Zucca Games Inc., a corporation incorporated in the State of Delaware with its registered office at 262 Chapman Rd Ste 240, Newark, Delaware 19702 ("JoyFlick", "we", "us", or "our"), operates the JoyFlick mobile applications, websites, and related services (collectively, the "Platform"). This Privacy and Cookie Policy explains how we collect, use, disclose, and protect your personal information when you use the Platform, and how we use cookies and similar technologies.

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is incorporated into and governed by our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

U.S.-focused policy. The Platform is intended for users in the United States. Where required by applicable U.S. state privacy law, we provide additional disclosures and choices, as set forth in Section 8. The Platform is not directed to individuals outside the United States, and we do not knowingly collect personal data from individuals outside the United States.

1. Information We Collect

1.1 Information you provide directly

We collect information that you provide when you create an account, participate in contests, make deposits or withdrawals, or contact us:

• Account information. Email address, username, display name, and avatar selection. You may sign in with a one-time passcode sent to your email address, or through Sign in with Google or Sign in with Apple. If you sign in through Google or Apple, we receive the information you authorize that provider to share (typically name and email address).
• Identity verification information (KYC). When you complete identity verification through our third-party identity-verification provider, Sumsub, we receive a photograph of your government-issued identification document, a selfie photograph, and information extracted from your identification document (including full legal name, date of birth, address, and document number). Biometric identifiers (such as the facial-match comparison vector) are processed and retained by Sumsub pursuant to Sumsub's policies; we retain only the verification results and related records as necessary for compliance, fraud prevention, and dispute resolution. See Section 1.4 for additional biometric-information notice.
• Financial information. When you make deposits or withdrawals, our third-party payment processors (Stripe, Inc. and PayPal Holdings, Inc.) collect your payment credentials (credit- or debit-card number, bank-account information, or PayPal-account information). JoyFlick does not directly collect, store, or have access to your full card numbers or bank-account numbers. We receive and store transaction records including amounts, dates, payment-method type, and transaction status.
• Tax information. Where your net contest winnings in a calendar year reach or exceed the applicable IRS reporting threshold, we collect your Social Security Number ("SSN") or Individual Taxpayer Identification Number ("ITIN") for tax-reporting purposes, and we may collect backup-withholding information under 26 U.S.C. § 3406.
• Communications. When you contact us for support or other inquiries, we collect the content of your messages, your email address, and any attachments you provide.

1.2 Information collected automatically

• Device information. Device model, operating system and version, application version, screen resolution, device language and locale, time zone, and unique device identifiers.
• Location information. With your permission, we collect precise GPS coordinates from your device to verify that you are in an Eligible Jurisdiction before you enter a cash-entry contest. We also collect the state or jurisdiction determined from your GPS coordinates. Location data is collected at the time of each contest entry and is not continuously tracked in the background.
• Gameplay data. For each contest you enter, we collect your submissions (taps, hops, steers, placements, key changes, and other contest-specific inputs), scores, input timing, game-session duration, and contest results. We may also record input-replay data (touch positions, input traces, placements, and timestamps) for anti-cheat purposes.
• Usage data. Screens viewed, features used, actions taken, time spent on the Platform, and crash or error logs.
• Network information. IP address, VPN or proxy detection signals, and connection type.

1.3 Information from third parties

• Authentication providers (Google, Apple). If you sign in with Google or Apple, we receive the profile information you authorize that provider to share. Email one-time-passcode sign-in, account authentication, and session management are operated by JoyFlick.
• Identity verification provider (Sumsub). Verification results including approval or rejection status, document-authenticity assessment, facial-match confidence score, liveness-check result, and anti-money-laundering screening results.
• Payment processors (Stripe, PayPal). Transaction status updates, dispute notifications, and fraud-risk assessments.

1.4 Biometric information notice

In connection with the Sumsub identity-verification workflow, biometric identifiers (specifically, a facial-image template and liveness-detection data) may be processed by Sumsub to compare the live selfie to the government-issued identification document. Certain U.S. states impose separate consent and notice requirements for the collection, use, retention, and destruction of biometric identifiers, including the Illinois Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1 et seq. ("BIPA"); the Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001; and the Washington biometric-identifier statute, Wash. Rev. Code § 19.375.020. The Platform collects affirmative written consent prior to processing biometric identifiers from users in these jurisdictions through the in-app verification consent flow, and biometric data is retained only for the duration permitted under applicable state law and in no event longer than three (3) years after your last interaction with the Platform. Biometric data is not sold, leased, traded, or otherwise profited from.

1.5 Digital-asset wallet information

Where you withdraw funds in a supported digital asset, we collect your public wallet address, on-chain transaction identifiers associated with your withdrawals, and screening results used for anti-money-laundering and sanctions compliance. Public blockchains are outside our control, and records on a public blockchain are permanent and publicly visible by design.

2. How We Use Your Information

• Platform operation. To create and manage your account, process contest entries, calculate scores, distribute prizes, manage Diamonds and Bonus Cash, process deposits and withdrawals, and provide customer support.
• Legal compliance. To verify your age, verify your identity, verify your geographic location, comply with anti-money-laundering and OFAC sanctions-screening requirements, comply with federal tax-reporting and backup-withholding obligations, and respond to legal process.
• Fair play and integrity. To detect and prevent cheating, bot usage, multi-accounting, collusion, external-solver use, and other prohibited conduct; and to monitor gameplay data for anomalies and conduct human review of flagged sessions.
• Safety and security. To detect and prevent fraud, unauthorized access, and other illegal activity; and to protect the security and integrity of the Platform.
• Communication. To send you transactional communications (contest results, deposit confirmations, withdrawal status, account alerts), respond to your support inquiries, and send service announcements.
• Improvement. To analyze usage patterns, diagnose technical issues, and improve the Platform's features and performance.
• Marketing. To send you marketing communications, provided that you have not opted out. We do not use your personal data in a way that would result in automated decision-making producing legal effects concerning you.
• Responsible gaming. To enforce responsible-gaming controls and to direct you to support resources where appropriate.

3. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances.

3.1 Third-party service providers

We share information with third-party service providers who process data on our behalf to operate the Platform. These providers are contractually required to use your information only for the purposes of providing services to us and to maintain appropriate security measures. Our principal service providers are:

• Stripe — card and bank deposits, payouts, and custody of player funds. Shared: tokenized card data (Stripe collects card numbers directly via its client-side SDK; JoyFlick never receives full card numbers), transaction amounts, payout details.
• PayPal — deposits and withdrawals. Shared: email address (PayPal account), transaction amounts.
• Sumsub — identity verification (KYC) and AML screening. Shared: government-ID photograph, selfie photograph, name, date of birth, address; biometric facial-match data (processed and retained by Sumsub).
• Cloudflare — content delivery, DNS, DDoS protection, edge geofencing. Shared: IP address, request headers, geographic signals.
• Sentry — error and crash reporting. Shared: device information, error traces, account identifier.
• Google Analytics, Firebase and Hotjar — product analytics and usage measurement. Shared: usage data, device information, interaction events.

We also interact with public blockchain infrastructure. Transaction data and wallet addresses associated with digital-asset withdrawals are broadcast and recorded on public ledgers.

3.2 Legal obligations

We may disclose your information when required to do so by law, regulation, legal process, or governmental request. This includes responding to subpoenas, court orders, or other legal process, and cooperating with law-enforcement or regulatory authorities, including in connection with OFAC sanctions screening and other lawful information requests.

3.3 Tax reporting

We report contest winnings to the Internal Revenue Service as required by law. Where your net winnings in a calendar year reach or exceed the applicable reporting threshold, we will file the applicable IRS information return, which includes your name, address, SSN or ITIN, and the amount of winnings. Our payment processor may separately issue Form 1099-K for payments meeting the threshold of 26 U.S.C. § 6050W.

3.4 Protection of rights

We may disclose your information when we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request.

3.5 Business transfers

If JoyFlick is involved in a merger, acquisition, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you of any such change by posting notice on the Platform or by email.

3.6 Aggregated and de-identified data

We may share aggregated or de-identified information that cannot reasonably be used to identify you (for example, aggregate statistics about contest participation, average scores, or Platform usage trends).

3.7 Sharing with other players

When you participate in contests, certain information about you — your username, in-app profile (display name and avatar), in-app actions and achievements, and contest results — may be visible to other Players and may become publicly available within the Platform.

4. Data Retention

We retain your personal information for as long as your account is active and for the periods described below after account closure or data collection. After the applicable retention period, data is archived to cold storage and subsequently deleted in accordance with our internal data-lifecycle procedures. We do not delete compliance records before the applicable retention period expires.

• Account information (name, email) — duration of account + 7 years, for tax and regulatory compliance.
• Transaction records — 7 years from the transaction date, for financial-record requirements.
• Geofence-verification records — 7 years, as regulatory audit evidence for state compliance.
• Age-verification records — 7 years, as proof of age-gate enforcement.
• KYC documents and verification results — 7 years after account closure, for AML/KYC regulatory retention.
• Biometric data processed by Sumsub — not longer than 3 years after last interaction, or as required by BIPA / Tex. Bus. & Com. Code § 503.001 / Wash. Rev. Code § 19.375.020, for biometric-statute compliance.
• Gameplay data and contest results — 7 years, for dispute resolution, anti-cheat review, and regulatory compliance.
• Admin audit logs — 7 years, for internal accountability and regulatory compliance.
• Platform event logs (user actions) — 7 years, for compliance audit, behavioral analytics, and dispute resolution.
• Device information — duration of account + 7 years, for anti-cheat context and fraud investigation.
• Tax records (SSN, information returns) — 7 years from the applicable tax year, for IRS requirements.
• Support communications — 3 years from resolution, for customer-service quality.

Blockchain limitations

If you request deletion of your Platform account, we will comply subject to the legal retention requirements described above. However:

• Wallet persistence. Deleting your Platform account does not necessarily delete your non-custodial wallet.
• Immutability. Because digital-asset transfers are final and confirmed on-chain, JoyFlick cannot delete or alter transaction histories, network fees, or wallet addresses once they are published on a public blockchain network.
• Investigations. We may retain data necessary for pending fraud or terms-violation investigations, as well as for accounting or tax purposes.

5. Data Security

We implement technical, administrative, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction:

• Encryption. All data is encrypted in transit using TLS (Transport Layer Security). Data at rest is encrypted using industry-standard encryption at the database and infrastructure level.
• Access controls. Access to personal information is restricted to authorized personnel on a need-to-know basis. Our administrative tooling enforces role-based access controls, with administrative actions recorded in an audit trail.
• Payment security. We are PCI-compliant through our payment-processor integrations. Card data is tokenized by Stripe's client-side SDK before it reaches our servers. Full card numbers never touch JoyFlick systems.
• Authentication security. Player authentication and session management are operated by JoyFlick. Email sign-in uses a single-use, time-limited one-time passcode rather than a stored password; Google and Apple sign-in rely on those providers' federated authentication. Multi-factor authentication is enforced for administrative access.
• Monitoring. We employ automated fraud detection, transaction monitoring, and security alerting through our payment processors and infrastructure providers.

While we take commercially reasonable steps to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

6. Your Rights and Choices

1. Account information. You may update your account information (display name, email address, avatar) at any time through the Platform's settings.
2. Location permissions. You may revoke location permissions through your device settings at any time. Because all contests on the Platform, including no-cost Diamond-entry contests, require location verification, revoking location permissions will prevent you from entering any contest. You may continue to sign in and use non-contest areas of the Platform, such as your account settings and Daily Roll.
3. Push notifications. You may opt out of push notifications through your device settings or within the Platform's notification preferences.
4. Marketing communications. You may opt out of marketing emails at any time using the unsubscribe link in any marketing message, or by contacting us. Transactional messages relating to your account are not marketing messages and cannot be opted out of while your account is open.
5. Account deletion. You may request deletion of your account by contacting [email protected] or through the in-app account-deletion process. Upon receiving a verified account-deletion request, we will close your account and prevent further access; return any remaining cash balance to you, subject to identity verification and applicable withdrawal-processing times; forfeit any remaining Bonus Cash and Diamonds balance; and delete or de-identify your personal information, except for data we are required to retain for legal, regulatory, tax, or compliance purposes (as described in Section 4). Account-deletion requests are processed within thirty (30) days.
6. Data access and portability. You may request a copy of the personal information we hold about you by contacting [email protected]. We will provide your data in a commonly used, machine-readable format within forty-five (45) days, subject to applicable identity-verification requirements.

7. U.S. State Privacy Rights

Depending on your state of residence, you may have additional rights under applicable U.S. state privacy laws, including the right to know, the right to delete, the right to correct, the right to opt out of certain processing activities (such as targeted advertising, sale, or profiling), and the right to data portability. The state privacy laws under which these rights may be conferred include the California Consumer Privacy Act / California Privacy Rights Act, Cal. Civ. Code §§ 1798.100 et seq.; Virginia Consumer Data Protection Act, Va. Code §§ 59.1-575 et seq.; Colorado Privacy Act, Colo. Rev. Stat. §§ 6-1-1301 et seq.; Connecticut Data Privacy Act, Conn. Gen. Stat. §§ 42-515 et seq.; Utah Consumer Privacy Act, Utah Code §§ 13-61-101 et seq.; Texas Data Privacy and Security Act, Tex. Bus. & Com. Code §§ 541.001 et seq.; Oregon Consumer Privacy Act, Or. Rev. Stat. §§ 646A.570 et seq.; Montana Consumer Data Privacy Act, Mont. Code Ann. §§ 30-14-2801 et seq.; Iowa Consumer Data Protection Act, Iowa Code §§ 715D.1 et seq.; Tennessee Information Protection Act, Tenn. Code Ann. §§ 47-18-3201 et seq.; Indiana Consumer Data Protection Act, Ind. Code §§ 24-15-1-1 et seq.; Florida Digital Bill of Rights, Fla. Stat. §§ 501.701 et seq.; New Jersey Data Privacy Act, N.J. Stat. §§ 56:8-166.4 et seq.; New Hampshire Data Privacy Act, N.H. Rev. Stat. §§ 507-H:1 et seq.; Delaware Personal Data Privacy Act, Del. Code tit. 6, §§ 12D-101 et seq.; Maryland Online Data Privacy Act, Md. Code Ann., Com. Law §§ 14-4601 et seq.; Minnesota Consumer Data Privacy Act, Minn. Stat. §§ 325O.05 et seq.; Rhode Island Data Transparency and Privacy Protection Act, R.I. Gen. Laws §§ 6-48.1-1 et seq.; and Kentucky Consumer Data Protection Act, Ky. Rev. Stat. §§ 367.3611 et seq.

7.1 California privacy rights (CCPA/CPRA)

If you are a California resident, you have the rights described in the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"): the right to know what personal information we collect about you, the right to delete personal information, the right to correct inaccurate information, the right to opt out of sale or sharing for cross-context behavioral advertising, the right to limit use of sensitive personal information (as defined in CCPA), and the right to non-discrimination.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.

Categories of personal information collected. Under CCPA categories, we collect: identifiers (name, email, SSN/ITIN where applicable); personal information under Cal. Civ. Code § 1798.80 (name, address, financial information); protected-classification characteristics (age, date of birth); commercial information (transaction records, contest history); internet or electronic-network activity (usage data, device information); geolocation data (GPS coordinates); sensory data (selfie and ID photographs for identity verification); sensitive personal information under CCPA § 1798.140(ae) (SSN/ITIN, government-ID information, biometric data via Sumsub, precise geolocation); and inferences drawn from the above (fraud-risk scores, skill ratings).

How to exercise your rights. To exercise any state privacy right, contact us at [email protected] or submit a request through the Platform's settings. We will verify your identity before processing your request (typically through your account email confirmation and additional verifying questions). You may designate an authorized agent to submit a request on your behalf with written authorization. We will respond within forty-five (45) days, subject to extensions permitted by applicable law.

Right to appeal. If we deny your request, you may appeal by submitting a request to [email protected] with the subject line "Privacy Appeal." We will respond to appeals within sixty (60) days. If your appeal is denied, you may contact your state attorney general to submit a complaint.

8. Children's Privacy

The Platform is not intended for children under the age of eighteen (18). We do not knowingly collect personal information from children under thirteen (13), and we do not permit users under the age of eighteen (18) on the Platform. If we become aware that we have collected personal information from a child under thirteen (13), we will promptly delete that information, consistent with the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506 ("COPPA").

If you are a parent or guardian and believe your child under thirteen (13) has provided us with personal information, please contact us at [email protected].

9. International Users

The Platform is currently available only in the United States. If you access the Platform from outside the United States, you understand and consent to the transfer, processing, and storage of your information in the United States, where data-protection laws may differ from those of your country.

10. Third-Party Links and Services

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access.

11. Use of Cookies and Similar Technologies

In order to improve operation of our Platform, we use cookies, web beacons, device fingerprinting, and similar technologies.

Cookies are text files containing small amounts of information that are downloaded to your computer, mobile, or other device when you visit a website. They are sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie. Cookies help websites recognize a user device, remember preferences, improve navigation, and provide better user experience.

Types of cookies used

1. Persistent cookies: These remain on a user device for the period specified in the cookie and are activated each time the user visits the website that created that cookie.
2. Session cookies: These allow website operators to link user actions during a browser session. A session starts when a browser window opens and ends when it closes. Session cookies are temporary and are deleted when the browser closes.
3. Strictly necessary cookies: These enable services you specifically requested. For these cookies, consent is not required. They are essential for core website functionality.
4. Performance cookies: These collect anonymous information about page usage and website errors. They do not identify individual users and are used to improve website performance.
5. Functionality cookies: These remember your preferences (such as language or region) to provide more personalized functionality.
6. Targeting or advertising cookies: These collect information about browsing habits to provide relevant advertising and measure ad effectiveness. They are often placed by advertising networks with our permission.

Other technologies and tools

• Web beacons (pixel tags): Transparent image files used to monitor your journey and interactions with the website.
• Device fingerprinting: Technology used to collect device attributes (browser, operating system, plugins, time zone, and other settings) for security and identification purposes.
• Google Analytics and Firebase: Tools we use to calculate visits, understand feature usage, and improve website operation. Learn more: Google Analytics privacy overview. You can opt out via the Google Analytics browser add-on.
• Hotjar: Tool used to analyze how users interact with our website. Learn more in the Hotjar Privacy Policy.

Cookies and similar technologies may be used for statistical purposes, personalization, and adapting website structure and content to user preferences. Some cookies may be linked to external services (including advertising platforms).

Handling and use of cookies is generally enabled automatically, but you can change these settings at any time in your browser settings. More information is available at All About Cookies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and, where practicable, by sending notice to the email address associated with your account. The effective date at the top of this policy indicates when it was most recently revised. Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Privacy inquiries and appeals: [email protected]
• General support: [email protected]
• Website: https://joyflick.com

Zucca Games Inc. · 262 Chapman Rd Ste 240, Newark, Delaware 19702