SnowBat logo
Indie dev – Danila Demkin (Kekl)

Privacy Policy
Mobile application "Imposter 3D: online horror" and "ABC Lore 3D: zombie online"
Last Revised: July 16, 2026


Who we are / What we do

IP Demkin Danila (Snow Bat) is the right-holder of the exclusive rights to the mobile applications “Imposter 3D: online horror” and “ABC Lore 3D: zombie online” and the related intellectual property, collectively referred to as the “Product” or “Products”.

IP Demkin Danila (Snow Bat) is referred to as “we”, “us”, “our”, or the “Operator”.

For the account, gameplay, moderation, support, security, and service-configuration processing described in this Policy, we determine why and how relevant personal data is processed and act as the controller where applicable. Data may be collected and processed automatically by the Product, our backend systems, and integrated software development kits (“SDKs”), even though we do not manually enter or maintain a separate archive of user data. Depending on the service and the applicable agreement, a provider may process data on our behalf or as an independent controller under its own privacy notice.

The Products include computer programs, databases, interface graphics, and related content made available on supported user Devices through the mobile applications.

The Products are provided for entertainment purposes.

This Privacy Policy applies when you use our Products and explains what Data is processed, for which purposes, with whom it may be shared, how long it is retained, and which rights and choices may apply.

Before registering, downloading, or otherwise using the Product, please read this Privacy Policy and the other legal documents presented in the Product.

This Privacy Policy is a privacy notice explaining how personal data is processed. Reading or acknowledging it does not, by itself, constitute consent to processing that requires consent under applicable law.

Where consent is required, the Product or the relevant provider must present a separate, specific choice before the relevant optional processing begins. A failure to display a consent interface, continued use of the Product, or acknowledgment of this Policy does not create consent. You may refuse or later withdraw consent as described in this Policy and in the applicable consent interface.

Click-wrap for agreement with this Privacy Policy and to use the Product.

By clicking a button with the text «I Agree» or similar wording where shown in the Product, you confirm that you have been presented with and have read this Privacy Policy, available at https://snokkk.github.io/privacy and in the Product. This acknowledgment is separate from any consent requested for a specific processing purpose.

Browse-wrap for agreement with this Privacy Policy and to use the Product.

When you use the Product after downloading and installing it on your Device, this Privacy Policy applies to the processing described below. Use of the Product is not treated as blanket consent to optional processing.

Continuity with the prior Policy. This July 16, 2026 revision is intended to supplement and clarify, not reduce, the user rights, choices, protections, retention commitments, or Product practices disclosed in the April 15, 2026 version. The more specific wording in this revision governs where it corrects a legal classification, removes a blanket consent or liability waiver that cannot validly be relied upon, reflects the current technical operation of the Products, or provides greater protection. Nothing in this paragraph revives an inaccurate statement or authorizes processing beyond the purposes and choices described in this Policy.


Account & Chat (Summary)

This section applies to registered accounts (Firebase Authentication) and in-game chat in Imposter 3D: Online Horror. It is a product-specific summary; the detailed provisions below remain applicable and control if additional context is needed.

Russian data localization: when we collect personal data for registered accounts of citizens of the Russian Federation, the initial account creation and the primary recording, systematization, accumulation, storage, clarification, and retrieval of that account Data take place using a database hosted on Yandex Cloud servers in Russia. Only after that primary processing may a permitted copy be mirrored or transferred to Google Firebase in the United States, subject to Section 8 and applicable cross-border-transfer requirements.

Accounts & chat: what we collect

In-game badges

Some players may have decorative in-game badges (for example: “Content Creator”, “Community Helper”, “Friend of the Game”). These badges are cosmetic, do not provide gameplay advantages, and do not grant moderation powers. Badges are not provided in exchange for payments, subscriptions, or external promotional activity.

Purposes

Children, account eligibility & consent

Storage periods

Service providers

We use the operational services listed above only to operate the Products, provide online functionality, investigate violations, enforce our rules, prevent fraud and abuse, respond to support issues, and maintain the safety and security of the Products.

Advertising and analytics providers are used only for the disclosed ad delivery, mediation, analytics, attribution, measurement, and fraud-prevention purposes, subject to the user choices and legal limits described in Sections 5–7.

Data processed through these services may include access, collection, use, storage, routing, review, and sharing of relevant account, technical, chat, report, moderation, and security-related data as described in this Privacy Policy.

Such data is retained and deleted in accordance with the retention and deletion rules described in this Privacy Policy, except where longer retention is reasonably necessary for fraud prevention, abuse investigation, security, dispute resolution, or legal compliance.

Requests about your data: snowbatstudio@gmail.com

Public chat (no private messages) in Imposter 3D: Online Horror

The in-game chat is public: messages are visible to other players in the same game session. The Product does not provide private/direct messages between users.

Moderation

To enforce our rules, protect users, prevent abuse and ensure safety, chat messages and related metadata (such as time, user ID, and server/session identifiers) may be processed by automated systems (e.g., filters) and may be reviewed by moderators, including when a message is reported or when we reasonably suspect a rules violation.

We process chat content primarily to provide the chat feature and to enforce our rules (legitimate interests / contract performance, depending on jurisdiction).

To enforce our rules, protect users, investigate abuse, and maintain the safety and integrity of the Product, moderation-related data may be accessed, collected, used, stored, routed, reviewed, and shared within our moderation and security workflows.

Such data may include public chat messages, report contents, user identifiers, hashed device identifiers, room or session information, timestamps, technical metadata, and records of moderation or anti-abuse actions.

Depending on the region and the technical route used, this data may be processed through Snow Bat backend services, routed through infrastructure providers such as Cloudflare, and delivered through internal notification tools such as Discord webhooks for review by authorized staff.

We use this data only for moderation, abuse prevention, fraud prevention, support, security investigation, enforcement of our rules, and legal compliance. We do not sell this data.

Moderation and security records are retained only for as long as reasonably necessary for these purposes and are deleted or anonymized in accordance with this Privacy Policy, unless longer retention is required for security, fraud prevention, dispute resolution, or legal obligations.

Reports

Players may report chat messages. Reports and moderation actions may be stored to investigate violations, handle appeals, and comply with legal obligations.

Reports: reports alone do not determine enforcement & abuse prevention

Submitting reports does not automatically result in bans, mutes, or other penalties. The number of reports alone does not determine enforcement. Reports are signals that help us review potential issues, but enforcement actions are based on our own review, context, and available evidence.

Report abuse is prohibited. Misuse of the reporting system (including false reports, mass reporting, coordinated reporting, or reporting to harass or target other players) may result in action under our rules, including restrictions on reporting and account enforcement.

Automated moderation and security tools may flag content, limit its sending or display, or apply predefined, provisional protective restrictions based on detected rule categories and risk signals. They do not exercise open-ended human discretion, and reports alone do not determine a penalty. A user whose account is materially restricted may contact support to request human review and contest the action. Authorized adult staff may review, confirm, change, or remove an enforcement action. Community reporting helpers and in-game roles have no ability to apply penalties.

Community reporting helpers

We may rely on community reporting helpers (trusted players) who can help us identify potential rule violations by submitting reports. These helpers do not have moderation powers: they cannot ban, mute, or take enforcement actions, and they do not have access to personal data or internal user records. Human reviews and discretionary enforcement decisions are made by the Product owner and/or authorized adult staff.

Please do not share personal data in the public chat (for example: phone numbers, home addresses, email addresses, exact location, documents/IDs, payment details, or other sensitive information).

Glossary

The text of our Privacy Policy uses terms and concepts with the following meaning:

Personal data, personal information, or Personally Identifiable Information (“PII”) means information relating to an identified or identifiable person, including account, Device, online, and advertising identifiers. Pseudonymous data remains personal data where it can be linked to a person. Anonymous data means data that no longer relates to an identifiable person.

Data means information processed by us or Third-Party Providers in connection with the Products, including personal data, technical information, content, and properly anonymized or aggregated information.

Product or Products means the iOS and Android mobile applications “Imposter 3D: online horror” and “ABC Lore 3D: zombie online” published or made available by IP Demkin Danila (Snow Bat).

Third Party or Third-Party Provider means an entity other than the Operator that provides distribution, hosting, authentication, multiplayer, payment, advertising, mediation, analytics, attribution, security, support, or another service used by a Product. Such providers are engaged under applicable contracts, platform terms, or mediation terms that govern the relevant service and Data exchange.

Device means user-operated hardware such as a smartphone, tablet, or computer. Content means information or materials made available in or through a Product by us, a User, or a Third Party.

Profile and/or Account means the Product record through which a User accesses registered features and which may contain identifiers, settings, progress, and other Data described in this Policy.

User means a person who accesses or uses a Product, whether through an Account or as a Guest.

Cookie is a small piece of data stored on your Device.

Defined terms may be used in the singular or plural as the context requires. Capitalized terms not otherwise defined have the meanings stated in this Glossary.


1. Introduction

This Privacy Policy governs the Products and related pages or services that link to this document and are controlled by IP Demkin Danila (Snow Bat). Please read it carefully. It explains the ways we and integrated providers process your Data when you access, visit, or use the Product or contact support. It does not cover websites, applications, destinations, or services that we do not own or control.

You can access this Privacy Policy any time on the Product's description screen, or as otherwise indicated depending on the Product you are using, or any public website's page: https://snokkk.github.io/privacy.

By clicking a button with the text «I Agree» where shown, you confirm that you have read this Privacy Policy at https://snokkk.github.io/privacy. Downloading, registering for, accessing, or using the Product does not by itself constitute consent to processing that requires a separate affirmative choice.

If you don’t agree with the terms and conditions of this Privacy Policy, you should not access, visit and/or use the Product. We advise that you print or retain a digital copy of this Privacy Policy for future reference.

This Privacy Policy may be modified from time to time, so please check it periodically. We will adjust the «Last Revised» date at the beginning of this document. If we make a material change in the way we use or disclose personal data, we will provide a prominent notice in the Product or by another appropriate channel. If a change requires new consent, we will request it before the relevant processing begins.

The personal-data provisions of this Policy apply not only to information you type in, such as an email address, but also to account identifiers, IP addresses, device and advertising identifiers, chat and report content, and other information that relates to or can reasonably be linked to you.


2. The Types of Data Acquired About You


2.1. Data.

Registration Information.When you register to use the Product(s), we may collect a nickname, a unique account identifier (such as Firebase UID), and an email address (if you choose to provide it). We do not require users to provide their real name, gender, or date of birth.

Profile and Other Information. Public profile information is limited to in-game data such as nickname and cosmetic status. We do not require users to provide real-world profile details such as address, photographs, or personal interests.

Support Communications. If you contact support or the Privacy Policy Coordinator, we may process your email address or other reply address, message, attachments, account identifiers you provide, and the resulting correspondence.

Required and Optional Data. Account identifiers and core technical data are required to create and operate a registered account; without them, registration or the relevant online feature cannot be provided, although Guest mode may remain available where supported. Optional consent may be refused or withdrawn without affecting processing already lawfully performed before withdrawal.

PLEASE NOTE: Messages and content shared in the in-game public chat are visible to other players within the same game session. Do not share personal data in chat.

We do not access contacts, calendars, photos, or media stored on your device.


2.2. Children’s Privacy.

Our Products may be used by a broad audience, including teens. As a Product rule, registered accounts, cloud features, and full text chat are intended for users aged 14 or older. This rule does not determine whether a minor has legal capacity to enter into the user agreement. Applicable national contract law may require a higher age, authorization by a parent or guardian, or another safeguard even where the minor may lawfully consent to a particular processing operation.

EU/EEA. The age in Article 8 GDPR is not a universal account age. It applies where we rely on consent under Article 6(1)(a) GDPR to offer an information society service directly to a child. For that purpose, the child may consent from age 16 unless the applicable Member State has set a lower age between 13 and 15. Below the applicable threshold, consent must be given or authorized by the holder of parental responsibility, and we must make reasonable efforts to verify that authorization. Consent for one purpose does not authorize unrelated optional advertising, analytics, or other processing. If a valid legal basis or required authorization is not available, the affected consent-based processing and feature must not be enabled.

United States (COPPA). For a user under 13, personal information may include an IP address, advertising identifier, Device identifier, and another persistent identifier even when the user does not provide a name or email address and plays as a Guest. Guest mode is therefore not represented as anonymous. We do not currently treat a checkbox, acknowledgment of this Policy, app-store account or password, or an unverified email response as verifiable parental consent. Because no child-account flow based only on those methods satisfies COPPA, a U.S. user under 13 may not create a registered account or use full text chat on that basis.

For a user known to be under 13, advertising and non-essential analytics SDKs must not be activated unless and until we have provided the required direct notice and obtained verifiable parental consent, or a specific COPPA exception applies. If the child's personal information would be disclosed to an advertising network or another third party for targeted advertising or another purpose that is not integral to the requested service, separate verifiable parental consent is required for that disclosure. A parent may consent to collection and first-party use without consenting to such disclosure. Email-plus or text-plus consent is not used to authorize disclosure of a child's personal information to advertising networks. Limited persistent identifiers may be processed without parental consent only where every condition of COPPA's support-for-internal-operations exception is met, including that they are not used for behavioral advertising, profiling, or another non-exempt purpose.

Users who do not meet the applicable account requirements should use the Product as a Guest where available, with limited features such as gameplay and quick-chat, and should not provide an email address. Guest mode may still process the limited technical Data described in this Policy. If we learn that a child's personal information was collected without required consent or another valid exception, we will stop the affected processing and delete it, except to the extent a specific law requires retention.


2.3. Anonymous Data.

We prefer properly aggregated or anonymous data where it can reasonably serve the stated purpose, for example to understand overall Product performance. Data is not anonymous merely because a name has been removed: device, account, online, or advertising identifiers and other pseudonymous data remain personal data where they can be linked to a person.


2.4. Credit/Debit Card and Payment Account Data.

We will not ask, and get, and sell or rent your credit/debit card number or payment account Data.

The Product has an in-app purchase feature. We don’t process payments for in-app purchases and don’t have access to your bank card details. Payments for in-app purchases are made through your account in AppStore or Google Play. Any post-purchase processes are managed by the application store and are subject to the terms of use of that application store:

- Google Play, which is provided by Google LLC, in accordance with the Google Play Terms of Use, is available at https://play.google.com/intl/en_uk/about/play-terms/  

- AppStore, which is provided by Apple Inc., in accordance with terms available at https://www.apple.com/legal/  

2.5. Child Sexual Abuse and Exploitation (CSAE) Prohibition

We strictly prohibit any content, activity, or behavior related to child sexual abuse and exploitation (CSAE). This includes, but is not limited to:

Any content or imagery involving the sexual exploitation of minors Sharing or soliciting sexually explicit material involving individuals under 18 years of age Grooming or attempts to exploit minors for sexual purposes Any behavior that sexualizes or endangers children

We have zero tolerance for such activities and will take immediate action, including but not limited to:

Permanent termination of user accounts involved in CSAE

Reporting to relevant law enforcement agencies

Cooperation with authorities in any related investigations

Users are required to report any suspected CSAE content or activity immediately to our Privacy Policy Coordinator or through the designated reporting channels in our Product.


3. How We Acquire Your Data


3.1. Data You Provide.

We and the Third Party mostly receive your Data and PII because you provide it to us and the Third Party by your deliberate choice.


3.2. Data Automatically Collected.

The Product may also automatically collect Data about you, your online behavior, and your Device. The Data collected may include, without limitation: 

- Advertising identifiers (such as Android Advertising ID or Apple IDFA, where available and permitted by the operating system);

- IP address;

- Device manufacturer and model;

- The operating system and version running on your system or device;

- Browser type;

- Language;

- The make of the CPU, and the number of CPUs present;

- The graphics card information, such as type, vendor and driver name, version, and graphics API;

- Amount of system and video RAM present;

- Current screen resolution;

- Operating system identifier;

- A checksum of all the data that gets sent to verify that it did transmit correctly;

- Approximate geographic location (such as country or region inferred from IP address);

- Pages visited, time of visits, content viewed, ads viewed, the site(s), application(s), destination(s), and/or service(s) you arrived from, and other clickstream data.

On Android, advertising components use internet and network-state access and may use advertising identifiers, Android Privacy Sandbox advertising services, and related technical device or network information for ad delivery, attribution, fraud prevention, and measurement. The Product does not request precise or approximate device-location permissions for advertising. Country or region may still be inferred from the IP address.


3.3. Data Acquired Elsewhere.

We do not build unrelated offline user profiles. We may receive Data outside the Product when you contact support, when an app store provides purchase or transaction status needed to fulfil a purchase, or when a provider sends us operational, fraud-prevention, attribution, or aggregated reporting data for the Product.

Third-party providers may process data on our behalf or for their independently determined purposes as described in this Privacy Policy and their own notices.

Regardless of role, every Third-Party Provider that receives user Data from a Product is required, as a condition of receiving that Data, to provide the same or equivalent protection described in this Policy and required by applicable law and App Store rules. Different technical practices or an independent-controller role do not permit a lower level of protection.


4. How We Use Your Data


4.1. Processing Your Requests for Products.

We use your Data to process your request for Content and/or Product. For example, if you write to our support or Privacy Policy Coordinator, we may use your email address to send you an answer and to give the right decision and recommendation.


4.2. Administering the Product.

We use relevant Data to operate and administer the Product, provide customer support, diagnose server and Product problems, maintain compatibility and security, understand aggregate demographics, usage, and trends, personalize Product features or Content, improve features, manage disclosed advertiser relationships, deliver and measure advertising, perform attribution, and prevent fraud and abuse. Approximate country or region inferred from an IP address may be used for service availability, security, legal compliance, and geographically relevant advertising. Personalization, advertising, and provider processing remain subject to the choices and legal bases described in this Policy. We do not use this clause as permission for unrelated tracking outside the Product.


4.3. Marketing Communications.

We do not currently maintain a separate direct-marketing mailing list for the Products. If we introduce optional marketing communications about Product features, events, other Products, advertisers, or partners, we will provide any notice and consent required by law and an effective way to unsubscribe. This does not prevent necessary service, security, account, or support communications.



4.4. Legal Requests.

We may disclose Data where reasonably necessary to comply with valid legal process, protect rights, safety, or security, investigate fraud or abuse, or establish, exercise, or defend legal claims. Additional detail is provided in Section 5.6.


4.5. Employment Opportunities.

The Product does not include an employment-application function, and we do not collect employment profiles through gameplay. If you separately and voluntarily contact us about work, we may use the information you send only to evaluate and respond to that inquiry and retain related recruiting, reporting, or administrative records where required or permitted by law, whether or not you are hired.


4.6. Transfer or Sale of Our Business or the Product.

If ownership of a Product or relevant business assets changes through a sale, assignment, merger, restructuring, acquisition, divestiture, reorganization, dissolution, financing, bankruptcy, or similar transaction, Data necessary to operate the affected Product may be transferred as a business asset, subject to applicable law, continued protection, and notice or consent where required.


4.7. Combining Your Anonymous Data with PII

We do not combine unrelated offline profile data with Product data for unrestricted purposes. We may link account, Device, session, moderation, security, purchase-status, and support records where reasonably necessary for the purposes described in this Policy. Once anonymous data is linked to an identifiable user, we treat the resulting data as personal data.


4.8. Legal Basis for Processing PII Under General Data Protection Regulation

If the GDPR applies, the specific legal bases for our processing are described in Section 10.1. Independent providers determine and disclose their own legal bases in their privacy notices.


4.9. Security and Investigations

We can use your data (including your communications) for security purposes or to prevent or investigate possible fraud or other violations and/or attempts to harm our Members, Visitors or others.


4.10. Delete the Product from Device or Account Closure

Deleting the Product from a Device does not itself delete a registered account. When you delete your account using the self-service function in the Product, the active account, profile, progress and associated user-generated Content controlled by us are deleted immediately, except for chat messages, reports and related moderation or security records retained for the six-month period described in Section 13.4 and any record subject to a specific legal hold or longer legal requirement. Deletion requests submitted by email are completed within 30 days. Backup copies of Data otherwise deleted may remain for up to 7 days before being deleted or overwritten.

We do not control data that other users have copied out of our Products.


5. Sharing Your Data for Marketing; Opt-Out; How to Update Your Data


5.1. Credit/Debit Card and Payment Account Data.

As explained in Section 2.4, we do not ask for, receive, sell, or rent your full credit/debit-card number or payment-account credentials. App-store providers process payments under their own terms. We do not ask users to submit sensitive personal data through gameplay or public chat, and we do not sell or rent sensitive personal data, whether or not money is exchanged.


5.2. Sharing Your Data for Marketing.

We do not provide names, email addresses, postal addresses, or phone numbers to third parties for their own direct-marketing lists. Advertising SDKs may receive technical identifiers and Product events for ad delivery, measurement, attribution, fraud prevention, and, where permitted by the user's choices and applicable law, personalized advertising. Such disclosures may be treated as “sharing” under certain laws even when no money is paid for the data.

If we introduce a new disclosure of contact or profile Data to an affiliate or another third party for that party's own direct marketing, we will first provide the notice, permission, and opt-out required by applicable law. This sentence does not state that such a direct-marketing list exists today.


5.3. How to Opt-Out of Sharing for Marketing.

You may use available consent-platform choices, operating-system privacy settings, and provider controls to manage advertising-related processing. You may also contact the Privacy Policy Coordinator for assistance with Data controlled by us. Some processing that is strictly necessary to provide a requested online feature, secure the Product, or comply with law cannot be disabled while that feature is used; where applicable, we will explain the consequence of the request rather than treating continued use as consent.

For optional marketing sharing of Data controlled by us, a request to the Privacy Policy Coordinator is an effective opt-out request. We will apply it to future sharing within our control and, where applicable, notify relevant processors or recipients. Properly anonymized data that can no longer be linked to you is outside the scope of an individual opt-out request.


5.4. How to Opt-Out of Marketing Messages from us.

We do not currently send direct-marketing messages from a Product mailing list. If optional marketing messages are introduced, you may unsubscribe through the mechanism in the message or contact us. Marketing messages sent by an independent provider are also subject to the unsubscribe mechanism provided by that sender. You may still receive communications that are necessary for an account, purchase, security, legal notice, or support request.


5.5. Links To Other Sites

Our Product may contain advertisements or links to sites and apps that we do not operate. If you open a Third Party's link, you will be directed to that Third Party's site or app. We strongly advise you to review the privacy notice of every external service you visit.

We do not control the content, privacy notices, or practices of independent Third-Party sites, services, or applications.


5.6. Legal Disclosures

It is possible that we will need to disclose information about you when required by law, subpoena, or other legal processes or if we have a good faith belief that disclosure is reasonably necessary to 

1) investigate, prevent or take action regarding suspected or actual illegal activities or assist government enforcement agencies; 

2) enforce our agreements with you; 

3) investigate and defend ourselves against any third-party claims or allegations; 

4) protect the security or integrity of our Services (such as by sharing with companies facing similar threats); 

5) exercise or protect the rights and safety of our members, personnel or others.

We may dispute such demands when we believe, in our discretion, that the requests are overbroad, vague, or lack proper authority, but we do not promise to challenge every demand.


6. Cookies and Related Technologies; Do Not Track (DNT)


6.1. Cookies/Local Device Storage.

The Product may use local files, preferences, secure storage, and similar local-device technologies that are strictly necessary to preserve a requested setting or session, transmit a communication, prevent fraud, diagnose a fault, or provide another feature expressly requested by the user. Whether a particular operation is strictly necessary is assessed separately; describing an advertisement as contextual or non-personalized does not by itself exempt associated Device storage or access.

Where a valid user choice and applicable law permit optional local storage or Device access, it may be used for disclosed purposes such as advertising frequency control, understanding interactions across Product sessions or compatible Devices, diagnostics, aggregate demographics and research, registration, and feature or Content personalization. This paragraph is not permission to use local storage for any unrelated purpose.

EU/EEA Device access and optional SDKs. Before an advertising, attribution, or non-essential analytics SDK stores information on or gains access to information from the Device, including an advertising, app-instance, persistent, or similar identifier, the Product must request the user's consent through an in-Product consent interface where Article 5(3) of the ePrivacy Directive or its national implementation requires consent. Until valid consent has been obtained, the relevant optional operation is not authorized by this Policy and must remain disabled. A missing or failed consent interface, an operating-system advertising setting, or continued use is not affirmative consent.

Our public website pages are separate from the native mobile Products. If a website controlled by us uses non-essential cookies or comparable browser storage, we will provide any notice and choice required by applicable law. Third-party destinations opened from an advertisement or link apply their own cookie and privacy notices.



6.2. You May Disable Local Device Storage.

The consent interface must allow optional purposes to be refused without losing access to core gameplay and must provide a way to revisit and withdraw the choice as easily as it was given. Withdrawal stops future optional access and processing but does not affect processing lawfully performed before withdrawal. If a build cannot provide a valid consent choice or the required withdrawal control, it must not rely on consent to activate the affected optional operation. Disabling storage that is strictly necessary for authentication, saved settings, fraud prevention, or another requested feature may prevent that feature from working properly.

Your Device or browser may also provide controls that block or clear some local storage, identifiers, or tracking technologies. The availability and effect of those controls depend on the platform and do not replace an in-Product consent choice where one is legally required.


6.3. Tracking Technologies.

Where permitted by the user's valid choices and applicable law, integrated SDKs may use advertising identifiers, IP addresses, Device or app-instance identifiers, event Data, and comparable technologies for ad delivery, frequency capping, measurement, attribution, analytics, and fraud prevention. Depending on the Product surface and provider, comparable technologies may include SDK events, pixels, web beacons, clear GIFs, or Device-signal matching and fingerprinting where disclosed and legally permitted. Consent and age signals must be communicated to the relevant SDKs and mediation providers before an optional request. The provider list and links in Section 14.2 explain where to find each provider's practices and controls. We do not currently use email pixels or text-message tracking for Product marketing.


6.4. Do Not Track (DNT).

Browser DNT signals are not designed to control processing inside a native mobile app, and an ordinary DNT signal does not by itself change native-app processing unless applicable law requires recognition of that signal. Where applicable law requires us to recognize a supported Device, consent-platform, or browser privacy signal for processing we control, we will do so. You may exercise the advertising choices described in Sections 5.3 and 7.2 at any time or contact us for assistance. General information about DNT is available at https://allaboutdnt.com/.


7. Online Behavioral Advertising (OBA) and How to Opt-Out of OBA


7.1. How OBA Works.

Where the user's choices and applicable law permit, an advertising provider may personalize ads using activity or inferred interests associated with an advertising or Device identifier. Depending on the provider and Product, the Data used for OBA may include Device make, model, settings and specifications; network connection, browser and operating-system information; advertising, app-instance or similar identifiers; IP-derived approximate region; timestamps; Product content or ads viewed; referring apps, sites, destinations and clickstream Data; ad impressions and interactions; and fraud signals. Non-personalized or limited ads may still use some technical Data for delivery, frequency capping, aggregated reporting, security, and fraud prevention. Provider-controlled processing is also governed by the provider's notice linked in Section 14.2.


7.2. Opt-Out of OBA.

Where prior consent is required, optional advertising processing does not begin merely because an opt-out is offered later. The in-Product consent or privacy-options interface must allow you to accept or reject optional purposes and revisit or withdraw your choice. Operating-system settings and provider controls may provide additional choices but do not replace prior consent where the law requires it. Rejecting or withdrawing optional advertising consent does not prevent contextual advertising that can be delivered without non-essential Device access, or technical processing that is strictly necessary to transmit, secure, or provide an expressly requested service. You may also contact support for assistance with Data controlled by us.

Additional industry opt-out resources may be available at https://optout.aboutads.info/, https://optout.networkadvertising.org/, and https://www.youronlinechoices.com/, or through an “Ad Choices” icon where one is displayed. These mechanisms affect only participating providers and the identifiers, browsers, Devices, or apps covered by the selected mechanism; they do not necessarily stop contextual advertising or processing strictly necessary to provide or secure the Product.


8. Transfer of Your Data Among Jurisdictions

We are based in Russia, and the Products are offered to a worldwide audience. Providers may process Data in Russia, the EEA, the United States, and other countries where they or their subprocessors operate. Acknowledgment of this Policy alone is not blanket consent to international transfers. For registered accounts, a separate cross-border-transfer choice is presented where required. Other transfers are made only under an applicable legal mechanism, such as an adequacy decision, applicable standard contractual clauses, another appropriate safeguard, or a specific derogation permitted by law. Where the LGPD applies, international transfers must also use a mechanism permitted by the LGPD and applicable ANPD rules. You may contact us for information about safeguards applicable to Data controlled by us and how to obtain a copy where available.

For the registered accounts described in the Account & Chat summary, personal data collected for accounts of citizens of the Russian Federation is first recorded, systematized, accumulated, stored, clarified, and retrieved in the Russian database described above before any permitted copy is mirrored or transferred to Google Firebase in the United States. This sequencing does not by itself authorize the later cross-border transfer; the other requirements in this Section still apply.


9. Data Security and Notification


9.1. Security Measures.

We take commercially reasonable technical and organizational measures designed to protect PII that we control against unauthorized access, alteration, disclosure, or destruction.


9.2. Limitations of Security.

No method of transmission or storage is completely secure. We use reasonable safeguards appropriate to the Data and risks, but cannot guarantee absolute security. Nothing in this Policy limits statutory rights or liability that cannot lawfully be excluded.


9.3. Breach Notification.

If a qualifying personal-data breach occurs, we will notify affected users and/or the competent authorities where required by law and within the applicable period. Depending on the circumstances and available contact channel, notice may be provided by email, in-Product notice, push notification, or another appropriate method.


10. Your Data protection rights under General Data Protection Regulation (GDPR)

10.1. Where the GDPR applies, we rely on performance of a valid user agreement, where applicable, for account creation, cloud save, multiplayer, purchases, and support requested by the user; legitimate interests for security, fraud and cheat prevention, diagnostics, moderation, and rule enforcement, after considering users' rights; consent for personalized advertising, non-essential Device storage or access, identifiers, and analytics where consent is required; and legal obligations for valid legal requests and records that law requires us to retain. A minor's ability to enter into a valid agreement is assessed separately under applicable national contract law. Independent providers determine their own legal bases as described in their notices.

10.2. If you are in the European Economic Area (EEA), you have the following data-protection rights, subject to the conditions and exceptions in applicable law. We normally respond within one month after receiving a request, although that period may be extended where the GDPR permits. We may ask for information reasonably necessary to verify your identity.

If you wish to know what PII we control or request its removal from our systems, please contact us. We require processors handling PII on our behalf to provide assistance reasonably necessary for us to respond to applicable Data-subject requests. For PII independently controlled by a provider, use the provider's contact method described in Section 14.2; we will assist with Operator-controlled Data where reasonably possible.

Subject to the applicability and conditions described above, the following GDPR rights may be available:

a) Your right of access

If you ask us, we will confirm whether we are processing your PII and, if so, provide you with a copy of that PII (along with certain other details). If you require additional copies, we may charge a reasonable fee for producing those additional copies.

b) Your right to rectification

If the PII we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have shared your PII with others, we'll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we've shared your PII with so that you can contact them.

c) Your right to erasure

You can ask us to delete or remove your PII in some circumstances, such as where we no longer need it or where you withdraw your consent (where applicable). If we have shared your PII with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your PII with so that you can contact them directly.

d) Your right to restrict processing

You can ask us to "block" or suppress the processing of your PII in certain circumstances such as where you contest the accuracy of that PII or you object to us processing it for a particular purpose. This may not mean that we will stop storing your PII but, where we do keep it, we will tell you if we remove any restriction that we have placed on your PII to stop us processing it further. If we've shared your PII with others, we'll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we'll also tell you who we've shared your PII with so that you can contact them directly.

e) Your right to data portability

Where the GDPR conditions for portability apply, you may obtain PII you provided to us in a structured, commonly used and machine-readable format, reuse it elsewhere, or ask us to transmit it to another controller where technically feasible.

f) Your right to object

You can ask us to stop processing your PII, and we will do so, if we are: (i) relying on our own or someone else's legitimate interest to process your PII, except if we can demonstrate compelling legal grounds for the processing; or (ii) processing your PII for direct marketing purposes.

g) Your rights in relation to automated decision-making and profiling

You have the right, where Article 22 GDPR applies, not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you, unless an applicable legal exception and required safeguards apply. Automated moderation tools are described in the Account & Chat summary above, and you may contact support to request human review of a material restriction.

h) Your right to withdraw consent

If we rely on your consent (or explicit consent) as our legal basis for processing your PII, you may withdraw it at any time through the available consent or privacy interface, another opt-out mechanism we provide (including an unsubscribe link where applicable), or by contacting us. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

i) Your right to lodge a complaint with the supervisory authority

You may lodge a complaint with the data-protection authority competent for your habitual residence, place of work, or the alleged infringement. We encourage you to contact us first so we can try to resolve the concern, but doing so is not a condition of filing a complaint.

10.3. EU/EEA Representative Status (Article 27 GDPR).

Where our processing falls within Article 3(2) GDPR, Article 27 may require us to designate in writing a representative established in the EU/EEA unless the narrow exception in Article 27(2) applies. This Policy does not currently identify or assert the appointment of such a representative. This omission is not an assertion that an exemption applies. Until valid representative details are published here, Data subjects and supervisory authorities may contact the Operator directly using Section 14.1. Appointment of a representative, where required, is an operational legal obligation and cannot be completed merely by changing this Policy.


11. Your Data protection rights under the Brazilian General Data Protection Law (LGPD)

11.1. Where the LGPD applies, we process personal data only for purposes compatible with this Policy and under a legal basis available under the LGPD, which may include consent, performance of a contract or preliminary procedures requested by you, compliance with a legal or regulatory obligation, exercise of rights, protection of life or physical safety, and legitimate interests subject to the rights and freedoms of the data subject. If another provision of this Policy conflicts with this Section for processing subject to the LGPD, this Section controls to the extent necessary to preserve the protections required by the LGPD.

11.2. Subject to the conditions in Article 18 LGPD and other applicable provisions, you may request: confirmation that processing exists; access; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data; portability where applicable and subject to regulation and commercial or industrial secrets; deletion of data processed on consent, subject to lawful retention under Article 16; information about public and private entities with which data was shared; information about the possibility and consequences of refusing consent; withdrawal of consent; review of qualifying automated decisions; objection to unlawful processing; and the right to petition the ANPD or consumer-protection bodies.

11.3. To exercise a right concerning Data controlled by us, contact the Privacy Policy Coordinator. We may take reasonable steps to verify the requester's identity and will respond within the form and period required by applicable law. We will provide assistance reasonably necessary to address an Article 18 request concerning Data controlled by us. For provider-controlled Data, the provider's own request channel may also be necessary.

11.4. As a condition of receiving user Data from a Product, every Third-Party Provider with whom we share such Data, including service providers, analytics tools, advertising networks, and SDK providers, is required to provide the same or equivalent protection of user Data as described in this Policy and required by applicable law and App Store rules. Providers may use different technical and organizational measures, but those differences do not reduce the required level of protection. We use appropriate contractual terms, configuration controls, and due diligence for each provider's role to limit processing to disclosed purposes and require confidentiality, security, retention and deletion safeguards, and respect for applicable user choices. We require employees, agents, and providers acting on our behalf to follow the applicable LGPD obligations, and personnel with access to covered Data must receive appropriate handling guidance and be bound to preserve its confidentiality and security.

11.5. International transfers of personal data subject to the LGPD are made only through a mechanism permitted by the LGPD and applicable ANPD rules, as further described in Section 8.

11.6. We are committed to carrying out appropriate privacy and data-protection impact assessments and will prepare a data-protection impact report or provide information to the ANPD where required by applicable law, the risk of processing, or a competent request. We will notify affected Data subjects and the ANPD of a qualifying security incident as required by the LGPD and applicable ANPD rules, and will respond to a notification, complaint, consultation, or request from the ANPD concerning covered processing.


12. Your Data protection rights in California


12.1. California Consumer Privacy Act (CCPA).

This Section applies only if the CCPA, as amended by the CPRA, applies to our processing. We act as the business responsible for requests concerning personal information that we control; we do not describe ourselves as a CCPA “service provider” merely because the Products use third-party SDKs.

We do not sell personal information for money. Disclosures of identifiers or Product events to advertising providers for cross-context behavioral advertising may constitute “sharing” under California law even when no money is exchanged. If the CCPA applies, California residents may request to know or access, correct, or delete covered personal information; opt out of applicable sale or sharing; limit the use or disclosure of sensitive personal information where that right applies; use an authorized agent; and exercise these rights without discrimination.


Subject to the applicability and conditions described above, the following CCPA rights may be available:

a) You may request the categories and specific pieces of covered personal information collected, sources, purposes, categories of recipients, and applicable sale or sharing information. Where the CCPA applies, a covered request to know is ordinarily available free of charge up to twice in a 12-month period, and we will respond within the period required by law.

b) You may request correction of inaccurate covered personal information or deletion of covered personal information collected from you.

However, this right does not apply where we need to retain the PII in order to do any of the following:

- to provide goods or services requested by you;

- to detect or resolve security- or functionality-related issues;

- to comply with the law;

- to conduct research in the public interest;

- safeguard the right to free speech;

- to carry out any actions for internal purposes that you might reasonably expect;

c) You may request to opt out of applicable sale or sharing and to limit use or disclosure of sensitive personal information where the statutory right applies. Available advertising and provider controls are described in Sections 5.3 and 7.2, and you may contact the Privacy Policy Coordinator.

d) You have the right not to be discriminated against for exercising applicable CCPA rights.


12.2. Shine the Light.

California's “Shine the Light” law, Civil Code Section 1798.83, gives eligible California customers rights concerning disclosure of certain personal information to third parties for those third parties' direct-marketing purposes. We do not provide names, email addresses, postal addresses, or phone numbers to third parties for their own direct-marketing lists. An eligible California resident may contact the Privacy Policy Coordinator for information about this practice or to opt out of any future disclosure by us for a third party's own direct-marketing purposes.

12.3. Online Erasure.

California's “Online Erasure” law, Business and Professions Code Sections 22580-22582, requires operators of certain websites and online services to allow qualifying registered users who are under 18 and residents of California to request removal of Content they posted. If this law applies to Content you posted through a Product, you may contact the Privacy Policy Coordinator. Removal from public view does not guarantee complete erasure where an exception applies or where another user or independent service copied and reposted the Content.


13. User Data Deletion

13.1 Right to Data Deletion

Users have the right to request the deletion of their data from our system. We respect your right to privacy and provide the option to delete your data in accordance with applicable laws.

13.2 Data Deletion Procedure

Please note: the self-service account-deletion function is available only within the game "Imposter 3D: Online horror". This does not limit a statutory request that may be submitted to the Privacy Policy Coordinator.

To delete your account and associated data, please follow these steps in the game:

  1. Open the game "Imposter 3D: Online horror"
  2. Go to the Online menu
  3. Select the "Account" button
  4. Select the "Account settings" button
  5. Choose "Delete Account"
  6. Follow the on-screen instructions to confirm your account deletion

For more detailed information about the deletion process, please visit our dedicated page: https://snokkk.github.io/imp3d_account.html

On this page, you will find detailed information about the deletion process, including:

13.3 Consequences of Data Deletion

Please note that account deletion is irreversible. The user-facing workflow may revoke access before all deletion operations have completed. Once the deletion procedure is completed:

13.4 Data That May Be Retained

When you delete your account using the self-service function in the Product, the active account, profile, progress, friends and other associated user-generated Content controlled by us are deleted from active systems immediately. Deletion requests submitted by email are completed within 30 days. Backup copies of Data otherwise deleted may remain for up to 7 days before being deleted or overwritten.

Six-month chat retention. We retain chat messages and related reports, moderation records and security records for six months from the receipt or processing of each message, including when the sender or another participant deletes an account. These records may include the message, sender account or Player identifier, room or session identifiers, timestamps, reports, and related IP, Device or security information reasonably needed to attribute and investigate the message. This retention preserves the history needed to moderate the Product, protect users, investigate abuse or possible crimes, preserve evidence and respond to lawful requests from competent authorities. Account deletion does not delete this history early and does not restart or extend the six-month period. If the same login is registered again, the retained history remains attributed to the deleted account's former internal identifier and is not reassigned to the new account.

During this period, retained chat records are access-restricted, are not available through the deleted account, and are not used for advertising or personalization. They are securely deleted or irreversibly anonymized after six months unless a specific preservation request, legal hold, investigation or applicable law requires a particular record to be retained longer. Access and any longer retention are limited to the applicable safety, investigation or legal purpose. The 7-day backup period applies to Data otherwise deleted and does not shorten the six-month chat-retention period.

Account deletion also causes us to delete, return, or notify and instruct our processors, service providers, SDK recipients, and other recipients as appropriate to delete Product Data they hold on our behalf or received from the Product, except for the six-month chat, moderation and security records described above and any record subject to a specific preservation or legal requirement. This does not delete Data that an app store or platform collected directly from you in its own relationship with you as an independent controller, such as its own purchase or transaction record; use that provider's controls for those independently collected records. Independent-controller status does not reduce the same-or-equivalent protection commitment in Section 11.4 for Data shared from a Product.

13.5 User Support

If you have any questions or issues with the data deletion process, please contact our support team at snowbatstudio@gmail.com.

14. Privacy Policy Coordinator


14.1. Our Privacy Policy Coordinator

If you have any concerns or questions about any aspect of this policy, please feel free to contact our Privacy Policy Coordinator as follows:

e-mail: snowbatstudio@gmail.com

If you wish to exercise this right, please contact our Privacy Policy Coordinator and state which of these items you wish to opt-out of sharing with third parties.

Also, as discussed above, if you have registered on any part of the Product and you wish to update or make changes to your PII on file with us, you may contact our Privacy Policy Coordinator.


14.2. Privacy Policies of Third Parties

The Products may integrate the following providers for distribution, authentication, cloud functionality, multiplayer, payments handled by an app store, advertising, mediation, analytics, attribution, measurement, and related security or fraud-prevention functions. Inclusion below means that a provider's technology may be present or used in at least one Product, platform, build, region, or version; it does not mean that every provider receives Data from every user:

a) Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043);

You can read Google’s privacy policy by the link:

https://policies.google.com/privacy 

b) YANDEX LLC (16 Lva Tolstogo St., Moscow 119021, Russia).

You can read YANDEX’s privacy policy by the link:

https://yandex.ru/legal/confidential/ 

c) AppLovin Corporation (Data Protection Officer, AppLovin Corporation, 1100 Page Mill Road, 

Palo Alto, CA 94304); 

You can read AppLovin’s privacy policy by the link: 

https://www.applovin.com/privacy/ 

d) Chartboost, Inc. (One Sansome Street Floor 21, San Francisco, CA 94104);

You can read Chartboost’s privacy policy by the link: 

https://answers.chartboost.com/en-us/articles/200780269 

e) ironSource Ltd (ironSource Ltd., dpo@ironsrc.com, 121 Menachem Begin Rd., Tel Aviv, Israel, 

Attn: Data Protection Officer); 

You can read ironSource’s privacy policy by the link: 

https://www.is.com/privacy-policy/ 

f) Digital Turbine (formerly AdColony);

You can read Digital Turbine’s privacy policy by the link: 

https://www.digitalturbine.com/legal/dt-clients-privacy-policy 

g) Unity Software, Inc. (30 3rd Street, San Francisco, CA 94103, United States); 

You can read Unity Software’s privacy policy by the link: 

https://unity3d.com/ru/legal/privacy-policy 

h) Liftoff Mobile, Inc. — Liftoff Monetize (formerly Vungle);

You can read Liftoff’s privacy policy by the link: 

https://liftoff.io/privacy-policy/ 

i) Bytedance Pte. Ltd (1 Raffles Quay, #26-10 ,Singapore 048583);

You can read Bytedance’s privacy policy by the link:

https://www.pangleglobal.com/privacy 

j) MGL MY.COM (CYPRUS) LIMITED — myTarget;

You can read the myTarget/MY.COM privacy policy by the link: 

https://legal.my.com/us/mytarget/privacy/ 

k) Mintegral International Limited. (Legal Department, Room 4312, No. 222-3 Xingmin Road, 

Tianhe District, Guangzhou City, Guangdong Province, China); 

You can read Mintegral’s privacy policy by the link: 

https://www.mintegral.com/en/privacy 

l) Tapjoy, Inc. (353 Sacramento Street, 6th Floor, San Francisco, CA 94111, U.S., Attn: Privacy, or 

call us at +1 415-766-6900);

You can read TapJoy’s privacy policy by the link: 

https://dev.tapjoy.com/en/legal/Privacy-Policy 

m) Start.io Inc. (584 Broadway St. 12th Floor Suite 1206 New York, NY, 10012);

You can read Start.io’s privacy policy by the link: 

https://www.start.io/policy/privacy-policy/ 

n) Apple Inc. (One Apple Park Way, Cupertino, California, USA, 95014)

You can read Apple’s privacy policy by the link:

https://www.apple.com/legal/privacy/en-ww/ 

o) Appodeal, Inc. — advertising mediation used in ABC Lore 3D: zombie online;

 You can read Appodeal privacy policy by the link:

https://appodeal.com/privacy-policy/

p) BigoAds;

 You can read BigoAds privacy policy by the link:

https://www.adsbigo.com/privacy.html

q) InMobi Pte. Ltd.;

 You can read InMobi’s privacy policy by the link:

https://advertising.inmobi.com/privacy-policy

r) zMaticoo, Inc.;

 You can read zMaticoo’s privacy policy by the link:

https://www.zmaticoo.com/privacy

s) Yandex AppMetrica, provided by Yandex LLC;

 You can read the Yandex privacy policy applicable to AppMetrica by the link:

https://yandex.com/legal/confidential/


To exercise rights concerning Data controlled by us, contact the Privacy Policy Coordinator. For Data independently controlled by a provider, use the controls or contact methods in that provider's notice. Support may explain available controls but cannot promise to alter Data controlled solely by an independent provider.


Advertising SDK packages may be present in the Product even when an individual advertising network is disabled remotely through mediation settings. The set of active networks may vary by Product, platform, region, build, version, and available advertising inventory.

Note: Only inquiries about this policy or your PII should be sent to the Privacy Policy Coordinator. No other communications will be accepted or responded to.

For communications on other matters, please contact us through the means described on the Product, if available (e.g. in the «Contact Us» section).


* * * * * * * * * * * * * *


If you do not wish to use the Product under the practices described in this Privacy Policy, stop using and uninstall the Product. You may separately request deletion of eligible Data as described in Section 13.

By clicking “I Agree” where shown, you confirm that you have read and understood this Privacy Policy. This acknowledgment is separate from any consent or age or parental attestation collected by the Product for a specific purpose.

Contact

snowbatstudio@gmail.com

Back to Home