Effective date: 23 October 2025

1. Introduction

We, Getcovers OÜ, are a technology company that designs, develops, and operates mobile games. With this Privacy Policy, we explain how and why we collect, store, use, disclose, and otherwise process personal data that we collect via our website, online advertisements, and mobile games (collectively, our “Services”). This Privacy Policy does not apply to any other data we collect, such as data we collect offline, from job applicants, or from employees.

If you have concerns about providing data to us or how it is used as described in this Privacy Policy, please see Section 6 (Control Over Your Information) and Section 7 (Requests to Exercise Privacy Rights), or contact our Data Protection Officer at support@calmi.io.

2. What Types of Personal Data We Collect and How We Collect It

Data We Collect and How We Collect It

• Data you provide: account or email (if you sign in), display name, avatar (if enabled), support messages, survey responses, and user-generated content (UGC).
• Data collected automatically: app events (for example session, progression, level attempts and completions), device and operating system model and version, language, coarse region or country, IP address, performance and diagnostics (crash logs, error codes), and an app instance ID. On iOS, we may display Apple’s App Tracking Transparency (ATT) prompt because, if you consent, we may engage in tracking for advertising measurement or optimization with third parties (for example Meta). We do not access or store Apple’s Identifier for Advertisers (IDFA). If you decline ATT, such tracking is disabled and we rely only on aggregate attribution (for example SKAdNetwork). On Android, we may use Google Play Install Referrer and Google Play App Set ID for anti-fraud and aggregate attribution. We do not perform device fingerprinting.
• Data from third parties: if you choose social sign-in (Apple, Google, Facebook), we receive your name, email, and provider user ID as authorized by you. From app stores we receive purchase receipts or tokens; we do not receive card numbers. We do not obtain data from data brokers, and we do not upload hashed emails or phone numbers for matching on third-party platforms. We do not collect precise (GPS-level) location and we do not collect sensitive categories such as health or biometric data.

3. How We Use Your Data

We process data for the purposes below and on the listed legal bases. (a) Core functionality and account (create or sign in, restore purchases, secure the Service): Contract; Legitimate Interests (security and fraud-prevention). (b) Purchases and receipts (verify in-app purchases, tax and audit): Contract; Legal Obligation. (c) Analytics and product improvement (game balancing, feature usage, crashes): Legitimate Interests; Consent where required by local law. (d) Attribution and performance measurement: we use aggregate attribution mechanisms (for example SKAdNetwork on iOS and Google Play Install Referrer on Android) under Legitimate Interests; where any tracking for advertising optimization or measurement would apply on iOS, we rely on your prior consent under App Tracking Transparency (see Section 6). (e) Customer support and communications: Legitimate Interests; Contract. (f) Compliance and enforcement (terms, fraud, abuse): Legitimate Interests; Legal Obligation. We do not show ads in the game and we do not personalize ads in-game. Where you do not grant consent to tracking on iOS, we rely only on aggregate attribution (for example SKAdNetwork) and disable any tracking-related flows.

4. Third-Party SDKs and Data Disclosure

We integrate SDKs only for the purposes below. We do not sell personal information as defined under the California Consumer Privacy laws. We do not use third-party ad-serving SDKs in the game. Firebase Authentication (Google): optional sign-in; data: authentication tokens, user ID (UID), and basic profile fields if you consent at the identity provider. Firebase Analytics (Google): product analytics (sessions, progression, feature usage); data: event metrics, device and OS info, app instance ID, and coarse location (country or region). Firebase Crashlytics: stability and crash reporting; data: crash stack traces and device or OS metadata at crash time. Meta/Facebook SDK (login and, if enabled, ads measurement/optimization): optional account linking. If you consent to tracking on iOS under App Tracking Transparency, we may send app events to Meta for advertising performance measurement or optimization. If you decline ATT, we do not enable such tracking and rely on SKAdNetwork on iOS. Auto-initialization and auto-event-logging are kept off until the applicable consent or setting allows them. We do not upload hashed contact lists or use data brokers. Google Sign-In and Apple Sign-In: same model as above for authentication. Unity IAP, Google Play Billing, and App Store: verification of in-app purchases via receipts or tokens. We do not handle card numbers. Google Play App Set ID and Install Referrer: anti-fraud and aggregate attribution. VoxelBusters EssentialKit and Google Play In-App Review: in-app rating prompts; no personal data is collected by our app. I2 Localization: loading of static localization content. Disclosure: we share data only with the providers listed above for the stated purposes. These providers act as independent controllers or processors under their own privacy notices and may process data inside or outside the EEA with appropriate safeguards (see Section 11).

5. Disclosure of Your Personal Data

We may disclose data to service providers (IT, analytics, crash reporting, customer support), platform partners (Apple, Google) for purchases and compliance, social sign-in providers if you choose them, competent authorities when required by law, and corporate transaction counterparties in connection with a merger, acquisition, or similar event. We do not disclose data to third-party ad networks for in-app advertising or personalization.

6. Targeted Advertising

We do not show ads in the game and we do not personalize ads. We may send app events for aggregate user-acquisition attribution and performance measurement via mechanisms such as SKAdNetwork on iOS and Google Play Install Referrer on Android. ATT on iOS: we request your permission via Apple’s App Tracking Transparency only to enable tracking for advertising measurement or optimization with third parties (for example Meta). Even if you consent, we do not access or store the IDFA. If you decline, tracking is disabled and we rely solely on aggregate attribution (for example SKAdNetwork). No contact-list matching: we do not upload or match customer lists or hashed identifiers (such as hashed emails or phone numbers) with third-party platforms. California: we do not sell personal information. We will not “share” personal information for cross-context behavioral advertising without your consent where required, and we implement Limited Data Use settings for applicable California users. You can contact us to exercise your CPRA rights as described in Section 8.

7. Control Over Your Information

You can manage how we use your personal data in several ways:

• Delete or Reset Our Services: Removing our app from your device will stop further data collection, but we may retain previously collected data.
• Deactivate Your Account: If you fully deactivate your account, all progress and virtual items will be lost.
• Manage Device Permissions: You can restrict our access to location data, notifications, or other device features through your device settings.

Opt-Out of Advertising Tracking: You can disable interest-based advertising through your device settings.

8. Requests to Exercise Privacy Rights

Depending on your location, you may have rights to access, rectify, erase, port, restrict, object, and withdraw consent. How to submit: in-app via Settings → Delete Account, via the web form at https://calmi.io/contact-us/ , or by email to support@calmi.io with the subject “Privacy request” or “Account deletion.” We may verify your identity and will respond within legally required timeframes (for example 30 days EU or UK, 45 days California). Non-discrimination: we do not discriminate against you for exercising your rights. Data deletion: deleting your account is irreversible and may affect access to purchased or earned items once account linkage is removed.

When you request deletion, we delete your account, gameplay progress associated with the account.
Deletion is irreversible and may affect access to in-app purchases or items linked to the deleted account.
The account deletion process may take up to 7 days.

How to submit a request
In-app: Menu → Settings → Delete Account
Web form: https://calmi.io/contact-us/
Email: support@calmi.io

9. Children’s Privacy

We do not knowingly collect personal data from children under 13, or under the age of digital consent in their country, without verifiable parental consent. If we learn that a child provided data without such consent, we will delete it. Parents may contact support@calmi.io to review or delete a child’s data. Defaults for minors are privacy-protective.

10. Security

We implement technical, organizational, and physical measures designed to protect personal data, including encryption in transit, access controls, and logging. No system is completely secure. You are responsible for safeguarding your device and credentials.

11. Third-Party Websites

Our Services may include links to third-party websites or services with their own privacy notices. We are not responsible for how third parties collect or use personal data. We encourage you to review their policies.

12. Data Retention

We retain personal data only as long as necessary for the purposes set out in this Policy or as required by law. Auth and account data: retained for the life of the account or as required by law. Analytics and crash logs: typically retained for 3 to 24 months, then aggregated or deleted. Purchase records: retained as required by tax and accounting rules. Support tickets and UGC: retained as needed to handle the request and enforce the Terms. We may retain minimal records to demonstrate compliance or handle disputes.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. If we make material changes, we will notify users via in-game notifications or other appropriate channels. The “Effective Date” at the top of this policy reflects the latest version.

14. Contact Us

For privacy-related inquiries, contact us at support@calmi.io.

By using Draw You!, you acknowledge that you have read, understood, and agree to this Privacy Policy.