Privacy Policy for Potion Punch

1. At a glance

This summary is a quick guide. The detailed policy controls if there is any difference.

2. Who we are and what this policy covers

Monstronauts Inc. is the data controller for Potion Punch. Our registered address is 969 Aurora Boulevard, Quirino 3-A, Quezon City, Metro Manila, Philippines 1102.

This policy covers the following platforms:

• Mobile application
• Tablet application

It applies to players, account holders, website visitors, and people who contact us in these territories:

• Worldwide / all territories

3. Information we collect

• Device identifiers
• Gameplay analytics
• IP address
• Crash logs
• Diagnostics
• Storage permission
• Persistent UUID
• Advertising identifiers

These categories may include information supplied by Users, account and support details, device and network information, gameplay events, crash records, storefront purchase confirmations, advertising identifiers, and social or multiplayer interactions where the relevant features are enabled.

Required and optional information

Unless this policy or the collection screen states otherwise, information requested to create or secure an account, deliver a requested feature, process a support request, or satisfy a legal requirement is required for that purpose. If required information is not provided, the affected feature or Service may be unavailable. Information identified as optional may be withheld without affecting unrelated features.

Users must have authority to provide any Personal Data about another person that they submit through the Service.

4. How we collect information

We collect information that Users provide directly, information generated automatically when the Service or a device interacts with it, and information supplied by selected storefronts, identity providers, advertising partners, analytics tools, hosting providers, and other service providers. Optional third-party account access is activated only after the User chooses the connection and grants the requested permission. Current selected providers: Google AdMob, Facebook Account Access, Unity Ads, Unity Analytics, AppLovin (including MAX Mediation), Liftoff (Vungle), AdColony, ironSource, Device Permissions for Personal Data Access.

5. How we use information

We use information to provide and secure the Service; create and administer accounts; save progress and preferences; provide requested social, communication, or support features; verify transactions and entitlements; diagnose crashes and performance problems; measure use and improve the Service; prevent fraud, abuse, and security incidents; send requested or permitted communications; comply with law and valid authority requests; and establish, exercise, or defend legal claims. We will provide any notice or consent required before using information for an incompatible new purpose.

6. Legal bases for processing

7. Payments

Purchases are processed through Apple App Store, Google Play. The storefront or its payment provider handles payment-card details under its own privacy terms. The Studio may receive transaction identifiers, entitlement status, product details, price, currency, region, refund status, and related records needed to verify purchases, provide content, prevent fraud, keep required financial records, and handle support. Storefront purchases, subscriptions, cancellations, and refunds remain subject to the applicable store rules and mandatory consumer rights.

8. Sharing and service providers

We disclose only the information reasonably needed for the purposes described in this policy. The disclosed SDK and service-provider inventory is Google AdMob, Facebook Account Access, Unity Ads, Unity Analytics, AppLovin (including MAX Mediation), Liftoff (Vungle), AdColony, ironSource, Device Permissions for Personal Data Access.

Selected provider details:

• Google AdMob — Mobile ad serving, programmatic ad delivery, and app monetization. Data received and processed may include Mobile advertising identifiers (including Android Advertising ID or iOS IDFA), IP address, device model, operating system, carrier information, and ad interaction logs such as clicks, impressions, and views. Processing location: Global infrastructure, primarily in the United States. Provider privacy policy.
• Facebook Account Access — Optional authentication and access to a User-authorized Facebook account. Data received and processed may include Email address and any profile information included in the permissions the User approves. Processing location: United States and Meta data centers worldwide. Provider privacy policy.
• Unity Ads — In-game video and interstitial advertising. Data received and processed may include Advertising identifiers, IP address, device type, operating-system version, and advertising interaction events. Processing location: United States and globally distributed server deployments. Provider privacy policy.
• Unity Analytics — Player-behavior measurement, retention analytics, and gameplay telemetry. Data received and processed may include Custom gameplay events, session duration, hardware specifications, IP address, and unique User identifiers. Processing location: United States and globally distributed server deployments. Provider privacy policy.
• AppLovin (including MAX Mediation) — Advertising monetization, mediation, bidding orchestration, and marketing analytics. Data received and processed may include Mobile advertising identifiers, IP address, network details, device properties, interaction timestamps, and advertising transaction logs. Processing location: United States and distributed global infrastructure. Provider privacy policy.
• Liftoff (Vungle) — Mobile video advertising, creative delivery, and advertising attribution. Data received and processed may include Device identifiers, network-carrier type, language settings, IP address, and video-ad completion information. Processing location: United States and global infrastructure nodes. Provider privacy policy.
• AdColony — Mobile advertising, ad delivery, and advertising measurement. Data received and processed may include Trackers or cookies and Usage Data, including device and advertising identifiers and ad-interaction information. Processing location: United States. Provider privacy policy.
• ironSource — Mobile advertising, mediation, attribution, and app monetization. Data received and processed may include Trackers or cookies, Usage Data, device identifiers, IP address, and advertising interactions. Processing location: Israel and globally distributed infrastructure. Provider privacy policy.
• Device Permissions for Personal Data Access — Potion Punch 2+ requests certain permissions from Users that allow it to access the User's device Data as summarized here and described within this document. Data received and processed may include Storage permission Processing location: Apple infrastructure in the United States and other regions selected by Apple. Provider privacy policy.

We may also disclose information to public authorities where legally required or as part of a reviewed corporate transaction. Each processor must be covered by appropriate contractual and security controls.

9. Processing locations and international transfers

The Studio processes information at its operating locations. Selected providers identify the following additional processing locations:

• Global infrastructure, primarily in the United States.
• United States and Meta data centers worldwide.
• United States and globally distributed server deployments.
• United States and distributed global infrastructure.
• United States and global infrastructure nodes.
• United States.
• Israel and globally distributed infrastructure.
• Apple infrastructure in the United States and other regions selected by Apple.

Personal Data may be transferred to a country other than the User's country when the Studio or a selected provider operates there. Where a restricted international transfer requires a safeguard, the Studio uses an applicable lawful mechanism, such as an adequacy decision, approved contractual clauses, or another mechanism permitted by law, together with supplementary measures where required. Users may contact the Studio for information about safeguards relevant to their Data.

10. How long we keep information

We retain Personal Data only for as long as needed for the purpose for which it was collected. Account and contract data may be kept while the relationship remains active; support, transaction, security, analytics, and system records follow purpose-specific schedules; and information may be retained longer when required by law, a valid authority request, consent that has not been withdrawn, or the establishment, exercise, or defense of legal claims. When the applicable period expires, the information is deleted or irreversibly anonymized, subject to limited backup cycles and legal holds.

11. Your privacy rights

Depending on location, Users may have rights to withdraw consent; object to processing, including direct marketing; access, correct, delete, restrict, or receive their information; request portability; opt out of sale, sharing, targeted advertising, or profiling; appeal a denied request; and complain to a regulator. Exercising a right will not result in unlawful discrimination.

Requests may be sent to privacy@monstronauts.com. We may request information reasonably necessary to verify identity or authority. Requests are free unless applicable law permits a reasonable fee, and we respond within the period required by law, including within one month where the GDPR applies. Where required, we provide an appeal method and notify recipients of a correction, deletion, or restriction unless doing so is impossible or disproportionate.

12. Cookies, analytics, advertising, and opt-outs

The Service may use device storage, cookies, analytics, attribution tools, or advertising identifiers only for disclosed purposes and where the selected features require them. Current tools: Google AdMob, Facebook Account Access, Unity Ads, Unity Analytics, AppLovin (including MAX Mediation), Liftoff (Vungle), AdColony, ironSource, Device Permissions for Personal Data Access.

Where required, optional analytics, advertising, or similar non-essential tracking starts only after the required notice and consent. Users may withdraw consent through available in-app controls, use device privacy or advertising settings, follow a selected provider's opt-out instructions, and unsubscribe from marketing messages using the link provided. Mobile Users may also limit interest-based advertising through platform settings or recognized industry opt-out tools. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.

13. Feature-specific processing

Enabled product features:

• Analytics
• Push notifications
• Third-party sign-in
• Advertising

Push notifications may use a device token or similar identifier. Users can disable notifications in the Service or device settings.

14. Security and processing methods

We use administrative, organizational, and technical safeguards appropriate to the nature of the information and the risks involved. Measures may include access controls, authentication, least-privilege permissions, encryption in transit, secure configuration, logging, backups, vendor review, staff procedures, and incident response. Access is limited to personnel and providers who need the information for a disclosed purpose. 

15. System logs, legal claims, and authorities

Operation and maintenance may generate system logs containing device, network, security, crash, and interaction details. Personal information may be preserved or disclosed when reasonably necessary to establish, exercise, or defend legal claims; investigate misuse; protect Users or the Service; comply with law; or respond to a valid request from a competent authority.

16. Contact us

Monstronauts Inc. is the data controller. Privacy questions and rights requests may be sent to privacy@monstronauts.com or mailed to 969 Aurora Boulevard, Quirino 3-A, Quezon City, Metro Manila, Philippines 1102.

17. Sale, sharing, and third-party resources

Sale, sharing, targeted-advertising, and profiling status: Shares for targeted advertising.

Any legally required opt-out method is described in the relevant section. Third-party storefronts, websites, advertisements, and services have their own privacy practices, which Users should review before providing information.

18. Changes and effective date

Effective date: 2026-08-07.

Change-notice method: In-App Notice, Website

Where a change affects consent-based processing, we will request new consent when required. Questions may be sent to privacy@monstronauts.com.

19. Definitions

Personal information means information that identifies or can reasonably be linked to a person. Usage Data means technical and interaction information collected automatically. User means a person using the Service and ordinarily the person to whom the information relates. Processor means a party processing information for the Studio. Service means the products and related services covered by this policy. Tracker means technology such as cookies, device identifiers, pixels, local storage, or similar tools used to recognize or measure a User or device.