Privacy Policy of the Game "Ball and Hole"

Version of November 13, 2026. This is a translation; in case of discrepancies the Russian version prevails.

1. General provisions

This personal data processing policy has been drawn up in accordance with Russian Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (the "Law") and defines the procedure for personal data processing and the measures for ensuring the security of personal data taken by DERALIGN LIMITED LIABILITY COMPANY (the "Operator"). The Operator considers respect for human and civil rights and freedoms in personal data processing, including the protection of privacy and personal and family confidentiality, to be a key objective and condition of its activities.

This policy of the Operator concerning personal data processing (the "Policy") applies to all information that the Operator may obtain about visitors to https://bib.deralign.com and users of the software "Ball and Hole".

2. Main terms used in the Policy

Automated personal data processing means processing personal data using computing equipment;

Blocking personal data means temporarily suspending personal data processing, except where processing is necessary to clarify the personal data;

Website means the collection of graphic and informational materials, software and databases that make them available on the Internet at https://bib.deralign.com;

Personal data information system means the personal data contained in databases and the information technologies and technical equipment used to process them;

Anonymisation of personal data means actions that make it impossible to determine, without additional information, whether personal data belong to a particular User or another data subject;

Personal data processing means any action or set of actions performed with personal data, with or without automated means, including collection, recording, systematisation, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (dissemination, provision or access), anonymisation, blocking, deletion and destruction;

Operator means a state authority, municipal authority, legal entity or individual that independently or jointly with others organises or performs personal data processing and determines the purposes of processing, the personal data to be processed and the actions performed with them;

Personal data means any information relating directly or indirectly to an identified or identifiable User of https://bib.deralign.com or of the software "Ball and Hole";

User means any visitor to https://bib.deralign.com or user of the software "Ball and Hole";

Provision of personal data means actions aimed at disclosing personal data to a particular person or a particular group of persons;

Dissemination of personal data means actions aimed at disclosing personal data to an indefinite group of persons, or making personal data available to an unlimited group of persons, including publication in the media, placement on information and telecommunications networks or provision of access by any other means;

Cross-border transfer of personal data means transferring personal data to the territory of a foreign state to a foreign state authority, foreign individual or foreign legal entity;

Destruction of personal data means actions that irreversibly destroy personal data so that the content of the personal data cannot subsequently be restored in a personal data information system, or that destroy the physical media containing personal data.

3. Data processed by the Operator

3.1. When the Game contacts the server. When the device is connected to the Internet, the Game contacts the Operator's server to check for a mandatory update or a message from the Operator and to synchronise the cloud save. With each request, the server receives:

• the device's IP address;
• the date and time of the request and the requested address;
• the technical description of the software transmitted with a network request (the game engine's name and version and the operating system);
• the Game version and platform (Android or iOS).

3.2. Guest account and cloud save. On the first launch with Internet access, the Game creates a guest account to prevent progress being lost in the event of a device failure. The Operator stores:

• an internal account name generated by the server (for example, guest_1a2b3c4d) and the account ID;
• the platform and Game version;
• the account creation date and last sign-in date;
• the cloud save: completed levels, stars and best times, total number of falls, tutorial completion flag, save format version, game currency (coins), purchased and equipped balls and effects, and Game settings (language, controls, volume and vibration), together with the time of its latest modification.

An account access key (token) is stored on the device; the server uses it to identify the account.

3.3. Registration (optional). To play on another device, the User may register by providing an email address and password and ticking the consent to personal data processing. The Operator stores:

• the email address;
• the password only as an irreversible hash (bcrypt); the password itself is not stored in the database.

3.4. Data remaining only on the device. Except in the cases described in sections 3.1–3.3, progress and settings are stored on the User's device. Without Internet access, the Game transmits nothing to the Operator.

3.5. Data not processed by the Operator. The Game does not request or receive a first name, surname, phone number, location, contacts, photographs or gallery contents, camera or microphone data, or the device's advertising identifier. The Game has no advertising, purchases with real money, third-party analytics services or third-party software libraries that transmit data to third parties. The server does not send emails. The Game's document pages do not use cookies or visitor counters. Special categories of personal data and biometric data are not processed.

The Operator recommends not using an email address containing the User's real first name and surname during registration if the User does not wish to disclose them.

4. Purposes of personal data processing

• Operating the Game: checking for mandatory updates, displaying the Operator's messages and blocking accounts that violate the Terms of Use (the data in section 3.1 and the account ID).
• Storing the cloud save and restoring it on the same or another device (the data in section 3.2).
• Signing in to a registered account with an email address and password on another device (the data in section 3.3).
• Anonymised statistics for the Operator: the number of accounts, guests and active players.
• Ensuring security, identifying server failures and correcting a save at the User's request.
• Responding to Users' requests and complying with the legislation of the Russian Federation.

The Operator does not use personal data for advertising or advertising profiles, does not send Users mailing campaigns and does not make decisions based on the data that produce legal consequences for the User.

5. Legal grounds for personal data processing

The data in sections 3.1 and 3.2 are processed to perform the Game's Terms of Use, to which the User is a party (point 5, part 1, article 6 of the Law): without these data, the server cannot store progress or inform the Game of updates.

The data in section 3.3 are processed on the basis of the User's consent (point 1, part 1, article 6 of the Law). Consent is set out in the separate document "Consent to Personal Data Processing" and is given by ticking a box in the registration form. Registration does not proceed without the tick; the Game can also be played without registration. If the User is under 14, consent is given by a parent or other legal guardian.

6. Collection, storage, transfer and other personal data processing

The security of the personal data processed by the Operator is ensured through legal, organisational and technical measures necessary to comply fully with the requirements of applicable personal data protection legislation.

The Operator ensures the safekeeping of personal data and takes all possible measures to prevent unauthorised persons from accessing them.

The User's data are not published or shown to other players.

The User may delete their account in the Game's Settings. Deletion is irreversible: the account, email address, password hash and cloud save are deleted from the server, and progress on the device is erased.

The User may also correct their data or request their deletion by emailing info@deralign.com with the subject "Personal Data". For a registered account, the email must be sent from the address used during registration or identify that address in the message. A guest account does not contain an email address; the User may delete it themselves in the Game.

The User may withdraw consent to personal data processing at any time by emailing info@deralign.com with the subject "Withdrawal of Consent to Personal Data Processing" from the address used during registration. After withdrawal, the Operator deletes the email address and password hash; the account becomes a guest account and remains accessible on the device where the User plays.

A response to a personal data request is sent within 10 working days of receipt. This period may be extended by no more than 5 working days, with notice to the User explaining the reasons for the extension.

7. Transfer of personal data to third parties

The Operator does not sell personal data or transfer them to third parties except in the following cases and only to the extent necessary:

• to the server infrastructure provider (hosting), whose facilities host the Game server, database and its backups;
• to authorised state authorities following a substantiated request in the manner and on the grounds provided by law.

The Game is distributed through application stores (RuStore and App Store). The stores process information about downloading and installing the Game under their own rules; the Operator does not receive it, except for anonymised statistics that the store makes available to developers.

Databases containing the personal data of citizens of the Russian Federation, including backups, are located on servers in the Russian Federation.

No cross-border transfer of personal data takes place.

8. Personal data retention periods

• The account and cloud save are retained until the User deletes the account or requests deletion, or until the Game server ceases operating.
• The email address and password hash are retained until account deletion or consent withdrawal.
• When the account is deleted through the Game, the data are deleted from the server immediately; following an email request, within no more than 30 days of receipt.
• Deleted data remain in database backups until those backups are replaced by new ones; data are not restored from backups except when restoring the server after a failure.
• Server logs (IP address, date, time and requested address) are used for diagnostics and security; their retention period is determined by the server and log rotation settings.
• Data on the User's device are retained while the Game remains installed.

9. Personal data protection

• The Game and server exchange data over the secure HTTPS/TLS protocol.
• Users' passwords are stored only as irreversible hashes.
• Only the Operator's authorised employees have access to the database and admin panel; panel sign-in is password-protected.
• Regular backups are performed and access to backups is controlled.

10. User rights

The User has the right to obtain information about the processing of their data, request their correction, blocking or destruction, and withdraw consent to processing.

The User may obtain explanations concerning personal data processing by contacting the Operator at info@deralign.com.

Any changes to the Operator's personal data processing policy will be reflected in this document. The Policy remains in force indefinitely until replaced by a new version.

The current version of the Policy is freely available at https://bib.deralign.com/legal/eng/privacy.

A response to a personal data request is sent within the time limits established by applicable legislation.

Operator: DERALIGN LLC (OOO "DERALAYN"), TIN (INN) 5904419034, address: 80 Pushkina St., Perm, Perm Krai, Russia; email: info@deralign.com.