Privacy Policy

01Who we are and what this policy covers

This Privacy Policy explains how Casheeno (“we”, “us”, “our”), a company established in Noida, Uttar Pradesh, India, collects, uses, shares and protects personal data when you use our websites, games and applications (the “Services”), including Surveys Queen, Cash Queen, Lucky Queen, Puzzles Queen, Dice Queen, Ludo Queen and instaBucks.

For the purposes of the EU and UK General Data Protection Regulation, Casheeno is the controller of the personal data described here. Where we act as a processor for a business customer, that customer’s own privacy notice applies to their data.

This policy applies worldwide. Sections 13 to 16 set out additional rights and disclosures that apply if you are in the European Economic Area or the United Kingdom, in the United States, in India, or in certain other jurisdictions. Where local law gives you greater protection, that local law prevails.

02Personal data we collect

Data you give us

• Account data — email address, username or display name, password (stored only as a salted hash), avatar, and country.
• Profile and survey data — where a Service offers surveys, the demographic and profiling answers you choose to provide, and your responses.
• Support and correspondence — the content of tickets, emails and messages you send us, and any attachments.
• Promotion data — entry details, and where you win a prize, the identity, age, address and tax information we are legally required to collect before releasing it.
• Careers data — if you apply for a role, your CV, contact details and the information in your application.

Data created by your use of the Services

• Device and technical data — device model, operating system and version, language, time zone, region, screen resolution, memory, network type, crash logs, diagnostics and performance data.
• Identifiers — an internal player or account ID, IP address, and where permitted the advertising identifier provided by your device (IDFA on iOS, Advertising ID on Android) and an app-instance identifier.
• Gameplay and progression data — levels, scores, streaks, rankings, session length, in-game actions, virtual item balances and transaction history.
• Multiplayer and social data — match history, opponents, and where you use chat or emotes in Ludo Queen or another multiplayer title, the content and metadata of those communications.
• Purchase data — the fact, amount, currency, item, platform and timestamp of an in-app purchase, and the store-issued receipt or transaction identifier. We never receive or store your full payment card number, CVV or bank credentials, which are handled entirely by Apple or Google.
• Advertising data — advertisements served, impressions, clicks, rewarded-video completions and related measurement data.
• Cookies and similar technologies — see our Cookie Policy.

Data from third parties

• app store operators, confirming that a purchase or subscription is valid;
• advertising and attribution partners, telling us which campaign brought you to a Service and whether an advertisement was viewed;
• analytics and anti-fraud providers, including signals indicating automated or abusive behaviour; and
• where you choose to link an account, the third-party platform, limited to what that platform’s permissions allow.

We do not knowingly collect special categories of personal data (such as data revealing health, race, religion, political opinion, sexual orientation, biometric or genetic data). Please do not send us such data. If a survey ever asks a question that would reveal such data, participation will be optional and we will ask for your explicit consent first.

03Sign-in methods and the data each one gives us

How you sign in determines what personal data we hold about you. We ask third-party providers for the minimum we need to create and secure an account.

Email registration

We collect your email address and a password, which is stored only as a salted cryptographic hash and is never visible to us. We use the address to identify the account, to send security and service messages, and to verify a data-subject request. Legal basis: performance of a contract.

Sign in with Google

Google shares a stable Google account identifier, your email address, and where you permit it your display name and profile picture. We do not receive your Google password and we do not gain access to Gmail, Drive, Contacts or any other Google service. Legal basis: performance of a contract; your consent given to Google at the point of sign-in.

Log in with Facebook

Facebook shares an app-scoped user identifier, and where you grant the permission your name, email address and profile picture. The app-scoped identifier is unique to our app and cannot be used to identify you on another developer’s app. We do not receive your Facebook password, friend list, posts or messages. Legal basis: performance of a contract; your consent given to Facebook at the point of sign-in.

You can review and revoke our access at any time in your Google account permissions or your Facebook “Apps and Websites” settings. Revoking access does not by itself delete the data we already hold — to do that, ask us to delete your account.

Guest and anonymous accounts

If you play as a guest, we create an anonymous account identifier (for example through Firebase Anonymous Authentication) together with an app-instance identifier. This lets us save your progress without knowing who you are. We do not collect your name, email address or any other directly identifying data for a guest account.

A guest identifier is still personal data under most privacy laws, because it distinguishes one device from another. We treat it as such. However, because it contains nothing that identifies you as a person, we are usually unable to verify that a guest account is yours, which limits our ability to action an access or deletion request for it. If you want to be able to exercise your rights over that data, link an email address, Google or Facebook account. Legal basis: performance of a contract; legitimate interests in providing a service without requiring registration.

Authentication infrastructure

We use Google Firebase Authentication to operate sign-in. Firebase processes the identifiers above, together with technical data such as IP address, device information, sign-in timestamps and tokens, in order to authenticate you and to detect abuse. Google acts as our processor for this purpose under its data processing terms, and may process the data outside your country — see Section 9 on international transfers.

We retain authentication records for as long as the account exists, and for a limited period afterwards for security, fraud-prevention and dispute-resolution purposes.

04Why we use your data, and our legal bases

We use personal data only where we have a lawful basis to do so. In the EEA and UK those bases are: performance of a contract; our legitimate interests; your consent; and compliance with a legal obligation.

• To provide the Services — creating and maintaining your account, saving progress, running matchmaking and multiplayer, delivering purchased items. Basis: performance of a contract.
• To process purchases — validating receipts, granting entitlements, handling refunds and chargebacks. Basis: performance of a contract; legal obligation.
• To operate prize draws — verifying eligibility and age, selecting and notifying winners, releasing prizes, and meeting tax and record-keeping duties. Basis: performance of a contract; legal obligation.
• To show advertising — delivering, capping, measuring and attributing advertisements, including rewarded video. Basis: consent where required for personalised advertising or device-level tracking; otherwise legitimate interests in funding a free product.
• To keep the Services safe — detecting cheating, bots, multi-accounting, fraud and abuse; moderating multiplayer chat; protecting minors. Basis: legitimate interests in a fair and safe service; legal obligation.
• To improve the Services — analytics, crash reporting, performance measurement, A/B testing and balancing. Basis: legitimate interests; consent where required.
• To communicate with you — service messages, security notices, and where you have opted in, news about our games. Basis: performance of a contract; consent for marketing.
• To comply with law — responding to lawful requests, keeping financial and tax records, and enforcing our terms. Basis: legal obligation; establishment or defence of legal claims.

Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights. You may object to that processing at any time — see Section 12.

05Advertising and how we are funded

We work with third-party advertising networks and demand partners who may act as independent controllers of the data they collect. Depending on your device settings and consent, advertising may be personalised (selected using an advertising identifier and inferred interests) or contextual (selected without such an identifier).

Your controls

• iOS — when required we present Apple’s App Tracking Transparency prompt. If you decline, we do not access the IDFA for cross-app tracking. You can change this at any time in Settings › Privacy & Security › Tracking.
• Android — you can reset or delete your Advertising ID, or opt out of personalised advertising, in Settings › Google › Ads.
• Consent — where consent is the lawful basis, we ask before non-essential advertising or analytics technologies are used, and you can withdraw it at any time in the Service’s privacy settings or by contacting us.
• United States — see Section 14 for your right to opt out of “sale” or “sharing” of personal information for cross-context behavioural advertising.

Declining personalised advertising does not remove advertising from the Services and does not reduce the number of advertisements you see; it means the advertisements are less relevant to you.

06Children and young people

The Services are not directed to children under 13, or under the higher minimum age applicable where you live (for example 16 in some EEA countries). We do not knowingly collect personal data from such children, and we do not knowingly serve them personalised advertising.

Where a Service is rated for a general audience and may attract younger players, we apply additional protections: we do not use advertising identifiers for personalised advertising in respect of users we identify as children; we restrict social and chat features; and we limit analytics to what is necessary to operate and secure the Service.

Prize draws are restricted to entrants aged 18 or over.

If you are a parent or guardian and believe your child has provided us with personal data, please contact support@casheeno.com. We will verify the request, delete the data and close the account promptly. Where the United States Children’s Online Privacy Protection Act applies, we honour parental rights to review, delete and refuse further collection of a child’s personal information.

07Online multiplayer and things others can see

When you play an online multiplayer title such as Ludo Queen, some information is necessarily visible to the people you play with. This includes your display name, avatar, rank or level, in-game statistics and your moves during a match. Anything you type in chat can be seen by other players and may be retained by us.

Please do not disclose personal information about yourself or anyone else in a display name, message or emote. Choose a display name that does not identify you.

We may record, retain and review multiplayer communications and match data to investigate reports, enforce our terms, detect cheating and protect users, particularly minors. We keep such records only as long as necessary for those purposes (see Section 9).

08Who we share your data with

We do not sell your personal data for money. We share it only as described here:

• Service providers acting on our instructions — cloud hosting and storage, content delivery, crash reporting, analytics, customer support tooling, email delivery and anti-fraud services. They are bound by contract to process data only for us.
• Advertising partners — advertising networks, mediation platforms, and attribution and measurement providers. Depending on configuration and your consent, some of these act as independent controllers, and under certain US laws this may constitute a “sale” or “sharing” of personal information (see Section 14).
• App store operators — Apple and Google, for purchase validation, entitlement and refunds.
• Prize and fulfilment partners — where necessary to deliver a prize you have won.
• Professional advisers — lawyers, auditors, insurers and accountants, under a duty of confidentiality.
• Authorities — law enforcement, regulators, courts or government bodies, where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims, to prevent fraud or crime, or to protect the vital interests of any person.
• Corporate transactions — if we are involved in a merger, acquisition, financing, reorganisation or sale of assets, data may be transferred as part of that transaction, subject to the receiving party continuing to honour this policy.

09International data transfers

We are established in India and use service providers located in various countries, including the United States and the European Union. This means your personal data may be transferred to, stored in and processed in a country other than your own, which may not provide the same level of protection as your home country.

Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on an appropriate safeguard, which will be one of the following:

• an adequacy decision by the European Commission or the UK government in respect of the destination country;
• the European Commission’s Standard Contractual Clauses, and for the United Kingdom the International Data Transfer Addendum, together with a transfer risk assessment and any supplementary technical and organisational measures we consider necessary; or
• another lawful transfer mechanism permitted under applicable law.

You may request a copy of the safeguard we rely on by writing to support@casheeno.com.

10How long we keep your data

We keep personal data only for as long as necessary for the purpose it was collected for, and then delete it or irreversibly anonymise it. In practice:

• Account data — for as long as your account is active, and then for up to 90 days after deletion to allow for recovery from accidental deletion and to complete removal from backups.
• Gameplay and progression data — for the life of the account, or until the Service is discontinued.
• Multiplayer chat and moderation records — typically up to 12 months, or longer where needed for an open investigation or a safeguarding matter.
• Purchase and tax records — for the period required by applicable accounting and tax law, which is commonly between 6 and 8 years.
• Prize draw records — for the period required to demonstrate the fair conduct of the promotion and to satisfy tax obligations.
• Support correspondence — typically up to 24 months after the ticket is closed.
• Advertising and analytics identifiers — for the retention period of the relevant partner, which we require to be proportionate.
• Backups — deleted data persists in encrypted backups for a limited rolling window and is overwritten in the ordinary cycle.

Where data is needed for the establishment, exercise or defence of legal claims, we may retain it until the relevant limitation period expires.

11How we protect your data

We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit, hashing of passwords, access control on a least-privilege basis, network segregation, logging and monitoring, dependency and vulnerability review, and staff confidentiality obligations.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You play an important part: use a strong, unique password, do not share your credentials, and tell us immediately if you suspect unauthorised access.

Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, within the timescales set by applicable law.

12Automated processing and profiling

We use automated processing in a limited number of places: to select advertisements; to match players of similar ability; to detect cheating, bots, multi-accounting and fraudulent advertising engagement; and to filter abusive language in chat.

Automated anti-fraud and anti-cheat systems may result in a restriction, suspension or termination of an account. Where an automated decision produces a legal or similarly significant effect on you, you have the right to obtain human review, to express your point of view and to contest the decision. Write to support@casheeno.com and a person will review the case.

13Your rights and how to use them

Subject to the law that applies to you, you may have the right to:

• access the personal data we hold about you, and receive a copy;
• rectify data that is inaccurate or incomplete;
• erase your data (the ‘right to be forgotten’), subject to our need to retain some records by law;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests, and to object at any time to processing for direct marketing;
• data portability — receive certain data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and
• complain to a supervisory authority.

To exercise any right, write to support@casheeno.com from the address associated with your account, or use the account deletion page. We will respond within the period required by applicable law — ordinarily one month in the EEA and UK, and 45 days in the United States — and will tell you if we need longer. We do not charge for this, unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting, in order to protect your data from being disclosed to someone else. We will not discriminate against you for exercising a privacy right.

14Additional information for the EEA and UK

If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR applies to our processing of your personal data, and the legal bases in Section 3 apply.

You have the right to lodge a complaint with your local supervisory authority. In the United Kingdom this is the Information Commissioner’s Office (ico.org.uk); in the EEA it is the authority in your country of residence, place of work or the place of the alleged infringement.

We ask that you contact us first at support@casheeno.com so that we have the opportunity to resolve the matter.

15Additional information for United States residents

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas or another state with a comprehensive privacy law, you may have the rights to know, access, correct, delete and obtain a portable copy of your personal information, to opt out of targeted advertising, and to appeal a refusal of a request.

“Sale” and “sharing”

We do not sell personal information for money. However, our use of third-party advertising and analytics partners may constitute a “sale” or “sharing” of personal information for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act as amended by the CPRA, and equivalent laws in other states.

You have the right to opt out. To do so, decline the tracking prompt on iOS, enable “Opt out of Ads Personalisation” on Android, use the privacy settings inside the relevant Service, or email support@casheeno.com with the subject line “Do Not Sell or Share My Personal Information”. We honour the Global Privacy Control signal where our systems receive it.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

You may designate an authorised agent to make a request on your behalf, subject to our verifying the agent’s authority. You have the right to appeal a decision on your request by replying to our response; if the appeal is denied, you may contact your state Attorney General.

16Additional information for India

Where the Digital Personal Data Protection Act, 2023 applies, we act as a Data Fiduciary and process your digital personal data for the lawful purposes described in this policy, on the basis of your consent or such legitimate uses as the Act permits.

You have the right to obtain information about the processing, to seek correction, completion, updating and erasure, to nominate another individual to exercise your rights in the event of death or incapacity, and to a readily available grievance redressal mechanism. Contact support@casheeno.com for all such requests, including grievances, and we will respond within the period prescribed.

17Other regions and region-specific versions

We also publish region-specific versions of our privacy notice for a number of countries. If a region-specific version applies to you and conflicts with this policy, the region-specific version prevails for you.

Residents of Australia, Canada, New Zealand, the Philippines, Ireland, France and Germany may also have additional rights under local law, including under the Australian Privacy Principles, PIPEDA, and the New Zealand Privacy Act.

18Changes to this policy

We may update this policy to reflect changes in our Services, in the technologies we use, or in the law. When we do, we will revise the “Last updated” date above.

Where a change is material — for example a new purpose, a new category of recipient, or a change in the legal basis on which we rely — we will give you prominent notice in the Service, on this website or by email before it takes effect, and where the law requires your consent we will ask for it.

We recommend reviewing this page from time to time.

19How to contact us

For any privacy question, request or complaint:

• Email: support@casheeno.com
• Post: Casheeno, Noida, Uttar Pradesh, India
• Web: casheeno.com/contact
• Delete your account: casheeno.com/delete_account

Please tell us which Service you use and the email address or player ID associated with your account, so that we can find your records.