Skip to main content
LEGAL · v4.2 · EFFECTIVE 2025-01-15

Privacy Policy.

Comprehensive privacy disclosure for gzpojie.com and the suite of native mobile and desktop applications published on the Apple App Store, Google Play, Mac App Store and the macOS / iOS direct-distribution channels.

VERSION
4.2 · 2025-01-15
JURISDICTIONS
42 covered
AUDIT
Cure53 · 2024-11-04
DPD CONTACT
contact@gzpojie.com

1. Overview & Scope

This Privacy Policy ("Policy") describes how gzpojie.com ("we", "us", "our"), Guangzhong Software Park, Vietnam, processes personal data when you (a) visit our website, (b) download, install, register for, or use any of our native applications published on the Apple App Store, Google Play, Mac App Store, the iOS direct-distribution channel, the macOS notarised distribution channel, or any other storefront through which we publish, or (c) contact our team.

This Policy covers every jurisdiction in which our titles are published: the European Economic Area ("EEA"), the United Kingdom ("UK"), the United States (federal & California, Colorado, Virginia, Connecticut, Utah, Oregon, Texas, Florida, Montana, Iowa, Indiana, Tennessee), Brazil, Mexico, Argentina, Chile, Colombia, Peru, Canada, Australia, New Zealand, Japan, South Korea, mainland China, Hong Kong SAR, Macau SAR, Taiwan, Singapore, Malaysia, Thailand, Vietnam, the Philippines, Indonesia, India, the United Arab Emirates, Saudi Arabia, Israel, South Africa, Switzerland, and the Russian Federation.

Headline statement. Across every gzpojie.com application, all user-created data is processed and stored locally on the user's device by default. The studio does not operate a per-user cloud data store.

2. Definitions

  • "Personal Data" means any information relating to an identified or identifiable natural person.
  • "Processing" means any operation performed on Personal Data, automated or manual.
  • "Service" means the gzpojie.com website, our apps and any related APIs.
  • "SDK" means a third-party software development kit integrated into our Service.
  • "End-User Device" means the smartphone, tablet or computer on which our app is installed.
  • "ADID/IDFA/GAID" means Apple Identifier for Advertisers, Google Advertising ID, or equivalent.

3. Data Controller Information

The Data Controller for processing within the meaning of GDPR Art. 4(7) and equivalent local laws is:

gzpojie.com
Guangzhong Software Park, Vietnam
General enquiries: support@gzpojie.com
Project briefs & privacy-related correspondence: contact@gzpojie.com

4. Personal Data We Collect

We collect the minimal categories of personal data necessary to deliver each feature.

  • Account Data — none collected by default. Where an account is offered, we collect a random opaque identifier and an email address used only for recovery.
  • User-Generated Content — content you create inside an app. Stored locally on your device, encrypted at rest using the platform's hardware-backed key-store.
  • Device & Diagnostics — anonymised crash reports (stack trace, model, OS version). Never linked to your account.
  • Purchase Data — receipts and subscription status delivered by Apple/Google; we never see your card details.
  • Localisation — your device locale setting.
  • Support Correspondence — whatever you volunteer when contacting us.
Special note. No sensitive identifiers (passport, SSN, NI, tax file number) are required by our apps. If you choose to vault such documents, the data is encrypted with a key that never leaves your hardware.

Where the GDPR, UK-GDPR or equivalent local law applies, we rely on: performance of contract, legitimate interests, consent, and legal obligation.

6. Ad-SDK Disclosure (AdMob, Meta, Unity, AppLovin, IronSource, Vungle, Chartboost, Pangle, InMobi, and Related Demand Sources)

Some of our free-tier applications display advertising through monetisation SDKs. We integrate only the SDKs that are explicitly opt-in, and we expose granular user controls in-app. For paid or subscription tiers, ads are removed.

6.1 Ad Formats We Display

  • Open / Splash Ads (App-Open) — full-screen ads that surface when the app is foregrounded or launched.
  • Interstitial Ads — full-screen ads shown at natural transition points.
  • Rewarded Video Ads — opt-in video ads where the user chooses to watch in exchange for an in-app reward.
  • Banner Ads — small inline ads embedded in clearly-marked "Sponsored" slots.
  • Native / In-Feed Ads — ads styled to match the surrounding content.
  • MREC / Medium Rectangle Ads — IAB Medium-Rectangle units for adaptive layouts.

6.2 Ad Networks Integrated

We may integrate the following demand sources. Each provider is listed with a link to its privacy policy. We configure each provider to honour "limit ad tracking" / "non-personalised ads" by default and to surface GPP / TCF v2.2 signals where supported.

6.3 Data Collected by Ad SDKs

Depending on the SDK and on the consent you grant, the following categories of data may be processed. None of this data is associated with the contents of your local vault.

  • Device identifiers: IDFA (iOS), GAID/AAID (Android), App Set ID, OAID (Huawei / Honor), privacy-preserving pseudo-IDs.
  • Device attributes: model, OS version, screen size, language, region, timezone, carrier, IP address (truncated).
  • Ad-attribution events: install, re-engagement, in-app conversion events (only when measurement is enabled).
  • Contextual signals: current screen / activity inside the app, capped session length, ad-impression timestamps.
  • For ad-choice compliance: IAB TCF v2.2 strings, IAB GPP strings, Limit-Ad-Track signals.
  • For frequency capping and basic fraud prevention: a rolling hashed device fingerprint — never biometric data.

6.4 In-App Ad Controls

Every app that integrates ads exposes a privacy & ads settings page allowing you to switch ad personalisation, reset / refresh the device-advertising identifier, withdraw consent for measurement, trigger an immediate purge of advertising IDs, and subscribe to a kid-mode profile.

6.5 Real-Time Bidding (RTB) & Supply-Chain Transparency

We use authorised resellers listed in our /app-ads.txt. The file is a static text file hosted at the website root and follows the IAB Tech Lab v1.1 specification.

6.6 Ads for Children

For users flagged as under-13 / under-16 (per §15) we disable all behavioural advertising; only contextual advertising is permitted.

7. Apple App Store & Privacy Manifest

Every released binary includes an Apple Privacy Manifest (PrivacyInfo.xcprivacy) declaring: whether the app uses data with the Tracking purpose; required Reason API codes (CA*1.1, NSPrivacyAccessedAPITypes); user-defaults & file timestamps accessed; whether the app participates in "tracking" (it does not, with the single exception of ad attribution gated by ATT); whether the app collects data for the purpose of Third-Party Advertising (yes, only via the SDKs in §6).

8. Google Play Data Safety Form

For every Play Store release we complete the Data safety form, declaring data shared with third parties, data collected by us, whether data is required or optional, and whether the user can request deletion.

9. Apple ATT & Tracking Disclosure

For users located in jurisdictions where Apple enforces the App Tracking Transparency framework (iOS 14.5+), we surface the standard ATT prompt. For Android the equivalent is Google Play Services "Opt out of Ads Personalisation".

10. Cookies, SDKs & Local Storage (gzpojie.com website)

The gzpojie.com marketing website uses a minimal set of storage techniques: strictly necessary cookies (session-id, CSRF token), functional storage (theme preference, animation-state), analytics storage (opt-in, Plausible / self-hosted equivalent — we do not use Google Analytics), marketing storage (opt-in paid-campaign pixels).

11. Use of Data

We process Personal Data only to deliver the requested app and its features; to maintain and improve the safety, security and stability of our services; to provide support and respond to enquiries; to detect and prevent fraud, abuse and security incidents; to comply with applicable legal obligations; and for advertising only as described in §6.

12. Data Sharing & Third Parties

We do not sell Personal Data. We share with: the advertising networks listed in §6 (with consent), the store operators (Apple, Google) for purchase-validation and refund support, sub-processors that operate under strict GDPR-compliant DPAs, and competent authorities when compelled by applicable law.

13. International Transfers (SCC, IDTA, EU-US DPF)

Where we transfer Personal Data outside the EEA/UK to a country not covered by an adequacy decision, we rely on Standard Contractual Clauses (Module 1, 2 or 3) and the UK International Data Transfer Addendum. A copy of the executed safeguards and a Transfer Impact Assessment can be requested at contact@gzpojie.com.

14. Retention & Deletion

Local app content is retained on-device until you delete it. Support correspondence up to 36 months. Crash logs 18 months (aggregated afterwards). Purchase receipts 10 years for tax & audit purposes. Server backups 30 days rolling.

15. Security & Encryption

TLS 1.3 + HSTS. Apple Secure Enclave / Android StrongBox. AES-256-GCM at rest, key-wrapped per-device with a per-app salt. Certificate pinning. Annual Cure53 penetration test. Bug bounty: contact@gzpojie.com with the subject "[SECURITY]".

16. Children's Privacy (COPPA · GDPR-K · UK Age-Appropriate Design Code · India Rule 12 · Brazil LGPD-Crianca)

Our apps are not directed to children under 13. Where the local age of digital consent is higher (e.g. 14 in Spain & South Korea; 16 in several EU Member States for most online services), we apply the higher threshold. For users in Brazil we apply the LGPD protection of children's data (Art. 14). We do not knowingly: collect Personal Data from a child without verifiable parental consent, allow a child to make a purchase without verifiable parental consent where the store rules require, serve behavioural advertising to a child, or conduct automated profiling of children. Where we operate a "kid" mode, all tracking & measurement SDKs are removed from the build at compile-time via build flags.

17. Age Gating & Verification

Age determination is performed at the store level (Apple/Google gate accounts by declared age) and reinforced in-app where relevant. For build configurations that target children, our apps will refuse to load on devices whose Age Rating setting indicates an under-age user.

18. User Rights (GDPR Art. 15–22 · CCPA §1798.100–§1798.150 · LGPD Art. 18 · PIPL Art. 44 · PDPA-SG §11–13)

You may exercise any of the following rights at any time: Access, Rectification, Erasure / Right to be Forgotten, Restriction, Portability, Objection, Withdraw consent, Opt-out of sale or sharing (CCPA), and Non-discrimination (CCPA §1798.125). Requests can be submitted via the in-app "Privacy → Data Rights" menu, or by email to contact@gzpojie.com with the subject "[DATA RIGHTS]". We respond within 30 days (CCPA: 45 days, LGPD: 15 days, PIPL: 30 days).

19. California Notice & "Do Not Sell or Share My Personal Information"

Under the CCPA / CPRA, California residents have additional rights: right to know, right to delete, right to correct, right to opt out of sale or sharing, and right to limit use of sensitive Personal Information. gzpojie does not sell Personal Data. Where advertising networks operate as "third parties" under CPRA, you may opt-out via the in-app toggle. We honour the Global Privacy Control (GPC) signal as a universal opt-out.

20. EU / UK Representative & Data Protection Officer

For the purposes of GDPR Art. 27 and UK-GDPR Art. 27, our appointed EU representative is Verasity Data Protection OÜ (Tartu mnt 84a, 10112 Tallinn, Estonia, eu-rep@gzpojie.com). UK representative: Verasity Data Protection Ltd. (7 Bell Yard, London WC2A 2JR, uk-rep@gzpojie.com). DPO: dpo@gzpojie.com.

21. Brazil, Mexico & APAC Addenda

Brazil (LGPD): Local DPO ("Encarregado") at encarregado@gzpojie.com. Mexico (LFPDPPP): ARCO rights. Japan (APPI): Art. 28 disclosure, Japan-EU adequacy. South Korea (PIPA): DPO contact kr-officer@gzpojie.com. Singapore (PDPA): DPO contact sg-dpo@gzpojie.com. Thailand (PDPA) / Indonesia (PDP Law) / Malaysia (PDPA): Local DPO contacts available on request. India (DPDP Act 2023): Local contact in-grievance@gzpojie.com. China (PIPL & DSL): CAC cross-border-transfer filings; local representative cn-rep@gzpojie.com.

22. Health, Biometrics & Special Categories

Our apps do not request special categories of data (health, biometric identifiers, genetic, racial, political, religious, sexual orientation, trade union membership).

23. Automated Decision-Making & Profiling

We do not subject end users to automated decision-making with legal or similarly significant effects (Art. 22 GDPR). Ad personalisation is an opt-in, granular, fully revocable preference.

24. Accessibility & Reasonable Accommodation

VoiceOver / Dynamic Type / Reduce Motion on iOS. TalkBack / Font Scale on Android. Full keyboard navigation and screen-reader support on macOS. WCAG 2.2 AA contrast targets.

25. Changes to this Policy

We update this Policy whenever our services or regulatory obligations change.

26. Contact & Complaints

For privacy-related enquiries, contact our Data Protection Officer at contact@gzpojie.com. EU/UK representation: see §20.