1. INTRODUCTION

First Fun Inc. ("First Fun," "we," "our," or "us") provides games, websites, player-support channels and other related services that link to this Privacy Policy (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, retain and otherwise process personal data when you use the Services, and the choices and rights available to you.

The personal data we collect and how we use it depend on the Services you use, the features you interact with, your device and platform, your privacy settings and where you live. Certain Services may provide additional or service-specific privacy notices. Where such a notice applies to a particular Service or feature, that notice supplements this Privacy Policy for the relevant processing.

Some jurisdictions require additional disclosures or provide additional rights. Please review the Supplemental Terms – Jurisdiction-Specific at the end of this Privacy Policy. If a jurisdiction-specific supplement conflicts with the main body of this Privacy Policy, the supplement applies to users in that jurisdiction to the extent of the conflict.

This Privacy Policy describes First Fun's own privacy practices. It does not apply to the privacy practices of third parties that we do not control, including third-party websites, platforms, app stores or services that you may access through or in connection with the Services. Those third parties may process personal data under their own privacy policies. See Section 8 (Third-Party Partners).

Your use of the Services is also subject to the Terms of Service applicable to your region, including provisions concerning dispute resolution, limitations of liability and governing law, where applicable. Please read the Terms of Service carefully before using the Services.

2. CONTACT US

If you have questions about data protection or would like to exercise a privacy right, you may also contact us at contactus@harborrushgame.com.

3. PERSONAL DATA WE COLLECT

We may collect personal data about you (1) directly from you, (2) automatically when you use the Services, and (3) from third parties. The information we receive depends on the Service you use, the features you interact with, third parties you choose to connect with and your privacy settings.

3.1 Information you provide directly

• Account and profile information, such as your player name, account identifier, profile image, country or region, language and other profile information.
• Contact and account-recovery information, such as your email address and other information used to recover, secure or verify an account.
• Content and communications, such as public posts, in-game chat, direct messages, survey responses and player-support tickets and attachments.
• Transaction-related information you provide in connection with purchases, refunds or other transactions. Payment-card and bank-account credentials are processed directly by the relevant app store or third-party payment provider. We do not collect, access, or store full payment-card details, bank-account information, or other payment credentials. Instead, we typically receive only transaction confirmations and related transaction records necessary to process or verify the transaction.
• Tax-related information, where required in connection with payments, refunds or other transactions, such as your tax residency, taxpayer identification number or other information necessary to comply with applicable tax and reporting obligations.
• Any other information you choose to provide to us.

3.2 Information collected automatically

• Identifiers and device information, including player IDs, device IDs, advertising IDs, IP addresses, cookie or SDK identifiers, session IDs and similar identifiers; device model, operating system and version, browser type, language, application/build version, mobile network or connection information and related technical attributes.
• Approximate location, generally inferred from your IP address or device settings. We may also collect more specific location or address information where necessary for tax, regulatory or reporting purposes. We do not otherwise collect precise geolocation unless we separately explain the relevant feature and obtain any consent or other authorization required by applicable law.
• Gameplay and usage information, including log-in and session information, timestamps, gameplay actions, matches, results, progression, rankings, achievements, social interactions, feature use and time spent in the Services.
• Technical, diagnostic and telemetry information, including application performance, crashes, errors, latency, event logs and related technical metadata.
• Purchase and virtual-economy information, including order ID, order amount, virtual currency or resource balances, rewards, purchases, redemptions, chargebacks and refunds.
• Advertising and attribution information, including ad impressions, clicks, conversions, campaign and attribution information, advertising-consent or tracking-authorization status and interactions with advertising content.
• Inferences and personalization information derived from other information we collect, such as likely preferences, interests, engagement patterns or general geographic location.
• Security and integrity information used to prevent fraud, abuse, account compromise or other prohibited conduct.

3.3 Information from third parties

• Platform and app-store providers, including account information, purchase-verification, refund and fraud-prevention information.
• Social-login or connected-account providers, such as Apple, Google, Facebook or other services you choose to connect. The information we receive depends on your settings and the provider's permissions.
• Advertising, attribution and analytics partners, including campaign, device, conversion, audience and fraud-detection information.
• Payment providers, customer-support providers and other service providers.
• Other users, public sources, or law-enforcement and public authorities where permitted by law.

For some Services, we may collect additional information beyond the categories described above. Where appropriate, we will provide an additional privacy notice describing that processing.

4. MOBILE IDS, COOKIES AND SIMILAR TECHNOLOGIES

We and our partners may use mobile identifiers, cookies, SDKs, pixels, local storage and similar technologies to operate the Services, remember preferences, understand usage and performance, and prevent fraud, measure advertising.

Mobile analytics and advertising identifiers are generated by operating systems such as iOS and Android and may be accessed by applications and SDKs. Where required by law, we obtain consent before using non-essential cookies, SDKs or similar technologies.

Depending on the Service and the technologies used, you may be able to manage certain cookies or similar technologies through available privacy or cookie settings, your browser controls, or your device settings. Where required by law, we honor recognized opt-out preference signals such as Global Privacy Control. Browser "Do Not Track" signals are not interpreted consistently across the industry, and our Sites do not currently respond to DNT signals.

4.1 Analytics and Advertising

Some personal data we collect through cookies, SDKs, mobile identifiers and similar technologies may be used for analytics, attribution, campaign measurement and fraud prevention. In addition to technologies we operate ourselves, we may use technologies provided by service providers and partners to help us understand how the Services are used, measure performance and the effectiveness of campaigns, attribute installs or other events, and protect the Services from fraud or abuse.

Depending on the technology used, these providers may receive identifiers, device information, IP address, usage or event data, and related technical information. Where appropriate, we use contractual restrictions, configuration settings and other controls designed to limit providers to the purposes for which we engage them and to require processing in accordance with applicable law.

We do not sell personal information, share personal information for cross-context behavioral advertising, or use personal information for targeted advertising, as those terms are defined under applicable U.S. state privacy laws. Certain analytics or advertising providers may offer their own privacy controls. You can also use the controls described in this Section and exercise applicable privacy rights as described in Section 7.

5. HOW WE USE PERSONAL DATA

We use personal data for the purposes described below and for other purposes we explain to you at the time of collection. Where the GDPR or UK GDPR applies, the legal basis depends on the data concerned and the specific context in which we use it.

5.1 Safety, Moderation and Integrity

We may receive and review player reports, support tickets, communications, uploaded content and information about in-game activity or conduct to enforce our Terms of Service and other applicable rules, protect players, prevent abuse, cheating, fraud and account compromise, and maintain the safety and integrity of the Services. Where legally permitted and reasonably necessary for these purposes, we may process and retain text, voice or similar communications, transcripts and related metadata. The availability and operation of these features may vary by Service and jurisdiction.

We may use a combination of manual review and automated tools, including filtering, transcription, pattern matching, machine-learning-assisted classification, anti-cheat, fraud detection and risk-scoring technologies, to identify or investigate potentially harmful, abusive, fraudulent, cheating or otherwise prohibited activity. These measures may analyze account, device, network, gameplay, transaction, communication and behavioral information and may support actions such as warnings, content or communications restrictions, limited access or account suspension. Where required by law or otherwise appropriate, you may be able to request review of an enforcement decision through the applicable player-support channel.

6. WHO MAY ACCESS OR RECEIVE PERSONAL DATA

In addition to First Fun, the following categories of parties may access or receive personal data as reasonably necessary for the purposes described in this Privacy Policy:

• Other players and the public. Information you choose to make public in the Services, such as your player name, profile image, rankings, achievements, guild or alliance information and public posts, may be visible to other users. Please avoid posting personal or sensitive information in public areas.
• Third-party social or connected services, where you direct us to connect or share information with those services.
• Service providers and processors that provide hosting, cloud infrastructure, analytics, customer support, communications, localization, content moderation, security, fraud prevention and other operational services on our behalf.
• App stores, platforms, payment providers and financial institutions involved in processing purchases, verifying entitlements, supporting refunds, preventing fraud or providing platform functionality.
• Affiliates, where access is necessary to provide the Services or operate our business and is subject to appropriate safeguards.
• Professional advisers, auditors, insurers and counterparties in connection with a merger, acquisition, financing, reorganization, asset sale or similar corporate transaction.
• Government authorities, courts, law enforcement or regulators where required by law, in response to valid legal process, or where reasonably necessary to protect rights, safety, property, users or the Services.
• Other parties at your direction or with your consent.

Third-party analytics, attribution and advertising partners may also collect information through the Services, such as identifiers, device information, IP address, usage data and related technical information, for purposes such as analytics, attribution, campaign measurement or fraud prevention.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising as those terms are defined under applicable U.S. state privacy laws. See Sections 4 and 7 and the U.S. supplement below.

7. YOUR CHOICES AND PRIVACY RIGHTS

Some jurisdictions, including certain U.S. states and regions such as the European Economic Area and the United Kingdom, provide additional privacy rights by law. Depending on where you live and subject to applicable conditions and exceptions, you may have some or all of the following rights, as well as other rights provided by applicable law:

• Access: The right to request confirmation of whether we process personal data about you, information about the personal data we hold and how it is processed, and, where applicable, a copy of that data.
• Correction: The right to request correction or completion of inaccurate or incomplete personal data concerning you.
• Deletion: The right to request deletion of personal data we hold about you, subject to applicable legal exceptions and retention requirements.
• Restriction: The right, in certain circumstances, to request that we restrict the processing of your personal data.
• Data portability: The right, where applicable, to receive certain personal data concerning you in a structured, commonly used and machine-readable format and to request that it be transmitted to another controller where technically feasible.
• Objection: The right, in certain circumstances, to object to processing of your personal data, including where processing is based on legitimate interests or another legal basis that gives rise to a right to object.
• Withdraw consent: Where we rely on your consent, the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Complaint: The right, where applicable, to lodge a complaint with a competent data-protection or privacy authority.

We do not sell personal information or share personal information for cross-context behavioral advertising. Accordingly, we do not provide an opt-out for those activities. Where applicable law provides other opt-out or limitation rights, we will honor those rights as required by law.

To exercise a privacy right, contact us at contactus@harborrushgame.com. We may ask for information reasonably necessary to verify your identity, locate the relevant account, understand your request and protect against fraudulent requests. We will acknowledge and respond to requests within the time required by applicable law. Where permitted by law, a request may be subject to limitations, exceptions or a reasonable fee.

Where applicable law permits, you may submit a request through an authorized agent. We may require evidence that the agent is authorized to act on your behalf and may also require you to verify your identity or confirm the authorization directly with us. We may deny an agent request if the authorization or verification requirements under applicable law are not satisfied.

Exercising certain rights may affect your ability to use some or all of the Services. For example, deleting information necessary to maintain your account or game progress may result in loss of access to the relevant account, progress or features. We may retain limited personal data where necessary to comply with law, maintain records, prevent fraud, resolve disputes, protect legal rights or enforce our agreements.

You have the right not to be unlawfully discriminated or retaliated against for exercising privacy rights available to you under applicable law.

If we do not take action on your request, or if you are not satisfied with our decision, you may have the right to appeal by contacting contactus@harborrushgame.com. Where an appeal right applies, we will review and respond to the appeal within the period required by applicable law and provide any further information required by law. This does not affect any right you may have to lodge a complaint with a competent data-protection or privacy authority.

8. THIRD-PARTY PARTNERS

We may use third-party providers to support the Services, including infrastructure, analytics, attribution, customer support, security and other functions. Providers acting on our behalf may process personal data as described in this Privacy Policy. Third-party services that act independently or that we do not control are responsible for their own privacy practices, which are governed by their own privacy policies.

9. RETENTION OF PERSONAL DATA

We retain personal data for as long as reasonably necessary to provide the Services and fulfill requested transactions, comply with legal obligations, resolve disputes, enforce agreements and support other legitimate and lawful business purposes. Because these needs vary by data type and context, retention periods may vary based on factors such as the nature and sensitivity of the data, user expectations or consent, security and fraud risks, and legal, accounting or contractual obligations.

When personal data is no longer needed, we delete or anonymize it, subject to lawful exceptions, backups and legal holds. If you request deletion, we may retain limited information where necessary to comply with law, resolve disputes, prevent fraud or enforce our agreements. Deleting an account may result in loss of access to game progress, account information and related Services.

10. LOCATION AND INTERNATIONAL TRANSFERS

We operate globally. Personal data may be stored or processed in the United States, Singapore and other countries where we, our affiliates, or our service providers operate. These countries may have data protection laws that differ from those in your country of residence. Where required by applicable law, we use appropriate safeguards to protect personal data transferred internationally and rely on lawful transfer mechanisms recognized under applicable data-protection laws.

11. SECURITY

We use administrative, technical, and physical safeguards designed to protect personal data from loss, misuse and unauthorized access, disclosure, alteration, or destruction. No system or transmission method is completely secure, and we cannot guarantee absolute security. You should protect your account credentials and notify us if you suspect unauthorized access to your account.

12. AGE LIMITS AND CHILDREN

If you are old enough to use the Services, but are considered a minor in your country, your parent or legal guardian should review this Privacy Policy with you and provide any permission required by applicable law. Where prohibited or discouraged by applicable local laws or policies, we may be unable, or may choose not, to provide the game services to minors.

We recognize that children require special protection in relation to personal data. We do not knowingly collect personal data from children below the applicable minimum age without legally required authorization. If we learn that we have done so, we will take steps to delete or otherwise handle that information as required by law. If you believe we may hold personal data from or about a child in circumstances that are not permitted, please contact us using Section 2.

13. SUPPLEMENTAL TERMS – JURISDICTION-SPECIFIC

13.1 European Economic Area, United Kingdom and Switzerland

If the processing of your personal data is subject to the GDPR, UK GDPR or applicable Swiss data-protection law, you may have rights to access, rectify or erase personal data; receive certain data in a portable format; withdraw consent; object to or restrict certain processing; and complain to a competent supervisory authority. Where processing is based on legitimate interests, you may request further information about those interests. Where data is transferred internationally without an applicable adequacy decision, we use recognized transfer safeguards as described in Section 10. If you are in the EEA or UK, you may lodge a complaint with the data-protection authority in your country or region, without prejudice to any other administrative or judicial remedy available to you.

13.2 California and Other U.S. States

This section supplements the Privacy Policy for residents of California and other U.S. states with comprehensive privacy laws. Terms such as "personal information," "sale," "share," "targeted advertising," "profiling," and "sensitive personal information" have the meanings assigned by applicable law.

In the preceding 12 months, we have collected personal information as described in the table below.

• Notice at Collection. More information on the sources and purposes are described in Sections 3 and 5, the categories of recipients in Section 6, and our retention practices in Section 9.
• Sale, sharing and targeted advertising. We do not sell or share personal information for cross-context behavioral advertising, or use personal information for targeted advertising, as those terms are defined under applicable U.S. state privacy laws. We do not knowingly sell or share the personal information of users under 16 without the affirmative authorization required by applicable law. This is why Section 6 lists categories of data recipients even while the table above indicates no "selling" or "sharing" with "third parties."
• Subject to applicable exceptions, residents may have rights to know/access, correct, delete or obtain portability of personal information; opt out of sale, sharing or certain profiling where applicable; limit certain uses of sensitive personal information; appeal certain denials; and exercise rights without unlawful discrimination. California residents may use an authorized agent. Where required, we honor Global Privacy Control on a device-by-device basis.
• California residents under 18 who are registered users may also have rights under California law to request removal of certain content they have publicly posted. A removal request may not result in complete removal where the law permits or requires continued retention.
• California "Shine the Light." California residents may have rights under California Civil Code Section 1798.83 regarding certain disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes as contemplated by this law.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will post the updated version and revise the "Effective date". If changes materially affect your rights or how we use personal data, we will provide additional notice in the Services or obtain consent where required by applicable law.