Privacy Policy

1. Operator Information

The data controller / personal data operator responsible for the Game is:

Operator: Islet Tech Co., Limited
Registered address: Room 12, 15/F, Core45, 43-45 Tsun Yip Street, Kwun Tong, Hong Kong 999077
Email: help@catrio3.com
Telephone: +852 8024 1569

For privacy questions or personal data requests, please contact us at:

Privacy contact: help@catrio3.com

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed when you:

• create or use an Account;
• download, access, or play the Game;
• use cloud save or progress synchronisation;
• purchase Coins;
• contact customer support;
• visit our website;
• receive service messages or marketing communications from us;
• interact with our payment, analytics, anti-fraud, hosting, or customer support systems.

This Privacy Policy does not apply to third-party websites, app stores, payment providers, advertising networks, or platforms that are not operated by us. Those third parties process data under their own privacy policies.

3. Personal Data We Collect

We may collect the following categories of personal data.

3.1 Account Data

When you create or use an Account, we may collect:

• email address;
• password or password authentication data;
• Account ID;
• username or nickname;
• login status;
• Account creation date;
• country or region inferred from device, IP address, payment data, or user selection;
• Account settings and preferences.

We do not store your password in plain text. We use technical measures such as hashing or equivalent security controls to protect authentication data.

3.2 Gameplay and Progress Data

When you play the Game, we may collect:

• level progress;
• scores;
• completed levels;
• failed levels;
• boosters, revives, extra moves, and other Items used;
• Coins balance and Coin transaction history;
• rewards, achievements, events, and game activity;
• cloud save data;
• device synchronisation data;
• gameplay logs used for support, anti-cheat, fraud prevention, balancing, and debugging.

3.3 Purchase and Payment Data

When you purchase Coins, we may collect:

• purchase package selected;
• price, currency, and tax information shown at checkout;
• payment status;
• payment provider transaction ID;
• date and time of purchase;
• receipt or invoice data;
• refund status;
• chargeback or payment dispute data;
• anti-fraud and risk signals related to payment abuse.

Payments are processed by third-party payment providers. We do not intentionally collect or store full card numbers, CVV codes, or complete payment credentials unless expressly stated by the payment provider or required by law.

3.4 Device, Technical, and Log Data

When you use the Game or our website, we may collect:

• device type;
• operating system;
• browser type;
• app version;
• language settings;
• time zone;
• IP address;
• approximate location derived from IP address;
• device identifiers;
• advertising identifiers, where permitted and with consent where required;
• crash logs;
• error reports;
• diagnostic data;
• server logs;
• network and connection data;
• security and anti-fraud signals.

3.5 Customer Support Data

If you contact us, we may collect:

• your email address;
• Account ID;
• purchase receipts;
• screenshots;
• device information;
• description of your issue;
• correspondence history;
• any other information you voluntarily provide to support.

Please do not send us unnecessary sensitive personal data in support requests.

3.6 Marketing and Communication Data

Where you consent to marketing communications or where otherwise permitted by applicable law, we may collect:

• email address;
• marketing consent status;
• communication preferences;
• unsubscribe records;
• delivery, opening, and interaction data for emails or messages;
• promotional campaign participation data.

3.7 Cookies and Similar Technologies

Our website and web checkout may use cookies, pixels, local storage, SDKs, and similar technologies to:

• keep you logged in;
• remember settings;
• support checkout;
• secure the service;
• prevent fraud;
• measure website and Game performance;
• understand usage patterns;
• deliver or measure marketing, where permitted.

Where required by applicable law, we will ask for your consent before using non-essential cookies or similar tracking technologies.

4. Personal Data We Do Not Intentionally Collect

We do not intentionally collect:

• passport data;
• national identity numbers;
• full payment card details;
• precise GPS location;
• biometric data used for identification;
• health data;
• data about race, ethnic origin, political opinions, religious beliefs, sexual life, or criminal records.

If you voluntarily provide such information to customer support or through other communications, we may delete it or process it only where necessary and legally permitted.

5. How We Use Personal Data

We process personal data for the following purposes:

5.1 Account and Game Operation

We use personal data to:

• create and maintain your Account;
• authenticate login;
• provide access to the Game;
• save and synchronise progress;
• maintain Coins and Items balances;
• process in-game activity;
• provide updates and technical functionality;
• restore progress where possible;
• provide customer support.

5.2 Purchases and Refunds

We use personal data to:

• process purchases of Coins;
• verify payment status;
• credit Coins to your Account;
• issue receipts or confirmations;
• process refunds where applicable;
• investigate failed payments, duplicate charges, chargebacks, or unauthorised payments;
• comply with tax, accounting, consumer-protection, and legal requirements.

5.3 Security, Anti-Fraud, and Anti-Cheat

We use personal data to:

• protect Accounts;
• detect cheating, bots, scripts, exploits, or unauthorised software;
• prevent payment fraud and chargeback abuse;
• detect suspicious login activity;
• protect the Game, servers, payment systems, and users;
• enforce our Terms of Service.

5.4 Analytics and Improvement

We use personal data to:

• understand how users play the Game;
• identify bugs, crashes, and performance problems;
• improve levels, events, balancing, and user experience;
• test new features;
• measure service reliability;
• generate aggregated or anonymised statistics.

Where possible, we use aggregated or anonymised data that does not identify individual users.

5.5 Communications

We use personal data to:

• send service-related messages;
• respond to support requests;
• notify you about Account, security, purchase, or policy issues;
• provide legal notices;
• send marketing communications only with consent where required by applicable law.

5.6 Legal Compliance

We use personal data to:

• comply with applicable laws;
• respond to lawful requests from courts, regulators, or public authorities;
• maintain accounting, tax, and payment records;
• protect our legal rights;
• resolve disputes;
• investigate violations of our Terms of Service.

6. Legal Bases for Processing

Where Russian personal data law applies, we process personal data only where we have a lawful basis, which may include:

• your consent;
• performance of an agreement with you, including the Terms of Service;
• fulfilment of legal obligations;
• protection of our rights and lawful interests where permitted by applicable law;
• processing required for payment, support, security, anti-fraud, or dispute-resolution purposes;
• other grounds permitted by applicable law.

Where consent is required, we will request it in a clear and separately identifiable manner where applicable. You may withdraw consent as described in this Privacy Policy, but withdrawal of consent does not affect processing that occurred before withdrawal or processing that we are legally permitted or required to continue.

7. Russian Federation Users

If we directly offer the Game to users located in the Russian Federation and collect personal data of Russian citizens, we will process such data in accordance with applicable Russian personal data requirements to the extent they apply.

This may include:

• providing information about our processing of personal data;
• obtaining consent where required;
• keeping records of consent;
• processing personal data only for stated purposes;
• ensuring that personal data is accurate, sufficient, and relevant to the purposes of processing;
• taking measures to update, block, or delete inaccurate or unlawfully processed data;
• applying appropriate organisational and technical security measures;
• notifying Roskomnadzor where required;
• handling personal data incidents according to applicable reporting rules;
• complying with applicable localisation requirements for certain personal data of Russian citizens;
• complying with applicable rules on cross-border transfers of personal data.

Where Russian localisation requirements apply, we will ensure that the recording, systematisation, accumulation, storage, clarification, and extraction of personal data of Russian citizens collected through the Game or website are carried out using databases located in the Russian Federation, unless an exception applies.

8. Cross-Border Transfers

We are incorporated in Hong Kong, and our service providers may be located in the Russian Federation, the United States, the European Economic Area, the United Kingdom, Singapore, or other countries.

As a result, personal data may be transferred outside your country of residence, including outside the Russian Federation.

Where Russian personal data law applies, cross-border transfers will be carried out in accordance with applicable requirements. This may include:

• assessing the transfer;
• ensuring the recipient provides appropriate protection;
• obtaining consent where required;
• notifying the competent authority where required;
• limiting the categories and purposes of data transferred;
• using contractual safeguards with service providers.

9. Sharing of Personal Data

We may share personal data with the following categories of recipients.

9.1 Service Providers

We may share data with providers that help us operate the Game, including:

• hosting providers;
• cloud infrastructure providers;
• database providers;
• analytics providers;
• crash reporting providers;
• customer support tools;
• email delivery providers;
• payment providers;
• anti-fraud and security providers;
• professional advisers, such as lawyers, auditors, and accountants.

These providers may process personal data only for authorised purposes and subject to contractual obligations where required.

9.2 Payment Providers

When you purchase Coins, payment providers process payment-related data under their own terms and privacy policies. We receive payment confirmation and transaction information necessary to credit Coins, provide receipts, process refunds, and prevent fraud.

9.3 Legal and Safety Disclosures

We may disclose personal data where necessary to:

• comply with law;
• respond to lawful requests by courts, regulators, or public authorities;
• enforce our Terms of Service;
• protect our rights, users, systems, or the public;
• investigate fraud, cheating, security incidents, or payment abuse.

9.4 Business Transfers

If we are involved in a merger, acquisition, restructuring, financing, sale of assets, transfer of the Game, or similar transaction, personal data may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

10. Marketing Communications

We will send marketing emails, SMS, push notifications, or similar promotional messages only where we have the consent required by applicable law.

You may withdraw marketing consent at any time by:

• using the unsubscribe link in an email;
• changing notification settings where available;
• contacting us at help@catrio3.com.

After you opt out, we may still send service-related messages about your Account, purchases, security, legal notices, or important Game changes.

11. Children’s Privacy

The Game may be suitable for a general audience depending on its age rating in the relevant app store or territory. Parents and guardians should review the Game, device-level parental controls, and purchase settings before allowing minors to play.

If you are a minor, you may use the Game only with the consent and supervision of a parent or legal guardian where required by applicable law.

We do not knowingly collect personal data from children where parental consent is required and has not been provided. If we learn that we have collected such data without required consent, we will take reasonable steps to delete it or obtain appropriate consent.

Parents or legal guardians may contact us at help@catrio3.com to request access, correction, deletion, or restriction of a minor’s personal data, subject to verification and applicable law.

12. Cookies, SDKs, and Analytics

We may use cookies, SDKs, and similar technologies in the Game and on our website.

Some technologies are necessary for login, checkout, security, fraud prevention, cloud save, or core service functionality. Others may be used for analytics, performance measurement, or marketing, where permitted by applicable law and with consent where required.

You may be able to control cookies or identifiers through your browser, device settings, operating system settings, or consent tools provided by us. Disabling certain technologies may affect Game functionality, login, checkout, or cloud save.

13. Automated Processing

We may use automated systems to:

• detect cheating;
• detect payment fraud;
• prevent account abuse;
• identify suspicious login activity;
• analyse crashes and technical issues;
• personalise gameplay difficulty, offers, events, or user experience where permitted.

We do not use automated processing to make decisions that produce legal effects concerning you or similarly significant effects, unless permitted by applicable law or based on your consent where required.

14. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Typical retention periods include:

• Account data: for as long as your Account exists;
• gameplay and cloud save data: for as long as needed to provide the Game and restore progress;
• purchase and payment records: for the period required for accounting, tax, refund, dispute, and fraud-prevention purposes;
• support communications: for as long as needed to resolve the issue and maintain support records;
• security and anti-fraud logs: for as long as needed to protect the Game and investigate abuse;
• marketing consent records: for as long as needed to prove consent or withdrawal of consent;
• legal records: for as long as necessary to comply with law or resolve disputes.

When personal data is no longer needed, we will delete, anonymise, or securely archive it in accordance with applicable law.

15. Security

We use organisational and technical measures designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

• access controls;
• password hashing;
• encryption in transit where appropriate;
• monitoring and logging;
• anti-fraud systems;
• internal access restrictions;
• security reviews;
• backup and recovery procedures;
• vendor security controls.

No online service can be completely secure. You are responsible for keeping your password confidential and for protecting the devices and email account used to access the Game.

16. Personal Data Incidents

If we become aware of a personal data incident, we will investigate it and take appropriate steps to reduce harm.

Where required by applicable law, we will notify the competent authority, affected users, or other relevant parties within the required time limits and in the required form.

17. Your Rights

Subject to applicable law, you may have the right to:

• receive information about how we process your personal data;
• access your personal data;
• request correction of inaccurate or incomplete data;
• request blocking, restriction, or suspension of unlawful processing;
• request deletion of personal data where it is no longer needed or is processed unlawfully;
• withdraw consent;
• object to marketing communications;
• request information about cross-border transfers or processors where required;
• complain to a competent data protection authority.

For users in the Russian Federation, the competent authority for personal data matters is generally Roskomnadzor.

To exercise your rights, contact us at help@catrio3.com. We may need to verify your identity before responding. We will respond within the time required by applicable law.

18. Withdrawal of Consent

Where processing is based on consent, you may withdraw consent by contacting us at help@catrio3.com or by using any available consent management tools.

After withdrawal, we will stop processing personal data based on that consent unless we have another lawful basis to continue processing, such as legal obligations, dispute resolution, fraud prevention, security, accounting, or performance of the Terms of Service.

Withdrawal of consent may affect your ability to use certain Game features. For example, if you withdraw consent necessary for Account operation, cloud save, or support, some features may no longer work.

19. Account Deletion

You may request deletion of your Account by contacting us at help@catrio3.com.

After receiving a deletion request, we may delete or anonymise your Account data, gameplay data, and related personal data, subject to applicable law.

We may retain certain information where necessary for:

• legal compliance;
• accounting or tax records;
• payment disputes;
• refund processing;
• fraud prevention;
• security investigations;
• enforcement of our Terms of Service;
• defence of legal claims.

Account deletion may permanently remove progress, Coins, Items, cloud save data, and other Game records, except where retention is required or permitted by law.

20. Third-Party Links and Platforms

The Game or website may include links to third-party websites, app stores, payment providers, or other services.

We are not responsible for the privacy practices of third parties. You should review their privacy policies before providing personal data to them.

21. Language

This Privacy Policy may be provided in multiple languages. For users located in the Russian Federation, we may provide a Russian-language version where required or appropriate.

If there is a conflict between language versions, the version designated by us as controlling will apply, except where mandatory consumer or personal data law requires otherwise.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we will notify you by reasonable means, such as within the Game, on our website, by email, or through another appropriate notice.

The updated Privacy Policy will take effect on the date stated in the updated version. Your continued use of the Game after the effective date means that you acknowledge the updated Privacy Policy, except where applicable law requires separate consent.

23. Contact Us

For privacy questions, personal data requests, complaints, or consent withdrawal, contact us at:

Operator: Islet Tech Co., Limited
Registered address: Room 12, 15/F, Core45, 43-45 Tsun Yip Street, Kwun Tong, Hong Kong 999077
Email: help@catrio3.com
Telephone: +852 8024 1569

Please include enough information for us to identify your Account and process your request, such as your Account email, Account ID, purchase reference, and a clear description of your request.