Privacy Policy — CAWAPP

Last updated: 11 June 2026

---

1. Introduction

CAWAPP places particular importance on protecting the privacy and personal data of its users.

This policy describes how CAWAPP collects, uses and protects the information gathered as part of all its activities:

• via the corporate website cawapp.com
• via the games portal games.cawapp.com
• via the mobile games published by CAWAPP (including Forge & Fall, and future catalogue titles)
• via the associated technical services (notably the Cawapp ID identity shared across all Cawapp games)

This policy complies with:

• Regulation (EU) 2016/679 of 27 April 2016 (GDPR)
• the French Data Protection Act of 6 January 1978 as amended
• the California Consumer Privacy Act (CCPA) for users residing in California
• the Children's Online Privacy Protection Act (COPPA) for users residing in the United States and under 13 years of age

2. Data controller

The controller of the data is:

CAWAPP A simplified joint-stock company (SAS) with capital of €1,000 20 rue de Béziers, 93150 Le Blanc-Mesnil, France Bobigny Trade & Companies Register B 818 922 858 Intra-EU VAT number: FR19 818 922 858

General contact: [email protected] Contact for personal-data matters: [email protected]

3. Scope of this policy

This policy applies to all CAWAPP services:

Service	URL or identifier	Status
Corporate website	cawapp.com	Live
Games portal	games.cawapp.com	Live
Mobile game	Forge & Fall (com.cawapp.forgefall)	Live
User identity	Cawapp ID	Live
Future games	Coming soon	Added as titles launch

As CAWAPP is the sole publisher of all its games, a single policy covers them all. Any major change (new game, new data type) will be reflected in an update to this policy.

4. Data collected

CAWAPP collects only the data strictly necessary for the purposes described in section 5. No data deemed sensitive under the GDPR (racial or ethnic origin, political opinions, religious beliefs, health data, etc.) is collected.

4.1 Via cawapp.com and games.cawapp.com

Contact form:

• Full name (required)
• Company or project name (optional)
• Email address (required)
• Message content (required)

Browsing:

• Technical data necessary for the website to function (connection logs kept by the host)
• No tracking cookies, no third-party audience-measurement tool

4.2 Via CAWAPP mobile games (Cawapp ID and game data)

Cawapp ID identity data (identity system shared across all CAWAPP games):

Level	Data collected	Nature
N0 (anonymous)	Unique identifier (uuid) generated automatically + technical device token	Pseudonymous data
N1 (nickname)	Nickname chosen by the user, friend code (friend_code)	Pseudonymous data
N2 (linked account)	Email address, sign-in method (email magic link, Apple Sign-In, Google Sign-In)	Identifying data

Nature (under the GDPR) — "pseudonymous data" = a technical identifier that distinguishes a player without revealing their real identity (uuid, nickname, friend code); not to be confused with the nickname chosen at level N1, which is merely a display name. "identifying data" = data that can be linked to a real person (email address). An N0 account holds no direct personal data — only a technical identifier.

N2 is the highest level currently in use: linking an email, Apple or Google yields a recoverable account (N2). No higher level is in service at this time.

Game data (per game session):

• Workshop played (workshop_id)
• Score achieved
• Session duration
• Highest tier reached
• Number of merges performed
• Orders completed
• Game-over reason (overflow, abandonment, etc.)
• Use of power-ups and continue (revive)
• Game timestamp (played_at)
• Technical session identifier (session_token, client_run_token)
• Device platform (iOS, Android)
• Installed game version
• Device language

Commercial data:

• Premium purchase status (yes/no, purchase date)
• In-app purchases made
• No banking data is collected or stored by CAWAPP; payments are processed directly by the Apple App Store or Google Play Store

Advertising data (non-Premium users only):

• Ad impressions and clicks (anonymized via the advertising SDK)
• Device advertising identifier (IDFA on iOS, AAID on Android), only if the user has consented to tracking

Analytics data:

• Game usage events (launch, session ended, purchase, etc.)
• Aggregated cohort data (retention, conversion, monetization)
• No personal identifier is associated with this analytics data

4.3 Data NOT collected

For transparency, CAWAPP NEVER collects:

• Your real name (unless voluntarily provided via the contact form)
• Your postal address (except for a B2B contractual request)
• Your phone number
• Your phone contacts
• Your health data
• Your biometric data (except local Apple/Google authentication, which never leaves your device)
• Your precise location data (country is inferred from the store, but no GPS geolocation is used)
• The content of your communications outside CAWAPP

5. Purposes of processing

The data collected is used solely to:

For the website and contact form

• Respond to contact or information requests
• Assess the feasibility of professional projects
• Communicate as part of a professional or pre-contractual relationship
• Ensure the technical security of the site (server logs, anti-spam)

For the mobile games

• Enable use of the games and their features (game save, score, progression)
• Manage Cawapp ID user accounts and their progression levels (N0 to N2)
• Enable social features (friends leaderboards, friend code, adding friends)
• Manage leaderboards (monthly Global, perpetual Friends)
• Detect and prevent cheating and abuse
• Enable and secure in-app purchases (Premium, etc.)
• Serve relevant advertising to non-Premium users
• Analyze usage statistics to improve the games
• Communicate with users about their account or technical matters
• Comply with legal and regulatory obligations

6. Legal bases for processing

Processing relies on the following legal bases under Article 6 of the GDPR:

Purpose	Legal basis	Reference
Account creation, account management, game features	Performance of a contract	Art. 6.1.b
Responding to contact requests	Consent / Pre-contractual steps	Art. 6.1.a / 6.1.b
Security, anti-fraud, anti-cheat	Legitimate interest	Art. 6.1.f
Statistical analysis of game usage	Legitimate interest (anonymized)	Art. 6.1.f
Personalized advertising	Consent	Art. 6.1.a
Non-personalized advertising	Legitimate interest	Art. 6.1.f
Premium purchase and other IAPs	Performance of a contract	Art. 6.1.b
Mandatory communications (policy updates, etc.)	Legal obligation	Art. 6.1.c

7. Recipients of the data

Your data is intended solely for authorized staff within CAWAPP. It is not assigned, rented, sold or transferred to third parties for commercial purposes.

CAWAPP uses the following technical sub-processors, strictly necessary to operate the services:

Hosting and infrastructure

Sub-processor	Role	Location	Safeguards
o2switch (SAS)	Hosting of cawapp.com, games.cawapp.com, and the Cawapp ID backend	France (European Union)	Inherent GDPR compliance

Distribution platforms

Sub-processor	Role	Location	Safeguards
Apple Inc.	Distribution of iOS apps, processing of iOS IAP payments	United States	Privacy Shield successor framework, Apple DPA
Google LLC	Distribution of Android apps via Google Play, processing of Android IAP payments	United States	Google Play DPA, Standard Contractual Clauses

Advertising (mobile games, non-Premium users only)

Sub-processor	Role	Location	Safeguards
ironSource / LevelPlay	Ad mediation	Israel, United States	ironSource DPA, Standard Contractual Clauses

Statistical analysis

Sub-processor	Role	Location	Safeguards
GameAnalytics ApS	Anonymized statistical analysis of the games	Denmark (European Union)	Inherent GDPR compliance

The full list of sub-processors is kept up to date and available on request at [email protected].

8. International data transfers

Some technical sub-processors are located outside the European Union (Apple, Google, ironSource). These transfers take place under:

• the Standard Contractual Clauses approved by the European Commission
• the Data Processing Agreements (DPAs) signed with each sub-processor
• additional technical measures (encryption, pseudonymization) where relevant

CAWAPP undertakes to maintain a level of data protection equivalent to that in force within the European Union, regardless of the place of processing.

9. Retention period

Website data

• Contact-form data: 3 years from the last exchange
• Host's technical logs: 12 months maximum

Mobile game data

• Active Cawapp ID account (N0 to N2): kept as long as the account is in use
• Inactive Cawapp ID account: 24 months of inactivity triggers an email notification (N2+ only), then automatic deletion if no reconnection within the following 6 months
• Detailed game data (individual scores): 5 years from the session
• Aggregated statistics (personal records per workshop): kept while the account is active
• Monthly leaderboards: kept indefinitely in anonymized form for historical purposes (past leaderboards remain accessible but uuids are anonymized after 12 months)
• Premium purchase data: kept 10 years (accounting and tax obligations)
• Advertising data: kept by the advertising sub-processor according to its own policy

Deletion on request

The user may request deletion of their account at any time (see section 10). In that case:

• Identifying personal data (email, nickname, friend_code) is deleted within 30 days
• The account and its scores are removed from leaderboards (no name remains)
• Accounting data (purchases) is kept 10 years (legal obligation)
• Security backups may contain data for an additional 90 days before final overwrite

10. Your rights

In accordance with Articles 15 to 22 of the GDPR and the equivalent provisions of the CCPA, you have the following rights over your data at any time:

Right	Description
Right of access	Obtain a copy of all personal data concerning you
Right to rectification	Correct inaccurate data
Right to erasure ("right to be forgotten")	Request deletion of your account and your data
Right to restriction of processing	Request a temporary suspension of the use of your data
Right to portability	Receive your data in a structured, usable format (JSON export)
Right to object	Object to certain processing (e.g. targeted advertising)
Right to withdraw consent	At any time, without retroactive effect
Right to set post-mortem directives	Regarding the processing of your data after your death

How to exercise these rights

To exercise these rights, send a request to [email protected], specifying:

• The right you wish to exercise
• Your Cawapp ID uuid if you know it (or your nickname + friend_code, or your linked email)
• Any information useful to handle the request

You will receive a response within one month at most, extendable by two months in case of particular complexity (with prior notice).

If there is doubt about your identity, CAWAPP may request additional information to ensure it is indeed you.

Complaint to the supervisory authority

You also have the right to lodge a complaint with the CNIL (the French data-protection authority) if you believe the processing of your data does not comply with the regulations:

CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 Website: www.cnil.fr

Users located in another EU member state may contact their local data-protection authority.

11. Cookies and trackers

On the websites cawapp.com and games.cawapp.com

The website currently uses no tracking cookie and no audience-analytics tool. Only cookies strictly necessary for technical operation may be placed; they do not require your consent (Article 82 of the French Data Protection Act).

If measurement or personalization tools were to be added in future, a consent banner compliant with CNIL recommendations would be put in place and this policy updated accordingly.

In the mobile games

CAWAPP games do not use cookies in the classic sense (the cookie concept is specific to web browsers). However, advertising SDKs (non-Premium users only) may access your device's advertising identifier (IDFA/AAID), subject to your prior consent in accordance with Apple's App Tracking Transparency (ATT) framework on iOS and equivalent provisions on Android.

12. Security

CAWAPP implements appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure, alteration or destruction:

• Encryption in transit: mandatory HTTPS/TLS connection for all exchanges
• Encryption at rest: sensitive data encrypted in the database
• Restricted access: only authorized staff within CAWAPP have access to the data
• Strong authentication: administrator access via multi-factor authentication
• Regular backups: daily encrypted backups
• Awareness: ongoing staff training in good security practices
• Regular audits: periodic security reviews of all systems

In the event of a data breach likely to create a risk to your rights and freedoms, CAWAPP undertakes to notify the CNIL within 72 hours in accordance with Article 33 of the GDPR, and to inform you as soon as possible.

13. Protection of minors

CAWAPP games are designed for an adult or teenage audience. In accordance with the GDPR (Article 8) and COPPA:

• The minimum age to create a Cawapp ID account linked to an email (level N2) is 16 in the European Union, 13 in the United States and other jurisdictions
• Users below this age may play in anonymous mode (N0) without creating an account
• No personalized advertising is served to users identified as minors
• No data is knowingly collected from children under 13 without verifiable parental consent
• If CAWAPP learns that an account belongs to a minor below the legal age, the account is suspended and the data deleted

Parents and guardians may at any time exercise the rights set out in section 10 on behalf of their minor child by contacting [email protected].

14. Changes to the policy

This policy may evolve (launch of new games, changes to technical tools, regulatory changes, etc.).

Any substantial change will be:

• Indicated on this page with the update date
• Notified by email to users holding an N2 or higher account, where applicable
• Subject to fresh explicit consent where the regulations require it

We invite you to review this policy regularly.

15. Contact

For any question about this policy or the processing of your data:

• Email: [email protected]
• Mail: CAWAPP, 20 rue de Béziers, 93150 Le Blanc-Mesnil, France

---

Legal document governed by French and European law. In the event of a discrepancy in interpretation between language versions, the French version prevails.