Privacy Policy — Card Kingdom Khmer

1. Information We Collect

We collect information to provide, improve, and personalize your experience. Types of information include:

1. Personal Information
   • Facebook Login Data: When you use "Sign in with Facebook" we may receive your Facebook user ID, name, profile picture, email (if shared), friends list (if granted), and other public/shared profile data per Facebook policies.
   • Google Login Data: When you use "Sign in with Google" we may receive your Google user ID, name, profile picture, email, and other public/shared profile data per Google policies.
   • Account Information: If you create an account directly, we may collect username, email, and password.
2. Usage and Device Information
   • In-Game Data: Progress, scores, achievements, card collections, and gameplay statistics.
   • Device and Log Data: Device type, OS, IP address, browser, unique device identifiers, crash reports, and analytics (sessions, features used).
   • Location Data: Approximate city-level location from IP for regional content or ads; precise location only with explicit permission.
3. Sensitive Information

   We do not collect sensitive personal information (health, financial, biometric) unless explicitly required and with your consent.

2. How We Use Your Information

1. Authentication & Account Management: To enable login via Facebook/Google and maintain your account.
2. Gameplay Enhancement: Save progress, matchmake players, personalize challenges, and show leaderboards.
3. Communication: Send notifications, updates, and promotional content (opt-out available in settings).
4. Analytics & Improvement: Understand usage, fix bugs, and develop features.
5. Marketing & Ads: Deliver personalized ads only if you opt in; we may share anonymized data with ad partners.
6. Legal Compliance: Comply with laws, prevent fraud, and respond to legal requests.

3. How We Share Your Information

We do not sell your personal information. We may share information in the following limited ways:

1. With Facebook: Data shared via "Sign in with Facebook" is subject to Facebook's Data Policy; Facebook may act as a data controller for that data.
2. With Google: Data shared via "Sign in with Google" is subject to Google's Privacy Policy; Google may act as a data controller for that data.
3. Service Providers: Trusted third parties (e.g., cloud providers, analytics) who assist in operating the Game; bound by confidentiality agreements.
4. Business Transfers: In mergers, acquisitions, or asset sales, user data may be transferred as permitted by law.
5. Legal Requirements: When required by law, subpoena, or to protect rights and safety.

All sharing complies with applicable laws, including GDPR and CCPA where relevant.

4. Data Retention

We retain information as long as necessary for the purposes described:

• Account data: Until you delete your account or request erasure.
• Usage logs: Retained up to 2 years for analytics and improvement.

You can request deletion at any time (see Section 6).

5. Security

We implement reasonable security measures (encryption, access controls) to protect your data. However, no system is perfectly secure; absolute security cannot be guaranteed.

OAuth logins: "Sign in with Facebook" and "Sign in with Google" use their respective secure OAuth flows.

6. Your Rights and Choices

You have control over your information:

1. Access & Update: View or edit information via game settings or contact us.
2. Opt-Out: Disable personalized ads, notifications, or third-party sharing in settings.
3. Deletion: Request account deletion; we will remove your data within 30 days except for legal backups.
4. EU/UK Users (GDPR): Rights to access, rectification, erasure, restriction, portability, and objection — contact us to exercise these rights.
5. California Residents (CCPA): Rights to know, delete, and opt-out of sales (we do not sell personal data).

For Facebook controls visit your Facebook settings. For Google controls visit your Google account settings.

7. Children's Privacy

The Game is not intended for children under 13 (or 16 in some regions). We do not knowingly collect data from children without verifiable parental consent. If we learn we have collected a child's data without consent, we will delete it promptly. Parents may contact us for assistance.

8. International Data Transfers

Data may be processed in the United States or other countries. We use appropriate safeguards (e.g., Standard Contractual Clauses) for transfers when required.

9. Third-Party Links and Services

The Game may link to third-party sites (Facebook, Google, etc.). We are not responsible for their privacy practices — please review their policies.

10. Changes to This Privacy Policy

We may update this policy. Material updates will be communicated via in-game notice or email. Continued use after changes constitutes acceptance.

11. Contact Us

For questions, complaints, or data requests contact:

• Email: playcardkingdom@gmail.com
• Address: Siem Reap, Cambodia
• Governing law: This policy is governed by the laws of Cambodia (the jurisdiction where our company is based), without regard to its conflict of laws principles.