Privacy Policy

01Who We Are

KarpiGames (karpigames.com) is operated by KARPILABS SOFTWARES LLP, a limited liability partnership registered in India, with its registered office at Block A 1701, House Of Hiranandani Queens Gate, Akshaya Vana, Akshayanagar, Bangalore – 560068, Karnataka, India ("KarpiGames", "we", "us", "our").

We publish free-to-play casual games that run in your web browser. This policy covers karpigames.com, every game served under it (for example karpigames.com/playdeckstrike/ and karpigames.com/snowrise/), and the KarpiGames account that works across all of them. Together we call these the "Service".

For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here.

By using the Service you confirm that you have read this policy. Where we rely on your consent, we ask for it clearly and you can withdraw it at any time, as described below.

02Information We Collect

We collect the following, and only what we need to run the Service:

• Account details: if you create an account, your mobile phone number and a 4-digit PIN. The PIN is stored only as a salted one-way hash; nobody at KarpiGames can read it.
• Guest play: you can play without an account. We create an anonymous player record linked to a session cookie so your progress is kept on that browser. If you later create an account, that progress moves into it.
• Gameplay data: your progress, levels, scores, match history, settings, and the virtual items (gems, coins, cosmetics, unlocks) you earn, buy or spend.
• Purchase records: when you buy a virtual item, our payment partner Razorpay processes the payment. We receive the order and payment identifiers, amount, currency, status, time and the general payment method type (for example "UPI" or "card"). We never receive or store your full card number, CVV, UPI PIN, net-banking password or bank credentials.
• Feedback reports: when you send a report or feedback from inside a game, we store what you write, the category you chose, an optional screenshot if you attach one, and technical context that helps us reproduce the problem: the page address, browser and operating system, screen size and pixel density, the game version, and a snapshot of the game state at that moment.
• Technical and log data: IP address, approximate location derived from it (city or region level), browser and device type, operating system, language, referring page, and the date and time of requests, recorded in our server logs for security and troubleshooting.
• Analytics: events describing how the Service is used (for example "game opened", "level completed", "purchase started"), sent to our analytics provider Mixpanel together with a pseudonymous identifier and device information.
• Advertising data: Google and its partners may collect cookie and device identifiers, IP address and browsing information when ads are shown. See "Advertising" and "Cookies" below.
• Messages to support: if you email us, your email address and whatever you choose to include.

We do not ask for, and ask you not to send us, sensitive information such as government ID numbers, health information or financial account details.

03How We Use Your Information

• To create and secure your account, sign you in, and keep you signed in across every KarpiGames game
• To save your progress and deliver the virtual items you earn or buy
• To process payments, prevent duplicate charges, issue refunds and keep the records that Indian tax and accounting law requires
• To investigate and fix bugs and other problems you report
• To understand which games and features are used, and to improve them (analytics)
• To show ads that keep the games free, and to grant in-game rewards for rewarded ads you choose to watch
• To detect, prevent and respond to cheating, fraud, abuse, and security incidents, including rate-limiting sign-in attempts
• To reply when you contact us, and to send you essential service messages
• To comply with law, respond to lawful requests from authorities, and enforce our Terms & Conditions

We do not use your phone number for marketing calls or SMS. If we ever want to send promotional messages, we will ask for your separate consent first.

04Legal Basis and Consent

Under the DPDP Act we process your personal data either with your consent, or for legitimate uses the Act permits, such as providing a service you have voluntarily asked for, meeting a legal obligation, or responding to a security incident.

You give consent when you create an account, attach a screenshot to a report, or accept personalised ads where we ask. You can withdraw consent at any time by writing to support@karpilabs.com. Withdrawing consent does not affect processing that already happened, and some features (for example, keeping an account) cannot work without the data they need.

05Payments

Payments for virtual items are processed by Razorpay Software Private Limited, a payment aggregator authorised by the Reserve Bank of India. Your payment details are entered on Razorpay's secure checkout and are handled under Razorpay's own privacy policy: razorpay.com/privacy/

We keep purchase records for as long as tax and accounting law requires, even if you delete your account.

06Advertising

Our games are free because some of them show ads. Ads are served by Google (Google AdSense and related Google ad products).

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.

You can opt out of personalised advertising by visiting Google's Ads Settings at adssettings.google.com or My Ad Center at myadcenter.google.com. You can also opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info/choices/ and www.youronlinechoices.eu/.

To learn how Google uses information from sites that use its services, see policies.google.com/technologies/partner-sites

Where the law requires it (for example for visitors from the European Economic Area, the United Kingdom or Switzerland), we ask for your consent through a consent message before personalised ads are shown. If you do not consent, Google may still show non-personalised ads, which use cookies only for purposes such as frequency capping, aggregated reporting and fraud prevention.

Rewarded ads are always optional. If you choose to watch one for an in-game reward, we only learn that the ad finished so we can grant the reward; we do not receive your personal data from the advertiser.

07Cookies and Similar Technologies

We use a small number of cookies and browser storage:

• Session cookie (strictly necessary): "game_platform_session" keeps you signed in and links guest progress to your browser. It is HttpOnly, Secure, first-party, and lasts up to 30 days. The Service cannot work without it.
• Local storage (functional): each game may keep settings and cached progress in your browser, stored under that game's own name.
• Analytics (Mixpanel): a pseudonymous identifier stored in a cookie or local storage, used to count visits and understand how features are used.
• Advertising cookies (Google and its partners): set when ads are shown, used to show, measure and, where you allow it, personalise ads, and to prevent ad fraud.

You can block or delete cookies in your browser settings. If you block the session cookie you will not be able to stay signed in, and guest progress may be lost. Controls for advertising cookies are listed under "Advertising" above.

08Who We Share It With

We do not sell, rent or trade your personal data. We share it only with service providers who help us run the Service, and only to the extent they need it:

• Cloud hosting and infrastructure: Amazon Web Services (servers, databases, storage and logs)
• Payments: Razorpay
• Analytics: Mixpanel
• Advertising: Google
• Email: our email provider, when you write to us

These providers act on our instructions under contracts that require them to protect your data. We may also disclose information when required by law or a lawful order, to protect the rights, property or safety of our users, the public or KarpiGames, or as part of a merger, acquisition or sale of assets, in which case we will notify you before your data becomes subject to a different privacy policy.

09Where Your Data Is Stored

Our servers and databases are hosted in India (AWS Asia Pacific, Mumbai). Some of our providers, such as Mixpanel and Google, may process data in other countries. Where data is transferred outside India, we do so in line with the DPDP Act and any restrictions notified by the Government of India, and we require those providers to protect it to a standard comparable to this policy.

10How Long We Keep It

• Account and gameplay data: while your account is active. If you ask us to delete your account, we delete or anonymise it within 30 days.
• Guest progress: while the session is in use; guest players inactive for 12 months may be deleted.
• Feedback reports and screenshots: up to 24 months, then deleted or anonymised.
• Purchase and refund records: for as long as Indian tax and accounting law requires (currently up to 8 years).
• Server logs: typically 90 days, longer only when needed to investigate a security incident.

Aggregated statistics that cannot identify you may be kept indefinitely.

11How We Protect It

All traffic to the Service is encrypted in transit (HTTPS). PINs are stored only as salted one-way hashes. Sign-in attempts are rate-limited to slow down guessing. Access to production systems and personal data is restricted to the people who need it, and secrets are kept out of our source code.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Act requires.

12Your Rights

Subject to the DPDP Act and other applicable law, you have the right to:

• Get a summary of the personal data we hold about you and how we use it, and know who we have shared it with
• Correct or update inaccurate or incomplete data
• Erase your data and delete your account (this permanently removes your progress and virtual items)
• Withdraw any consent you have given
• Nominate another person to exercise these rights on your behalf in the event of death or incapacity
• Have your grievances addressed by our Grievance Officer, and, if you are not satisfied, complain to the Data Protection Board of India

To make a request, email support@karpilabs.com from any address and include the phone number registered to your account. To protect your account, we may ask you to confirm ownership (for example, by signing in or confirming your PIN) before acting. We respond within 30 days.

13Children and Minors

Our games are general-audience casual games. They are not directed at children under 13, and children under 13 should not use the Service or create an account.

Under the DPDP Act, anyone under 18 is a child. If you are under 18, you may use the Service only with the involvement and verifiable consent of a parent or lawful guardian, who must also approve any purchase. Parents and guardians are responsible for purchases made on their payment methods.

We do not knowingly carry out tracking, behavioural monitoring or targeted advertising directed at children. If we learn that we have collected personal data from a child without verifiable parental consent, we will delete it.

If you are a parent or guardian and believe your child has given us personal data or made a purchase without your consent, contact support@karpilabs.com and we will help, including deleting the data and reviewing the purchase under our Refund Policy at /refund-policy/.

14Grievance Officer

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000 and rules made under it, complaints about the processing of your personal data can be sent to our Grievance Officer:

Grievance Officer, KARPILABS SOFTWARES LLP

Address: Block A 1701, House Of Hiranandani Queens Gate, Akshaya Vana, Akshayanagar, Bangalore – 560068, Karnataka, India

Email: support@karpilabs.com (subject line: "Grievance")

We acknowledge grievances within 48 hours and aim to resolve them within 15 days.

15Changes to This Policy

We may update this policy when our games, our providers or the law change. We will post the new version on this page and update the "Last updated" date. If a change materially affects how we use data you have already given us, we will tell you inside the Service before it takes effect and, where required, ask for your consent again.

16Contact Us

Questions about this policy or your data: support@karpilabs.com

Post: KARPILABS SOFTWARES LLP, Block A 1701, House Of Hiranandani Queens Gate, Akshaya Vana, Akshayanagar, Bangalore – 560068, Karnataka, India