Privacy Policy for TWOCRAZY

This Privacy Policy describes how Giovanni Bevacqua, as data controller, processes personal data in relation to the video game TWOCRAZY ("Game" or "App") and the official website twocrazy.app ("Site").

This notice applies to the Site and the Game, unless otherwise specified.

The data controller is:
Giovanni Bevacqua
VAT: IT03809330792
Italy
Privacy email: privacy@twocrazy.app

For questions about this Privacy Policy, the processing of personal data, or to exercise your rights, you can use the email address above.

TWOCRAZY is designed around a data minimisation principle.

We do not require you to create a TWOCRAZY account to play, and we do not directly ask users for information such as first name, last name, phone number or postal address to use the Game normally.

Some technical data may nonetheless be processed automatically by the Game, the Site, or third-party services used to provide features such as advertising, analytics, security, distribution and diagnostics.

The data processed depends on the platform, the device, geographic location, the user's privacy preferences and the services actually available.

When a user visits twocrazy.app, the systems needed to run the Site may automatically process technical information such as:

• IP address;
• date and time of the request;
• browser used;
• operating system;
• device type;
• language;
• pages requested;
• technical connection information;
• technical and security logs.

This information may be processed by the hosting provider and other technical providers needed to make the Site available and protect it.

This processing may be necessary to ensure functioning, security, abuse prevention, diagnostics and the integrity of the service.

With the user's consent where required by applicable law, the Site may use Google Analytics 4 ("GA4") to understand how it is used.

We may, for example, measure:

• page views;
• general traffic sources;
• campaigns that brought users to the Site;
• interactions with trailers and content;
• clicks on buttons leading to the stores;
• selected language;
• other interactions relevant to assessing the effectiveness of the Site and promotional activities.

Google Analytics may use its own cookies to distinguish users and sessions.

We do not intentionally use GA4 to collect, through the Site, information such as name, email address or other data that directly identifies the user.

The Site may use Google Tag Manager ("GTM") to centrally manage tags and measurement tools.

Through GTM, analytics or marketing services may be activated based on the user's privacy preferences.

Using GTM does not change the user's right to accept or refuse the categories of processing for which consent is required.

Links used to promote TWOCRAZY may contain campaign parameters, including UTM parameters.

These may let us understand, for example, whether a visit comes from TikTok, Instagram, YouTube, an advertising campaign, or a specific promotional piece of content.

This information is used to measure the effectiveness of our communication and marketing activities.

The Site may, in the future and with consent where required, use measurement tools provided by platforms such as Meta, TikTok or Google Ads.

These tools may be used to measure the effectiveness of campaigns and, where permitted by law and by the user's preferences, for advertising purposes.

Such tools will not be considered active under this notice until they are actually implemented on the Site. This Privacy Policy will be updated if further relevant processing is introduced.

The Site may use cookies and similar technologies.

Some tools may be strictly necessary for functioning, security, or storing the user's preferences.

Cookies or technologies used for analytics, advertising or other purposes that are not strictly necessary are managed in accordance with applicable law and, where necessary, on the basis of the user's consent.

The Site may use a consent management platform ("CMP") through which the user can accept, refuse or change their preferences.

Google Consent Mode allows Google tags to adapt their behaviour to the choices received from the consent system; it does not, however, replace the mechanism by which those choices are requested from the user.

Further information may be provided in the Site's Cookie Policy.

TWOCRAZY does not require an account for normal use of the Game.

Game information is stored only locally on the device and is not sent to us:

• progress and unlocked levels, per difficulty;
• records (scores, stars, CRAZY times), including the history of previous versions;
• settings and preferences (language, music, sound effects, voice, motion);
• the last CRAZY run code.

To recognise moves, the Game reads the position of your fingers on the screen in real time. This touch data is processed only on the device while you play: it is not kept after the move is evaluated and is not sent to us or to third parties.

The local CHALLENGE runs on a single device and run codes are shared by hand, copied as text: the Game does not transmit them and there are no shared leaderboards.

The Game uses no third-party analytics or crash reporting. Unity engine diagnostics collection and Unity services (Analytics, Ads, In-App Purchasing, Crash Reporting) are disabled in the build.

If features that change how data is processed are introduced (for example advertising, purchases or online features), this Privacy Policy will be updated before they are activated.

Future feature — not active in the TestFlight beta. The following will apply only once the feature is introduced.

TWOCRAZY may be monetised through advertisements.

To manage and mediate ads we use, or plan to use, Unity LevelPlay and the advertising networks actually configured through that service, which may include:

• Google AdMob;
• Unity Ads;
• other advertising partners that may be added in the future.

Unity provides specific privacy resources for LevelPlay covering, among other things, GDPR, Google Data Safety and Apple privacy declarations.

Depending on the network, platform, region and the user's privacy choices, advertising services may process data such as:

• IP address;
• device identifiers;
• advertising identifiers, where permitted;
• technical device characteristics;
• operating system;
• App version;
• interactions with ads;
• impressions;
• information about whether an ad was completed;
• diagnostic information;
• information necessary for fraud prevention;
• general or approximate location information derived from technical data such as the IP address.

This information may be used, under the applicable terms, to serve ads, measure their performance, limit how often they appear, prevent fraud and, only where permitted, provide personalised advertising.

Future feature — not active in the TestFlight beta.

TWOCRAZY may offer Rewarded Ads, i.e. ads the player chooses to watch. The reward will be cosmetic only (for example an alternative palette or trail, also obtainable by playing) and will never give a continue, points, lives, undone mistakes or any other competitive advantage. Levels, difficulties, multiplayer and retries will never require an ad.

Watching will be optional. The advertising system will tell the Game the technical information needed to verify that the ad was completed and that the cosmetic reward can be granted.

Future feature — not active in the TestFlight beta. The following will apply only once the feature is introduced.

TWOCRAZY may occasionally show full-screen ads ("Interstitial Ads") during natural pauses or transitions in the Game.

Ads are not designed to intentionally interrupt an active phase of gameplay.

TWOCRAZY does not currently feature permanent advertising banners during gameplay.

Future feature — not active in the TestFlight beta. The following will apply only once the feature is introduced.

Where required by applicable law, advertising services are initialised and used in accordance with the privacy preferences collected through the consent tools implemented in the App.

Depending on the region and the choices made, the availability or personalisation of ads may vary.

For LevelPlay, Unity notes that under European law consent may be required before third-party SDKs are initialised, and it provides tools to pass consent information to supported networks.

Declining personalised advertising does not necessarily prevent use of the Game; where technically and legally possible, non-personalised or limited forms of advertising may be used instead.

Future feature — not active in the TestFlight beta. The following will apply only once the feature is introduced.

TWOCRAZY may offer in-app purchases, for example a future Remove Ads option.

Payments are processed by the distribution platform, for example the Apple App Store or Google Play.

The controller does not directly receive the user's full payment card details or payment instrument information.

We may receive from the platform the technical information needed to verify a purchase and make the purchased feature available.

In the Game: the build contains no third-party crash reporting or analytics; Unity engine diagnostics are disabled. If diagnostic services are integrated in the future, they will be listed here before activation.

TestFlight beta: the beta is distributed through Apple's TestFlight, which operates under Apple's own privacy policy. If you take part, Apple may share with the developer your name and email address (or a public identifier if you joined via a public link), beta installation and usage dates, crash reports and the feedback you choose to send (text, screenshots and technical information such as device model, system and beta version). This data is used only to run the beta and fix problems; we do not use it for advertising.

Email: when you write to support@twocrazy.app or privacy@twocrazy.app we process your address and the content of your message to reply, and keep them as long as needed to handle the request.

The data described in this Privacy Policy may be processed to:

• provide the Site and the Game;
• allow preferences and progress to be saved;
• ensure the security and integrity of the services;
• prevent fraud and abuse;
• diagnose technical issues;
• understand how the Site is used;
• measure the effectiveness of promotional activities;
• serve and measure advertisements (future feature);
• manage Rewarded Ads (future feature);
• verify purchases and unlocked features (future feature);
• respond to user requests;
• comply with legal obligations.

Where the GDPR applies, processing may be based, depending on the case, on:

Performance of a contract or pre-contractual measures, when processing is necessary to provide a service requested by the user.

Consent, when the law requires the user to make a prior choice, for example for certain uses of cookies, analytics or advertising.

Legitimate interest, when processing is necessary to ensure security, prevent fraud and abuse, ensure the technical functioning of the services, or pursue other legitimate interests, in compliance with the data subject's fundamental rights and freedoms.

Legal obligation, when processing is necessary to comply with an obligation set by law.

Where processing is based on consent, it can be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Data may be processed by, or disclosed to, within the necessary limits, parties that provide services related to the Site and the Game, such as:

• hosting and infrastructure providers;
• analytics providers;
• advertising and mediation service providers (once advertising is introduced);
• app distribution platforms, including Apple for the App Store and TestFlight;
• technical and security service providers;
• payment service providers via the stores;
• public authorities, where required by law.

Depending on the service and the processing involved, these parties may act as data processors or as independent controllers under their own terms.

Some providers used by the Site or the Game may process data outside the European Economic Area or the user's country of residence.

Where required by applicable law, such transfers are carried out using legally recognised safeguards, such as adequacy decisions, standard contractual clauses, or other valid mechanisms.

Personal data is kept for as long as necessary to achieve the purposes for which it was processed, and for any further periods required by law.

For services provided by third parties, retention periods may also depend on that provider's own configuration and policies.

We aim to use retention periods proportionate to the purposes pursued.

TWOCRAZY is a video game intended for a general audience and is not designed or marketed specifically for children.

The Game does not intentionally ask children to directly provide their name, email address or other personal data in order to play.

We do not knowingly use the Site or the Game to collect personal data from children in violation of applicable law.

If we become aware of personal data about a child being processed in circumstances where a parent's or guardian's consent would be required, or where the processing would otherwise not be permitted, we will take the reasonable steps required under applicable law.

Parents or guardians who believe a minor has provided personal data in a way that does not comply with applicable law can contact us at the address given in the Contacts section.

Where provided for by applicable law, the user may have the right to:

• obtain confirmation of whether processing is taking place;
• access their personal data;
• request correction of inaccurate data;
• request deletion of data;
• request restriction of processing;
• object to processing;
• receive data in a portable format, where applicable;
• withdraw consent previously given.

Exercising these rights may be subject to the conditions and exceptions set out in applicable law.

To submit a request, you can contact: privacy@twocrazy.app

We may ask for information reasonably necessary to verify the identity of the person making the request.

Users subject to the GDPR also have the right to lodge a complaint with the competent supervisory authority.

For data subjects in Italy, the competent authority is the Garante per la protezione dei dati personali.

Where available, users can change or withdraw their preferences through the tools provided on the Site or in the Game.

The Site will offer a feature equivalent to "Manage privacy preferences", through which the consent management system can be reopened.

The Game will provide the privacy controls needed in relation to the services actually used.

Google distinguishes, among others, consent for analytics_storage, ad_storage, ad_user_data and ad_personalization.

We adopt reasonable and proportionate technical and organisational measures to protect processed data from unauthorised access, loss, alteration or improper disclosure.

No IT system or method of data transmission can, however, guarantee absolute security.

The Site or the Game may contain links to, or integrate services provided by, third parties.

When a user interacts directly with a third-party service, the processing carried out by that party may also be governed by its own Privacy Policy.

This Privacy Policy may be updated to reflect:

• changes to the Site;
• new versions of the Game;
• the introduction or removal of services;
• changes in how data is processed;
• regulatory changes.

The updated version will be published on this page and will show the date of the last update.

Where required by applicable law, substantial changes will be communicated through additional means or will require renewed consent.

For questions, requests or reports concerning privacy:

Giovanni Bevacqua
VAT: IT03809330792
Italy
Email: privacy@twocrazy.app