Legal · Document 01

Privacy Policy

This policy explains how Fenlux Ltd collects, uses, shares and protects information when you use our apps, games, websites and related services on any platform.

1Who we are

Fenlux Ltd ("Fenlux", "we", "us" or "our") is an independent software publisher. We are the developer and seller of record of the apps listed under our name on the Apple App Store, Mac App Store, Google Play, Microsoft Store, Amazon Appstore and other storefronts, and we operate the website at fenluxltd.shop.

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR and the Data Protection Act 2018, and similar laws, Fenlux Ltd is the data controller responsible for personal data processed through our products. You can reach us at [email protected].

2Scope of this policy

This policy applies to every Fenlux app, game, widget, extension, watch app, website and online service (together, the "Services") on every platform, including iOS, iPadOS, macOS, watchOS, tvOS, visionOS, Android, Wear OS, Windows and the web. If a particular app has a supplementary privacy notice, that notice applies in addition to this policy and will prevail if the two conflict for that app.

This policy does not cover the practices of app stores, payment providers, operating system vendors or other third parties (for example Apple, Google, Microsoft or Amazon). Their own privacy policies govern how they handle your information.

3Information we collect

What we collect depends on which app you use and which features you turn on. The categories below describe everything a Fenlux app may collect; most apps collect far less. Each app's store listing shows a privacy label ("App Privacy" on Apple platforms, "Data safety" on Google Play) describing exactly what that app collects.

3.1 Information you give us

• Account details — if an app offers optional accounts: your name or display name, email address, and an authentication identifier. If you use Sign in with Apple you can choose to hide your email address, in which case we receive an Apple private relay address. If you use Sign in with Google we receive your name, email address and profile picture as permitted by you.
• Content you create — notes, entries, settings, images or other content you create in an app. Unless a feature says otherwise (for example, cloud sync or sharing), this content stays on your device or in your personal iCloud / Google Drive storage, which we cannot access.
• Communications — when you email us, use a feedback form or contact support, we receive your email address, your message, and any attachments or diagnostic information you choose to send.
• Survey and feedback responses — if you choose to answer them.

3.2 Information collected automatically

• Device and app information — device model, operating system version, app version, language, region setting, time zone and screen size. Used for compatibility, troubleshooting and localisation.
• Diagnostics — crash logs, performance data and error reports. Where possible these are collected through the platform's own systems (Apple's crash reporting, which you control in Settings › Privacy & Security › Analytics & Improvements, or Google Play Console vitals). Some apps use a crash-reporting SDK such as Firebase Crashlytics.
• Usage data — which screens and features are used, session length and similar aggregated product-interaction data, used to understand what to improve. In apps that use analytics, this is collected with a pseudonymous app-instance identifier, not your name.
• Identifiers — an app-instance ID or installation ID generated by the app; a push-notification token if you allow notifications; and, only if you grant permission through Apple's App Tracking Transparency prompt or have not opted out on Android, the device advertising identifier (IDFA on Apple, Advertising ID on Android).
• Approximate location — derived from IP address at the country or region level, used for localisation, fraud prevention and legal compliance. We do not collect precise location unless an app's feature requires it and you grant permission (see section 9).

3.3 Information from third parties

• App stores and payment providers — Apple, Google, Microsoft and other stores process all payments. We never see your full card number. We receive transaction information such as a purchase receipt, product identifier, purchase date, subscription status, country and price tier so we can unlock what you bought.
• Sign-in providers — the limited profile information described in 3.1 when you use Sign in with Apple or Google.
• Advertising and attribution partners — in ad-supported apps, aggregated information about ad impressions and, where permitted, which campaign led to an install.

3.4 Information we do not collect

We do not intentionally collect special categories of personal data (such as health, biometric, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation). Where an app uses Face ID, Touch ID or Android biometrics to lock content, the biometric check happens entirely on your device and we never receive biometric data. We do not access your contacts, photos, microphone, camera or health data except as described in section 9 and only with your permission.

4How we use information

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.

5Legal bases for processing (EEA, UK and Switzerland)

• Performance of a contract — to provide the app and features you asked for, process purchases and provide support.
• Legitimate interests — to keep the Services secure, fix bugs, understand aggregated usage and improve our products, where those interests are not overridden by your rights. You may object at any time.
• Consent — for personalised advertising, non-essential analytics where required, marketing emails, push notifications and access to device permissions. You may withdraw consent at any time without affecting earlier processing.
• Legal obligation — to keep financial records and respond to lawful requests from authorities.

6How we share information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising except in ad-supported apps where you have given the consent required by law. We share information only as follows:

• Service providers (processors) who host data, provide analytics, crash reporting, email or customer support tools on our behalf, under contracts that require them to protect it and use it only on our instructions.
• Platform providers such as Apple, Google, Microsoft and Amazon, as needed to distribute apps, process payments and deliver notifications.
• Advertising partners in ad-supported apps, as described in section 8.
• Legal and safety — where required by law, court order or governmental request, or to protect the rights, property or safety of Fenlux, our users or the public.
• Business transfers — if Fenlux is involved in a merger, acquisition, financing or sale of assets, information may transfer to the successor, which will remain bound by this policy or give you notice of changes.
• With your direction — when you choose to share content or connect a third-party service.

7Third-party services and SDKs

Depending on the app, we may use some of the following. Each provider processes data under its own privacy policy, linked below.

The app's store privacy label lists which of these an individual app actually uses. If you would like a list for a specific app, email us.

8Tracking, advertising and App Tracking Transparency

Most Fenlux apps contain no advertising and do not track you. Where an app is ad-supported:

• Apple platforms: we ask permission through Apple's App Tracking Transparency (ATT) prompt before accessing the IDFA or tracking you across apps and websites owned by other companies. If you choose "Ask App Not to Track", you will see only non-personalised or contextual ads. You can change this at any time in Settings › Privacy & Security › Tracking.
• Android: you can reset or delete your Advertising ID, or opt out of personalised ads, in Settings › Privacy › Ads (or Settings › Google › Ads).
• EEA, UK and Switzerland: we display a consent message using a certified consent management platform (Google's User Messaging Platform, compliant with the IAB TCF) before serving personalised ads. You can revisit your choices from the app's settings.
• Where available, a one-off in-app purchase removes advertising entirely.

9Device permissions

Apps ask for permissions only when a feature needs them, and explain why at the time of the request. You can grant or revoke permissions in your device settings at any time; the rest of the app will continue to work.

10Purchases and subscriptions

All payments are processed by the app store you purchased from (Apple, Google, Microsoft, Amazon or another store). We do not receive or store your payment card details. We receive confirmation of the purchase and subscription status so we can provide what you paid for, and we keep transaction records for tax and accounting purposes. Refund requests are handled by the store; see our Support page.

11Data retention

• Account data and synced content — kept while your account is active and deleted within 30 days after you delete your account, except backups, which are purged within a further 60 days.
• Support emails — kept for up to 24 months after the conversation ends, then deleted.
• Analytics data — retained for no longer than 14 months, then deleted or fully anonymised.
• Crash reports — retained for up to 90 days.
• Transaction records — retained for as long as required by tax and accounting law (typically 6–7 years).
• On-device data — stays on your device until you delete it or uninstall the app.

12Security

We protect data with encryption in transit (TLS) and at rest, access controls limited to staff who need them, multi-factor authentication on our administrative systems, and regular review of our providers. Where possible we use the platform's secure storage (Keychain on Apple platforms, Keystore on Android). No method of transmission or storage is completely secure; if we become aware of a breach that affects you, we will notify you and the relevant authorities as required by law.

13International data transfers

Our service providers may process data in the United Kingdom, the European Economic Area, the United States and other countries. When personal data is transferred out of the UK, EEA or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU–US / UK–US Data Privacy Framework where the recipient is certified.

14Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy;
• Correct inaccurate or incomplete data;
• Delete your data (see Delete Account);
• Restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• Data portability — receive your data in a structured, machine-readable format;
• Withdraw consent at any time;
• Complain to a data protection authority.

To exercise any right, email [email protected] with the subject "Privacy Request", the app name and the email or identifier associated with your data. We may need to verify your identity before acting. We respond within one month (extendable by two further months for complex requests, in which case we will tell you), and we do not charge a fee unless a request is manifestly unfounded or excessive.

15US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of the sale or sharing of personal information and of targeted advertising; and not to be discriminated against for exercising these rights.

• Categories collected in the past 12 months may include identifiers, commercial information (purchase history), internet or other electronic network activity, approximate geolocation and inferences — each as described in section 3.
• Sale and sharing: we do not sell personal information. In ad-supported apps, the use of advertising identifiers may be considered "sharing" for targeted advertising under California law; you can opt out using the in-app privacy settings, your device's advertising settings, or by emailing us. We honour Global Privacy Control signals on our website.
• Sensitive personal information: we do not use or disclose it for purposes requiring a right to limit.
• Authorised agents may submit requests on your behalf with written permission. If we deny your request, you may appeal by replying to our decision; we will respond within 45 days.

16Children's privacy

Our Services are generally intended for a general audience and not directed at children under 13 (or the minimum age of digital consent in your country, which may be up to 16). We do not knowingly collect personal information from children below that age without verifiable parental consent. If a Fenlux app is listed in Apple's Kids category or Google Play's Families programme, it complies with those programmes' requirements and with COPPA and the UK Age Appropriate Design Code: it contains no third-party advertising or analytics that identify the child, and links out of the app and purchases are protected by a parental gate. If you believe a child has provided us personal information, contact us and we will delete it promptly.

17Platform-specific disclosures

Apple (iOS, iPadOS, macOS, watchOS, tvOS, visionOS)

• Each app's "App Privacy" label on the App Store summarises data linked to you, data not linked to you, and data used to track you.
• Apps that include third-party SDKs ship Apple-required privacy manifests describing those SDKs' data use.
• Where an app supports account creation, you can delete your account from within the app (Settings › Account › Delete Account), as required by App Store Review Guideline 5.1.1(v).
• Data stored in iCloud / CloudKit private databases is held in your iCloud account and is not accessible to us.
• HealthKit, HomeKit, and similar framework data is never used for advertising or sold, and is not stored in iCloud by us.

Google Play (Android, Wear OS, ChromeOS, Google TV)

• Each app's "Data safety" section on Google Play describes data collected and shared, whether it is encrypted in transit, and whether you can request deletion.
• You can request account and data deletion without reinstalling the app at fenluxltd.shop/delete-account.
• We comply with Google Play's User Data policy, including prominent disclosure and consent for any data collection not reasonably expected.

Microsoft Store, Amazon Appstore and other stores

The same practices described in this policy apply. Store-provided identifiers and purchase records are handled as described in sections 3 and 10.

18Cookies on our website

fenluxltd.shop is a static website. It does not set advertising or tracking cookies. Our hosting provider (Google Firebase Hosting) may process your IP address and request information in server logs for security and delivery, and our pages load fonts from Google Fonts, which receives your IP address to serve those files. If we ever add analytics or other non-essential cookies, we will ask for your consent first where required and update this section.

19Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed. If we make material changes, we will notify you in the app, by email (if we have it), or by a notice on this website before the changes take effect. Previous versions are available on request.

20Contact and complaints

For any question about this policy or our data practices, or to exercise your rights, contact:

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the supervisory authority in your country of residence (list of authorities). We would appreciate the chance to address your concern first.