Catchy Privacy Policy

This Privacy Policy explains how Catchy (the "game") handles personal data. The game is published by Mobixify LTD ("Mobixify", "we", "us"), a company registered in England and Wales with company number 16138122 and its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the controller of the personal data described here under the UK GDPR and the Data Protection Act 2018, and under the EU GDPR where it applies to you. The game is an online game: it needs an account and an internet connection, and it lets you play and chat with other people.

The short version

• You need an account to play. We ask for an e-mail address, a display name and a password.
• Room chat is seen by the other players in your room. The server keeps it only in memory while the room is open, except for the evidence copied into a report.
• You can report and block other players. Our own team reviews reports and acts on them within 24 hours.
• The game has no advertising, analytics, tracking or crash-reporting service, and no in-app purchases. It does not use your device's advertising identifier, location, contacts, photos, camera or microphone.
• You can delete your account at any time, in the game (Profile, then DELETE ACCOUNT) or on the web.
• You can ask us about your data at any time at info@mobixify.com.

Who runs what

Mobixify LTD decides why and how your personal data is used, so we are the controller. We run the game server, its database and the account website at moba.ping999.tr ourselves, and our own team operates them, handles reports and answers support requests. The server and its database are hosted on Amazon Web Services (AWS) in Frankfurt, Germany. AWS acts as our processor: it provides the hosting and handles your data only on our instructions, under its data processing terms. Our team members who can reach the data are bound by confidentiality.

Apple and Google run the app stores. They are separate controllers of the data they hold about your download, and their own privacy policies apply to it: see the Apple Privacy Policy and the Google Privacy Policy.

Information we collect

Your account. When you register we receive your e-mail address, the display name you choose and your password. The server stores the password only as a salted hash (Argon2) and never in readable form. It also creates an account ID and records when the account was created, and whether it has been banned. You sign in with your e-mail address or display name and your password. The game does not save your password or a "remember me" session on your device, so you sign in each time you start it. The game does not send you e-mail and does not verify your e-mail address. When you create an account, the game shows a line with links to the Terms and this Privacy Policy, the zero-tolerance rule for abuse and the minimum age of 13. The Privacy Policy, Terms and support page are also linked in the game's Settings and on the sign-in screen.

Your session. When you sign in, the server gives your device a session cookie and short-lived play tokens, which the game keeps in memory to prove it is you while you play. They end when you sign out, delete your account or the session expires.

Rooms and chat. When you create a room we receive its name, whether it is public or private, its password if private, and its time limit and kill goal. Public rooms are listed for every signed-in player. When you join a room, the other players in it see your display name and team. Chat messages (up to 280 characters) go to the players in the room, to everyone or to your team only. Anything you write in chat, in a display name or in a room name can be read by other players, so do not share personal information.

Playing a match. While you play, the game sends your movement, aim and actions to the server in real time, and the server decides what happens. When a match ends, the server records the match: its mode, start and end, the result and why it ended, and for each player the kills, deaths, gold, hooks cast and hooks that hit, and whether and how the player left. The game shows you your own totals and your last 10 matches from these records.

Reports and moderation. When you report a player, the server stores who reported whom, the reason you chose (abusive chat, offensive name, spam, cheating or other), the room and the time, and a copy of the last 10 chat lines the reported player wrote in that room that you could read. The game does not send chat text with your report; the server takes it from its own history. Our own moderators read open reports in an admin panel and can ban accounts.

Technical data. The server and the web server in front of it receive your IP address, the time of your requests, the protocol version of the game, and measurements of the quality of your connection (such as delay and gaps between messages). They write security and error logs that include IP addresses and are used to run the service, limit abuse and protect accounts from password guessing.

Account website. At moba.ping999.tr you can sign in, change your display name or password, and delete your account. The site uses the same session cookie, which is needed to keep you signed in, and no analytics or advertising cookies. Its pages load fonts from Google Fonts, so your browser sends your IP address and browser details to Google when you open them, under the Google Privacy Policy.

On your device only. Your settings (language, volume, graphics, controls, window size) and the list of players you have blocked are saved on your device. The block list is kept per account, holds up to 200 players, and is never sent to us.

Information we do not collect

We do not collect your phone number, location, contacts, photos, camera or microphone data, or payment details, and we do not collect your device's advertising identifier or other device identifiers. The game contains no analytics, advertising, attribution or crash-reporting service. It does not track you across apps or websites of other companies and does not show the App Tracking Transparency prompt. The game has no real-money purchases. If you have chosen in your device settings to share diagnostics with app developers, Apple or Google may give us aggregated crash and usage statistics through their developer tools; the operating system produces them and they do not identify you to us.

Why we use information

UK data protection law needs a lawful basis for each use of personal data.

• Running your account and the game (registering you, signing you in, rooms, chat, matches, your totals and match history): to carry out our contract with you, which is these Terms.
• Keeping the game safe (the word filter, reports, bans, spotting cheating and abuse, security logs, limiting repeated sign-in attempts): our legitimate interests, and those of other players, in a safe and fair game. We balanced these against your interests and rights and limited the data to what is described here. You can object, see Your rights. Where the law requires us to deal with illegal content or to answer an authority, we also rely on legal obligation.
• Understanding how the game is used in aggregate (for example how many people play and how often players leave a match early): our legitimate interest in keeping the game running and improving it. We do this from our own match records and use no third-party analytics service.
• Answering your messages and requests: our legitimate interest in replying to you, or our contract with you when your message is about your account.
• Defending legal claims and meeting legal duties, such as tax, accounting and answering lawful requests: legal obligation and our legitimate interest in protecting our legal position.

We do not use your data for advertising, we do not sell it, and we make no decisions about you by automated means that have legal or similarly significant effects on you. The word filter only masks words on your own screen. Bans are decided by a person. We use your e-mail address to identify your account, to deal with a request you make and to contact you about it, and the game currently sends no automatic e-mail. If that changes, we will update this policy first. We do not intentionally collect special-category data such as health or beliefs. Please do not write such data in chat.

Who sees your information

• Other players see your display name, your team, your chat messages, the name of a room you create and what you do in a match.
• AWS, as described above, hosts the server and database and processes the data for us.
• Our own team. Moderators and support staff see reports, the evidence copied into them and the data on the accounts reported, and only the people who run the service can reach the server and its data.
• Authorities, advisers and others. We disclose data where the law requires, to protect the safety of players or others, or to defend legal claims, and to professional advisers under confidentiality. If we ever sell or reorganise the business, data may pass to the new owner under this policy.
• Service providers. Our mailbox is hosted by Google Workspace.

We do not share your data with advertisers or data brokers.

Where your information is processed

The game server and database are hosted by AWS in Frankfurt, Germany, in the European Economic Area, which the UK treats as adequate. Some of our team members work from Türkiye and can reach the server and its data remotely to operate, secure, moderate and support the service. Türkiye has no UK or EU adequacy decision. This is access by our own staff, not a disclosure to another organisation, so we protect it with staff confidentiality obligations and by limiting access to the people who need it. If you use the account website, Google Fonts may serve fonts from Google's servers in the United States, as described above. You can ask us about these safeguards at info@mobixify.com.

How long information is kept

• Account data (e-mail address, display name, password hash, account ID, ban status, dates): until you delete your account.
• Sessions and play tokens: until they expire or you sign out, delete your account or are banned.
• Chat: the server keeps only the latest 32 messages of a room, in memory, and discards them when the room closes. The only chat it stores is the evidence copied into a report.
• Reports and their evidence: until the report has been reviewed, and then for up to 12 months, so that we can spot repeated abuse and handle appeals and legal claims.
• Match records: kept while your account exists, so that your totals and match history can be shown. When you delete your account, your name and ID are removed from them and what is left is statistics that no longer identify you.
• Server and web-server logs (including IP addresses): up to 30 days.
• Backups of the database: up to 30 days. If a backup is ever restored, accounts deleted since it was taken are deleted again.
• On your device: until you delete the game or clear its data. The block list is also removed when you delete your account.
• Messages to us: only as long as needed to answer you and deal with any follow-up, then deleted.

Delete your account and data

You can delete your account yourself, at any time:

1. In the game. Sign in, open Profile, choose DELETE ACCOUNT, enter your password and confirm.
2. On the web. Open moba.ping999.tr/account/delete, sign in and choose "Delete my account".
3. By e-mail. If you cannot sign in, for example because you have forgotten your password, write to info@mobixify.com from the e-mail address of your account and tell us your display name. We may ask you to confirm that the account is yours. We will act within one month.

When you delete your account, the server ends all of its sessions and play tokens, deletes the account, and removes your name and ID from finished match records. The game removes your block list from your device. Reports about you that are still open, and report evidence we need to deal with them, are handled as described under How long information is kept. A deleted account cannot be restored. Deleting the game from your device does not delete your account.

You can also ask us to delete only some of your data without deleting your account. We will do it where the law gives you that right.

Your rights

You can ask us for access to your personal data, to correct it, to delete it, to restrict its use, and to receive a copy of it in a portable format. Where we rely on legitimate interests, you can object at any time, and we will stop unless we have compelling grounds or need the data for legal claims. You also have the right not to be subject to decisions based solely on automated processing that significantly affect you; we make none. Apple and Google are separate controllers of the data they hold, so ask them about that data.

Write to info@mobixify.com from the e-mail address of your account, or use the in-game and web tools above. We will reply within one month. For a complex request we may take up to two further months, and we will tell you why.

If you are not happy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk. If you live in the EU or EEA, you can also complain to your local data protection authority. If you live in Türkiye, you may also have rights under the Personal Data Protection Law (KVKK, Article 11) and can write to us at info@mobixify.com.

Children

The game is for players aged 13 and over, and you must be at least 13 to create an account. It is not directed at children under 13, and we do not knowingly collect personal data from them. If we learn that an account belongs to a child under 13, we delete it. Players aged 13 to 17 can use the game, but public rooms put you in touch with people you do not know. You can create a private room with a password for friends, report and block anyone who bothers you, and ask us to delete your account at any time. If you are a parent or guardian and have a concern, or want an account deleted, write to us at info@mobixify.com.

Safety and moderation

The game filters offensive words in chat, names and room names on your screen, and lets you report and block players. Our own team reviews reports, and we act on reports of objectionable content within 24 hours. Section "Community rules" of the Terms says what is not allowed and what happens to accounts that break the rules.

Security

All communication between the game, the account website and the server is encrypted with HTTPS and WSS. Passwords are stored only as salted hashes. The server limits the rate of sign-in attempts and other requests to resist guessing and abuse, and access to the data is limited to the people who need it to run and moderate the service. If a personal data breach puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.

Changes to this policy

If we change how the game handles personal data, we will update this page and its effective date, and we will say so in the release notes on the store or in the game when a change is material.

Contact

Write to Mobixify LTD at info@mobixify.com, or by post to 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.