PRIVACY
Service Providers, Third-Party Disclosures and International Transfers
On this page
1. About this Schedule
The entries apply only to integrations used in the relevant launched Service. Recipient, data and country details depend on the applicable feature and user choices.
Users in Korea should review the Korean public schedule. Users in the EEA or UK, the United States or Japan should also review the EEA and UK Privacy Supplement, U.S. State Privacy Notice or Japan Privacy Supplement, as applicable.
This Service Providers, Third-Party Disclosures and International Transfers schedule (the “Schedule”) supplements the Global Privacy Policy and the applicable regional notice.
2. Service Providers and Processors
The following providers process information for the stated Services and purposes. Independent-recipient disclosures are listed in Section 3.
Scroll horizontally to view the full table on smaller screens.
Service provider | Services provided | Personal information | Applicable Services | Processing or retention period |
|---|---|---|---|---|
Google LLC — Google Cloud / Firebase | Authentication, hosting, databases, file storage, notifications and diagnostics | Account/guest identifiers, profiles, content, game activity, files, push tokens and operational logs | Launched games, Rest Brain, Puzzle Reels and Behind | Account or Service period, subject to eligible deletion, necessary security retention and the applicable recovery cycle. |
Google LLC — Firebase Analytics / BigQuery | Usage analytics and advertising performance measurement | Pseudonymous identifiers, device, country, campaign, gameplay, advertising events and revenue | Integrated launched games, Rest Brain, Puzzle Reels and Behind | Configured analytics retention and the period needed for the stated analysis, subject to eligible deletion. Recovery copies follow the applicable provider cycle. |
Amazon Web Services | Cloud infrastructure and Bedrock AI chat | Game, device and log information; Behind messages, context, persona and adult-status signal | Relevant launched game servers; Behind chat | Service period and the applicable security or abuse-monitoring period, subject to eligible deletion. |
AppsFlyer Ltd. | Attribution, deep links, conversion and advertising-revenue measurement | Advertising/AppsFlyer IDs, IP/device, installation, campaign, conversion and advertising-revenue information | Integrated launched games, Rest Brain and Puzzle Reels | Up to 24 months under the applicable arrangement, subject to eligible earlier deletion. |
OpenAI | AI content moderation | Chat messages and images submitted for moderation | Behind | For the moderation endpoint: no abuse-monitoring log retention. |
Google / Anthropic PBC | Alternative AI chat responses | Chat messages, context and outputs | Behind where the alternative model is enabled | Paid Gemini abuse-monitoring logs up to 55 days; Claude inputs/outputs 30 days, subject to applicable exceptions. |
country.is | IP-to-country lookup | IP address | Behind | For country-lookup processing and any recipient security-record period. |
Digital Turbine (IL) Ltd. — DT Exchange | Advertising, reporting, fraud prevention and optimization | Advertising data and SDK diagnostics | Launched games using DT Exchange | Up to 30 days under the applicable arrangement. |
Google Workspace | Support email and communications | Contact information, request, attachments and response history | Services using the relevant support mailbox | For request handling and any applicable statutory complaint, dispute or claims period. |
3. Third-Party Disclosures and Independent Controllers
The following advertising and reward recipients process information for the stated purposes, including the independent uses identified below.
Advertising data includes advertising and device identifiers, IP address, device and app information, approximate location, ad requests and interactions, conversion information, consent signals and advertising inferences. Additional fields are identified below. Precise location applies only where actually collected with the required permission.
Scroll horizontally to view the full table on smaller screens.
Recipient | Purpose | Personal information | Retention | Legal basis and choices |
|---|---|---|---|---|
AppLovin Corporation; dataprotection@applovin.com | MAX mediation, ads, profiling, service/AI advertising improvement | Advertising data, session/install information and inferences | Typically up to 2 years | Advertising recipient; applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
Google advertising services — Google LLC; googlekrsupport@google.com | AdMob/Ad Manager delivery, personalization, measurement, fraud prevention and improvement | Advertising data, interaction and SDK diagnostics | Partial IP deletion after 9 months; cookie anonymization after 18 months | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
Meta Platforms, Inc. / Meta Platforms Ireland Limited where applicable; help.meta.com/support/privacy; korealocalagent@support.facebook.com | Audience Network ads, measurement, optimization and product improvement | Advertising data, SDK version and viewability | For the stated purpose and any applicable legal or security-record period. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
MINTEGRAL PTE. LTD. ; privacy@mintegral.com | Ads, retargeting, attribution, profiling and algorithmic-model training | Advertising data, Android/device details, sensor/battery information and crash data where actually collected | For the stated purpose and any applicable legal or security-record period. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
LMI Inc. — Liftoff Monetize / Vungle; DPO@liftoff.io | Ad targeting, user profiles, measurement and SDK/platform improvement | Advertising data and inferred age/gender; precise location only if actually permitted and collected | Target profiles: 28–30 days. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
ByteDance Pte. Ltd. / TikTok Pte. Ltd. — Pangle; regional entities as applicable; pangle_support@bytedance.com | Ad personalization, frequency control, attribution, fraud prevention and research | Advertising data, Pangle identifier and inferred age/gender | For the stated purpose and any applicable legal or security-record period. | Independent advertising; joint collection arrangements may apply in the EEA/UK. |
BidMachine, Inc.; dpo@bidmachine.io | Ad targeting/delivery, analytics, fraud prevention and R&D | Advertising data, app statistics and iOS performance/crash data | For the stated purpose and any applicable legal or security-record period. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
Moloco, Inc. ; privacy@moloco.com | Ad optimization, profile enrichment and model/AI training | Advertising data and app-install/session data | For the stated purpose and any applicable legal or security-record period. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
Air Smart Advertising Solutions FZ-LLC — Yandex Ads; privacy@ads.yandex.com | Personalized/contextual ads, fraud prevention, service improvement and ML training | Advertising data, cookies and SIM network codes; location where actually permitted | For the stated purpose and any applicable legal or security-record period. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
Bigo Technology Pte. Ltd.; biz-cooperation@bigo.sg | Behavioral/cross-app ads, profiling, measurement, fraud prevention and development | Advertising data, hardware/battery/screen details and diagnostics | Up to 2 years | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
Unity Technologies SF — Unity Ads; DPO@unity3d.com | Ads, targeting, analytics, fraud prevention and development | Advertising data, ad-experience app use, purchase and diagnostic information | Interactions up to 12 months; transaction records 180 days | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
ironSource Mobile Ltd. / Unity Technologies SF ; DPO@unity3d.com | ironSource advertising, analytics and fraud prevention | Advertising data and diagnostics | For the stated purpose and any applicable legal or security-record period. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
InMobi Technology Services Pte. Ltd. | Interest-based ads, retargeting, bidding, audience segments and improvement | Advertising data and additional Android/sensor/Wi-Fi data where enabled; precise location only with actual permission | Up to 13 months | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
PubMatic, Inc.; privacy@pubmatic.com | OpenWrap ads, targeting, ID sync, reporting, frequency control and fraud prevention | Advertising data and session information; downstream bid requests | Ad delivery 20 days, targeting 30 days, reporting 62 days | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
A9.com LLC / Amazon Europe Core S.à r.l. — APS; APS policy Contact Us; contracts-legal@amazon.com for contractual notices | TAM auction advertising and reporting | Resettable advertising ID, IP, pseudonymous IDs and impression/click data | For the stated purpose and any applicable legal or security-record period. | Role varies by region and function; auction bidders receive information independently. |
Anzu Virtual Reality Ltd.; DPO@anzu.io | In-game ads, performance/viewability measurement and audience analytics | IP, device/network and app-use data, viewability and consent signal | Up to 120 days; transaction data 7 years | Advertising recipient; the role differs for Kids Safe Mode where that mode is enabled. |
Gadsme SAS; dpo@gadsme.com | In-game ads, frequency control, measurement, settlement and fraud detection | Advertising data, ad-view history and child-directed-app flag | Policy: 12 months; raw bid records under the DPA: 5 years. | Advertising recipient; joint device-access processing may apply. |
Tapjoy, Inc. / Unity Technologies SF; tapjoy-privacy-request@unity3d.com | Offerwalls, rewards, fraud prevention and personalization | Publisher user ID, advertising ID, approximate location, offer activity, performance and purchase data if sent | For the stated purpose and any applicable legal or security-record period. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
Almedia GmbH — Freecash; Koppenstr. 8, 10243 Berlin, Germany | Reward attribution, fraud prevention and marketing | AppsFlyer postbacks: advertising/click ID, install and selected in-app events and timestamps | For the stated purpose and any applicable legal or security-record period. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
Bright Data Ltd.; privacy@brightdata.com | Optional idle-bandwidth proxy/public-web-data service and settlement | IP, approximate location, device/OS/SDK details, request metadata and idle network bandwidth | For the stated purpose and any applicable legal or security-record period. | Optional network-resource sharing under a separate opt-in, withdrawable in the applicable settings. |
Downstream advertising demand partners | Bid evaluation and ad delivery through GAM, Amazon TAM or PubMatic P2P | Bid-request advertising/device IDs, IP, device/app data, approximate location and consent signals | For the stated purpose and any applicable legal or security-record period. | Applicable consent and sale/sharing or targeted-advertising opt-out rights apply. |
4. International Transfers
The table identifies destinations, data, purposes, timing, retention and transfer safeguards for the relevant current integrations.
Scroll horizontally to view the full table on smaller screens.
Recipient and contact | Destination | Data transferred | Purpose | Timing and method | Retention | Transfer mechanism, safeguards and choices |
|---|---|---|---|---|---|---|
Google LLC — Cloud/Firebase; support.google.com/cloud/contact/dpo | United States | Account/guest information, content, files, game activity, notifications and logs | Authentication, hosting, storage and operation | When the relevant Service is used, through SDK/API or server transfer | Applicable Service, security and recovery period in Section 2 | Applicable cloud processing terms and regional transfer safeguard. Necessary authentication/storage processing may be required for the feature. |
Google — Firebase Analytics/BigQuery; googlekrsupport@google.com | United States | Pseudonymous IDs, device/country, campaign, gameplay, advertising and revenue information | Usage and advertising analysis | When analytics events are sent and processed | Period in Section 2; provider recovery period | Applicable processing terms and regional transfer safeguard; consent or objection rights apply as required. |
Amazon Web Services; aws.amazon.com/privacy | United States | Game/device/log data; Behind messages, context, persona and adult-status signal | Game hosting and AI chat | During server operation or chat requests | Relevant Service and security-record period | AWS processing terms; applicable regional transfer safeguard. The chat or hosted function requires the relevant processing. |
OpenAI; privacy@openai.com | United States | Messages and images for moderation | Behind content moderation | When content is submitted for moderation | Moderation endpoint period in Section 2 | Applicable data-processing terms and regional transfer safeguard. |
AppsFlyer Ltd.; privacy@appsflyer.com | EU/US storage; support access in Israel, US, UK, Germany, India and Japan | Device/advertising IDs, IP, campaign, conversions and advertising revenue | Attribution, measurement and deep links | SDK/events and relevant server-to-server reporting | Up to 24 months, subject to eligible earlier deletion | Applicable DPA/SCC or other regional safeguard; advertising choices and deletion rights apply. |
Google / Anthropic PBC | United States | Chat messages, context and outputs | Behind alternative AI chat | When the relevant chat model is used | Gemini paid abuse logs up to 55 days; Claude 30 days, subject to exceptions | Applicable commercial processing terms and regional transfer safeguard. |
country.is | IP address | Country lookup | When a country lookup is requested | |||
Advertising recipients and contacts in Section 3 | US: AppLovin, Google, Meta, BidMachine, Moloco, PubMatic. Singapore/US: Pangle, BIGO, InMobi. Liftoff: US, Singapore, Japan, Germany. | Advertising data and recipient-specific fields in Section 3 | Ads, profiling, measurement, fraud prevention and disclosed independent uses | When advertising or conversion events occur, including bidder disclosures | Recipient periods in Section 3 | Applicable regional transfer basis and recipient safeguards; consent and opt-out rights apply. |
Yandex Ads recipient in Section 3; privacy@ads.yandex.com | UAE; possible Russia and other onward countries | Advertising data, cookies and relevant device/network information | Ads, fraud prevention and ML/service improvement | When relevant advertising events occur | Recipient period in Section 3 | |
Digital Turbine / Unity / ironSource / Anzu / Gadsme; contacts in Section 3 | DT: Israel and onward US. Unity/ironSource: US and applicable affiliate countries. Anzu: US servers, Israel access. Gadsme: France. | Advertising data and relevant diagnostics/viewability information | Advertising, measurement, fraud prevention and disclosed independent uses | When relevant advertising events occur | Recipient periods in Sections 2 and 3 | Applicable processor/controller transfer terms and regional safeguard; consent and opt-out rights apply. |
Amazon APS and downstream bidders; contacts in Section 3 | Bid-request identifiers, IP, device and advertising events | Advertising auction and delivery | When advertising requests and bids are processed | Recipient periods in Section 3 | Applicable regional transfer basis and recipient safeguards; consent and opt-out rights apply. | |
Tapjoy / Unity; tapjoy-privacy-request@unity3d.com | United States and applicable Unity facility countries | User/ad ID, offer activity, rewards and relevant device data | Offerwall and reward provision | When the optional offerwall is used and related events are reported | Recipient period in Section 3 | Applicable Unity processing/transfer terms and regional safeguard; required consent and opt-out rights apply. |
Almedia GmbH; Koppenstr. 8, 10243 Berlin, Germany | Germany and United States | Advertising/click ID, installation and selected in-app events | Reward attribution and fraud prevention | Partner postbacks for relevant reward campaigns | Recipient period in Section 3 | Applicable Link DPA and regional transfer safeguard; required choices apply. |
Bright Data Ltd.; privacy@brightdata.com | Israel | IP, approximate location, device and request metadata; idle bandwidth | Optional proxy/public-web-data service | After separate opt-in while the feature is enabled | Recipient period in Section 3 | Applicable regional transfer basis; opt-in may be declined or withdrawn in the feature settings. |
International transfers are subject to the applicable regional notice. Information about relevant safeguards, including copies where required, is available at help@supercent.io.
5. Regional Information and Choices
For EEA and UK users, legal bases, international-transfer safeguards and data-subject rights are described in the EEA and UK Privacy Supplement.
For U.S. users, rights relating to sale, sharing, targeted advertising and universal opt-out signals are described in the U.S. State Privacy Notice.
For users in Japan, information about foreign third-party transfers and retained personal data is described in the Japan Privacy Supplement.
Privacy questions and requests may be submitted to help@supercent.io. Additional request procedures are described in the Global Privacy Policy and the applicable regional notice.