Privacy Policy

Last updated: August 27, 2026  ·  Effective: August 27, 2026

This Privacy Policy explains what data is collected when you play the mobile games and use the applications, websites and online services published by Mad Poly Studio, why we collect it, who we share it with, how long we keep it, and how you can ask us to delete it.

1. Who we are

These games and services are published by Mad Poly Studio, a game studio of VNGGAMES PTE. LTD. (“Mad Poly Studio”, “we”, “us” or “our”), which is the data controller for the data described in this policy.

2. Which products this policy covers

This policy applies to all mobile games and applications published by Mad Poly Studio on the Google Play Store and the Apple App Store, to their associated Meta / Facebook apps, and to the websites and support channels we operate under the madpoly.studio domain (together, the “Services”).

The specific game you are playing may not use every feature described below. Where a section applies only to some titles, we say so explicitly. If you are unsure which data a particular title collects, contact us at support.global@vng.com.vn and we will tell you.

3. What we collect

4. What we do not collect

• We do not ask for your real name, date of birth, postal address or telephone number.
• We do not receive or store your credit card number, bank details or any payment credentials. All purchases are processed by Apple or Google; we only receive a confirmation that a purchase succeeded.
• We do not collect precise GPS location, your contacts, your photo library, your microphone or your camera, unless a specific game feature asks for your explicit permission first and you grant it.
• We do not read your Facebook messages, your private posts, or the content of your Facebook timeline.
• We do not sell your personal data.

5. Meta / Facebook SDK — exactly what we use it for

Our games integrate the Facebook SDK for Unity published by Meta Platforms. We want to be precise about what it does, because it is the part players ask about most often.

5.1 In every title that includes the SDK

The SDK is initialised when the game starts and is used for App Events (analytics) and advertising attribution only. Specifically, it reports to Meta:

• an app activation / session event each time you open the game;
• a first-launch event the first time you open the game after installing it;
• standard in-app purchase events containing the product identifier, the price and the currency — never a payment method;
• your device advertising identifier together with basic device and app information, which Meta uses to match an install back to the advertising campaign it came from.

These events tell us how many people install and play our games and whether our advertising is working. They do not require you to have a Facebook account, and they do not give us access to any Facebook profile.

5.2 In titles that offer a Facebook Login button

Some of our titles let you connect a Facebook account. This is always optional — you can install, play and complete the game without ever pressing it. If you do choose to connect, Meta shows you a consent screen, and only if you approve it do we receive:

• public_profile — your Facebook user ID, your name and your profile picture, used to identify your saved progress and to show your name on friend lists and leaderboards;
• email — your Facebook email address, used to recover your account and to contact you about your account if you ask us to;
• user_friends — the list of your Facebook friends who also play the same game and have also connected their account, used for friend lists, invitations and social leaderboards. Meta does not give us your full friend list.

Where a game offers sharing, inviting or posting features, those actions are only performed when you tap the corresponding button and confirm the dialog that Meta displays. We never post to your Facebook account in the background.

You can disconnect at any time from the game settings screen, or by removing the game under Facebook Settings → Apps and Websites. Removing the app there stops any further data sharing between Meta and us. To also delete the data we already hold, follow the instructions on our Data Deletion page.

5.3 Data we receive from Meta

Apart from the profile fields listed in section 5.2 — which we only receive with your consent — the only information Meta sends back to us is aggregated advertising and campaign reporting, for example how many installs a campaign produced. That reporting does not identify individual people.

6. Third parties who process data for us

We use a small number of established service providers. Each one is bound by a contract to process data only on our instructions and to keep it secure. We do not sell your data to anyone.

We may also disclose data where we are legally required to do so — to comply with a valid legal request, to enforce our terms of service, to investigate fraud or cheating, or to protect the rights, property or safety of our players, our staff or the public.

7. Advertising and your choices

Our free-to-play games are supported by advertising. Ads may be personalised using your advertising identifier. You are in control of this:

• Android: Settings → Google → Ads → Delete advertising ID (or Opt out of Ads Personalisation).
• iOS: Settings → Privacy & Security → Tracking → turn off Allow Apps to Request to Track. On iOS we ask for your permission through the Apple App Tracking Transparency prompt before the advertising identifier is used for tracking; if you decline, it is not used.
• You will still see ads after opting out, but they will be less relevant to you.

8. Legal bases for processing

Where the GDPR or a similar law applies to you, we rely on the following legal bases:

• Performance of a contract — to provide the game, save your progress and deliver your purchases.
• Legitimate interests — to keep the game secure and free of cheating, to fix crashes, and to understand how our games are used in aggregate.
• Consent — for personalised advertising, for optional Facebook Login, and for any device permission you grant. You may withdraw consent at any time.
• Legal obligation — to keep transaction records for tax and accounting purposes.

9. International transfers

We and our service providers operate globally, so your data may be processed in countries other than the one you live in, including Singapore, Vietnam, the European Union and the United States. Where data leaves the European Economic Area or the United Kingdom, we rely on the European Commission Standard Contractual Clauses or another lawful transfer mechanism.

10. Storage, security and retention

Your data is stored on access-controlled cloud infrastructure. We protect it with encryption in transit (TLS/HTTPS), encryption at rest for our databases and backups, network isolation, and role-based access limited to the small number of staff who need it for their work. All of them are bound by confidentiality obligations. We review our systems for vulnerabilities on a regular basis.

No system can be guaranteed to be perfectly secure. If a breach affects your personal data and creates a risk to you, we will notify you and the relevant supervisory authority as required by law.

11. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — ask for a copy of the data we hold about you.
• Rectification — ask us to correct data that is wrong or incomplete.
• Erasure — ask us to delete your data. See section 12.
• Portability — receive your data in a structured, machine-readable format.
• Restriction and objection — ask us to stop or limit certain processing, including profiling for personalised advertising.
• Withdraw consent — at any time, without affecting processing already carried out.
• Complain — to your local data protection authority.

Exercising these rights is free. To do so, email support.global@vng.com.vn with the name of the game and your in-game player ID. We will respond within 30 days.

12. How to delete your data

13. Children’s privacy

Our games are not directed at children under the age of 13 (or the higher minimum age that applies in your country, such as 16 in parts of the European Economic Area), and we do not knowingly collect personal data from them. Titles that we distribute to a mixed audience apply the age screening and reduced-data settings required by the Google Play Families policy, the Apple App Store guidelines, COPPA and the GDPR — which includes disabling personalised advertising and the collection of advertising identifiers for users identified as children.

If you are a parent or guardian and believe your child has provided us with personal data, email support.global@vng.com.vn. We will verify the request and delete the data promptly.

14. Changes to this policy

We may update this policy as our games change or as the law requires. When we do, we will update the “Last updated” date at the top of this page and publish the new version at this same URL. If a change materially affects how we use your data, we will give you clearer notice — through an in-game announcement or notification before the change takes effect, and, where the law requires it, we will ask for your consent again. We encourage you to review this page from time to time.

15. Contact us

For any question about this policy, about the data we hold, or to exercise any of your rights:

We aim to answer every enquiry within 30 days.