01Who we are (the data controller)

Flames Stories (the "Game" or "Service") is provided by ELATE GAMES Korlátolt Felelősségű Társaság ("ELATE GAMES Kft.", "we", "us", "our"), a limited liability company incorporated in Hungary. We are the data controller for personal data processed through the Game.

We have not appointed a Data Protection Officer, as we are not required to do so. For any privacy matter you can contact us using the details above.

02Scope and your acceptance

This Policy applies to the Flames Stories mobile application on iOS and Android and to all related processing of personal data carried out by us. It does not apply to the separate processing carried out by third parties (such as Apple, Google or advertising networks) under their own privacy policies, which we do not control.

The Game is intended exclusively for adults. You must be at least 18 years old to download, access or use Flames Stories. It is not intended for, and must not be used by, anyone under the age of 18 (see Section 14).

By downloading, accessing or using the Game you acknowledge that you have read this Policy. Where the law requires your consent (for example, for personalised advertising or certain tracking), we ask for it separately, and you may withdraw it at any time as described in Section 6.

03Key definitions

• Personal data — any information relating to an identified or identifiable individual.
• Processing — any operation performed on personal data (collection, storage, use, disclosure, deletion, etc.).
• Controller — the party that determines the purposes and means of processing (here, ELATE GAMES Kft.).
• Processor / sub-processor — a party that processes personal data on the controller's behalf.
• GDPR — Regulation (EU) 2016/679. EEA — the European Economic Area. We also refer to the UK GDPR and the Hungarian Act CXII of 2011 (Infotv.).

04Personal data we collect

a. Data you provide to us

• Email address (optional). If you choose to link an email to your game account, we use it to save and restore your progress and to help you recover your account. You can play without providing an email.
• Account data. A unique account identifier (Account ID) and your game profile, created and stored through our backend provider PlayFab (see Section 7).
• Support correspondence. If you contact us, we process the information you include in your message.

b. Data collected automatically

• Device & technical data — device model, operating system and version, language, region, app version, and network information.
• Identifiers — device identifiers and, where permitted, advertising identifiers (Apple IDFA, Google Advertising ID/AAID).
• IP address and approximate location — your IP address, from which an approximate (country/region-level) location is derived, including by PlayFab. We do not collect precise GPS location.
• Gameplay & usage data — game progress, in-game events and choices, session information, in-game settings and interactions.
• Diagnostic & log data — crash reports, error logs and performance/diagnostic information.

c. Purchase data

In-app purchases are processed by the Apple App Store and Google Play. We receive confirmation that a purchase occurred and a transaction identifier so we can deliver the purchased content. We do not receive or store your full payment card or bank details — those are handled by Apple, Google and their payment providers. The Game does not currently offer subscriptions.

d. Data we receive from third parties

We may receive limited data from our service providers, such as advertising and attribution data from ad networks (e.g., whether an ad was shown or interacted with) and aggregated analytics about how the Game is used.

05How and why we use your data — and our legal bases

Under the GDPR we must have a legal basis for each purpose. The table below summarises how we use personal data and on what basis.

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You may object to such processing (see Section 12).

06Advertising, tracking and your choices

Flames Stories is an ad-supported game. To keep it free, we display advertising provided by third-party advertising networks. These networks may use device and advertising identifiers, IP address and ad-interaction data to deliver and measure ads.

Personalised vs. non-personalised ads

If you are in the EEA, the United Kingdom or Switzerland, we ask for your consent before we (and our ad partners) use your data for personalised advertising or non-essential tracking. If you do not consent, you may still see non-personalised (contextual) ads, which do not rely on profiling. On iOS, we also use Apple's App Tracking Transparency framework: we ask for your permission before accessing the IDFA for cross-app tracking.

Advertising partners

Advertising in the Game is provided by the following third-party networks, which act as independent controllers for the data they collect:

• Unity Ads (Unity Technologies); and
• ironSource / Unity LevelPlay.

How to control advertising and tracking

• Change your consent choices in the Game's settings / privacy menu (where shown).
• On iOS: Settings → Privacy & Security → Tracking, and Settings → Privacy & Security → Apple Advertising.
• On Android: Settings → Privacy → Ads — you can reset or delete your advertising ID and opt out of ad personalisation.

07Third-party services and sub-processors

We rely on trusted third parties to operate the Game. They process personal data on our behalf or as independent controllers, under their own privacy policies:

• Microsoft Azure PlayFab — backend services, accounts, data storage and game analytics. See the Microsoft Privacy Statement.
• Apple — app distribution, in-app purchases and App Tracking Transparency. See Apple Privacy.
• Google — app distribution, in-app purchases and Google Play services. See the Google Privacy Policy.
• Unity Ads and ironSource / Unity LevelPlay — advertising and monetisation. See the Unity Privacy Policy and the ironSource Privacy Policy.

We may add, replace or remove service providers over time. We will keep this list up to date and update this Policy where the change is material.

08How we share your data

We do not sell your personal data for money. We disclose personal data only in the following circumstances:

• Service providers / sub-processors — the parties listed in Section 7, to operate and improve the Game.
• Legal and regulatory requirements — where required by law, court order, or a lawful request from a public authority.
• Protection of rights and safety — to detect, prevent or address fraud, security or technical issues, or to protect the rights, property or safety of our users, ourselves or others, and to enforce our terms.
• Business transfers — in connection with a merger, acquisition, financing, reorganisation or sale of all or part of our business, personal data may be transferred to the successor or acquirer, subject to this Policy.

Where we share data with advertising partners for personalised advertising, this may be treated as a "sale" or "sharing" under certain U.S. state laws — see Section 13.

09International data transfers

Some of our service providers operate outside your country, including in the United States (for example, PlayFab/Microsoft and Unity). When we transfer personal data outside the EEA or the UK, we rely on appropriate safeguards, such as:

• Adequacy decisions of the European Commission (and, where relevant, UK adequacy regulations), including the EU–U.S. Data Privacy Framework where the recipient is certified; and/or
• Standard Contractual Clauses (SCCs) approved by the European Commission, together with the UK International Data Transfer Addendum where applicable, and supplementary measures where needed.

You may request more information about these safeguards using the contact details in Section 21.

10Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy:

• Account and gameplay data — for as long as your account exists. When you delete your account (Section 15), we delete or anonymise this data, except where we must keep it for legal reasons.
• Diagnostic and log data — for a limited period needed for security, debugging and abuse prevention.
• Purchase and transaction records — for the statutory retention period required under Hungarian accounting and tax legislation.
• Support correspondence — for as long as needed to handle your request and a reasonable period afterwards.

11Data security

We use reasonable technical and organisational measures intended to protect personal data, including encryption of data in transit and access controls. You are responsible for keeping your account credentials confidential.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee its absolute security, and any transmission is at your own risk.

12Your rights (EEA / UK and similar laws)

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Restrict or object to certain processing, including processing based on legitimate interests and processing for direct marketing;
• Data portability — receive your data in a structured, commonly used, machine-readable format;
• Withdraw consent at any time, without affecting processing carried out before withdrawal;
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects — we do not carry out such decision-making.

To exercise your rights, email [email protected]. We will respond within the timeframe required by law (generally one month under the GDPR). We may need to verify your identity before acting on your request. You also have the right to lodge a complaint with a supervisory authority (Section 21).

13California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use and disclose;
• Access and delete your personal information;
• Correct inaccurate personal information;
• Opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising;
• Limit the use of sensitive personal information; and
• Non-discrimination for exercising your rights.

We do not sell personal information for money. However, the use of advertising identifiers for personalised advertising may qualify as a "sale" or "share" under California law. You can opt out by adjusting your in-app privacy choices and your device advertising settings (Section 6), or by emailing [email protected] with the subject "California — Do Not Sell or Share".

14Age restriction — strictly 18+

Flames Stories is an adults-only Game intended exclusively for users aged 18 and over. Because of its mature, romance-themed content, the Game is rated 18+ and must not be downloaded, accessed or used by anyone under the age of 18, regardless of the digital age of consent that may apply in their country.

To enforce this restriction, we ask you to confirm that you are at least 18 years old before you create an account or start playing, and the Game is published on the Apple App Store and Google Play with an 18+ age rating. In line with the principle of data minimisation, we store only the fact that you have confirmed you are 18 or over — we do not store your date of birth for this purpose. The Game is not directed to, and is not intended for, children or any person under 18, we do not market it to them, and we do not knowingly collect personal data from them.

If we become aware that we have collected personal data from a person under the age of 18, we will delete that data promptly and may suspend or terminate the associated account. If you are a parent or guardian and believe that a person under 18 has provided us with personal data, please contact [email protected] and we will take steps to delete it.

15Account and data deletion

You can delete your account and associated personal data at any time:

• In-game: open the Settings menu and use the account-deletion option (where available); or
• By email: send a message to [email protected] with the subject line "Request to delete data", including your Account ID (shown in the Game under Settings).

We will process your request within a few business days and delete or anonymise your personal data, except for information we are legally required to retain (such as transaction records kept for accounting and tax purposes).

16Cookies and similar technologies

The Game is a mobile app and does not use browser cookies in the traditional sense. However, our third-party SDKs (for advertising, analytics and core functionality) may use device identifiers, advertising identifiers, local storage and similar technologies to operate, secure, measure and — where you consent — personalise the Service. You can manage these through the in-app consent options and your device settings described in Section 6.

17Links to third-party services

The Game may contain links to third-party websites or services that we do not operate or control. This Policy does not apply to them. We are not responsible for the content or privacy practices of any third party, and we encourage you to review their privacy policies before providing any personal data.

18Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date at the top of the page and post the updated Policy here. If a change is material, we will provide additional notice where required (for example, in-app). Continued use of the Game after an update keeps you informed of how we process your data, but it does not by itself constitute consent: where we rely on your consent (for example, for personalised advertising or non-essential tracking), we will always ask for that consent separately, and a Policy update does not create, change or renew any consent you have given.

19Disclaimers and limitation of liability

The Game is provided on an "as is" and "as available" basis. We do not control, and are not responsible for, the independent data-processing practices of third parties (including Apple, Google, advertising networks and other providers).

To the maximum extent permitted by applicable law, we exclude liability for any loss or damage arising from unauthorised access to, or loss, misuse or alteration of, your personal data that occurs despite our reasonable security measures, or from the acts or omissions of third-party services. Nothing in this Policy limits or excludes any liability or any of your rights that cannot be limited or excluded under mandatory applicable law, including your rights under the GDPR and applicable consumer-protection law.

20Governing law

This Policy and any matter arising from it are governed by the laws of Hungary and applicable European Union law. Any disputes that are not subject to mandatory jurisdiction rules shall be submitted to the competent courts of Hungary. If you are a consumer, you continue to benefit from any mandatory protections and the right to bring proceedings under the law of your country of residence.

21Contact and complaints

For any question, request or complaint about this Policy or your personal data, contact us at:

If you are in the EEA, you have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):