Zuzuzoo — Privacy Policy

Effective date: November 21, 2025

Operator: Siarhei Kazachonak (kazachonaksiarhei@gmail.com), Poland.

1. Overview

This Privacy Policy explains how Zuzuzoo ("App", "we", "us", "Operator") collects, uses, discloses, and protects information when you use our App. The App is designed for young children (ages 1-4) and aims to minimize personal data collection in compliance with COPPA (Children's Online Privacy Protection Act) and GDPR (General Data Protection Regulation). Please read this Privacy Policy carefully. By using the App you agree to the terms described below.

2. What data we collect

2.1. No personal data of children

The App does not intentionally collect personal information of children (for example: names, photos, voice recordings, precise location, contact lists, email addresses, or other direct identifiers that can be used to contact or identify a specific child).

2.2. Trial subscription fraud prevention

Device Identifier (IDFV): To prevent abuse of our 3-day free trial subscription, we collect a device identifier (Identifier for Vendor, or IDFV) provided by Apple iOS. This identifier:

• Is used ONLY to ensure each device receives one free trial per subscription offer.
• Is NOT used for advertising, behavioral tracking, profiling, or marketing purposes.
• Is NOT shared with third parties for advertising or marketing.
• Is sent only to RevenueCat (our subscription management provider) to enforce trial eligibility rules.
• Cannot be used to identify or contact a specific child.

Why we collect this: This is necessary to prevent fraudulent abuse of free trials and protect our business from repeated trial misuse. Without this, users could delete and reinstall the app indefinitely to receive unlimited free trials.

Your control: Parents may contact us at kazachonaksiarhei@gmail.com to request deletion of this identifier. Note that trial eligibility is also managed by Apple through your Apple ID and cannot be reset by us.

2.3. Technical and analytics data (limited)

We intentionally do not use third-party analytics SDKs or remote crash-reporting services in the children's area of the App. The only technical data shared externally is the minimum required by RevenueCat to manage subscriptions (see Section 3). Other diagnostic or usage information remains local to the device and is not transmitted to third parties.

• Local app usage: Game progress and preferences are stored locally on the device and are not uploaded.
• Subscription metadata: Subscription status and minimal device info required by RevenueCat for purchase validation (device model, OS version, app version) may be transmitted to RevenueCat solely for subscription management.

This approach ensures we do not collect behavior analytics or profiling data about children.

3. How we collect data

Data is collected via:

• RevenueCat: Manages subscription state and trial eligibility. RevenueCat receives the device identifier (IDFV) and minimal subscription-related metadata to enforce trial rules and validate purchases. Actual payment processing is handled securely by Apple via the App Store; we never see or store credit card information.
• Local device storage: All gameplay progress, preferences, and settings are stored locally on the user's device and are not transmitted to external servers.

We do not use Firebase, Bugfender, or any other third-party analytics/crash-reporting SDKs. We do not use advertising networks, behavioral analytics, or tracking services in the App.

4. Legal bases for processing (GDPR)

For EU users (including Poland) our legal bases are:

• Performance of a contract: Processing necessary to provide paid subscription services and app functionality (Article 6(1)(b) GDPR).
• Legitimate interests: Protecting the service from fraud by enforcing trial eligibility (Article 6(1)(f) GDPR). We have balanced this interest against user privacy and determined that collecting only the device identifier for trial enforcement does not pose significant privacy risks.
• Fraud prevention: Collecting device identifiers to prevent trial subscription abuse is a legitimate interest to protect our business and ensure fair access to trials (Article 6(1)(f) GDPR).

We do not rely on consent as our primary legal basis, but where required by law, we will ask for explicit parental consent before processing data beyond what is described here.

5. Use of collected data

• Provide and maintain the App and subscription services.
• Enforce trial eligibility rules and prevent subscription fraud.
• Manage subscriptions and verify purchase state via RevenueCat and Apple.
• Comply with legal obligations and respond to lawful requests from authorities.

We do NOT use collected data for:

• Targeted advertising or behavioral profiling.
• Selling or renting data to third parties.
• Contacting users directly (we have no contact information unless provided voluntarily).

6. Disclosure of data to third parties

We share limited data with the following trusted third-party service providers only as described below:

• RevenueCat (RevenueCat, Inc.): Subscription management and trial eligibility enforcement. RevenueCat receives device identifiers (IDFV) and subscription status strictly for the purposes of purchase validation and subscription lifecycle management. RevenueCat Privacy Policy: https://www.revenuecat.com/privacy
• Apple Inc.: Payment processing, subscription management, and trial eligibility (managed through App Store). Apple Privacy Policy: https://www.apple.com/legal/privacy/

We do not use Firebase, Bugfender, or other analytics/crash-reporting third parties. We do not sell or rent user data to any third parties.

7. Data retention

We retain data only as long as necessary to provide services and comply with legal obligations:

• Device identifiers (IDFV): Retained in RevenueCat for the duration of the subscription lifecycle and up to 60 days after subscription termination to prevent trial abuse. Automatically deleted thereafter.
• Subscription metadata: Retained for 7 years to comply with tax and accounting regulations, then deleted.
• Local app data: Stored only on the user's device and can be deleted by uninstalling the app or clearing app data in iOS settings.

Parents may request early deletion of data by contacting us at kazachonaksiarhei@gmail.com. We will respond within 48 hours and complete deletion within 30 days, except where retention is required by law.

8. International transfers

The Operator is based in Poland (EU). Our third-party service provider (RevenueCat) may process data outside the European Economic Area (EEA), including in the United States. These transfers are necessary to provide the App's subscription services and are protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions for certain countries.
• Service providers' compliance with GDPR, COPPA, and other privacy frameworks where applicable.

For more information about how our service providers protect data, please refer to their privacy policies linked in Section 6.

9. Your rights (EU/GDPR)

If you are in the EU/EEA, you have the following rights under GDPR:

• Right to access: Request a copy of the data we process about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your data, subject to legal obligations.
• Right to restriction: Request that we limit how we process your data in certain circumstances.
• Right to object: Object to processing based on legitimate interests.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to withdraw consent: If processing is based on consent, you may withdraw it at any time.
• Right to lodge a complaint: Contact your national data protection authority if you believe your rights have been violated.

To exercise any of these rights, contact us at kazachonaksiarhei@gmail.com. We will respond within 48 hours and fulfill your request within 30 days, or explain why we cannot comply (e.g., legal obligations).

10. COPPA compliance and parental rights (US)

The App is designed for children under 13 and complies with the Children's Online Privacy Protection Act (COPPA). No personal information of children is collected, stored, or shared for advertising or marketing purposes.

10.1. Minimal data collection

We collect only the minimum data necessary to operate the App and enforce trial eligibility. We do not collect personal information such as names, email addresses, photos, or precise locations from children.

10.2. Parental consent and notification

We notify parents about our data practices through this Privacy Policy. By allowing a child to use the App, parents consent to the minimal data collection described here (device identifiers for trial fraud prevention and subscription management via RevenueCat).

If we change our practices to collect additional personal information from children, we will notify parents and obtain verifiable parental consent before doing so.

10.3. Parental rights

Parents have the right to:

• Review the personal information collected from their child (if any).
• Request deletion of their child's personal information.
• Refuse further collection or use of their child's information.

How to exercise parental rights: Contact us at kazachonaksiarhei@gmail.com with the subject line "COPPA Parental Request". Include:

• Your name and relationship to the child.
• The child's approximate age or date of birth.
• Device model and operating system version (to help us locate relevant data).
• Your specific request (access, deletion, or opt-out).

We will verify your identity as the child's parent or guardian before fulfilling your request. We will respond within 48 hours and complete your request within 30 days.

10.4. No third-party advertising and no analytics

The App contains NO advertising and uses NO third-party advertising services. We do not use behavioral advertising networks, tracking, or profiling technologies in the App. We also do not use third-party analytics or remote crash-reporting services in the children's area of the App.

11. Security

We implement industry-standard security measures to protect data, including:

• Encryption of data in transit (HTTPS/TLS) and at rest where applicable.
• Access controls and authentication for internal systems.
• Regular security updates and careful management of third-party libraries.
• Secure payment processing handled entirely by Apple (we never see payment information).

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information using commercially acceptable means, we cannot guarantee absolute security. If you become aware of any security vulnerability, please report it to kazachonaksiarhei@gmail.com.

12. Parent Gate and parental responsibilities

The App is intended for use by children ages 1-4 under parental supervision. Parents and guardians are responsible for:

• Reviewing this Privacy Policy and Terms of Service before allowing their child to use the App.
• Supervising their child's use of the App and ensuring appropriate content and screen time.
• Managing in-app purchases and subscriptions through Apple's Screen Time and parental control settings (Learn more).

Parent Gate Protection: The App includes a math-based parent gate (simple arithmetic question) to restrict access to the Settings screen. Settings and legal documents (Terms of Service, Privacy Policy) can only be accessed after solving the parent gate challenge, preventing unintended access by young children.

Premium game features are unlocked after one free round. To continue playing premium games, a subscription is required. Parents can manage subscriptions and disable purchases through iOS Settings > Screen Time > Content & Privacy Restrictions.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or App features. When we make material changes, we will:

• Update the "Effective date" at the top of this policy.
• Notify users through an in-app message or notification (if technically feasible).
• For material changes affecting children's data collection, obtain renewed parental consent where required by COPPA.

Continued use of the App after changes indicates acceptance of the updated Privacy Policy. We encourage parents to review this policy periodically.

14. Contact and data protection officer

Operator: Siarhei Kazachonak

Email: kazachonaksiarhei@gmail.com

Jurisdiction: Poland (EU)

For privacy-related questions, COPPA requests, or GDPR rights, contact us at the email above. We will respond within 48 hours.

If you believe your privacy rights have been violated, you may contact your local data protection authority.