CRAZY AXIU PRIVACY POLICY

Scope: Services published and operated by Crazy Axiu

Developer: Crazy Axiu

Effective Date: July 1, 2026

Last Updated: July 27, 2026

1. Introduction

Crazy Axiu ("we," "us," or "our") publishes and operates games, applications, websites and related services (collectively, the "Services").

This Privacy Policy applies to the games, applications, websites and related services published or operated under the Crazy Axiu developer account unless a separate privacy policy is expressly provided.

This Privacy Policy explains:

· what information we collect;

· how and why we use it;

· when and with whom it may be shared;

· how long we retain it;

· how we protect it; and

· the privacy choices and rights available to users.

Please read this Privacy Policy before using the Service. Where required by applicable law or Google Play policy, we will provide an in-app notice and obtain your consent before collecting or using personal or sensitive data.

1.1 Privacy at a Glance

· We collect limited account, device, gameplay, advertising and diagnostic information needed to operate, secure and improve the Services.

· We do not sell personal data for money. Advertising-related disclosures may constitute "sharing" under some laws, and eligible users may opt out.

· Personalized advertising and non-essential analytics are subject to consent where required. Users can change their choice through Settings > Privacy > Privacy Choices.

· Users may request access, correction, deletion or export through the in-app privacy controls or by emailing zbpujun@163.com.

· Children's experiences use age screening, restricted advertising and verifiable parental consent where required.

· International transfers use recognized safeguards, including adequacy decisions and applicable Standard Contractual Clauses.

· This summary is provided for convenience. The complete Policy below controls if there is any inconsistency.

2. Developer and Privacy Contact

The developer responsible for the Services is:

Google Play developer name: Crazy Axiu

Legal entity / registered name: Crazy Axiu

Registration status: Crazy Axiu is the registered entity responsible for operating the Services

Registered and operating contact address: Available to verified legal or regulatory requesters through the privacy contact below

Privacy contact: zbpujun@163.com

Data Protection Officer (DPO): Data Protection Officer, Crazy Axiu

DPO email: zbpujun@163.com

Recommended subject line: "DPO / EU Data Protection Request"

The DPO advises on data-protection obligations, monitors compliance, supports impact assessments, cooperates with supervisory authorities and serves as the contact point for users and regulators. The DPO function applies where the Services conduct large-scale, regular and systematic monitoring or where appointment is otherwise required. Privacy complaints sent to the DPO email will be acknowledged within 10 business days.

3. Information We Collect

Depending on the Service and features you use, we may collect the following information. We collect only information that is relevant to the Service being used.

3.1 Information You Provide

· a unique in-game user identifier (UID);

· customer-support messages and information you submit with a request;

· survey responses or other feedback you choose to provide;

· information needed to verify an account or data-deletion request.

3.2 Information Collected Automatically

· device and technical information, such as device model, operating-system version, language, app version and screen resolution;

· online and device identifiers, such as IP address, app-instance ID and advertising ID, where permitted;

· approximate location derived from IP address, such as country or city;

· gameplay and usage information, such as game progress, session events, feature interactions and ad interactions;

· diagnostics, such as crash reports, ANR information, performance data and error logs.

We do not request access to contacts, SMS, call logs, precise location, microphone, camera or files unless the relevant feature genuinely requires it and the access is clearly disclosed to you before permission is requested.

We use the automatically collected information described above for service operation, advertising delivery, campaign attribution and analysis, performance improvement, security and fraud prevention. Where consent is required, this collection will not begin until you consent. If you refuse or withdraw consent, we will stop collecting this information for advertising and campaign analysis. You may continue to receive non-personalized or contextual advertising.

3.3 Payments and In-App Purchases

The Services currently do not offer in-app purchases. We do not collect or process payment-card details, bank-account information or purchase-verification records.

3.4 Third-Party Login

If you choose to sign in through Google, Facebook or another supported third-party login provider, we may receive the information authorized by you and provided by that service, such as an account identifier, display name or email address. The information received depends on your settings and the provider's policies.

3.5 App Permissions

The permissions requested by a particular Service depend on its features and package manifest. A permission is requested only when needed for the corresponding function. System permission controls remain available through Android settings.

Each production APK/AAB must be checked against this table before publication. Any permission not present in the package must be removed from this table, and any additional permission must be added with its exact function and user control.

4. How We Use Information

We use information only for the following applicable purposes:

· providing and operating the Service;

· creating and managing user accounts;

· saving game progress and delivering game features;

· providing customer support;

· detecting crashes, errors, abuse, cheating and fraud;

· maintaining security and preventing unauthorized access;

· analyzing performance and improving the Service;

· measuring advertising performance, attribution and campaign effectiveness;

· displaying contextual advertising;

· displaying personalized advertising only where permitted and after obtaining any required consent;

· complying with legal obligations and enforcing our terms.

We do not sell personal or sensitive user data.

5. Advertising and Analytics

The Service may use advertising, analytics, diagnostics, authentication and game-technology SDKs. Where required, personalized advertising and non-essential advertising or analytics collection will remain disabled until you provide consent. If you decline or later withdraw consent, collection for advertising and campaign analysis will not begin or will stop, although you may still receive non-personalized or contextual advertising.

You may reset or delete your Android advertising ID through your device settings. Withdrawal of consent does not affect processing that occurred before the withdrawal.

5.1 Advertising ID, Cookies and Similar Technologies

On Android, advertising and analytics providers may use the resettable advertising ID, app-instance identifiers, SDK storage, local storage, pixels or similar technologies to recognize an app installation, limit ad frequency, prevent fraud, measure campaigns and, where permitted, personalize advertising. Mobile apps do not generally rely on traditional browser cookies, but an in-app browser or a linked website may use cookies under the relevant website or provider notice.

We do not combine the advertising ID with persistent hardware identifiers. If you reset or delete the advertising ID, withdraw consent, enable an applicable opt-out or use a child-restricted experience, personalized advertising and non-essential tracking will be disabled or limited as required.

5.1.1 Clearing Local Cache and Tracking Identifiers

Users can remove locally stored data and reset tracking choices using the following controls:

· Clear app cache: Android Settings > Apps > select the relevant Service > Storage & cache > Clear cache.

· Clear local app data: Android Settings > Apps > select the relevant Service > Storage & cache > Clear storage or Clear data.

· Reset in-app privacy choices: open the Service and go to Settings > Privacy > Privacy Choices.

· Reset or delete the advertising ID: Android Settings > Privacy > Ads, then choose Reset advertising ID or Delete advertising ID, depending on the Android version.

· Clear website or in-app-browser cookies: use the privacy or browsing-data controls of the relevant browser.

Clearing app data may remove local settings, downloaded content and locally stored game progress. Account-linked information stored on our systems is not deleted by clearing the device cache or app data; use the account and data-deletion process in Section 12 for that purpose.

5.2 First-Launch Consent and Withdrawal

Where consent is required, the first launch flow presents a privacy notice before personalized advertising or non-essential analytics SDKs are initialized. The notice identifies the main data categories and purposes and provides equally accessible choices to accept, reject or manage options. Essential processing needed to deliver the Service, maintain security or remember a privacy choice may continue without advertising consent where permitted by law.

Users can later review or withdraw consent through:

Settings > Privacy > Privacy Choices

After withdrawal, new processing based on consent stops and updated consent signals are sent to applicable SDKs. Previously lawfully processed data is not retroactively invalidated. Users may also contact zbpujun@163.com if the in-app control is unavailable.

5.2.1 Separate In-App Tracking Notice

Before enabling advertising-ID access, cross-app or cross-service tracking, personalized advertising, advertising attribution or another non-essential tracking technology, the Service displays a separate, concise tracking notice. This notice is presented independently from the full Privacy Policy and before the relevant SDK or technology begins the optional processing.

The notice identifies the tracking technologies and SDK categories involved, the data used, the purposes, whether information may be disclosed for cross-context behavioral advertising and the available controls. It provides equally prominent Allow, Reject and Manage Options choices and includes a direct link to this Policy. Rejecting tracking does not block access to unrelated core gameplay. The user's choice is recorded, transmitted to applicable SDKs and can be changed later through Settings > Privacy > Privacy Choices.

The Service currently uses the following third-party providers:

5.3 Responsibilities of SDK Providers

Crazy Axiu determines the purposes and configuration of data processing within the Services and acts as the controller or business for that processing. A provider acting only on documented instructions is a processor or service provider and must apply contractual confidentiality, security, deletion and assistance obligations. A provider that independently determines purposes, such as certain advertising, fraud-prevention, authentication or platform activities, may act as a separate controller or third party for those activities.

The final role allocation must be checked against the current SDK contract, product configuration and region. We remain responsible for selecting compliant SDKs, minimizing transmitted events, configuring consent and child-directed treatment, and keeping this Policy and the Google Play Data safety form accurate.

5.4 SDK Compliance, Remediation and Responsibility

Crazy Axiu remains the primary responsible entity for the selection, integration and configuration of third-party SDKs within the Services and is the primary contact for users concerning data processed through those integrations. We do not disclaim our statutory controller or business responsibilities merely because processing is performed by an SDK provider.

Our contracts require applicable SDK providers to follow documented instructions, maintain appropriate security, support rights requests, notify us of incidents, delete or return data when required, restrict subprocessors and comply with applicable transfer safeguards. If an SDK provider violates these obligations, we may suspend data transmission, disable or remove the SDK, require remediation and deletion, conduct an investigation, notify affected users or authorities where required and pursue contractual indemnification or other remedies. These contractual remedies do not reduce any right or remedy available to users under applicable law.

6. How We Share Information

We may share information only as necessary with:

· service providers that host, maintain, analyze or support the Service;

· advertising and analytics providers listed above;

· authentication providers when you choose to use their services;

· professional advisers where necessary to protect our legal rights;

· government or regulatory authorities when required by applicable law; and

· a successor organization in connection with a merger, acquisition or transfer of the Service, subject to appropriate notice and safeguards.

Service providers may process information only for the agreed purpose and must protect it appropriately. We do not permit third parties to use personal or sensitive data for unrelated purposes.

7. Legal Bases

Where required by applicable law, we process personal data based on:

· performance of a contract, when processing is necessary to provide the Service;

· consent, including where required for personalized advertising or optional features;

· legitimate interests, such as security, fraud prevention and service improvement, where those interests are not overridden by your rights; or

· compliance with a legal obligation.

You may refuse consent when the consent request is shown, withdraw consent through the in-app privacy or consent controls where available, or contact us at zbpujun@163.com.

8. Data Retention

We generally retain personal and automatically collected information for no longer than 180 days, unless deletion is requested earlier or a longer period is required to maintain an active account, prevent fraud, protect security or comply with law. Any exception is limited to the longest period stated below and is reviewed when that period ends.

When retention is no longer necessary, we delete or irreversibly anonymize the information. Data retained for fraud prevention, security, accounting or legal compliance is logically segregated from active-service data, access-restricted by role, encrypted in transit and at rest where supported, protected by audit logging, excluded from advertising and product analytics, reviewed at least annually and deleted when the applicable maximum period ends.

9. Security

We use reasonable administrative, technical and organizational safeguards designed to protect personal data. These safeguards include, where appropriate:

· encryption in transit using HTTPS/TLS;

· access controls based on job responsibilities;

· authentication and logging for administrative systems;

· restricted access to production data;

· security monitoring and incident-response procedures; and

· periodic review of service providers and SDKs.

No system is completely secure, but we continuously review our safeguards and address identified risks.

9.1 Security Vulnerability Reporting

Security researchers and users may report a suspected vulnerability to zbpujun@163.com with the subject "Security Vulnerability Report." Please include the affected Service, version, reproduction steps and potential impact, but do not include unnecessary personal data or publicly disclose an unremediated issue. We will acknowledge a credible report within 10 business days and provide status updates as appropriate.

10. International Data Transfers

Personal data may be processed internationally by Crazy Axiu and the providers listed in Section 5. International processing remains subject to the contractual, organizational and technical safeguards described below.

For transfers from the European Economic Area, United Kingdom or Switzerland, we use an applicable adequacy decision where the destination or recipient is covered. Where no adequacy decision applies, we use the European Commission's 2021 Standard Contractual Clauses, the UK International Data Transfer Addendum or another valid transfer mechanism, together with a transfer-impact assessment and supplementary safeguards where required. Supplementary safeguards may include encryption in transit and at rest, access minimization, pseudonymization, contractual limits on government-access requests and review of recipient security practices.

Before enabling a covered transfer to an SDK provider outside the European Economic Area, Crazy Axiu enters into a separate written data-processing and transfer agreement with that provider. The agreement incorporates the applicable module of the European Commission's 2021 Standard Contractual Clauses and identifies the data categories, purposes, security measures, subprocessors, retention requirements and audit or cooperation obligations. Separate SCC arrangements are maintained for Google/Firebase, Meta, Pangle, Unity and any other SDK provider receiving covered EEA personal data, unless the transfer is fully covered by an applicable adequacy decision or the recipient is already directly subject to the GDPR in a manner for which those transfer SCCs are not the appropriate mechanism.

We do not rely on an invalidated privacy framework. If a provider relies on a current certification or data-privacy framework, the relevant details are stated in that provider's privacy notice. Users may request information about the applicable transfer mechanism by contacting zbpujun@163.com.

11. Your Privacy Rights and Choices

Depending on your location, you may have the right to:

· request access to personal data;

· request correction of inaccurate data;

· request deletion of personal data;

· withdraw consent;

· object to or restrict certain processing;

· request data portability; and

· lodge a complaint with a competent supervisory authority.

To exercise a right, use Settings > Privacy > Submit a Privacy Request or contact zbpujun@163.com with the request type in the subject line. We may request limited information necessary to verify your identity. We will not require a reason for a deletion request.

We acknowledge privacy requests within 10 business days and normally complete access, correction, deletion, portability and complaint requests within 30 calendar days after verification. If applicable law permits and a request is unusually complex, we will notify you before the original deadline and explain any extension. California requests follow the specific deadlines in Section 11.2.

11.1 Data Portability and Game Data Export

Open Settings > Privacy > Export My Data, verify the account and choose the available machine-readable export. If the in-app option is unavailable, email zbpujun@163.com with the subject "Data Export Request" and identify the relevant Service and player ID. The export may include account data, game progress, entitlement records and selected activity history, but may exclude information that would reveal another person's data, compromise security or violate law.

11.2 California Privacy Rights (CCPA/CPRA)

This section applies to California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to us. California residents may request to know the categories and specific pieces of personal information collected; request deletion or correction; opt out of the sale or sharing of personal information; limit certain uses of sensitive personal information; use an authorized agent; and receive equal service without discrimination for exercising a right.

We do not sell personal information for money. Certain disclosures of advertising identifiers, device information and ad interactions for cross-context behavioral advertising may be considered "sharing" under California law. To opt out, use Settings > Privacy > Privacy Choices > Do Not Sell or Share My Personal Information or email zbpujun@163.com with the subject "California Opt-Out Request." Where technically applicable to our web resources, we also treat a recognized Global Privacy Control signal as an opt-out request.

We process an opt-out request as soon as feasible and no later than 15 business days. Verified requests to know, delete or correct are generally answered within 45 calendar days; if reasonably necessary and permitted by law, we may extend once for an additional 45 days after giving notice. We will use verification information only to handle the request.

Authorized Agents

A California resident may authorize an individual or a business entity registered with the California Secretary of State to submit a CCPA request on the resident's behalf. The authorized agent should email zbpujun@163.com with the subject "California Authorized Agent Request" and provide:

· the consumer's name or player/account identifier;

· the type and scope of request;

· written and signed permission from the consumer identifying the agent and authorizing the specific request; and

· contact details that allow us to communicate separately with the consumer and the agent.

For access, correction or deletion requests, we may ask the consumer to verify identity directly with us and directly confirm that the agent has permission. A valid power of attorney may be accepted where applicable. We do not require notarization unless specifically required by applicable law, and we use authorization and verification information only to process the request and prevent fraud. If authority or identity cannot be reasonably verified, we will explain the additional information needed or why the agent request cannot be completed.

We do not knowingly sell or share the personal information of users under 16 without affirmative authorization. For a user under 13, authorization must come from a parent or legal guardian. For a user aged 13 through 15, authorization must come from the user. A user or guardian may later opt out, and we will wait at least 12 months before asking the user to opt in again unless the user initiates the request.

11.3 Complaints to Regulatory Authorities

Users may contact us or the DPO first so that we can investigate, but this is not required before making a regulatory complaint where applicable law provides a direct complaint right. Examples include:

· European Economic Area: the data-protection authority where the user lives or works, or where the alleged infringement occurred. The official list is available at https://www.edpb.europa.eu/about-edpb/our-members_en.

· United Kingdom: the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.

· California: the California Privacy Protection Agency at https://cppa.ca.gov/ or the California Attorney General consumer complaint channel at https://oag.ca.gov/contact/consumer-complaint-against-business-or-company.

· Other locations: the privacy, consumer-protection or data-protection authority responsible for the user's country or region.

We will not retaliate or discriminate against a user for making a good-faith complaint or cooperating with a regulator.

12. Account and Data Deletion

If a Service allows users to create an account, users can request deletion both inside and outside the Service.

12.1 In-App Request

Open the relevant Service and use the readily discoverable Delete Account option in the account or settings area. The exact menu name may vary by Service. If the Service provides an in-app link to the web deletion resource instead, open that link and follow the instructions to submit the request.

12.2 Web Request

Submit a request at:

https://jpu1oc1fkp.feishu.cn/wiki/MLFTwuVE4iVTZfkb3eBcqSGVnfe?sheet=812eb8

Alternatively, email zbpujun@163.com with the subject "Account Deletion Request" and provide:

· information identifying the relevant Service; and

· only the player ID or account information needed to identify the account.

12.3 What Will Be Deleted

After verification, we will delete the account and associated personal data, including:

· account profile information;

· account-linked game progress and service records;

· account-linked identifiers; and

· other personal data associated with the account.

Deletion will generally be completed within 30 days after successful verification of the request, unless a shorter period is required by applicable law. We may retain limited records only where necessary for security, fraud prevention, dispute resolution, accounting or legal compliance. Any retained information will be isolated, protected and deleted when the retention obligation ends.

Disconnecting a Google, Facebook or other third-party account only revokes that provider's connection. It does not itself delete information held by us unless the deletion process above is also completed.

13. Children's Privacy and COPPA Controls

Unless a specific store listing expressly identifies a child-directed experience, the covered Services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal data from children under 13 without legally valid parental consent.

13.1 Neutral Age Screen

Where age screening is used, a neutral age or birth-year prompt appears before personalized advertising, optional analytics or account features are enabled. The prompt does not suggest that a user should enter an older age and does not store a full birth date when an age-band result is sufficient.

13.2 Under-13 and Guardian Flow

If the age screen indicates that the user is under 13, or the applicable local minimum age, the Service switches to a child-restricted mode. Personalized advertising, advertising-ID access, cross-app tracking, third-party login and non-essential analytics are disabled before the relevant SDKs initialize. Only data reasonably necessary for internal operations or to obtain consent may be processed.

If a child-directed account or feature requires personal information, the Service first requests a parent or guardian email address solely to send a direct privacy notice and consent request. The notice describes the data, purposes, recipients, retention and available controls. The guardian must return a signed consent form or complete another legally accepted verifiable parental-consent method before collection begins. Support staff verify that the consent applies to the relevant child account and record only the minimum evidence needed to demonstrate consent. If consent is not completed, the feature remains unavailable and the pending contact information is deleted within a reasonable period.

13.3 Parent and Guardian Rights

A verified parent or guardian may contact zbpujun@163.com with the subject "Child Privacy Request" to review the child's personal information, request deletion, refuse further collection or revoke consent. We will verify the requester's authority using only the minimum information necessary, disable the affected processing while a valid revocation is handled and notify relevant processors to delete the data where required.

13.4 Children's Advertising Controls

In child-restricted mode, only contextual or otherwise legally permitted advertising may be shown. SDK child-directed-treatment flags, maximum-content-rating controls and non-personalized-ad settings must be enabled. Interest-based advertising, remarketing, profiling, advertising-ID collection and sale or sharing for cross-context behavioral advertising are disabled. If an advertising provider cannot reliably honor these settings, it must not load in child-restricted mode.

If you believe a child has provided personal data without appropriate authorization, contact zbpujun@163.com. We will investigate promptly, suspend non-essential processing and delete the information where required.

The app's target-audience declaration, advertising SDK configuration and age-related experience must remain consistent with this section and Google Play's Families requirements.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Service, data practices or legal requirements. For a material change, we will provide notice through the Service, email where available or another prominent channel at least 30 days before the change takes effect, unless an earlier change is required to address an urgent security risk or binding legal obligation.

The notice will summarize the material change, the effective date and the available choices. If a new purpose requires consent, it will not apply to a user who refuses consent. A user who does not accept a material change may stop using the affected Service, withdraw optional consent, export available game data and request account and data deletion before the new version takes effect. Refusing an optional new purpose will not affect unrelated core functions where those functions can reasonably continue without the new processing.

14.1 Language Versions

We may provide this Privacy Policy and privacy notices in multiple languages to improve accessibility. Users should be shown a version appropriate to the language selected in the Service or device settings where a translation is available. Material changes should be reflected in supported translations at or before the time the updated Policy becomes effective.

Translations are intended to communicate the same rights, purposes, data categories, retention periods and contact methods as the English version. If a translation conflicts with the English version, the English version controls to the extent permitted by applicable law. Where local law requires a local-language notice or gives that notice mandatory effect, the locally required version controls for users covered by that law. Users may request clarification or another available language version by contacting zbpujun@163.com.

15. Contact Us

For privacy questions, complaints or requests, contact:

Developer: Crazy Axiu

Legal entity / registered name: Crazy Axiu

Registered and operating contact address: Available to verified legal or regulatory requesters through the email below

Email: zbpujun@163.com

Data Protection Officer: Data Protection Officer, Crazy Axiu

DPO email: zbpujun@163.com

Complaint acknowledgment: Within 10 business days

Covered services: Games, applications, websites and related services published or operated by Crazy Axiu