Ranked #11 of 38 in Game Puzzle
Red Flags
1Warnings
5"The aforementioned advertising IDs (IDFA and GAID) are unique identifiers for mobile devices that advertisers use for personalized advertising and consistent across all mobile applications and thus allow cross-app tracking."
The company explicitly acknowledges using advertising IDs (IDFA/GAID) that enable tracking users across all mobile applications, building a cross-app behavioral profile.
"Your personal data may be transferred to our advertisement partners who enable our Services to be provided free or for low cost. [Partners include] AppLovin, Facebook, Fyber, Google, InMobi, ironSource, Mintegral, MoPub, Ogury, Smaato, Tapjoy, Unity, Vungle [plus analytics partners Adjust, Firebase, SafeDK]."
User data is shared with over 15 third-party advertising networks and analytics providers, each with their own data collection and tracking practices.
"We collect your advertising ID (IDFA for IOS devices and GAID for Android devices), other device identifiers (IDFV for IOS devices), device identifier, operating system, model, producer information, hardware type, operating system version, memory usage, country, time zone and preferred language information, internet protocol (IP) number, location information according to your IP address, operator and browser information."
The app collects extensive device information including hardware details, memory usage, operator info, and browser information that goes well beyond what a mobile game needs to function.
"We collect... internet protocol (IP) number, location information according to your IP address, operator and browser information."
The company derives and collects user location data from IP addresses, which is shared along with other data to its extensive network of advertising and analytics partners.
"GJG stores your data for as long as it is necessary to provide our Services and deletes it when the purposes of the data processing cease to exist. Personal data is deleted in case the reasons which necessitate processing within the context of the stated purposes in this privacy notice cease to exist and after two (2) years as of the registration date of the relevant record at the latest."
Data is retained for up to two years from recording regardless of whether the user still plays the game, and the 'necessary to provide Services' language could extend retention indefinitely for active users.