GULF GAMBIT — PRIVACY POLICY

Effective date: 2026-10-20 Last updated: 2026-11-09

1. Who we are

Gulf Gambit ("Gulf Gambit", the "App", "we", "us" or "our") is a mobile strategy game operated by:

For the purposes of the EU General Data Protection Regulation ("GDPR" / "AVG"), we are the data controller for the personal data described in this Privacy Policy, except where another party acts as an independent controller.

2. Scope of this Policy

This Privacy Policy explains:

• what personal data we collect;
• why we collect it;
• the legal basis on which we process it;
• who we share it with;
• how long we retain it;
• how we protect it; and
• what rights you have.

This Policy applies when you use Gulf Gambit, create an account, participate in matches or alliances, use chat, make purchases, receive notifications, contact support or otherwise interact with the App.

This Policy is informational. Where a particular type of processing requires your consent, we will ask for that consent separately.

3. Children and age requirements

Gulf Gambit is intended for players aged 13 and over.

We do not rely on consent for personal data that is strictly necessary to create your account or provide the core game service. That processing is necessary to perform our contract with you (art. 6(1)(b) GDPR), which is a lawful basis a 13-year-old can rely on in their own right.

We have designed Gulf Gambit so that no part of it depends on a child's consent. In particular, advertising is contextual for every player and is never based on profiling, at any age — see section 4.5.

The age question. Before you begin, the App asks once what year you were born, so that it can apply the minimum age above. Your answer is stored on your own device and is never transmitted to us. We do not hold your date or year of birth on our servers, it is not in any of our databases, and it is not shared with anyone. If you delete the App, the answer goes with it.

We store the year rather than only checking it because a single "I am over 13" tap collects nothing anyone can act on, whereas a year lets the App behave correctly at the second threshold too: the age below which consent-based processing would need a parent's authorisation. In the Netherlands that threshold is 16.

Because the answer never reaches us, this is not personal data that we process. It is described here anyway, because being asked your birth year and being told it is not collected would otherwise look like a contradiction.

Where a future optional feature would require consent, we will not knowingly carry out that processing for a child who cannot legally provide it unless any legally required parental authorisation has been obtained.

If you believe that a child has provided personal data to us contrary to applicable law, contact privacy@gulf-gambit.com and we will investigate and take appropriate action.

4. Personal data we collect

4.1 Account data

When you create an account, we may process:

We do not store passwords in plain text.

4.2 Gameplay and progression data

We process information generated through gameplay, including:

• matches played;
• factions or roles selected;
• orders and moves submitted;
• wins, losses and draws;
• matchmaking information;
• rankings and leaderboard position;
• experience points and player level;
• streaks and daily rewards;
• achievements;
• alliance membership;
• owned Commanders and Accessories;
• Coins and other virtual balances; and
• game configuration and progression.

We use this information to provide Gulf Gambit, synchronise progress, operate matchmaking, prevent cheating, calculate rankings and maintain game balance.

Legal basis: performance of our contract with you and, where applicable, our legitimate interest in operating and securing the game.

4.3 Chat and user-generated content

Gulf Gambit may include:

• match chat;
• alliance chat;
• usernames;
• reports;
• moderation records; and
• other user-generated content ("UGC").

We process chat messages to provide the communication feature.

Messages are visible to the players who participate in the relevant match, alliance or channel. They should therefore not be treated as private communications.

We may access or review messages where reasonably necessary to:

• investigate a report;
• enforce our Terms of Service;
• detect abuse or cheating;
• protect players;
• comply with law; or
• maintain the integrity of the service.

Reported messages and related moderation information may be retained for longer than ordinary chat messages where reasonably necessary for safety, fraud prevention or dispute handling.

Legal bases: contract and legitimate interest.

4.4 Purchases

If you purchase Virtual Goods through the Apple App Store, we may receive:

• Apple transaction identifier;
• product identifier / SKU;
• product purchased;
• purchase date;
• purchase status;
• amount or localised transaction information where made available to us;
• the store environment the transaction came from — the live App Store, or Apple's test environment ("Sandbox"), which pre-release (TestFlight) versions use and which charges nothing;
• each attempt to validate a purchase, including attempts we refuse, with the technical reason for the outcome; and
• information necessary to validate or restore a purchase.

Apple processes the actual payment. We do not receive your full payment-card details or Apple ID password.

We process purchase information to:

• fulfil purchases;
• restore purchases;
• prevent fraud;
• handle support issues;
• maintain accounting records; and
• comply with tax and legal obligations.

4.5 Advertising

Gulf Gambit shows advertising provided by Google AdMob (Google Ireland Ltd. / Google LLC). There are two kinds, and no others:

• Rewarded videos — a video you choose to watch, in return for coins. When

you finish one, Google tells our server directly that the advert was watched and names your account ID, so that we can credit the coins. Your account ID is the only thing we give Google for this, and it is used for nothing else.

• An advert before a turn's orders — a full-screen advert that may play when

you open a match whose turn has been resolved since you last looked: at most once per turn and a limited number of times a day. It is never shown if you own Remove Ads (included in the Season Pass) or have made a purchase.

Adverts are not personalised. They are contextual for every player and never based on profiling, at any age: the App tells Google's SDK not to personalise them, and players under 16 are additionally marked as under the age of consent. We do not read Apple's advertising identifier (IDFA), and the App does not present Apple's App Tracking Transparency prompt.

To show an advert, limit how often the same one repeats, measure it and prevent fraud, Google's SDK collects information from your device such as your IP address, the device type and operating system, the App's version and your interaction with the advert. Google processes it as described at policies.google.com/technologies/ads.

In the EEA, the United Kingdom and Switzerland we ask for your consent through Google's consent form before any advert is requested, and you can change your answer at any time under Settings → AD PRIVACY. If you decline, Google may still show limited adverts that do not use information stored on your device.

Our own privacy manifest still declares NSPrivacyTracking = false, because nothing in the App tracks you in the sense of Apple's rules; Google's SDK carries its own privacy manifest, which Apple includes in the App's privacy report.

4.5a Push notifications

If you allow notifications, Apple issues your device a push token, which we store against your account so we can tell you when it is your turn in a match or when something needs your attention.

The token identifies a device, not you personally, but because we hold it against your account we treat it as personal data.

You control this entirely. Notifications are off until you allow them, you can withdraw permission at any time in iOS Settings, and we stop sending as soon as Apple tells us a token is no longer valid. Signing out removes the token for that device, so the next person to sign in on it never receives notifications meant for you. Deleting your account deletes it with everything else.

Apple operates the delivery network and necessarily processes the token and the notification content in transit.

4.6 Device, security and diagnostics

We may process:

• device model;
• operating-system version;
• App version and build number, and whether the App came from the App Store or from TestFlight;
• language and time zone;
• an installation identifier — a random value the App creates when it is first opened, which identifies that installation and nothing else (it is not Apple's advertising identifier, and it is not shared with anyone);
• an identifier for each time the App is opened, and one for each request it sends, so that a problem can be traced from your device to our servers and back;
• the country your connection comes from, derived from your IP address (never your precise location);
• crash and hang reports;
• diagnostic information;
• timestamps;
• IP address;
• server requests, including the outcome of each request that fails or changes something (for example: that orders were submitted, accepted or refused and why; that a turn was resolved, and when);
• when the App connected to and disconnected from our live game service, and why it disconnected;
• whether notifications are permitted on the device, the outcome of each notification we send through Apple, and whether a notification was opened; and
• security or anti-abuse signals.

We use this information for:

• security;
• abuse prevention;
• troubleshooting, including investigating a problem you report to us;
• compatibility, including knowing which versions of the App are still in use;
• service reliability; and
• fraud and cheating detection.

Legal basis: legitimate interest in operating and protecting Gulf Gambit, and in fixing problems that affect you.

4.7 Bug reports

If you send a bug report from the App, we receive:

• the description you write;
• the screen, match and turn you were on, and the time;
• a screenshot of the App as it was just before you opened the report, unless you switch it off;
• a technical log the App kept on your device for roughly the preceding 30 minutes: the requests it sent and their outcomes, connection events, the error messages it showed you, notification and purchase events, which features were switched on, and the device and App details listed in section 4.6; and
• at the moment we receive it, a copy of the related records on our servers (for example, your match's state and the orders we hold for you), so the two sides can be compared.

The log never includes your password, the content of chat messages, or the contents of requests. We use bug reports only to investigate and fix the problem, and to reply to you.

If the App crashes or stops responding, the App may send us Apple's crash or hang report for that event the next time it opens. These reports come from Apple's MetricKit framework, and iOS provides them only if you have allowed sharing with app developers (Settings → Privacy & Security → Analytics & Improvements → Share With App Developers). They describe the App's state — they do not contain your messages or account details.

Legal basis: legitimate interest in providing a working service, and the performance of our contract with you where you ask us to fix something.

4.8 Usage statistics

We record in our own database how Gulf Gambit is used, from the actions our servers carry out for you — for example, that you opened the App, joined a match, submitted orders or sent a chat message. These records are linked to your account. We use them to understand whether new players stay, whether matches are completed, and which parts of the game need work. The App itself does not track which screens you view.

They are not shared with third parties, not sent to any analytics provider, and not used for advertising.

Legal basis: legitimate interest in improving Gulf Gambit.

4.9 Where your installation came from (Apple Search Ads)

If you installed Gulf Gambit after an Apple Search Ads advertisement, the App asks Apple, through Apple's AdServices framework, whether that installation came from one of our campaigns. The App receives a token from Apple that identifies nothing on its own and sends it to us; we pass it to Apple, and Apple tells us only whether the installation came from one of our campaigns and, if so, which campaign, the country or region it ran in, and whether it was a first download or a re-download. No device identifier is involved and nothing follows you across other apps, which is why the App does not ask for tracking permission. We link Apple's answer to your account to learn which of our own campaigns bring players. It is not used to show you advertising and is not shared with anyone else.

Legal basis: legitimate interest in knowing what our advertising brings.

We do not intentionally request access to your contacts, health information, precise GPS location, microphone, camera, photo library or files outside the App unless a future feature clearly requires it and appropriate permission and notice are provided.

5. Third-party service providers

We use third parties to operate Gulf Gambit.

The database is not hosted by a separate provider: PostgreSQL runs on our own servers at the hosting provider named above.

The advertising provider is Google AdMob, named above — see section 4.5.

We do not use a third-party analytics SDK or a third-party crash-reporting SDK. Crash and diagnostic information reaches us through Apple's built-in reporting, which Apple collects only where you have enabled sharing on your device; App Store Connect's aggregated statistics; feedback you choose to send through TestFlight; and the App's own reports described in sections 4.6 to 4.8, which go only to our own servers.

We require service providers acting on our behalf to process personal data only for authorised purposes and with appropriate safeguards.

Some third parties, such as Apple, may act as independent controllers for certain processing they perform.

We do not sell your personal data.

6. International transfers

We aim to host core Gulf Gambit data in: Finland (EU/EEA).

Some service providers may process information outside the European Economic Area.

Where personal data is transferred internationally, we use a lawful transfer mechanism where required, which may include:

• an adequacy decision of the European Commission;
• Standard Contractual Clauses;
• another approved transfer safeguard; or
• another lawful mechanism available under applicable data-protection law.

The mechanism actually used depends on the relevant provider and processing activity.

7. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting, security and dispute-resolution requirements.

Our expected retention periods are:

Backups may retain deleted information for a limited additional period before being overwritten.

Information may be retained longer if reasonably necessary to comply with law, establish or defend legal claims, prevent fraud or protect users.

8. Account deletion

You can initiate account deletion from: Settings → About → Delete Account.

Deleting your account is permanent.

Subject to legal exceptions, we will delete or anonymise personal data associated with your account, including gameplay data and user-generated content attributable to your account.

Some information may be retained where legally required or reasonably necessary, including:

• accounting records;
• fraud/security records;
• evidence relating to serious Terms violations;
• legal claims; or
• other information we are legally required to retain.

Account deletion does not automatically cancel any subscription managed directly through Apple; where applicable, subscriptions must also be managed through your Apple account.

9. Your privacy rights

Depending on applicable law, you may have the right to:

• access your personal data;
• correct inaccurate personal data;
• request deletion;
• restrict processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a supervisory authority.

Withdrawing consent does not make processing that occurred before withdrawal unlawful.

We may need to verify your identity before completing certain requests.

For users in the Netherlands, the competent supervisory authority is the Autoriteit Persoonsgegevens. Depending on where you live, additional local privacy rights may apply.

10. Security

We use technical and organisational measures appropriate to the nature of Gulf Gambit and the personal data we process. These include:

• TLS on all connections between the App and our servers;
• token-based authentication with revocable sessions;
• passwords stored only as salted hashes, never in plain text;
• an API that is not directly reachable from the public internet, reached only through our reverse proxy;
• rate limiting and load shedding to absorb abuse;
• structured request logging and monitoring, with alerting on failures;
• encrypted, automated off-site backups, with restores tested rather than assumed; and
• prompt application of security updates.

No online service can guarantee absolute security.

If a personal-data breach occurs, we will investigate it and notify the competent supervisory authority and/or affected users where and within the timeframes required by applicable law.

11. Tracking technologies and local storage

Gulf Gambit is primarily a native mobile application. It does not use cookies. It stores a small amount of information on your device:

• authentication and refresh tokens, so you stay signed in;
• a cached copy of your account profile;
• the settings you have chosen, such as sound, language and chat preferences;
• your progress, such as tutorial position and daily streak;
• the pace of the advert before a turn's orders — when one last played and how many have played today — and which turn of each match you last opened, so that it plays at most once per turn (section 4.5);
• your answer to Google's consent form, where you were asked for one (section 4.5);
• the age-gate answer described in section 3, which stays on your device;
• the installation identifier described in section 4.6; and
• the App's diagnostic log of roughly the last 72 hours (section 4.7), which stays on your device unless you send a bug report or the App sends a crash report.

All of it is removed when you delete the App. None of it is an advertising identifier, and none of it is used to build a profile of you. Google's advertising SDK also keeps information on your device in order to show and limit adverts (section 4.5) — in the EEA, the United Kingdom and Switzerland only with your consent.

Our Cookie and Local Storage Policy lists every item individually, explains which are strictly necessary and which are not, and covers the one place third-party cookies can appear — the Google sign-in page, if you choose to use it.

The App does not include a third-party analytics SDK.

The App does not carry out tracking as defined by Apple's App Tracking Transparency framework, and therefore does not present an ATT permission request. See section 4.5.

The website. The website that hosts this Privacy Policy sets no cookies, runs no JavaScript, and loads no third-party resources — no analytics, no advertising tags, no embedded fonts or scripts from other domains. Nothing on it tracks you, and there is therefore nothing for you to consent to. If that ever changes, we will provide any notice and consent mechanism required by applicable law before making the change. Short links under gulf-gambit.com/go/, which we give to promoters and use in posts, forward you to the App Store; on the way we count how often each link is opened, per link and per day, without storing who opened it — a key derived from your network address is kept for at most an hour, only so that one visitor is counted once.

12. Changes to this Privacy Policy

We may update this Privacy Policy when:

• Gulf Gambit changes;
• we add or remove service providers;
• our processing changes;
• legal requirements change; or
• clarification is needed.

When we make material changes, we will provide reasonable notice through the App, website, email or another appropriate method.

The Last updated date at the top indicates when this Policy was most recently revised.

Where a new processing activity requires consent, we will request that consent separately where required.

13. Contact