GULF GAMBIT — PRIVACY POLICY

Effective date: 2026-09-27 Last updated: 2026-09-27

1. Who we are

Gulf Gambit ("Gulf Gambit", the "App", "we", "us" or "our") is a mobile strategy game operated by:

For the purposes of the EU General Data Protection Regulation ("GDPR" / "AVG"), we are the data controller for the personal data described in this Privacy Policy, except where another party acts as an independent controller.

2. Scope of this Policy

This Privacy Policy explains:

• what personal data we collect;
• why we collect it;
• the legal basis on which we process it;
• who we share it with;
• how long we retain it;
• how we protect it; and
• what rights you have.

This Policy applies when you use Gulf Gambit, create an account, participate in matches or alliances, use chat, make purchases, receive notifications, contact support or otherwise interact with the App.

This Policy is informational. Where a particular type of processing requires your consent, we will ask for that consent separately.

3. Children and age requirements

Gulf Gambit is intended for players aged 13 and over.

We do not rely on consent for personal data that is strictly necessary to create your account or provide the core game service. That processing is necessary to perform our contract with you (art. 6(1)(b) GDPR), which is a lawful basis a 13-year-old can rely on in their own right.

We have designed Gulf Gambit so that no part of it depends on a child's consent. In particular, advertising is contextual for every player and is never based on profiling, at any age — see section 4.5.

The age question. Before you begin, the App asks once what year you were born, so that it can apply the minimum age above. Your answer is stored on your own device and is never transmitted to us. We do not hold your date or year of birth on our servers, it is not in any of our databases, and it is not shared with anyone. If you delete the App, the answer goes with it.

We store the year rather than only checking it because a single "I am over 13" tap collects nothing anyone can act on, whereas a year lets the App behave correctly at the second threshold too: the age below which consent-based processing would need a parent's authorisation. In the Netherlands that threshold is 16.

Because the answer never reaches us, this is not personal data that we process. It is described here anyway, because being asked your birth year and being told it is not collected would otherwise look like a contradiction.

Where a future optional feature would require consent, we will not knowingly carry out that processing for a child who cannot legally provide it unless any legally required parental authorisation has been obtained.

If you believe that a child has provided personal data to us contrary to applicable law, contact privacy@gulf-gambit.com and we will investigate and take appropriate action.

4. Personal data we collect

4.1 Account data

When you create an account, we may process:

We do not store passwords in plain text.

4.2 Gameplay and progression data

We process information generated through gameplay, including:

• matches played;
• factions or roles selected;
• orders and moves submitted;
• wins, losses and draws;
• matchmaking information;
• rankings and leaderboard position;
• experience points and player level;
• streaks and daily rewards;
• achievements;
• alliance membership;
• owned Commanders and Accessories;
• Coins and other virtual balances; and
• game configuration and progression.

We use this information to provide Gulf Gambit, synchronise progress, operate matchmaking, prevent cheating, calculate rankings and maintain game balance.

Legal basis: performance of our contract with you and, where applicable, our legitimate interest in operating and securing the game.

4.3 Chat and user-generated content

Gulf Gambit may include:

• match chat;
• alliance chat;
• usernames;
• reports;
• moderation records; and
• other user-generated content ("UGC").

We process chat messages to provide the communication feature.

Messages are visible to the players who participate in the relevant match, alliance or channel. They should therefore not be treated as private communications.

We may access or review messages where reasonably necessary to:

• investigate a report;
• enforce our Terms of Service;
• detect abuse or cheating;
• protect players;
• comply with law; or
• maintain the integrity of the service.

Reported messages and related moderation information may be retained for longer than ordinary chat messages where reasonably necessary for safety, fraud prevention or dispute handling.

Legal bases: contract and legitimate interest.

4.4 Purchases

If you purchase Virtual Goods through the Apple App Store, we may receive:

• Apple transaction identifier;
• product identifier / SKU;
• product purchased;
• purchase date;
• purchase status;
• amount or localised transaction information where made available to us; and
• information necessary to validate or restore a purchase.

Apple processes the actual payment. We do not receive your full payment-card details or Apple ID password.

We process purchase information to:

• fulfil purchases;
• restore purchases;
• prevent fraud;
• handle support issues;
• maintain accounting records; and
• comply with tax and legal obligations.

4.5 Advertising

This version of Gulf Gambit contains no advertising, and no advertising provider receives any data from it.

There is no advertising SDK in the app. No advertising identifier is read, no ad is requested or displayed, and Apple's App Tracking Transparency prompt is never shown — because there is nothing to ask permission for. This is why our privacy manifest declares NSPrivacyTracking = false with no tracking domains, and why our App Store privacy answers report no data used for tracking.

If advertising is introduced in a future version, this Policy will be updated BEFORE that version ships, the relevant provider will be named here, and any permission that applicable law or Apple's rules require will be requested at that point.

4.5a Push notifications

If you allow notifications, Apple issues your device a push token, which we store against your account so we can tell you when it is your turn in a match or when something needs your attention.

The token identifies a device, not you personally, but because we hold it against your account we treat it as personal data.

You control this entirely. Notifications are off until you allow them, you can withdraw permission at any time in iOS Settings, and we stop sending as soon as Apple tells us a token is no longer valid. Signing out removes the token for that device, so the next person to sign in on it never receives notifications meant for you. Deleting your account deletes it with everything else.

Apple operates the delivery network and necessarily processes the token and the notification content in transit.

4.6 Device, security and diagnostics

We may process:

• device model;
• operating-system version;
• App version;
• language;
• crash data;
• diagnostic information;
• timestamps;
• IP address;
• server requests; and
• security or anti-abuse signals.

We use this information for:

• security;
• abuse prevention;
• troubleshooting;
• compatibility;
• service reliability; and
• fraud and cheating detection.

Legal basis: legitimate interest in operating and protecting Gulf Gambit.

We do not intentionally request access to your contacts, health information, precise GPS location, microphone, camera, photo library or files outside the App unless a future feature clearly requires it and appropriate permission and notice are provided.

5. Third-party service providers

We use third parties to operate Gulf Gambit.

The database is not hosted by a separate provider: PostgreSQL runs on our own servers at the hosting provider named above.

No advertising provider is listed because this version serves no advertising — see section 4.5. An earlier draft of this Policy named one; it was removed because naming a processor that receives nothing is as inaccurate as omitting one that does.

We do not use a third-party analytics SDK or a third-party crash-reporting SDK. Crash and diagnostic information reaches us only through Apple's built-in reporting, which Apple collects only where you have enabled sharing on your device, and App Store Connect's aggregated statistics.

We require service providers acting on our behalf to process personal data only for authorised purposes and with appropriate safeguards.

Some third parties, such as Apple, may act as independent controllers for certain processing they perform.

We do not sell your personal data.

6. International transfers

We aim to host core Gulf Gambit data in: Finland (EU/EEA).

Some service providers may process information outside the European Economic Area.

Where personal data is transferred internationally, we use a lawful transfer mechanism where required, which may include:

• an adequacy decision of the European Commission;
• Standard Contractual Clauses;
• another approved transfer safeguard; or
• another lawful mechanism available under applicable data-protection law.

The mechanism actually used depends on the relevant provider and processing activity.

7. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting, security and dispute-resolution requirements.

Our expected retention periods are:

Backups may retain deleted information for a limited additional period before being overwritten.

Information may be retained longer if reasonably necessary to comply with law, establish or defend legal claims, prevent fraud or protect users.

8. Account deletion

You can initiate account deletion from: Settings → Account → Delete Account.

Deleting your account is permanent.

Subject to legal exceptions, we will delete or anonymise personal data associated with your account, including gameplay data and user-generated content attributable to your account.

Some information may be retained where legally required or reasonably necessary, including:

• accounting records;
• fraud/security records;
• evidence relating to serious Terms violations;
• legal claims; or
• other information we are legally required to retain.

Account deletion does not automatically cancel any subscription managed directly through Apple; where applicable, subscriptions must also be managed through your Apple account.

9. Your privacy rights

Depending on applicable law, you may have the right to:

• access your personal data;
• correct inaccurate personal data;
• request deletion;
• restrict processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a supervisory authority.

Withdrawing consent does not make processing that occurred before withdrawal unlawful.

We may need to verify your identity before completing certain requests.

For users in the Netherlands, the competent supervisory authority is the Autoriteit Persoonsgegevens. Depending on where you live, additional local privacy rights may apply.

10. Security

We use technical and organisational measures appropriate to the nature of Gulf Gambit and the personal data we process. These include:

• TLS on all connections between the App and our servers;
• token-based authentication with revocable sessions;
• passwords stored only as salted hashes, never in plain text;
• an API that is not directly reachable from the public internet, reached only through our reverse proxy;
• rate limiting and load shedding to absorb abuse;
• structured request logging and monitoring, with alerting on failures;
• encrypted, automated off-site backups, with restores tested rather than assumed; and
• prompt application of security updates.

No online service can guarantee absolute security.

If a personal-data breach occurs, we will investigate it and notify the competent supervisory authority and/or affected users where and within the timeframes required by applicable law.

11. Tracking technologies and local storage

Gulf Gambit is primarily a native mobile application. It does not use cookies. It stores a small amount of information on your device:

• authentication and refresh tokens, so you stay signed in;
• a cached copy of your account profile;
• the settings you have chosen, such as sound, language and chat preferences;
• your progress, such as tutorial position and daily streak;
• counters that enforce the daily limit and cooldown on rewarded advertisements; and
• the age-gate answer described in section 3, which stays on your device.

All of it is removed when you delete the App. None of it is an advertising identifier, and none of it is used to build a profile of you.

Our Cookie and Local Storage Policy lists every item individually, explains which are strictly necessary and which are not, and covers the one place third-party cookies can appear — the Google or Facebook sign-in page, if you choose to use it.

The App does not include a third-party analytics SDK.

The App does not carry out tracking as defined by Apple's App Tracking Transparency framework, and therefore does not present an ATT permission request. See section 4.5.

The website. The website that hosts this Privacy Policy sets no cookies, runs no JavaScript, and loads no third-party resources — no analytics, no advertising tags, no embedded fonts or scripts from other domains. Nothing on it tracks you, and there is therefore nothing for you to consent to. If that ever changes, we will provide any notice and consent mechanism required by applicable law before making the change.

12. Changes to this Privacy Policy

We may update this Privacy Policy when:

• Gulf Gambit changes;
• we add or remove service providers;
• our processing changes;
• legal requirements change; or
• clarification is needed.

When we make material changes, we will provide reasonable notice through the App, website, email or another appropriate method.

The Last updated date at the top indicates when this Policy was most recently revised.

Where a new processing activity requires consent, we will request that consent separately where required.

13. Contact