Privacy Policy — Diceonaut (Android app)

Last updated: 27 June 2026 · Version: 2.0 · Effective date: the date this version is published

This Privacy Policy explains what personal data the Diceonaut Android application ("the App") collects, why, who it is shared with, how long it is kept, and the rights you have. The App is published by Atashi Technologies Private Limited ("Diceonaut", "we", "us"). It mirrors our website policy at https://diceonaut.com/privacy and adds Android-specific detail. Diceonaut is a free, casual social game — not a real-money game: you cannot deposit real money into gameplay, you cannot win real money, and the in-game play currency cannot be bought or cashed out.

1. Who we are

• Operator / Data Fiduciary / Data Controller: Atashi Technologies Private Limited.
• Registered office: Kolkata, West Bengal, India.
• Privacy contact: [email protected]
• Grievance Officer (India — DPDP Act 2023 §13 & IT Rules 2021): Dipanjan Mondal, [email protected] (acknowledged within 24 hours).

We design to the stricter of India's Digital Personal Data Protection Act, 2023 + DPDP Rules 2025 and the EU/UK GDPR.

2. Data the App collects

You can play local single-device games without an account. If you sign in / play online, we collect:

• Account data (via our identity service, Keycloak): email, username, display name, avatar seed, account ID, timestamps, and your Terms/age acceptance. Your password is stored only by the identity service as a secure hash — we never see it.
• Gameplay & progression: matches, per-game stats and skill rating, ratings/reviews, your in-game Coins ("Stardust") and Gems ledger, achievements, championships, cosmetics, and (when enabled) match replays.
• Social data: friends, direct messages (chat), presence, notifications.
• Analytics (only if you opt in): a few product events (app open, game open, match end, sign-up, page view, purchase), stored on our own servers — not sent to any third-party analytics provider.
• Technical/security data: IP address and device/network info, handled via Cloudflare for delivery, TLS, and abuse/bot protection.
• Advertising identifiers (only if/when ads are enabled): see §6.

We do NOT collect: precise location/GPS, contacts, photos, microphone, or camera; special-category data; and we do not sell your personal data.

3. Permissions the App uses

• Internet / network access — to sign in and play online.
• The App does not request location, contacts, camera, microphone, or access to your personal files.
• If advertising is enabled, the Google Mobile Ads (AdMob) SDK may access the Advertising ID (§6).

4. Why we use your data

To create/run your account; run matches, rankings, rewards and social features; keep the service safe (anti-abuse/anti-cheat); and — with your consent — product analytics. Legal bases: performance of contract, legitimate interests (security), and your consent (analytics; future advertising) under GDPR Art. 6 / DPDP Act §6–§7.

5. In-game currencies and purchases (Android)

• Coins ("Stardust") are earn-only, cannot be bought, and cannot be cashed out.
• Gems are a cosmetic-only currency. In the Android app (v1) there are no in-app purchases — Gems are purchased on the Diceonaut website; the App only shows and spends your existing balance. A future App version selling digital goods would use Google Play Billing (or India's User-Choice Billing), with this policy and the Play data-safety form updated first.
• Real money never enters gameplay and there is no cash-out — Diceonaut is a permitted casual game, not a real-money game under India's Promotion and Regulation of Online Gaming Act, 2025.

6. Advertising and AI opponents (bots)

• Advertising is currently off. If enabled, the App will use Google AdMob, which may collect an advertising identifier and device data to serve/measure ads; we will request the separate consent required, update this policy and the Play data-safety form, and not serve behaviourally-targeted ads to users under 18.
• AI opponents (bots): when human players are scarce, a match may be filled by a clearly-labelled AI (bot) opponent. Bots cannot affect your ranking, Coins, Gems, or any pot, and are never counted as real players online. We do not fake activity.

7. Who we share data with

Hosting (Hetzner), CDN/TLS/bot-protection (Cloudflare), identity (Keycloak, self-hosted), web fonts (Google Fonts — receives your IP), and — when enabled — advertising (Google AdMob). Analytics is self-hosted (not shared). We disclose data when required by law, to enforce our Terms, or in a business transfer. We do not sell your data.

8. International transfers

Servers run via Hetzner (European data-centre infrastructure). Some providers (Google) process data abroad (incl. the US). For EU/UK users we rely on appropriate safeguards (Standard Contractual Clauses / adequacy).

9. Children and age

You must be 13+ (or have parent/guardian permission). For India, the DPDP Act treats under-18s as children and (from 13 May 2027) requires verifiable parental consent and no behavioural tracking/targeted ads at children; we are building toward this and keep advertising/behavioural tracking off in the meantime.

10. Retention, your rights, and deletion

• We keep account/gameplay data while your account is active; analytics up to 24 months; messages until you or the other person deletes them or you delete your account.
• You can export your data and delete your account in-app: deletion anonymises your account and deletes your ratings, reviews, analytics events, private messages, friend connections, and notifications. You can also access, correct, withdraw consent, raise a grievance, and complain to the Data Protection Board of India or your EU/UK supervisory authority. Email [email protected] to exercise any right.

11. Security & breach notice

TLS/HTTPS in transit; passwords stored only as hashes by the identity service; access controls; anti-abuse protections. If a breach affects you, we notify you and the relevant regulator without undue delay, in plain language (DPDP Rules 2025 / GDPR Art. 33–34).

12. Changes & contact

We update this policy when practices change (and update the Play data-safety form to match). Questions or grievances: [email protected] — Atashi Technologies Private Limited (Diceonaut), Kolkata, West Bengal, India. Governing law: India; courts at Kolkata, West Bengal, subject to your mandatory consumer rights.