• Support & correspondence: If you email us, we receive your email address, message content, and any information you choose to include (such as a name or Player ID).

5.2 Information generated through use of the app.

• Player ID: A pseudonymous identifier generated for the app installation.
• Run Data: Game mode, score, round duration, streak count, platform (android or web), and submission timestamp, submitted to our API endpoints (including /api/runs/submit and /api/players/upsert).
• Local app data: Scores, streaks, play time, mode statistics, and preferences stored in on-device databases and local storage until cleared or the app is uninstalled.

5.3 Information collected automatically.

• Server & security logs: Our hosting provider may log IP addresses, request timestamps, URLs, user-agent strings, and similar technical data when you visit the website or when the app calls our APIs. We use IP addresses in rate-limiting logic to prevent abuse of player and score submission endpoints.
• Device & network data: The app requires internet permission to sync scores. We do not collect precise GPS location through the app.

5.4 Website-specific data. The public website does not require login. We do not use third-party analytics or session-recording tools on the website. Standard web server logs may still be generated by our host.

Except as described above, we do not collect:

• Passwords or account credentials (no traditional accounts)
• Payment card, billing, or financial information (the app has no in-app purchases)
• Phone numbers or postal addresses through the app
• Government-issued identification numbers
• Precise geolocation / GPS coordinates
• Photos, microphone audio, or contacts from your device
• Advertising identifiers — the Android app explicitly removes the Google Advertising ID permission
• Behavioral advertising profiles (we do not serve ads in the app or on the website)

• Directly from you (Gamer Tag, support emails)
• Automatically from your device and app (Player ID, Run Data, local scores)
• Automatically from network requests to our servers (technical logs)

We use collected information for the following purposes:

• Operating quiz, memory, puzzle, and arcade games in the Android app
• Storing and displaying scores, streaks, and progress
• Operating public leaderboards that show Gamer Tags and scores
• Syncing gameplay data between your device and our servers
• Preventing fraud, score manipulation, and API abuse (including rate limiting)
• Responding to support requests and legal inquiries
• Maintaining, securing, and improving the Services
• Complying with applicable legal obligations

We do not use personal information for targeted advertising, and we do not sell personal information.

Where GDPR or UK GDPR applies, we rely on the following legal bases:

• Gameplay, leaderboards, Player ID & Run Data: Legitimate interests in operating the game and community features; where required, consent of a parent/guardian for children.
• Security, abuse prevention, server logs: Legitimate interests in security and integrity of the Services.
• Support emails: Legitimate interests / performance of a request; consent where applicable.
• Legal compliance: Compliance with a legal obligation.

You may object to processing based on legitimate interests where applicable law provides that right. Contact us using the details in Section 19.

WhizArc maintains leaderboards that may display a user’s Gamer Tag, score, game mode, and related gameplay statistics to other users. Leaderboard data is visible to anyone who can access the relevant feature in the app or associated API responses.

Because Gamer Tags are user-chosen and may be visible publicly, we instruct users — especially children — not to include their real name, school, address, phone number, email, or other identifying information in a Gamer Tag. We are not responsible for information a user chooses to include in a display name contrary to this guidance.

11.1 Current features. The app may include local or asynchronous gameplay modes. Where multiplayer elements exist today, they do not include open chat, direct messaging, voice communication, or user-generated text visible to other players beyond the Gamer Tag and score data described above.

11.2 Planned online multiplayer. We may introduce real-time or online multiplayer quiz modes in future updates. If we do, opponents may see your Gamer Tag and gameplay statistics during a match. We do not plan to add open chat or contact exchange between players. Material changes to multiplayer privacy will be reflected in an updated version of this Policy before or when such features launch.

Website: The website does not currently use non-essential analytics cookies or third-party advertising cookies. Our hosting infrastructure may use strictly necessary technical cookies or similar mechanisms required to deliver pages securely. You can control cookies through your browser settings.

Android app: The app stores gameplay data, Gamer Tags, Player IDs, and preferences in local on-device storage (including app databases). This data remains on your device until you clear app storage or uninstall the application.

We do not sell, rent, or trade personal information. We share information only as follows:

• Infrastructure providers: We use cloud hosting and storage providers to operate the website and APIs, including Vercel (hosting, serverless functions, and related infrastructure) and, where configured, Google Firebase / Cloud Firestore or Vercel Blob for player and score records. These providers process data on our behalf under their respective terms and security measures.
• Google Play: Distribution of the Android app is subject to Google’s policies and processing when you download or update the app through Google Play.
• Other users: As described in Section 10, Gamer Tags and scores may be visible on leaderboards.
• Legal & safety: We may disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of WhizArc, our users, or others.
• Business transfers: If WhizArc is involved in a merger, acquisition, or asset sale, user information may be transferred subject to this Policy or successor notice.

WhizArc is operated from India. Our service providers may process data in India, the United States, the European Union, the United Kingdom, and other countries where they maintain facilities.

Where GDPR or UK GDPR requires safeguards for transfers outside the EEA or UK, we rely on appropriate mechanisms such as Standard Contractual Clauses implemented by our providers, or other lawful transfer tools available at the time of transfer. You may contact us for more information about transfer safeguards.

We retain Player IDs, Gamer Tags, Run Data, and leaderboard records for as long as necessary to operate the Services and maintain historical leaderboards, unless you request deletion or we are required by law to delete sooner.

Support emails and related correspondence are retained until you request deletion or we no longer need them for the purpose collected.

Server logs are retained for a limited operational period appropriate for security and debugging, then rotated or deleted.

Local app data on your device persists until you clear storage or uninstall the app. Deleting server-side data does not automatically erase local device copies.

Depending on your location, you may have some or all of the following rights, subject to applicable law and exceptions:

• Access — request confirmation of whether we process your information and obtain a copy
• Correction — request correction of inaccurate information
• Deletion / erasure — request deletion of information we hold
• Restriction — request restriction of certain processing
• Objection — object to processing based on legitimate interests
• Portability — receive certain data in a structured, commonly used format where applicable
• Withdraw consent — where processing is based on consent
• Complaint — lodge a complaint with a supervisory authority (EEA/UK) or the Data Protection Board of India under the DPDP Act

How to exercise rights. Email kabirsingla1106@gmail.com with the subject line “Privacy Request”. Include your Gamer Tag and/or Player ID if known, the nature of your request, and proof of parental authority if you are contacting us on behalf of a child. We will respond within the timeframe required by applicable law.

U.S. state privacy laws. We do not sell personal information. Residents of U.S. states with comprehensive privacy laws may have additional rights regarding access and deletion. Contact us to exercise those rights.

We implement reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, or alteration. These include HTTPS for network communication, server-side validation of score submissions, rate limiting on sensitive API endpoints, and access controls on administrative tools.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be posted on this page and, where appropriate, communicated through the app or website. Continued use of the Services after the effective date of an update constitutes acceptance of the revised Policy, to the extent permitted by law.

For privacy questions, parental requests, or data deletion:

Kabir — WhizArc
D-83, Gulmohar Park, New Delhi, India
Email: kabirsingla1106@gmail.com

If you are located in the EEA or UK and believe we have not adequately addressed your concern, you have the right to contact your local data protection authority. In India, you may have rights to approach the Data Protection Board of India under the DPDP Act once fully operational.