Privacy Policy

This Privacy Policy outlines how Lemon Crate Studio LLC collects, uses, and protects your personal information when you visit our website and use our services.

Last Updated: August 5, 2026

This Privacy Policy describes how Lemon Crate Studio LLC (“we”, “us”, or “our”) collects, uses, and discloses information about you when you use our website (https://cardandpuzzle.com) and our mobile applications (collectively, the “Services”).

We are the Data Controller for your information.

1. Information We Collect

We collect information to provide a seamless gaming experience across web and mobile. We categorize data collection by the source:

A. Information You Provide to Us

Contact Information: If you use our contact form or email us, we collect your name, email address, and message content.
Newsletter Subscription: If you subscribe to our newsletter, we collect your email address. You can unsubscribe at any time using the “unsubscribe” link included in every email.
Voluntary Feedback: Any game reviews or bug reports you submit.

B. Information Automatically Collected (Web & Mobile)

Data Category	Specific Data Points	Purpose	Legal Basis (GDPR)
Game State	Game progress, settings, and preferences.	Strictly Necessary: To save your progress locally on your device so you can resume playing. Game save data is stored locally on your device unless you explicitly use features that require server storage (such as accounts, leaderboards, or multiplayer features).	Performance of Contract
Web Analytics	Pages visited, time spent, clicks, referring URL.	To understand how users navigate our website.	Consent (or Legitimate Interest where allowed)
Mobile Device Data	Device Model, OS Version, Carrier, Connection Type (Wi-Fi/cellular), Language, Screen Resolution.	To ensure the game runs without crashing on your specific phone.	Legitimate Interest
Mobile Usage Data	Screens viewed, features used, session duration, in-app events.	To understand how players use the app so we can improve it.	Consent (or Legitimate Interest where allowed)
Crash & Performance Data	Crash logs, stack traces, and performance metrics.	To diagnose and fix crashes, freezes, and performance problems.	Legitimate Interest
Approximate Location	City/country-level location derived from your IP address or device-level location services. We do not collect precise GPS location.	For analytics, regional content, and advertising.	Legitimate Interest (analytics) / Consent (advertising)
Identifiers	IP Address, Advertising ID (IDFA/GAID), Cookies.	To deliver personalized ads and prevent fraud.	Consent
Google Play Games Data (Mobile)	Play Games player ID, gamertag, and avatar, plus achievements and saved game progress.	If you choose to sign in to Google Play Games Services, to sync your achievements and save your progress to your Google account so you can restore it on another device (cloud save).	Consent / Performance of Contract
Purchase Data (Mobile)	Records of in-app purchases you make, including the item purchased, price, and currency. Payment details (card numbers, billing address) are handled entirely by the Apple App Store or Google Play and are never collected by or visible to us.	To deliver and validate purchases, provide customer support, and prevent fraud.	Performance of Contract
Push Notification Tokens (Mobile)	A device token used to deliver notifications, if you allow notifications.	To send game reminders, updates, and announcements you have opted in to.	Consent
Install Attribution Data (Mobile)	Referral information provided by the app store about how you found the app.	To measure the effectiveness of our marketing campaigns.	Legitimate Interest (or Consent where required)

2. Legal Bases for Processing (EEA/UK)

Where required by law, we rely on the following legal bases to process your personal data:

Consent — for personalized advertising, analytics cookies, and advertising identifiers. You can withdraw consent at any time via the “Consent Preferences” link on our website or “Privacy Settings” in our mobile apps.
Legitimate Interest — for security (e.g., Cloudflare DDoS protection), crash reporting (e.g., Crashlytics), and basic device diagnostics needed to ensure game compatibility.
Performance of Contract — to provide core game functionality such as saving your progress locally on your device, syncing cloud saves, and delivering in-app purchases.
Legal Obligation — to comply with applicable laws, regulations, and legal processes, including tax and accounting requirements for purchases.

We do not sell your personal data. We share data with trusted third-party service providers to operate our business.

A. Website Services (Web Only)

These services operate when you visit cardandpuzzle.com.

Google Funding Choices: Manages your consent preferences and cookie choices.
Google AdSense: Displays advertisements on the website. Uses cookies to personalize ads.
PostHog: Our primary analytics tool. Analyzes user behavior and improves website performance.
Formspark: Processes our contact form submissions.
Cloudflare: A Content Delivery Network (CDN) that secures our site and speeds up loading. (Processes IP addresses for security).
Google Ads (gtag.js): Tracks ad conversions.
Meta Pixel: Tracks ad conversions and measures the effectiveness of advertising campaigns across Meta platforms (Facebook, Instagram).
Email Service Provider: If you subscribe to our newsletter, your email address is processed by our email marketing service provider to deliver newsletters and related communications.

B. Mobile & Game Services (App & WebGL)

These services operate when you play the game on mobile or in the browser.

Google Analytics for Firebase: Analyzes user engagement, retention, and in-game behavior on mobile devices.
Google AdMob / Unity Ads / ironSource: Mobile ad networks and mediation partners that may access your Advertising ID to show rewarded videos or interstitials. On mobile devices, consent for personalized advertising may be managed through the in-app consent dialog and your device privacy settings.
Meta Ads / Meta Audience Network: Used for user acquisition campaigns, ad performance measurement, and serving ads within mobile apps. May access device identifiers for attribution and ad optimization.
GameAnalytics: Game-specific analytics to track difficulty curves (e.g., “How many players fail Level 5?”).
ByteBrew: Game analytics, A/B testing, remote configuration, and push notifications.
Google Play Games Services: Sign-in, achievements, and cloud save. If you sign in, your Play Games profile and saved game data are stored under your own Google account.
Google Play Billing / Apple App Store: Process in-app purchases. These stores handle all payment details; we only receive a record of what was purchased.
Crashlytics (Firebase): Reports app crashes so we can fix bugs.

Some third-party advertising partners (for example, Google AdMob, Unity Ads, ironSource, and Meta) may process certain data (such as device identifiers, usage data, and IP-based general location) for their own purposes, including ad personalization, measurement, fraud prevention, and compliance. In those cases, they may act as independent data controllers. Please review their privacy policies for details.

We may add or remove advertising and analytics partners over time (including through mediation platforms). We will update this policy and related disclosures as required by applicable law.

C. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and in our apps.

Category	Provider	Purpose	Typical Duration	Required for Service
Strictly Necessary	Cloudflare	Security, bot protection, traffic integrity	Session to short-term	Yes
Consent Preferences	Google Funding Choices (UMP)	Stores consent choices and applies privacy controls	Varies by region/settings	Yes
Analytics	PostHog	Usage analytics and product improvement	Up to 12 months	No
Advertising	Google AdSense / Google Ads	Ad delivery, frequency capping, measurement, personalization	Varies by cookie	No
Advertising	Meta Pixel	Ad conversion tracking and campaign measurement	Varies by cookie	No

You can manage your choices through privacy controls provided in the website and app consent flows, browser settings, and device privacy settings.

Mobile applications: Our ad partners and analytics providers may use device advertising identifiers, SDKs, and similar technologies to collect information about your use of our apps and other apps. You can limit ad tracking through your device settings or the “Privacy Settings” option inside our apps (see Section 7).

Push notification tokens: If you allow notifications, the operating system issues a device token that we and ByteBrew use solely to deliver notifications to your device. It is not an advertising identifier and is not used for ad targeting. You can revoke it at any time by turning off notifications for the app in your device settings.

D. Third-Party Privacy Policies

For more details about how our third-party partners process data, you can review their privacy policies:

Google (AdMob, AdSense, Firebase/Crashlytics, Funding Choices, Google Ads, Play Games Services, Play Billing): https://policies.google.com/privacy
Apple (App Store, in-app purchases): https://www.apple.com/legal/privacy/
Meta (Meta Ads, Meta Audience Network, Meta Pixel): https://www.facebook.com/privacy/policy/
Unity Ads: https://unity.com/legal/privacy-policy
ironSource (LevelPlay): https://unity.com/legal/privacy-policy
GameAnalytics: https://gameanalytics.com/privacy/
ByteBrew: https://docs.bytebrew.io/BBSettings/privacypolicy
PostHog: https://posthog.com/privacy
Cloudflare: https://www.cloudflare.com/privacypolicy/
Formspark: https://formspark.io/legal/privacy-policy/

These third-party policies may be updated by their providers from time to time.

We may disclose information in the following circumstances:

With service providers listed above, to operate and improve our Services.
To comply with law — in response to subpoenas, court orders, or legal process.
To protect rights and safety — when we believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.
Business transfers — in connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. How We Process Your Information

We process data for the following specific purposes:

To Provide the Service: Storing your game progress locally so you don’t lose progress.
To Improve the Game: Using PostHog, Firebase, and GameAnalytics to see where players get stuck.
To Fund the Service: Using AdSense (Web) and mobile ad networks/mediation partners (such as AdMob, Unity Ads, and ironSource) to generate revenue via ads.
Security: Using Cloudflare to block bots and DDoS attacks.
To Communicate: If you subscribe, sending you newsletters with game updates, tips, and announcements. You can opt out at any time.
To Save and Restore Progress Across Devices: If you sign in to Google Play Games Services, syncing your achievements and saved games to your Google account.
To Process Purchases: Processing and validating in-app purchases made through Google Play Billing or the Apple App Store.
To Send Push Notifications: Sending you notifications, where you have allowed them. You can turn them off at any time in your device settings.
To Respond to You: Answering your inquiries, contact form submissions, and support requests.
To Detect Abuse: Detecting and preventing fraud, abuse, and technical issues.
Legal Compliance: Complying with legal obligations and enforcing our terms.

5. International Data Transfers

Our servers and third-party service providers (like Google, PostHog, and Cloudflare) are primarily located in the United States. If you are accessing our Services from the EEA or UK, please note that your data is transferred to the US. We rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (where applicable for certified providers like Google) to safeguard these transfers.

If you are located in the EEA, UK, or Switzerland, you have the following rights:

Right to Access: Request a copy of your personal data.
Right to Rectification: Correct inaccurate data.
Right to Erasure (“Right to be Forgotten”): Request deletion of your data (e.g., reset game stats).
Right to Withdraw Consent: You can withdraw your consent for ads/analytics at any time via the “Consent Preferences” link (Web) or “Privacy Settings” (Mobile).
Right to Restrict Processing: Ask us to pause processing your data.
Right to Object: Object to processing based on “legitimate interest” or direct marketing.
Right to Portability: Request your data in a structured, machine-readable format.
Right to Complain: Lodge a complaint with your local Data Protection Authority (DPA).

To exercise these rights, email [email protected]. We will respond within 30 days (or sooner if required by applicable law).

For users in Brazil (LGPD) and Canada (PIPEDA), you may contact us using the details in Section 13 for privacy inquiries, complaints, and data-related requests.

7. U.S. State Privacy Rights (California, Virginia, Colorado, etc.)

Global Privacy Control (GPC)

We honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we will automatically treat it as a request to opt-out of the “sale/sharing” of your personal information (turning off tracking cookies/ads).

Do Not Track Signals

Our Services do not respond to traditional “Do Not Track” browser signals. However, we honor Global Privacy Control (GPC) signals where required by law.

We do not sell personal information for monetary value (we don’t sell your email list). However, allowing ad networks (like Google, Meta, or Unity) to place cookies or access your Advertising ID to show personalized ads may be considered “sharing” or a “sale” under California law.

Right to Opt-Out of Sale/Sharing: You can opt-out of this ad targeting at any time.
- Web: Click the “Do Not Sell or Share My Personal Information” link in the website footer.
- Mobile: Adjust your device’s ad tracking settings, use the “Privacy Settings” option inside our mobile apps, or contact us.
Right to Know & Delete: You may request to know what data we hold and ask for it to be deleted.
Response Timeline: We will respond to verified requests within 45 days.

California Civil Code Section 1798.83 (“Shine the Light”) permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, contact us using the details in Section 13.

Other US States (Virginia, Colorado, Connecticut, and others)

Residents of states with comprehensive privacy laws (such as the VCDPA, CPA, and CTDPA) have similar rights to access, delete, correct, and opt out of targeted advertising. To exercise these rights, contact us at [email protected].

8. Automated Decision-Making

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

9. Data Retention

We keep your information only as long as necessary:

Game Save Data (Local): Stored locally on your device until you clear your browser/app data, reset the game, or uninstall the app.
Game Progress and Cloud Saves: Stored under your own Google account through Play Games Services and retained until you delete it from your Play Games profile or Google Account settings.
Purchase Records: Records of in-app purchases are held by the Apple App Store or Google Play and retained under their policies, and by us for as long as needed to validate entitlements, provide support, and meet tax and accounting obligations.
Push Notification Tokens: Retained only while notifications remain enabled for the app. Tokens are discarded when they expire, when you disable notifications, or when you uninstall the app.
Analytics Data: Retained by our partners (Google, PostHog) for a period of 14 to 26 months before being automatically deleted or anonymized.
Contact Form Data: Retained for as long as necessary to resolve your support inquiry, then archived or deleted.
Newsletter Data: Your email address is retained until you unsubscribe or request deletion.
Deletion Requests: To request deletion of any personal data we hold, email us at [email protected]. Google Play Games data (achievements, saved games) is stored under your own Google account — you can delete it at any time from your Play Games profile or Google Account settings.

We do not collect precise GPS location. Some third-party advertising or analytics partners may infer general (coarse) location from IP address or device signals.

10. Children’s Privacy (COPPA)

Our Services are not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you are a parent and believe we have collected data from a child, contact us immediately at [email protected], and we will delete it.

11. Data Security

We implement reasonable security measures, including HTTPS encryption for web traffic and secure storage for game data. However, no method of transmission over the internet is 100% secure.

If a security incident involving personal data occurs, we will investigate, mitigate, and provide notices to affected users and regulators where required by applicable law.

12. Changes to This Policy

We may update this privacy notice from time to time. The updated version will be indicated by an updated “Last Updated” date at the top of this policy. If we make material changes, we may notify you via a prominent notice on our Service. Your continued use of our Services after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this policy, please contact us:

Lemon Crate Studio LLC 2108 N ST STE N, Sacramento, CA 95816, USA Email: [email protected]