Privacy Policy & Data Protection Declaration
Compliant with Digital Personal Data Protection Act, 2023 (DPDP Act) & DPDP Rules 2025 (India), General Data Protection Regulation (GDPR - EU), COPPA (US), and CCPA/CPRA.
1. Information We Collect & Purpose of Processing
Under DPDP Act Section 5, we collect only data strictly necessary to provide and secure multiplayer gaming services:
Username, custom avatar, country/region, birth year, and secure authentication tokens (Google OAuth, email, guest tokens).
IP address, network ping, OS version, device model, and screen resolution strictly to maintain latency and prevent cheating.
Win/loss match history, level XP, trophy stars, virtual coins, passes, cosmetic skins, and non-sensitive Google Play transaction IDs.
In-room chat messages, animated emoji reactions, 3D charm gifting records, and user block/report logs.
2. Peer-to-Peer Networking (WebRTC Direct Mesh)
CITAGAH utilizes high-speed WebRTC peer-to-peer mesh networking to deliver lag-free sub-50ms multiplayer physics in fast-action games like Air Hockey, Cup Pong, and Tic-Tac-Toe.
3. Certified Third-Party Service Providers
We integrate certified industry-standard service providers for core functionality:
4. In-App Purchases & VIP Subscriptions
All microtransactions (Coins, Passes, Table Themes) and VIP Subscriptions (Gold and Diamond VIP) are handled securely through Google Play In-App Billing. CITAGAH never accesses, collects, or stores payment card credentials, CVVs, or banking passwords. Subscriptions auto-renew unless cancelled at least 24 hours before the end of the billing period in Google Play Store settings.
5. Data Principal Rights (DPDP Sec 11–14 & GDPR)
- • Right to Access & Portability (Sec 11): Download a complete, machine-readable JSON export of your profile, game match history, virtual inventory, and friends list.
- • Right to Correction (Sec 12): Update your username, bio, and avatar at any time in Profile Settings.
- • Right to Erasure / Deletion (Sec 12): 1-tap complete deletion of your account. Under DPDP Rule 8(3), non-identifying transaction order hashes are retained in an isolated audit table for 1 year before automatic purging.
- • Right of Nomination (DPDP Rule 14(4)): Nominate an individual who shall, in the event of death or incapacity, exercise your data principal rights.
- • Right to Withdraw Consent (Sec 6): Toggle ad personalization or request data erasure at any time without penalty.
6. Protection of Minors & Zero Behavioral Tracking
In strict compliance with Section 9 of the DPDP Act 2023 (India), individuals under 18 years of age are classified as children. We enforce strict child-safety measures: zero behavioral tracking, zero profiling, and mandatory age verification.