Privacy Policy for Magi Cards

Last Update: September 28, 2026

"Your privacy is not in game"

At Bibiu Games ("Company," "we," "us," or "our"), we are committed to creating original and memorable gaming experiences through Magi Cards (the "Game"). This Privacy Policy explains, in plain language, what information we actually collect, why we collect it, who we share it with, and what rights you have. We have written it to match what the Game actually does — not a generic template.

By installing or using the Game, you agree to this Policy. If you do not agree, please uninstall the Game and stop using our services. Where applicable law requires affirmative consent, you give that consent by tapping "Accept" on our in-game consent screen.

1. Scope and Applicable Laws

This Policy is designed to comply with:

• Brazil — Lei Geral de Proteção de Dados (LGPD), Law 13.709/2018.
• Philippines — Data Privacy Act of 2012 (Republic Act No. 10173) and the rules of the National Privacy Commission.
• United States — California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), comparable state laws (Virginia VCDPA, Colorado, Connecticut, Utah, Texas, Oregon, Florida, Montana, Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, and others), and the Children's Online Privacy Protection Act (COPPA).

If you live outside the jurisdictions listed above, the protections of this Policy still apply to you, but specific statutory rights may differ.

2. Children's Privacy

The Game is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at contact@bibiugames.com and we will delete it.

Users between 13 and the age of legal majority in their country (18 in Brazil and the Philippines; the age of majority of your U.S. state) should obtain parental or guardian consent before using the Game.

We send the signal is_child_directed = "false" to all advertising partners so that no ad-personalization profiles are built for children, in compliance with COPPA, LGPD Art. 14, and the Philippine Data Privacy Act.

3. What Information We Collect

We collect only the categories of information described below. We do not collect your real name, email address, phone number, postal address, date of birth, password, photographs, contacts, microphone audio, precise location, or files from your device.

a) Information you provide directly

• In-game display name — a nickname you choose. Used in your in-game profile, world boss leaderboards, and shared messages. You can change it at any time inside the Game.
• Avatar selection — your choice from our built-in avatar set. No image upload occurs.
• Promo codes — when you redeem a code, we record the code and the redemption to prevent reuse.

b) Information collected automatically

• Advertising identifier — Google Advertising ID (GAID) on Android, Identifier for Advertisers (IDFA) on iOS. These are pseudonymous and resettable from your device's system settings.
• Unity Player ID — a pseudonymous identifier generated by Unity Authentication; not linked to your real identity. Used to load your save and synchronize progress across devices.
• Google Play Games player ID and display name — only if you choose to sign in with Google Play Games for achievements.
• Device information — device model, operating system version, language, region, screen resolution, network type. Used for compatibility, troubleshooting, and ad delivery.
• IP address — collected by all network calls; used by our service providers for security, fraud prevention, and approximate geolocation (country / region level only).
• Gameplay analytics events — non-content events such as: achievements claimed and completed, screens opened, buttons tapped, dungeons entered and cleared, equipment salvage and repair, attribute allocation, daily reward claimed, player death, level up, temple card summoned, and whether the notification reminder was shown, enabled, or closed. Each event includes the Unity Player ID and gameplay context (player level, item context). When you change your character's display name, the previous and new name are recorded as part of an analytics event.
• Notification token — a Firebase Cloud Messaging token for this install, together with the platform (Android or iOS) and the game version. We send it to our servers through Unity Cloud Code when you reach Home, so we can deliver notifications when your device allows them.
• Notification activity — the time you last entered Home, and, while a forge job is running, the job type and its scheduled end time. The end time is removed when you collect the job.
• On-device reminder state — whether we already showed the system notification permission and our later reminder. This stays on the device.
• Purchase metadata — when you make an in-app purchase, Google Play (or Apple App Store, when iOS is launched) shares with us the product identifier, transaction identifier, purchase timestamp, and validation status. We do not receive your full payment card data, billing address, or store account email.
• Ad-interaction data — ad impressions, clicks, completions, mediation routing decisions, and frequency-capping signals. Collected by ironSource / LevelPlay and Unity Ads.
• Crash and error events — basic exception data captured by Unity Analytics to diagnose stability issues. We do not currently use Sentry, Bugsnag, Crashlytics, or any third-party crash reporter.

c) Sign-in providers

The Game uses anonymous Unity Authentication by default. The only optional third-party sign-in is Google Play Games. We do not currently support Facebook, Apple, Game Center, or any other sign-in provider.

4. How We Use Your Information

We use the information listed in Section 3 to:

• Operate the Game — load your save, synchronize progress, deliver in-game mail, validate purchases, run the world boss leaderboard, grant achievements.
• Improve the Game — understand which features are used, fix crashes and bugs, balance gameplay difficulty and economy.
• Display advertising — show rewarded ads with frequency capping and basic measurement. We do not engage in cross-context behavioral advertising for any user, in any jurisdiction (see Section 7).
• Prevent fraud — detect cheating, account takeover, abuse of promo codes or in-app purchases.
• Communicate with you — through in-game mail, notices, and optional device notifications described below.
• Comply with legal obligations — respond to lawful requests, enforce our Terms, protect rights and safety.

Notifications

If you allow notifications, we use them to tell you when a forge craft or repair is finished, when a login reward is available, and when a World Boss event is available for your version of the Game. Some of these alerts are scheduled on your device. Others are delivered by Google Firebase Cloud Messaging.

On Android, the system asks for notification permission once, right after you accept this Policy. If you decline, we may show our own reminder a few more times. You can close that reminder. Allowing notifications is optional, and the Game works either way. You can turn notifications off at any time in your device settings, including the Forge, Rewards, and World Boss channels on Android.

We do not use your information for automated decision-making that produces legal effects on you.

5. Legal Basis for Processing

For users in jurisdictions that require a legal basis for processing (Brazil and others), we rely on:

• Execution of a contract (LGPD Art. 7, V) — to operate the Game, save your progress, deliver purchases.
• Legitimate interest (LGPD Art. 7, IX) — for analytics, fraud prevention, security, and ad delivery, balanced against your rights.
• Consent (LGPD Art. 7, I) — when you actively accept this Policy on first launch, when you allow notifications, and for any other optional features that require consent.
• Compliance with legal obligation (LGPD Art. 7, II) — for tax, consumer-protection, and law-enforcement requests.

6. How We Share Your Information

We share your information only with the categories of recipients listed below, and only to the extent necessary for the purposes in Section 4. We do not sell your personal information for monetary consideration. We do not share your personal information for cross-context behavioral advertising.

Recipient	Purpose	Categories shared
Unity Technologies (Authentication, Cloud Save, Cloud Code, Analytics)	Account, save synchronization, server-side game logic, gameplay analytics, and storing what is needed to send gameplay notifications	Unity Player ID, device info, gameplay events, save data, notification token, platform, game version, last Home entry, forge job type and end time
Google LLC (Firebase Cloud Messaging)	Deliver gameplay notifications to your device	Notification token, platform
Google LLC / Google Play Games	Optional sign-in, achievements platform	Google Play Games player ID and display name (only if you sign in)
Google Play Billing	Process Android purchases	Purchase token, product ID, transaction time
Apple App Store / StoreKit (when iOS is launched)	Process iOS purchases	Transaction ID, product ID
ironSource Ltd. / LevelPlay (Unity Mediation)	Serve rewarded ads, mediation	Advertising ID, IP address, device info, ad-interaction events
Unity Ads	Serve rewarded ads (in-network)	Advertising ID, IP address, device info, ad-interaction events
Hosting / cloud infrastructure providers used by Unity	Run the back-end	Same data already listed above, in transit and at rest
Government authorities	Only when legally compelled (court order, valid law-enforcement request)	The specific data requested

Unity, Google, Apple, and ironSource participate in international data-transfer frameworks (Standard Contractual Clauses for EU-equivalent transfers, equivalent LGPD international transfer instruments).

7. Advertising and Tracking

The Game shows rewarded video ads delivered through ironSource (LevelPlay) with Unity Ads as a mediation network. Banner and interstitial ads are not currently shown.

• No cross-context behavioral advertising for any user. We send the signal do_not_sell = "yes" to every ad partner, for every user, in every jurisdiction — even where the law would not require us to. Ads are served using contextual signals (country, language, device class), not a profile of your behavior built from other apps and websites.
• COPPA stance. We send is_child_directed = "false" because the Game is not directed to children under 13.
• Apple App Tracking Transparency (iOS). When iOS is supported, the system will ask you whether to allow tracking. If you decline, no advertising identifier is shared with our ad partners.
• Google Advertising ID (Android). You can reset or limit your GAID in Android Settings → Privacy → Ads.

You can also purchase the Remove Ads in-app product; once activated, no advertisements will be shown.

8. In-App Purchases

In-app purchases are processed exclusively by Google Play Billing on Android and, when iOS is launched, by Apple StoreKit. We never see your payment instrument, billing address, or platform-account email. We only receive a purchase confirmation containing the product identifier, transaction identifier, and timestamp, which we use to grant the purchased content. Available products today include consumable currency packs, the non-consumable Remove Ads, card offers, the Premium Quest Line, and the Special Food Pack. The catalog may change over time.

9. Data Retention

We retain your data for as long as your Game account is active, plus the period necessary to:

• Comply with legal and accounting obligations (in Brazil, fiscal records: 5 years; consumer law: 5 years).
• Resolve disputes and enforce our agreements.
• Combat fraud and abuse.

We keep the notification token while your account is in use and refresh it on later launches. A forge job's scheduled end time is removed when you collect that job.

If you do not launch the Game for 24 consecutive months, your save and analytics data may be aged out and deleted. Anonymized, aggregated data may be retained indefinitely. You can request deletion at any time (see Section 10).

10. Your Rights

a) Brazil (LGPD)

• Confirmation of processing and access to your data (Art. 18, I and II).
• Correction of incomplete, inaccurate, or outdated data (Art. 18, III).
• Anonymization, blocking, or deletion of unnecessary or excessive data (Art. 18, IV).
• Portability (Art. 18, V).
• Deletion of data processed with consent (Art. 18, VI).
• Information about public and private entities with whom we shared data (Art. 18, VII).
• Information about the consequences of refusing consent (Art. 18, VIII).
• Revocation of consent (Art. 18, IX).

b) Philippines (DPA 2012)

Right to be informed, to access, to object, to erasure or blocking, to damages, to data portability, and to file a complaint with the National Privacy Commission.

c) United States (California — CCPA / CPRA, and similar state laws)

• Right to know what we collect, the sources, the purposes, and the third parties.
• Right to delete personal information.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. We honor this right by default for all users (see Sections 6 and 7); no action is needed on your part.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information as defined by CPRA §1798.140(ae).
• Right to non-discrimination for exercising any of the above rights.

d) How to exercise your rights

Send an email to contact@bibiugames.com with the subject line "Privacy request". Include:

• The right you want to exercise.
• Your in-game display name and approximate level (so we can locate your save without asking for additional sensitive information).
• The platform (Android / iOS) and the country you are playing from.

We will respond within 15 days for Brazilian users (LGPD Art. 19), within 45 days for California users (CCPA), and as required by other applicable laws elsewhere.

You may also lodge a complaint with: Autoridade Nacional de Proteção de Dados (ANPD) in Brazil, the National Privacy Commission (NPC) in the Philippines, or the California Privacy Protection Agency / Office of the Attorney General in California.

11. Security

We protect your data using technical and organizational measures appropriate to the level of risk:

• Transport-layer encryption (HTTPS / TLS) for all network calls.
• Encrypted local save files using AES-based encryption with rotational atomic writes.
• Access controls on Unity Cloud services and Cloud Code endpoints (server-authoritative reward gating, protected cloud-save items).
• Data minimization — we collect only what we need.

No system is perfectly secure. If a breach affects you, we will notify you and the relevant supervisory authority within the timeframes required by applicable law.

12. International Transfers

Your data may be processed in data centers operated by Unity, Google, and ironSource located outside Brazil, the Philippines, or the United States. These providers participate in standard international data-transfer mechanisms (e.g., EU Standard Contractual Clauses; UK IDTA; equivalent LGPD international transfer instruments).

13. Cookies

The Game itself is a native mobile application and does not use HTTP cookies. The website bibiugames.com may use a minimal set of strictly-necessary cookies (session, language preference) and is governed by a separate website cookie notice.

14. Third-Party Links

The Game and our website may link to third-party services (e.g., Google Play, App Store, ad-network landing pages). We are not responsible for their privacy practices — please review their policies.

15. Changes to This Policy

We may update this Policy when our practices change, when laws change, or when our service providers' terms change. The "Last Update" date at the top reflects the most recent version. Material changes will be communicated through an in-game notice on next launch and, where required, a renewed consent prompt.

16. Governing Law

This Policy is governed by the laws of the Federative Republic of Brazil. Brazilian consumer-protection law (Código de Defesa do Consumidor, Law 8.078/1990) and consumer-protection law in your country of residence apply where they cannot be waived.