Privacy Policy

Appalex Limited · Last updated: October 4, 2026

Our Commitment to Privacy

Appalex Limited (“we”, “our”, “us”) is committed to protecting the privacy and security of our users’ personal information. We strive to be transparent about our data practices and to provide you with control over your personal information.

This Privacy Policy explains how we collect, use, share, and protect your information when you use the Appalex apps listed above (the “Apps”). We comply with the General Data Protection Regulation (GDPR) for our European users and applicable US privacy laws for our American users.

1. Data Controller

Company Name: Appalex Limited
Address: 1012 Budapest, Logodi utca 48. A. lház. 1. em. 2. ajtó, Hungary
Company Registration: 01-09-433441
Tax Number: 32612600-2-41
Email: info@appalex.hu
Phone: +36 70 213 3578

Data Protection Contact:
Email: info@appalex.hu
Phone: +36 70 213 3578

2. Data Processors

We work with trusted third-party service providers who process data on our behalf. Not every processor applies to every App; the actual set used depends on the specific App and platform.

3. Information We Collect

The specific data collected depends on which App you use and on the App’s functionality.

3.1. Device and Technical Data

Data collected:

• Device type and model
• Operating system version
• App version
• Network status
• Device identifier (IDFV on iOS, advertising ID on Android where applicable)
• IP address
• Country (from locale)
• Language settings

Purpose: Compatibility, troubleshooting, security
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention: 1 year

3.2. Usage Analytics

Data collected:

• Screen views
• Feature usage
• In-app events
• Session duration
• App launches

Purpose: Service improvement, user experience enhancement, troubleshooting
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention: 2 years

3.3. Purchase and Subscription Data (only for Apps with in-app purchases)

Data collected:

• Purchase ID
• Product identifier
• Subscription status (where applicable)
• Purchase date
• Renewal date (where applicable)

Purpose: Subscription management, billing, customer support
Legal basis: Contract performance (GDPR Art. 6(1)(b))
Retention: As required by tax law (typically 7–10 years)

3.4. Push Notifications (only for Apps that send notifications)

Data collected:

• Push notification token
• Notification preferences
• OneSignal user ID (where OneSignal is used)

Purpose: Sending notifications you have opted in to receive
Legal basis: Consent (GDPR Art. 6(1)(a)) — you may revoke this in your device settings at any time
Retention: Until opt-out

3.5. Camera and Photo Library (only for Apps that use the camera)

Apps such as TCG Card Scanner, Tree Identifier, and Photography Poses may request access to your device camera and/or photo library to provide their core functionality (e.g., scanning a card, identifying a tree, viewing reference photos). Camera input is processed on-device or transiently for the requested feature; we do not store your photos on our servers unless explicitly required by the App and disclosed in-app.

Legal basis: Contract performance (GDPR Art. 6(1)(b)) — access is granted by you on first request

3.6. Location Data (only for Apps that use location)

Hungary Public Transit may use location data to find nearby stops and provide route information. Location is accessed only while you are using the relevant feature and is not stored on our servers.

Legal basis: Contract performance (GDPR Art. 6(1)(b))

3.7. Torpedo: Sea Battle 2 Player (iOS)

This section describes everything Torpedo collects and who receives it. Where it differs from the general sections above, this section applies to Torpedo.

No account. Torpedo has no sign-up or login. It never asks for your name, email address, phone number, contacts, photos or precise location. The app creates a random ID when it is first opened; it identifies the install, not you, and is synced through your own iCloud so a new device keeps the same ID.

Who receives what

Stays with you. Your rank, medals, statistics, battle history, coins, pearls, layouts and settings are stored on your device and in your own iCloud storage. Nearby battles are sent directly between the two devices. The age range you share through Declared Age Range stays on the device; only the resulting “child” or “under the age of consent” flag reaches ad requests.

Your choices

• App Tracking Transparency. After a few battles, never at launch and never during your first session, Torpedo explains why it asks and then shows Apple’s tracking prompt. If you don’t allow tracking, the IDFA is never read and Google’s ad signals (ad storage, ad user data and ad personalization) stay off, so ads are not personalized and purchases are not sent to Google Ads. You can change this at any time in iOS Settings > Privacy & Security > Tracking, or in Torpedo’s Settings > Privacy.
• Privacy Choices (EEA, UK, Switzerland and US states with privacy laws). Where the law requires it, Google’s consent form asks how ads and analytics may use your data. Your answer controls Google Analytics storage and ad personalization. Change it any time with the Privacy Choices row in Torpedo’s Settings > Privacy. Until you answer in these regions, Google Analytics stores nothing and receives only cookieless, anonymous pings (Google consent mode).
• US-state opt-out. If you live in a US state with a consumer privacy law, the same Privacy Choices row lets you opt out of the “sale” or “sharing” of your personal information and of targeted advertising. After an opt-out, Torpedo turns Google’s ad signals off, whatever you answered to the tracking prompt.
• Remove Ads. Buying Remove Ads, or an Admiral Club subscription, turns off ads between battles, banners and launch ads. Reward videos remain optional.
• Analytics and crash reports are part of how we run the game and have no separate switch. Outside the EEA, UK and Switzerland, Google Analytics runs for everyone; inside those regions, it follows your Privacy Choices answer. Crashlytics runs for everyone.
• Deletion and access. In Torpedo, open Settings > Support > Contact Support: the email it prepares to info@appalex.hu already contains your random player ID. Write “Delete my data” (or “Send me my data”) and send it. Within 30 days we have the data for that ID deleted from Google Analytics and RevenueCat (or sent to you) and confirm by email; crash reports expire on their own after 90 days. Deleting the app and turning off iCloud for Torpedo removes your game data from your devices and iCloud.

Children

Torpedo is rated 9+. Where available, it asks iOS for your age range through Apple’s Declared Age Range feature (never your birth date). If you are declared to be under 13, Torpedo:

• shows only child-directed, non-personalized ads rated G (General Audiences), with AdMob’s child-directed treatment for the Children’s Online Privacy Protection Act (COPPA);
• serves those ads from Google AdMob alone: the other ad networks listed above are not started and receive no ad requests;
• never shows the tracking prompt and never reads the IDFA;
• keeps Google’s ad signals off, so purchases are not reported to Google Ads;
• shows no automatic offer pop-ups.

Players declared to be 13 to 17 get ads tagged as under the age of consent, and every ad network is told not to sell or share their data, and the protections described in the app. Analytics and crash reports are used only to run, secure and improve the game.

Legal basis (EEA, UK, Switzerland)

Consent for personalized advertising, the advertising identifier and Google Analytics storage (GDPR Art. 6(1)(a)); legitimate interest for non-personalized advertising that keeps the game free, for crash reports, fraud prevention, Remote Config and ad and purchase measurement (GDPR Art. 6(1)(f)); contract performance for purchases, restoring them and game features (GDPR Art. 6(1)(b)); legal obligation for keeping purchase records (GDPR Art. 6(1)(c)).

How long we keep Torpedo data

• Google Analytics for Firebase: event-level data for at most 14 months; aggregated reports that identify no one may be kept longer.
• Firebase Crashlytics: crash reports and their identifiers for 90 days.
• Firebase installation IDs (Remote Config): until deleted on request; then removed from Google’s systems within 180 days.
• RevenueCat: purchase records and the identifiers and ad events linked to them for as long as needed to provide and restore your purchases, and purchase records as required by tax law (up to 10 years); deleted earlier on request where the law allows.
• Google AdMob: under Google’s own retention policy (policies.google.com/technologies/retention).
• Ad networks bidding through AdMob: under each network’s own privacy policy (linked in “Who receives what”).

Google’s use of data from apps that use its services is described at policies.google.com/technologies/partner-sites; RevenueCat’s at revenuecat.com/privacy; Apple’s at apple.com/legal/privacy.

4. Cookies and Tracking Technologies

We use only the tracking technologies necessary to operate the Apps and improve user experience:

• Google Analytics for Firebase: App usage analysis; in Torpedo also ad and purchase measurement (see 3.7)
• Google AdMob (Torpedo): Ad delivery and measurement; the advertising identifier (IDFA) only if you allow tracking
• Ad networks bidding through AdMob (Torpedo): AppLovin, Unity Ads, Meta Audience Network, Liftoff Monetize, Mintegral, Pangle, InMobi and ironSource; ad delivery and measurement, the IDFA only if you allow tracking
• RevenueCat (Torpedo): Purchase and ad-revenue measurement linked to a random app ID
• Device identifiers: IDFV on iOS (app-specific, resets when all of a developer’s apps are removed), advertising ID on Android (where applicable)

4.1. Opt-out Options

• iOS: Settings > Privacy & Security > Tracking > disable “Allow Apps to Request to Track”, or turn tracking off for a single app
• Torpedo: Settings > Privacy > Privacy Choices (where offered) for consent and US-state opt-outs
• Android: Settings > Privacy > Ads > reset or delete advertising ID
• Disabling tracking does not affect core App functionality

4.2. Advertising Data

We do not sell your personal data for money. In our ad-supported apps (Torpedo), Google receives identifiers, ad interactions and coarse location to show and measure ads, and purchase events to measure our own ad campaigns. Some US state laws treat this as a “sale” or “sharing” of personal information; see section 12.1 to opt out.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: All data is encrypted in transit (HTTPS/TLS)
• Access control: Only authorized personnel have access to personal data
• Regular security reviews
• Data leak prevention

6. Your Rights

Under data protection laws, you have the following rights:

6.1. Right to Access

You can request information about what personal data we process about you.

6.2. Right to Rectification

You can request correction of inaccurate personal data.

6.3. Right to Erasure (“Right to be Forgotten”)

You can request deletion of your personal data when:

• The data is no longer needed
• You withdraw consent
• You object to processing
• The data was unlawfully processed

6.4. Right to Restriction

You can request restriction of processing in certain circumstances.

6.5. Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format. Upon request, we provide your data within 30 days in JSON or CSV format.

6.6. Right to Object

You can object to processing based on legitimate interests.

6.7. Right to Withdraw Consent

You can withdraw previously given consent at any time.

7. International Data Transfers

Some of our processors are located outside the European Economic Area. We ensure appropriate safeguards:

7.1. EU-US Data Privacy Framework (DPF) Certified Partners

• Google LLC — Firebase services
• OneSignal Inc. — Push notifications

7.2. Standard Contractual Clauses (SCC) Protected Partners

• Apple Inc. — iOS app services
• RevenueCat Inc. — Subscription management
• Ad networks bidding through AdMob (AppLovin, Unity, Meta, Liftoff, Mintegral, Pangle, InMobi, ironSource) — Advertising in Torpedo, under each network’s own transfer safeguards

7.3. Safeguards

• All transfers include appropriate protection levels
• DPF certifications are regularly verified
• SCCs are based on EU Commission Decision 2021/914
• Details available upon request

8. Children’s Privacy

Our Apps are not directed primarily at children under 13. We do not knowingly collect personal information from children under 13 except as the Children’s Online Privacy Protection Act (COPPA) allows for supporting an app’s internal operations. Torpedo is rated 9+ and applies the protections for players declared to be under 13 described in section 3.7. If you believe we have collected personal information from a child under 13 without these protections, email info@appalex.hu and we will delete it promptly. In the EEA, we follow the age of digital consent of your country (13 to 16).

9. Data Retention

• Usage analytics: 2 years
• Technical logs: 1 year
• Purchase data: As required by law (7–10 years)
• Push notification data: Until opt-out
• Torpedo: see the retention list in section 3.7

10. Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant impacts on you.

11. Data Breach Management

In case of a data breach:

• We notify the supervisory authority within 72 hours
• We notify affected users in case of high risk
• We document the incident and measures taken

12. Your California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, and share
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information and of targeted advertising
• Right to limit the use of sensitive personal information (we do not collect sensitive personal information)
• Right to non-discrimination for exercising privacy rights

Residents of other US states with consumer privacy laws (for example Colorado, Connecticut, Virginia, Utah, Texas and Oregon) have similar rights. To appeal a decision on your request, reply to our answer with “Appeal” in the subject.

12.1. Do Not Sell or Share My Personal Information

In the last 12 months, Torpedo has disclosed the following categories to Google for advertising, which some US state laws treat as a “sale” or “sharing”: identifiers (IDFV, and the IDFA if you allowed tracking), internet or other electronic network activity (ad interactions, gameplay and purchase events) and coarse geolocation derived from the IP address. We do not sell or share the personal information of anyone we know to be under 16 without the required consent; players declared to be under 13 get only child-directed, non-personalized ads.

To opt out:

• in Torpedo, open Settings > Privacy > Privacy Choices and opt out of the sale or sharing of your personal information;
• in iOS Settings > Privacy & Security > Tracking, don’t allow Torpedo to track you;
• or email info@appalex.hu with the subject “Do Not Sell or Share”, ideally through Torpedo’s Settings > Support > Contact Support, which adds your player ID.

After an opt-out, Torpedo stops sending ad signals to Google for personalized advertising and ad conversions; you will still see non-personalized ads.

13. Contact Us

For privacy-related questions or to exercise your rights, contact us:

Appalex Limited
Email: info@appalex.hu
Phone: +36 70 213 3578
Address: 1012 Budapest, Logodi utca 48. A. lház. 1. em. 2. ajtó, Hungary

14. Supervisory Authority

EU users can file complaints with their local data protection authority. Our lead supervisory authority is:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Email: ugyfelszolgalat@naih.hu
Phone: +36 (1) 391-1400

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes via the Apps. Changes become effective 30 days after posting.

16. Governing Law

This Privacy Policy is governed by the laws of Hungary. However, this does not affect your rights under applicable data protection laws in your country of residence, including GDPR for EU residents and state privacy laws for US residents.

Last Updated: October 4, 2026
Version: 2.1

← Back to home