Privacy Policy for Winchange Games

(Revised as of September 23, 2026)

WHY DO WE HAVE THIS POLICY?

This Privacy Policy is a set of commitments that WINCHANGE LIMITED promises to follow when collecting, processing, and protecting your personal data. Your privacy is our highest priority, and we are committed to safeguarding your personal information in accordance with applicable laws and security best practices. This Policy explains:

• What data we process;
• With whom we may share your data;
• The purposes of data processing;
• How long we retain your data;
• How we protect your data; and
• How you can control your data.

We strive to comply with applicable data protection laws, including but not limited to the GDPR (European Union), LGPD (Brazil), and PIPA (Korea). Where local laws grant you specific rights, these are outlined in the section “How Can You Control Your Data?” and in any additional regional notices, as applicable.

WHO ARE WE?

WINCHANGE LIMITED ("Winchange", "we", "us", "our") is a game publisher dedicated to providing engaging and secure gaming experiences. This Privacy Policy explains how we collect, use, and protect your personal data as you play our games.

This Privacy Policy applies to mobile games published by WINCHANGE LIMITED that link to this Policy, including test, alpha, beta and soft-launch versions, and their related authentication flows, support channels and account-deletion services (each a “Project”). References to the Project mean the game you are using and its related services.

Features differ between Projects. Sections relating to accounts, purchases, advertising, analytics or Tests apply only where the relevant feature or processing is used in the Project. Where we request your consent, the in-Project notice or privacy settings identify the relevant purposes, data and partners before that processing starts. This Policy does not itself give consent to optional processing or imply that all games share a single account.

If you are not an adult, please obtain permission from your legal guardian before using the Project. For any questions or concerns, please contact us via the “Support” section in the Project or by email at:
Email: vibebyte.games@gmail.com

If we appoint a Data Protection Officer (DPO), a representative or a similar contact required under applicable law, we will publish the relevant contact details as required. You can use the contact details in this Policy for privacy requests.

Data Controller

For the purposes of the GDPR and other applicable data protection laws, the Data Controller is:

WINCHANGE LIMITED
Georgiou Griva Digeni, 113, Astromeritis, 2722, Nicosia, Cyprus
Email: vibebyte.games@gmail.com

WHAT DATA DO WE COLLECT AND WHY?

We consider any information that can identify you as personal data. We collect various types of data to provide you with a full gaming experience and to continually improve our services. In order to clearly explain the data we process, please refer to the table below.

Where we rely on your consent, you may withdraw it at any time. We review whether it remains appropriate and request renewed consent when needed, including when the purpose or scope of processing changes. We do not rely on consent for more than five (5) years from your last relevant interaction, and may refresh it sooner. This maximum does not mean that consent automatically remains valid for five years.

Data Processing Overview

PRODUCT EXPERIMENTS AND TESTING

From time to time, we run product experiments, A/B tests and other testing activities to understand how players use the Project and to make the gameplay experience better, clearer, safer and more enjoyable. These activities may include testing different versions of our first-time user experience, early-game mechanics, content presentation, offers, features, technical performance, and comparing results between test and control groups.

We may also conduct closed or open alpha tests, beta tests, technical tests, soft launches, feature previews, server stress tests, regional roll-outs and other pre-release or limited tests of the Project or particular features (collectively, “Tests”). Tests may be invitation-based, automatic for eligible accounts, limited to certain regions, platforms, devices, servers, account ages or newly created accounts, and may take place in separate or live environments.

To carry out these Tests, we may assign players to different versions of the Project, direct registrations from certain countries, platforms to dedicated test servers, limit participation to specific cohorts, or make temporary or experimental content available only within a test environment. Depending on the Test, this may affect the availability, appearance or order of features, content, offers, onboarding steps, pricing presentation, game balance, login flows, progression pacing, or access to particular environments. Prices of existing offers generally remain unchanged; we may test new offers, but we do not increase the prices of existing offers solely because of a player’s participation in a Test.

As part of these Tests, we may process account, gameplay, technical and analytics data that helps us understand how players interact with the Project, including, for example, account ID, region or server, platform, device or operating system information, session and gameplay events, progression data, engagement and retention metrics, conversion-related events, crash data, performance metrics, support-related signals and other information reasonably necessary to analyse the Test and improve the Project.

All collected data is processed within the Project or the relevant test build, transferred securely to our systems, and removed from your device afterwards where applicable. We keep such data only for as long as needed to analyse and validate the Test, typically up to 12 months, and then delete or anonymize it unless a longer period is required by law or the data has been irreversibly anonymized. Access is strictly limited to teams and service providers who help us analyse gameplay, maintain service quality, detect issues and improve the Project. We do not use data collected for these Tests for targeted advertising.

Where permitted by applicable law, participation in product experiments and Tests is generally automatic for eligible accounts and does not require separate consent where the relevant processing is necessary to provide, operate, secure, support or improve the Project or a test build you choose to access, to authenticate users, prevent fraud, ensure service quality, fix bugs, evaluate gameplay balance or performance, or conduct proportionate product improvement using data that we already process for the Project. In such cases, we generally rely on performance of contract and/or our legitimate interests, subject to appropriate safeguards and your rights under applicable law.

We will obtain your consent, or another form of authorization required by applicable law, before conducting a Test where we need to use personal data, device access or tracking technologies that are not necessary for the Test or not reasonably expected in the context of the Project. Where required by law, we will also obtain verifiable parental or guardian consent for participation by children.

Depending on the Test, content, features, progression, rewards, purchases, entitlements or access available in a test environment may be temporary, unstable, limited, reset, modified or unavailable after the Test ends, unless otherwise stated in a separate notice, test-specific terms or other communication. Participation in a Test does not by itself grant any ownership or guaranteed continued access to any feature, item, progress or reward made available during the Test.

Where appropriate, we may provide an additional notice, an in-Project prompt, a consent screen, an invitation flow, or separate test terms describing the specific purposes, categories of data, retention periods, eligibility criteria, regions, confidentiality requirements, withdrawal mechanisms and other conditions applicable to a particular Test. You may also contact us through in-Project support to request removal from a specific Test where technically feasible, or to object to processing based on our legitimate interests, as described in the section “How can you control your data?”.

LEGAL BASES FOR DATA PROCESSING

We process your personal data only when necessary for providing access to and improving the Project. Our legal bases for processing include:

• Contract: For account creation, management, and processing in-game transactions.
• Legitimate Interests: For security measures, fraud prevention, and the analysis of user behavior to enhance the gaming experience.
• · Consent: For processing data based on your explicit permissions (e.g., targeted ads, where applicable).
• Legal Obligations: To comply with applicable laws such as tax reporting and consumer protection regulations.

HOW DO WE SHARE YOUR DATA?

We do not sell your personal data for money. However, certain disclosures to advertising partners may be considered “sharing” for cross-context behavioral advertising, “targeted advertising” or similar activity under some US state privacy laws. Where applicable, you may opt out of such sharing or targeted advertising as described in this Policy. To provide you with our services, we may share your data under the following circumstances:

1. Service Providers & Partners:
   • Technical and Customer Support Providers: Account details, contact information, support messages and relevant technical data, as needed to operate the Project and resolve your requests.
   • Cloud and Hosting Providers: Account, gameplay and technical data, as needed to host, securely store and operate the Project and related services.
   • Analytics and Diagnostics Providers: Gameplay events, usage information, device information, crash reports and performance data, as needed to analyse and improve gameplay, stability and performance, subject to your consent where required.
   • Advertising and Attribution Partners: Advertising identifiers and related advertising interaction or event data, as needed to deliver ads, measure campaign performance and attribute installations or purchases, subject to your choices and consent where required.
   • App Stores and Payment Providers: Purchase and transaction information, as needed to process payments, validate purchases and handle billing or refunds. Payment card details are processed by the relevant store or payment provider and are not stored by us.

These categories describe the partners with whom we may share personal data for the relevant Project. Each partner receives only the data needed for its role. Not every partner category is used by every Project. Where optional processing requires consent, the applicable in-Project notice or privacy settings provide the information needed to make your choice.

We require third parties that receive user data to provide the same or an equal level of protection as described in this Policy and required by the applicable app store rules.

1. Affiliates & Business Transfers:
   • Data may be shared within our corporate group or transferred in connection with mergers, acquisitions, or asset sales, subject to confidentiality agreements.
2. Legal & Regulatory Requirements:
   • We may disclose data to comply with legal obligations, respond to lawful requests, or protect the rights, property, or safety of our users or the public.
3. International Transfers:
   • When data is transferred outside the EEA, we ensure appropriate safeguards (such as Standard Contractual Clauses) are in place.

If you reside in other regions (e.g., Brazil, Korea), we will also use appropriate or equivalent safeguards to ensure lawful data transfers, in line with LGPD or PIPA requirements.

Account deletion: https://vibebyte.games/delete-account/
Terms of Service: https://vibebyte.games/terms/ Parent’s Guide: https://vibebyte.games/parents/

DATA RETENTION

We retain your personal data only as long as necessary to fulfill the purposes outlined in this Policy or as required by law. For example:

• Account Data: Retained for as long as your account is active; if deletion is requested, data is generally removed or anonymized within 30 days (except where longer retention is required, e.g., 7 years for financial records).
• Usage & Analytics Data: Personal data, including aggregated data that can still identify an individual, is subject to the retention periods and choices described in the Data Processing Overview. Only irreversibly anonymized information that no longer identifies an individual may be retained indefinitely.
• Support Data: Retained for the duration of the support case or as required by law.

Once the purpose for which data is processed has been fulfilled, personal data is securely deleted.

HOW CAN YOU CONTROL YOUR DATA?

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion (“Right to be Forgotten”): Request deletion of your personal data (note that this may result in loss of access to the Project).
• Restriction & Objection: Request that we limit or cease processing your data.
• Withdraw Consent: Revoke consent for data processing where it is based on your permission (e.g., targeted ads).

Additional rights for specific regions:

Data Portability (GDPR, some other jurisdictions): Receive your data in a structured, commonly used, and machine-readable format.

Right to Lodge a Complaint: You may file a complaint with a supervisory authority (for example, in the EU or Brazil) if you believe we have processed your data unlawfully.

Request for Suspension of Processing (Korea): Under PIPA, users may request temporary suspension of processing under certain conditions.

To exercise these rights, please contact us via the in-game “Support” section or email:
Email: vibebyte.games@gmail.com

We may require reasonable verification of your identity before processing your request. We normally respond within 30 days and, where applicable law requires a shorter period, within that period. If a lawful extension is needed, we will explain the reason and the applicable timeframe.

Targeted Advertising Choices:

You can opt out of targeted advertising at any time through the privacy settings, account settings, consent management interface, or by contacting us.

If you are a resident of a US state that provides this right, you may opt out of the sale or sharing of personal information and targeted advertising. Where required by applicable law, we also process applicable opt-out preference signals, such as Global Privacy Control.

Read more

You can exercise the choices and rights described in this Policy. We are constantly improving the data management methods available to you.

You can form a request within the Project by sending a request in the Support section or Account. You are entitled to obtain information from us on how we handle your personal data, to see copies of all personal data held by us and to request that your personal data is amended, corrected or deleted from our systems. You can also limit, restrict or object to the processing of your data.

For exercising your rights, you can:

- at any time withdraw your consent for processing based on consent;

- access the personal data we hold about you and request information about its storage and processing, as well as a copy of that data;

- require limitation of Data processing for the time required to verify the reliability of the information provided;

- request correction of inaccurate or incomplete personal data associated with your Account;

- object to the processing of your Data. If you believe that we have no legitimate reason for processing your Data, please contact us using email: vibebyte.games@gmail.com. If we fail to satisfy your claim, you have the right to file a complaint with the local supervisory authority.

- delete Data related to the Account.

The procedure for withdrawing consent to the processing and deletion of Data:

You can start account deletion using the “Delete account” option in the Project. You may also request deletion by contacting us at vibebyte.games@gmail.com; instructions are available on the account-deletion information page linked from this Policy. Identify the relevant game and account in your request. You do not need to reinstall the game to use the external request route. If you do not have a registered account, you may still request deletion of personal data associated with your use of a Project through the same contact details.

PLEASE NOTE that we use personal data for the purposes described in this Policy. By deleting Account Data, you will lose access to the relevant Project account and its associated personal data will be deleted, subject to the retention exceptions described in this Policy. A request relating to one game does not automatically delete accounts in other games.

HOW DO WE PROTECT YOUR DATA?

We implement robust technical and organizational measures to safeguard your data against unauthorized access, alteration, or loss. Our security measures include:

• Data Encryption: During both storage and transmission.
• Access Controls: Restricting data access to authorized personnel only.
• Two-Factor Authentication: For sensitive account operations.
• Regular Audits & Security Assessments: To continuously identify and mitigate vulnerabilities.

Read more

We provide access to the Project internationally and strive to comply with applicable local laws. Your use of the Project is subject to our Terms of Service. Nothing in those Terms limits our obligations under applicable data protection law.

WINCHANGE LIMITED respects the confidentiality of your data and strives to ensure a high level of protection. Keeping your account credentials secure also helps protect your information.

The Project uses technical and organizational measures to ensure the security of your data. We do everything possible for your safety when using the Project and are constantly improving our information protection methods. As some means of protecting information from unauthorized access, alteration, disclosure or destruction, we use the following methods:

- data encryption during storage and transmission;

- we carry out two-factor user authentication when requesting an action with the Data;

- we improve the techniques and methods of collecting, storing and processing the Data;

- access to personal data is limited to authorized employees, consultants and service providers who need it to perform their duties, with appropriate access controls and safeguards;

- all persons having access to the Data are briefed on working with data, their knowledge and skills are systematically being checked.

In addition to the measures we take, protecting your Account credentials is important for the security of your data. We strongly recommend that you do not share access to your Account and that you follow the Terms of Service. These recommendations do not limit our data protection obligations.

WARNING! The following actions are prohibited by this Policy and the Terms of Service, and may also violate the confidentiality of your data:

- transfer of information about the Account and (or) access rights to third parties. Please note that our official representative will never request access to your Account;

- the use of unauthorized third-party programs, the use of robot programs and (or) programs that change the Project process, including assistance in the Project process. In addition to the fact that the use of such programs is expressly prohibited by the Terms of Service, they may contain malicious software that could harm the security of your data;

- the acquisition of in-game values from third parties. By acquiring in-game values bypassing the Terms of Service, you can become a victim of fraudsters.

WINCHANGE LIMITED appreciates the help of our users in identifying and addressing potential vulnerabilities, as we take the security of our systems and data extremely seriously. Please report any security vulnerabilities found in our systems or applications to us as soon as possible.

In your email, please include a detailed description of the vulnerability, including any relevant technical details that may help us understand the nature and severity of the issue. If possible, please also include steps to reproduce the vulnerability, so that we can more easily investigate and remediate the issue. We take all reports of security vulnerabilities seriously, and we will investigate each report promptly and thoroughly.

We may also contact you for additional information or clarification, so please be sure to include your contact information in your email. Thank you for helping us maintain the security of our systems and data. We greatly appreciate your contribution to our security efforts.

Please keep your account credentials secure and do not share them with others. If you suspect any security breach, contact us immediately at:
Email: vibebyte.games@gmail.com

CHILDREN’S PRIVACY

The Projects covered by this Policy are not directed to children under the age of 18. Our requirement for parental or guardian permission for users under 18 is a service rule; it does not mean that every jurisdiction sets the legal age of consent to data processing at 18. We are committed to handling any children’s data responsibly and in compliance with applicable law.

We do not knowingly collect personal information from users under 18 without verifiable parental or guardian consent, subject to any limited collection permitted by applicable law to establish age, obtain consent or protect users. Where applicable law imposes stricter requirements, those requirements apply.

If we discover that we have inadvertently collected personal data from a child without proper consent, we will promptly delete or anonymize that data.

Age Restriction & Verification

Age Gate: Where feasible, we implement checks (e.g., age prompts) to discourage children under the required age from providing personal data.

Parental/Guardian Consent: If a user is under the required age, they must obtain permission from a parent or legal guardian before accessing or using the Project’s services. We may request a parent’s email address or other verification information to ensure consent is valid and verifiable.

Limited Data Collection

Any data collected in connection with children’s activity (e.g., for support requests or gameplay functionality) is minimized to what is strictly necessary for providing our services. We do not use such data for behavioral advertising or other purposes not permitted by law.

We do not use children’s data, or data of users whose age status does not allow such processing, for behavioral advertising.

The same principles apply to alpha, beta or other pre-release environments made available to child users, unless stricter rules apply under local law.

Parental Controls & Guidance

We encourage parents and guardians to familiarize themselves with online safety practices and monitor their children’s in-game activities. Please read our Parent’s Guide and use the parental controls made available by your app store for information on protecting children’s privacy and managing in-app purchases.

Parental Rights

Parents or legal guardians may request to review, delete, or prevent further collection of their child’s personal data. If you believe we have collected information from a child contrary to applicable law, contact us immediately, and we will take appropriate measures.

Contact for Children’s Data Concerns

If you have concerns about the data we may hold from or about a child, or wish to withdraw consent previously given, please contact our support team:

Email: vibebyte.games@gmail.com

CHANGES TO THIS POLICY

We reserve the right to modify or update this Privacy Policy at any time. Should significant changes be made, we will notify you via the Project or other appropriate channels. Continued use of the Project does not constitute consent to new optional processing. Where consent is required, we will request it separately before that processing starts.

CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, or if you wish to request previous versions of this Policy, please contact us at:

WINCHANGE LIMITED
Address: Georgiou Griva Digeni, 113, Astromeritis, 2722, Nicosia, Cyprus
Email: vibebyte.games@gmail.com

FAITHFULLY YOURS,
WINCHANGE LIMITED
This Policy is written in English. In the event of any discrepancies between translations, the English version shall prevail.