This policy describes how we process personal data in the RiKiKing mobile app (iOS/Android, bundle hu.magic9.rikiking), a digital Rikiki card game. The playable game is not offered as a public website. Official site: https://rikiking.com.

This text matches the product. It is not a substitute for independent legal advice.

1. Controller

• Company: Magic 9 Korlátolt Felelősségű Társaság (Magic 9 Kft.)
• Registered seat: 3528 Miskolc, Bodrog utca 28. 2. ép., Hungary
• Company registry no.: 05-09-031661 (Company Court of the Miskolc Regional Court)
• Tax ID (HU): 26691059-2-05
• EU VAT ID: HU26691059
• Email: [email protected]
• Website: https://rikiking.com

We have not appointed a DPO (GDPR Art. 37 does not require one for our activities). Privacy requests: [email protected].

2. Data we process

We do not store payment card numbers. Apple and Google process payments.

• Account: email, password hash (Firebase Auth), Firebase UID, or anonymous guest UID. After registration we send a one-time email verification message; verification status is stored with the account (verified accounts receive a one-time crown bonus).
• Marketing email (optional): only if you tick the unticked box at registration — email, UID, consent flag and consent timestamp. Used to send news, tournaments and offers about RiKiKing.
• Profile & UGC: display name, optional country, avatar/frame/card-back/table IDs, friends, invites, in-app messages.
• Play: wins/losses, ranked RP, tie-break tricks, Kings’ Path XP/seals, daily/weekly mission state.
• Economy: crown balance, cosmetics inventory, ad-free / unlimited-invite expiry, store transaction IDs when verified.
• Ads: advertising ID (IDFA/GAID) only with consent (iOS ATT + EEA/UK UMP). Interstitial at match end; rewarded ads for daily login, daily missions, and the invite seal.
• Device / local: OS/device type, App Check token, local settings, a short on-device crash log, local notification permission (streak / leaderboard / seal reminders).
• Web deletion form: email or UID and optional reason.

Ad-free: no ad after a match, and daily login / mission rewards without watching an ad. The invite-seal ad still plays.

Firebase Analytics / gtag run only if those SDKs are actually present; the app includes a no-op bridge and does not require cloud analytics to play.

3. Purposes and legal bases (GDPR Art. 6)

• Contract (b): account, matches, shop, restoring purchases.
• Legitimate interests (f): security, App Check, anti-cheat, non-personalised diagnostics. You may object via email.
• Consent (a): personalised ads (UMP/ATT), local notifications, marketing email.
• Legal obligation (c): accounting records, official requests.

Marketing email: you can withdraw consent at any time via the unsubscribe link in every such email or by writing to [email protected]. We then delete your subscription record; deleting your account also deletes it. Not subscribing has no effect on the game.

4. Recipients

• Google Firebase (Auth, Firestore, Functions, App Check) — Google Privacy.
• Google AdMob — Google may be an independent controller for ad personalisation.
• Google Play Billing / Play Integrity; Apple App Store / StoreKit / ATT.
• Email-delivery provider acting as our processor (marketing email only, subscribers only).

Transfers outside the EEA (including the USA) use the Data Privacy Framework and/or Standard Contractual Clauses as provided by those vendors.

5. Retention and deletion

We keep account data until you delete the account. Leaderboard scores may be kept in anonymised form. Accounting records may be kept as required by Hungarian law.

Delete in-app: Profile → Account → Delete account & data. Web: delete_account.html (typically within 24 hours). Email: [email protected] (we may verify identity; usually within 30 days).

Deleting the app account does not cancel a store subscription — cancel in Apple/Google account settings.

6. Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (withdrawal does not affect prior lawful processing). No solely automated decisions with legal effect. Contact [email protected].

7. Children

EEA/UK: 16+, or younger only with a holder of parental responsibility. Elsewhere: 13+ (COPPA-aligned). We do not target children under 13. If we learn we hold such data without authority, we delete it.

8. California (CCPA/CPRA)

We do not sell personal information. Ad personalisation depends on your consent and Google’s role. Requests: [email protected].

9. Security

TLS, Firestore security rules, Cloud Functions for economy/XP/RP (once production is deployed), App Check. No system is perfectly secure.

10. Complaints

First: [email protected]. Supervisory authority (Hungary / lead): NAIH, 1055 Budapest, Falk Miksa utca 9-11., [email protected], naih.hu. You may also complain to your local EEA authority. Courts: as allowed under GDPR and Hungarian law.

11. Store listings

Google Play Data safety and Apple Privacy Nutrition labels must match this policy (account, gameplay, purchase tokens, advertising ID with consent, on-device diagnostics).

12. This website

rikiking.com is a marketing / legal site (no playable game). We store a language preference in the browser (localStorage: rk_legal_locale / landing locale). We do not set advertising cookies on this site. If we later add analytics, we will update this policy and, where required, obtain consent.

13. Changes

We publish updates here and in the app. Material changes may also be flagged in-app.