Privacy Policy

Zodiverse Publishing OÜ (“we,” “us,” “our”) is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data when you visit thezodiverse.com, purchase products from us, or use any of our mobile applications published under the Zodiverse Reälms label (including Riverhold and future titles such as Memeleon Clicker, Memeleon Fly Catcher, and Zodiverse Card Game) on the Apple App Store and Google Play.

We are the data controller for the purposes of the EU General Data Protection Regulation (GDPR) and UK Data Protection Act 2018.

1. What Data We Collect

When you make a purchase, we collect:

• Full name
• Email address
• Shipping address
• Billing address
• Order details and history

When you visit our website, we may collect:

• IP address
• Browser type and version
• Pages visited and time spent
• Referring website

When you contact us:

• Name
• Email address
• Message content

When you use our mobile apps (Zodiverse Reälms titles):

• A pseudonymous player account identifier (used to save your progress)
• Display name and avatar you choose in-game
• Device platform and operating system version (iOS / Android)
• A device advertising identifier (Apple IDFA or Google Advertising ID) only where you have granted explicit permission via your operating system; we do not use this for cross-app tracking
• IP address (collected automatically when your device connects to our servers)
• Gameplay state (your characters, inventory, currency balances, quest progress, achievements)
• In-app purchase receipts (token, product identifier, transaction date) returned by the Apple App Store or Google Play; we never see or store your payment card details
• Crash reports and basic diagnostic information when the app fails unexpectedly

2. How We Use Your Data

We use your data for the following purposes:

• To fulfil and deliver your orders
• To communicate with you about your orders
• To process refunds or exchanges
• To respond to your enquiries
• To improve our website and services
• To save and synchronise your gameplay progress across sessions and devices
• To validate in-app purchases against the Apple App Store or Google Play receipt servers and credit the correct items to your account
• To detect and prevent fraud, cheating, and abuse in our apps
• To diagnose crashes and improve app stability
• To comply with legal obligations

We do not use your data for automated decision-making or profiling.

3. Legal Basis for Processing

Under GDPR, we process your data on the following legal bases:

• Contract: Processing necessary to fulfil your order
• Legitimate interest: Improving our website and services
• Consent: Where you have opted in to receive communications
• Legal obligation: Where required by law (e.g., tax records)

4. Who We Share Your Data With

We share your data only with the following third parties, solely for order fulfilment, website operation, and app delivery:

• Stripe — payment processing for website orders (see Stripe’s privacy policy at stripe.com/privacy)
• Royal Mail / postal services — order delivery
• Apple Inc. — iOS app distribution, in-app purchase processing, and receipt validation (see Apple’s privacy policy at apple.com/legal/privacy)
• Google LLC — Android app distribution via Google Play, Google Play Billing for in-app purchases, and receipt validation (see Google’s privacy policy at policies.google.com/privacy)
• Hetzner Online GmbH (Germany) — hosting our game servers and website infrastructure within the European Economic Area

Website analytics are not shared with anyone. We measure how our website is used with Umami, an open-source analytics tool we run ourselves on our own servers in the European Economic Area. No analytics company, advertising network or data broker receives your visit. Umami sets no cookies, does not follow you across other websites, and does not collect anything that identifies you personally — it records the page visited, the site you arrived from, and coarse details such as browser, operating system and country.

We do not sell, rent, or trade your personal data to any third party. We do not share your data with marketing companies or advertisers. We do not use third-party advertising SDKs in our apps.

5. International Data Transfers

As an Estonian company, your data may be processed within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g., to payment processors), appropriate safeguards are in place in accordance with GDPR requirements.

6. Data Retention

We retain your personal data for the following periods:

• Order data: 7 years (for tax and accounting compliance)
• Contact enquiries: 2 years
• Website analytics: 26 months (anonymous, cookieless; no personal data is held)
• App account and gameplay data: for as long as your account remains active. If you request account deletion (see Section 13), all gameplay data is erased within 30 days, except where law requires us to retain transaction records (in-app purchase receipts are kept for 7 years for tax compliance).
• Crash and diagnostic logs: 90 days

After these periods, data is securely deleted.

7. Your Rights

Under GDPR and UK data protection law, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict processing of your data
• Object to processing of your data
• Data portability — receive your data in a structured format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at loridze@thezodiverse.com. We will respond within 30 days.

8. Cookies

Our website uses a small number of cookies to ensure proper functionality. It does not use cookies to understand how visitors use the site.

Essential cookies: Required for the website to function (e.g., shopping cart, session management). These cannot be disabled.

Analytics cookies: None. We measure site usage with self-hosted, cookieless analytics that store nothing on your device and cannot identify you, so there is no analytics cookie to accept or refuse. See our Cookie Policy for detail.

You can manage your cookie preferences through your browser settings. For more details, see our Cookie Policy.

9. Children’s Privacy

Our website and our mobile apps are not directed at children under 13 (or under 16 in the European Economic Area and United Kingdom). Riverhold and other Zodiverse Reälms titles contain dark fantasy themes and are rated for older players; they are not designed for, or marketed to, children. We do not knowingly collect personal data from children under these age thresholds. In our apps we do not use third-party advertising SDKs, behavioural advertising, or cross-app tracking that would identify a child user.

If you believe a child has provided us with personal data, please contact us at loridze@thezodiverse.com and we will delete the account and associated data within 30 days.

10. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All payment data is handled by Stripe and is never stored on our servers.

11. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date.

12. In-App Purchases

Our apps offer optional in-app purchases of virtual currency (such as Riverstones) and other in-game items. All payments are processed by Apple App Store or Google Play. We never see your full payment card details. The purchase receipt token returned by Apple or Google is sent to our servers solely to verify the purchase and credit the correct items to your account. Receipt tokens are retained for tax compliance (7 years).

Virtual items purchased in our apps have no monetary value outside the app, cannot be exchanged for real money, cannot be withdrawn to an external wallet, and cannot be transferred between accounts. Where law grants you a statutory right of withdrawal for digital content, the right is exercised by contacting loridze@thezodiverse.com within the applicable period.

13. Account Deletion

You can request deletion of your in-app account at any time by emailing loridze@thezodiverse.com from the email address associated with your account, or by using any in-app account-deletion option where available. We will erase your gameplay data, identifiers, and contact records within 30 days. In-app purchase receipts are retained for tax compliance (7 years) but are dissociated from any directly identifying information.

14. Contact and Complaints

For any privacy-related questions or to exercise your rights:

Zodiverse Publishing OÜ
Email: loridze@thezodiverse.com

If you are not satisfied with our response, you have the right to lodge a complaint with:

• Estonia: Andmekaitse Inspektsioon (Data Protection Inspectorate) — aki.ee
• UK: Information Commissioner’s Office (ICO) — ico.org.uk