Privacy Policy

This Privacy Policy describes how neowire GmbH ("neowire", "we", "us", "our") processes personal information when you use the Flikk website, mobile apps and related services (collectively, the "App"). It explains what we collect, how we use and share it, how long we keep it, and the rights you have over it.

You can access this Privacy Policy at any time at https://getflikk.com/privacy or in the App under "Privacy & data" ("Your Privacy Choices" in the United States).

Last updated: October 29, 2026

Who We Are

neowire GmbH (full contact details in the imprint at https://getflikk.com/imprint) is the entity responsible for personal information collected through Flikk. In EU and UK terminology, neowire is the "controller" of your personal information. In US terminology, neowire is the "business."

This Privacy Policy covers Flikk. neowire also supplies games to other companies' apps, websites and services; the notice for that is at https://neowire.ai/partner/privacy and it does not apply to your use of Flikk.

If you have questions about this Privacy Policy or about our handling of your personal information, please contact us by email at privacy@neowire.ai or by post at the address in the "Contact" section below.

Data Protection Officer

We have appointed an external data protection officer. You can contact him directly about anything in this Privacy Policy; you do not have to come through us first.

• Nils Möllers, Keyed GmbH, Siemensstraße 12, 48341 Altenberge, Germany
• Email: info@keyed.de

Where Flikk Is Available

Flikk is offered to users in Germany, Austria, France and Spain, the United Kingdom and the United States. We do not direct, market, or make Flikk available anywhere else. If you are located outside those countries, please do not register for or use the App. If you become aware that a person located elsewhere has registered for Flikk, please contact us at privacy@neowire.ai so that we can close the account.

Wherever you use Flikk from, our infrastructure is operated by neowire GmbH from Germany, and personal information collected through Flikk is stored on servers located in the European Union — see "Where Your Personal Information Is Processed" below.

If you are visiting our website from another country. Our website at https://getflikk.com is reachable worldwide, and visitors from countries where Flikk is not offered are shown a notice that Flikk is not available in their country. If you only browse the website without registering, the sole personal information we process about you is the technical data described under "Server Log Files" below, together with the strictly necessary storage described under "Cookies and Information Stored on Your Device". We do not analyse your visit, we set no analytics or advertising cookies, and we do not build a profile of you. Because we are established in Germany, the GDPR governs that processing wherever you are — see "Annex A — Provisions for Users in the EU/EEA" below — and you can contact us at privacy@neowire.ai to exercise the rights it gives you.

Regional Provisions — Please Read

The general provisions in this Privacy Policy apply to all users of Flikk. In addition, depending on where you are located, further rights and obligations apply under your local data-protection law. Please also consult the annex that applies to you:

• Users in the EU/EEA — see Annex A: Provisions for Users in the EU/EEA
• Users in the United Kingdom — see Annex B: Provisions for Users in the United Kingdom
• Users in the United States — see Annex C: Provisions for Users in the United States

Because we are established in Germany, the GDPR applies to everything this Privacy Policy describes, wherever you are (Art. 3(1) GDPR). The rights in Annex A are therefore available to every user, in addition to the rights in the annex for your own country; where the two overlap, you may use whichever is more favourable to you. Where regional and general provisions appear to conflict, the regional annex prevails for users covered by it.

General Provisions

What Is Personal Information?

Personal information is any information relating to an identified or identifiable natural person (Art. 4(1) GDPR). This includes obvious details such as your email address or nickname, but also technical identifiers such as your IP address, your advertising ID or a pseudonymous user identifier, because these can be linked to a person — where necessary in combination with other information.

Pseudonymous data — for example usage data we hold under an identifier rather than under your name — remains personal information and is treated in accordance with this Privacy Policy. Anonymous data, which neither we nor any third party can link back to you (for example aggregated statistics or totals), is not subject to data protection law or to this Privacy Policy; we may continue to use such data for statistics and reporting, including after your account has been deleted.

Server Log Files

Each time our website or app back end is accessed, an automated system collects data and stores it in our server log files. The following may be collected: browser type and version used; the operating system of your device; your internet service provider; your IP address; the date and time of access; the page or endpoint requested and the page previously visited (referrer); and the volume of data transferred together with the delivery status code.

This data is technically necessary in order to deliver the website and the App to you, to ensure their stability and security, and to detect and defend against attacks. It is not stored together with the other personal information held for your account, and we do not use the log files to identify you as a person. IP addresses in server logs are deleted after 30 days (see "How Long We Keep Your Personal Information").

Cookies and Information Stored on Your Device

Both the website and the App store information on your device, or access information already stored there. In Germany, whether that storage and access is permitted is governed by § 25 TDDDG (Telecommunications Digital Services Data Protection Act, formerly the TTDSG); the subsequent processing of any personal information obtained is governed by the GDPR. In the other EU/EEA states the national implementations of Art. 5(3) of Directive 2002/58/EC apply; in the United Kingdom, Regulation 6 PECR applies.

On the website: the only storage we use is strictly necessary to deliver the site you asked for (§ 25(2) no. 2 TDDDG). That is the NEXT_LOCALE cookie, which remembers your language selection. We use no analytics cookies, no advertising cookies and no tracking pixels on the website, and there is therefore no cookie consent banner — there is nothing to consent to. You can block or delete cookies in your browser settings at any time; if you do, the site will simply stop remembering your language.

In the App — strictly necessary (§ 25(2) no. 2 TDDDG, no consent required): your sign-in session (Firebase Authentication), your language and currency settings, your consent status — including, in the EU/EEA and the UK, the record of the choices you made on the advertising consent screen (see "In-app advertising" below) — the user ID our purchase provider RevenueCat keeps on your device so that a purchase is credited to the right account (see "Flikk Tokens"), and technical information needed to deliver the content you asked for.

In the App — consent-based (§ 25(1) TDDDG): access to the device identifiers described under "Personal Information We Collect", including the Advertising ID (GAID/IDFA) and the identifiers set by our analytics and advertising SDKs, for the data flows described under "Advertising". The same consents decide whether our purchase provider receives those identifiers — see "Flikk Tokens". This takes place only where you have given the relevant consent in the App (Settings → Privacy & data → Your consents) — in the EU/EEA and the UK, for in-app advertising, on the consent screen described under "In-app advertising" — and on iOS, only where you have also accepted the App Tracking Transparency (ATT) prompt. You can reset or withhold the advertising identifier at any time in your device settings: on iOS by declining or revoking the ATT prompt for Flikk, and on Android by enabling "Delete advertising ID". See "How to opt out" for the full set of advertising choices.

You can withdraw any consent at any time with effect for the future, in the App under Settings → Privacy & data → Your consents. You can also delete the information stored on your device — for the App through your device's system settings, and for the website through your browser settings. If strictly necessary storage is deleted or blocked, some functions may not work, or may not work fully.

Personal Information We Collect

We collect the following personal information when you use Flikk. Where relevant, the corresponding category under the California Consumer Privacy Act ("CCPA") is shown in parentheses for the convenience of US users.

Authentication. We use Firebase Authentication (provided by Google Ireland Limited) to authenticate you. Where you register via email, your password is collected and stored by Firebase Authentication, not by us; we never see, store or have access to your password.

You provide directly when you register or use the App:

• Email address, nickname and avatar (both shown to other users — see "Your Profile and Social Features"), age range and gender (CCPA: identifiers; customer records information). Where your device's operating system shares it with the App (Apple Declared Age Range, Google Play Age Signals), the age range your device reports, which the App reads on your device when you register.
• If you contact us or use the AI support chat: the content of your message (CCPA: contents of communications between you and us as the intended recipient).
• If you speak a game description or a change instead of typing it: a short recording of your voice, which is turned into text and not kept — see "Speaking instead of typing" under "Creating Your Own Game" (CCPA: audio information; contents of communications between you and us as the intended recipient).
• If you use the social features: the users you follow and who follow you, your friends and friend requests, the games you share with friends and the reactions to them; if you link Discord, your Discord user ID; if you vote in "Help improve Flikk", your votes (CCPA: identifiers; internet or other electronic network activity).
• If applicable, the email address used by you to receive payouts via Tremendous (CCPA: identifiers; commercial information).
• If you buy Flikk Tokens: which pack you bought, how many tokens it granted, when, and any refund the store made — see "Flikk Tokens" below (CCPA: commercial information).
• If your payout request is selected for additional verification and you are asked to verify your phone number: your phone number. We ourselves store only the verification result and a cryptographic hash of the number, not the number itself — see "Automated Decision-Making and Fraud Prevention" below (CCPA: identifiers).

Collected automatically when you use the App:

• Device identifiers including Firebase UID, Firebase App Instance ID and the Advertising ID (GAID/IDFA); push token (CCPA: identifiers).
• Technical information about your device: model and product name, operating system version, general device specifications, carrier name and country, platform (web, Android, iOS), language and currency settings (CCPA: internet or other electronic network activity).
• IP address allocated to your device (CCPA: identifiers; internet activity).
• Country and postal code, but not precise geolocation (CCPA: approximate geolocation).
• Information about your use of the App, such as which games you have played and how you played them, your reactions to games, games you have asked us to create, games you have reported, the rewards you have earned, the Flikk Tokens you have collected for playing, the points you have exchanged for Flikk Tokens, the tokens you have spent and your interactions with marketing communications (CCPA: internet activity; commercial information).
• Campaign attribution data (source, campaign name) when you install Flikk from a marketing channel (CCPA: internet activity).

We do not collect, and Flikk is not designed to collect, the following: precise geolocation; government identification numbers; financial-account numbers, debit-card or credit-card numbers; racial or ethnic origin; religious or philosophical beliefs; union membership; genetic or biometric data; health information; data concerning sex life or sexual orientation; any other special-category data under Art. 9 GDPR; or any other sensitive personal information as the CCPA defines it (see "Sensitive Personal Information" in Annex C). Please do not enter information of that kind into the AI support chat or into a game description — none of it is needed for either.

How We Use Your Personal Information

We use your personal information for the following purposes (the corresponding legal basis under EU and UK law is set out in Annex A, under "Legal Bases for Processing"):

• To provide and operate Flikk — set up and maintain your account, identify you, check from the age you confirm, and from the age range your device reports where it shares one, that you are old enough to use Flikk and, in the United States, apply the settings for users under 18 (see "Children and Users Under 18"), deliver the AI-generated games available to you, run the social features (your profile, follows, friends, leaderboards and the live feed), generate a game where you ask us to, sell you Flikk Tokens and credit them to your balance, calculate and pay out your rewards, act on the reports you send us about a game, process your support requests.
• To prevent fraud and protect Flikk — detect and prevent fraudulent activity, enforce our Terms of Service, ensure the technical security of Flikk (see "Automated Decision-Making and Fraud Prevention" below).
• To improve Flikk — analyse pseudonymous use of the App to understand how it is used and to improve our services. We do this only where you have given the relevant consent.
• To display advertising within the App — serve ads around and between games through AppLovin MAX, where you have given the relevant consent (see "Advertising" below).
• To send you marketing communications — send you marketing emails and push notifications and track your interactions with them, where you have given the relevant consent or, for emails about similar services to an existing user, where the law allows it without consent (see "Marketing Communications" below).
• To comply with our legal obligations — including tax retention obligations, and responses to lawful requests from authorities.
• To establish, exercise or defend legal claims.

AI-Generated Games

Every game in Flikk is generated by neowire using AI-based generation tools rather than built by hand. The finished games are stored on our servers and delivered to your device when you play them. We do not transmit your personal information to any third-party AI provider in connection with the games you play, and no AI provider receives information about which games you play or how you play them. Which games are presented to you is decided by our own systems. Where you ask us to create a game for you, a different flow applies and what you write does leave our infrastructure — that is described separately under "Creating Your Own Game" below.

If you report a game. Because the games are generated rather than written by hand, the App lets you report one you believe is unlawful, harmful, infringing or otherwise wrong — whether we generated it on our own initiative or another user asked us to build it. We process what you tell us, which game it concerns, and which account the report came from (CCPA: contents of communications between you and us as the intended recipient). We keep the report linked to your account so that we can come back to you about it and so that we can tell a genuine report from an abusive one. We do not disclose your identity to the user who requested the game. What we may then do about a reported game is set out in our Terms of Service.

Playing Games

What we record while you play. When you play a game we record how the session went: which game it was, when you started and stopped, how far you got, scores and progress, in-game events, and technical signals about how the game ran on your device (CCPA: internet or other electronic network activity; commercial information). We use this to run the game, to save your progress, to determine the Flikk Tokens you collect for playing and, where the game was created from another user's idea, the points that user may receive for its plays, and to detect automated or manipulated play.

Reactions, and what you are shown next. You can react to a game with an emoji. Other users see only how many people reacted; the user whose idea the game was gets a notification with your nickname and your reaction. We use your reactions, together with what you have played, to choose which games to put in front of you (CCPA: internet or other electronic network activity). Your scores appear on leaderboards and in the live feed — see "Your Profile and Social Features".

How your rewards are determined. What you collect for playing on Flikk is Flikk Tokens; points go to the user whose idea a game was created from, when other users play it. Neither is a published rate per action: there is no set of tasks to complete and no fixed schedule of what a given activity pays. Our systems determine what, if anything, is credited to your account under the criteria in our Terms of Service: for tokens, your active play time in the session, with a value per minute that varies by game, country and time; for points, the genuine sessions in which other users play a game created from your idea, with a value per session that varies in the same way. Why we keep gameplay records beyond the individual session, and for how long, is set out in the table under "How Long We Keep Your Personal Information". What the reward mechanism is as a matter of contract is set out in our Terms of Service rather than here.

The determination is made by our systems without a person looking at each case. If you think a reward is wrong you can raise it with us and a person will look at it; the route is in our Terms of Service.

Advertising breaks. Our systems decide when an ad break fits, based on a natural pause in the game you are playing. That decision is about timing only: nothing about which ad you are shown is decided by us, and no gameplay information is sent to the advertising partners. What those partners do receive is described under "Advertising" below.

Your Profile and Social Features

Other Flikk users can see your profile and some of what you do in the App. Unless we say otherwise below, what is described in this section is visible only to people signed in to Flikk, not to the public.

Your profile. When you register, you choose a nickname and an avatar (an illustration you pick from generated designs, not a photo). Your nickname cannot be changed afterwards; your avatar can. Any Flikk user can open your profile, which shows your nickname, your avatar, the games created from your ideas, how often they have been played and how many followers you have. Choose a nickname that does not identify you if you would rather not be recognised.

What other users see of your activity.

• Leaderboards. Each game has a leaderboard of the top 50 scores, showing nickname, avatar and score. Your friends also see your best score on each game.
• Live feed. When you score in a public game, or a game created from your idea is published or changed, an entry with your nickname, your avatar, the game and your score can appear in the live feed other users see.
• Followers. Any user can follow you and see who follows you; you get a notification with the follower's nickname.
• Reactions. See "Playing Games".

There is no setting to keep your scores off the leaderboards or out of the live feed; they are part of how Flikk works.

Friends and messages. You can add friends by nickname, QR code or invite link, and send them games. A friend request shows the other person your nickname and avatar. Messages contain only the games you share and emoji reactions to them — there is no free text — and your friend can see when you have seen a message. Invite links run through our attribution provider Adjust, which sees the nickname in the link. You can remove a friend at any time.

Notifications about you. We notify your friends and followers when a game created from your idea is published, a friend when you beat their best score, and the user whose idea a game was when you react to it; each notification carries your nickname. You can turn each type of notification off in the App.

Why we do this. Showing your profile and activity to other users is part of the service described in our Terms of Service, so it rests on that contract (Art. 6(1)(b) GDPR).

Linking Discord (optional). If you have a game in Flikk, you can link your Discord account to join our creator community on Discord. Discord asks you to allow the link; we then store your Discord user ID, add you to our server and give you a creator role there. Discord (Discord Inc., USA) acts under its own privacy policy, https://discord.com/privacy. You can unlink in Settings; that removes the link at our end but not your membership of the server, which you can leave in Discord.

Help improve Flikk (optional). You can play two games built from the same brief by different AI models and vote for the better one. We record your vote with your user ID, the two games and how long you played each, and use it to decide which models build our games. No AI provider receives anything about you. We rely on our legitimate interest in improving our games (Art. 6(1)(f) GDPR).

On your device only. Your bookmarks and the blog posts you have read are kept on your device and are not sent to us.

Creating Your Own Game

You can describe a game you would like to exist and spend Flikk Tokens to have it built, and spend tokens again to change it afterwards. If we build it, the finished game is published in the App for all users to play, with your nickname shown as the person whose idea it is (your "idea credit"). The game itself is created by us.

What we process. The description you write and the rest of your conversation with the Flikk AI about the game (CCPA: contents of communications between you and us as the intended recipient — the same category as the AI support chat); the generated game itself, and any changes you ask for to it; the tokens you spent and any tokens refunded; and our decision on whether to build the game, including the reason where we decline (CCPA: commercial information). We keep the decision record so that we can answer a question about it later.

What else we use your description for. A description is there to describe a game, not you — which is why we ask you to leave personal information out of it. Besides writing the game brief your game is built from, we use descriptions to develop and improve our generation pipeline; to train, evaluate and improve AI models, ourselves or through service providers working on our instructions; to create games in our other products; and to promote Flikk, for example by quoting an idea in an app-store listing or on social media. When we quote a description, we never show your nickname or anything else about you with it. We rely on our legitimate interest in developing and promoting our products (Art. 6(1)(f) GDPR, see Annex A). You can object at any time (see "Your Rights as a Data Subject"): we then remove the link between your descriptions and your account, so that what remains is no longer information about you. The rights you grant us in your description are set out in our Terms of Service.

What you write leaves our infrastructure. To build the game, your description is sent to the AI provider that runs the generation. It is sent for the sole purpose of generating the game you asked for, under a contract that prohibits the provider from using it for its own purposes. Please do not put personal information about yourself or anyone else into a game description — none of it is needed to build a game. The provider is a United States company, and it passes your description on to the company that runs the AI model, which may process it in the United States or in another country outside the European Economic Area, depending on the model. That transfer is made on the basis of the EU Standard Contractual Clauses.

Speaking instead of typing. You can tap the microphone button and say your description, or a change to your game, instead of typing it. The App asks for access to your microphone the first time, and records only between your tap to start and your tap to stop, for at most one minute. The recording is sent to our AI provider to be turned into text, and the text is placed in the box for you to read and edit — nothing is submitted until you press send, and what you send is then handled exactly like a description you typed. Your recording is not kept anywhere. It is deleted from your device as soon as it has been sent or discarded; we do not store the recording or the text made from it on our servers; and it is sent only to speech-to-text services that keep no copy of what they receive and do not use it for their own purposes. The speech-to-text service is reached through the same AI provider, on the same contract and with the same transfer outside the European Economic Area as a typed description. We do not use your voice to identify you, and we create no voiceprint from it. What we keep is a technical record that a transcription took place — when, how long the recording was and what it cost — and never what you said. You can withdraw microphone access at any time in your device settings; typing works without it.

Your idea credit is public, and it cannot be un-seen. A published game carries your nickname as its idea credit, visible to every other Flikk user and to anyone who opens a share link to it. You can make a game private yourself, and public again, at any time in the App (under "Your Games", or in the Creator studio): a private game is no longer shown to other users, only you can still play it, and its share links stop working. You can also ask us to remove your idea credit from a game by writing to help@getflikk.com, and we anonymise the credit if you delete your account — but making a game private does not reach what has already been seen or shared: other users have already played it, and copies or recordings made by other people are beyond our reach. If you would rather not be credited, do not request a game.

If you delete your account. A game created from your idea stays in the App, because other users are playing it. What we remove is the link between the game and you: the idea credit is anonymised, so the game remains playable but is no longer shown as yours, and the record connecting it to your account is erased with the rest of your account data after the 30-day grace period described under "How Long We Keep Your Personal Information". Your descriptions stay too, because the game and any later change to it are built from them and we use them for the purposes described above; what we erase is the link between them and your account, so that what remains is no longer information about you. Tokens you spent on a game are not refunded when you close your account. The contractual side of this is in our Terms of Service.

Flikk Tokens

Flikk has two balances. Points are what you earn when other users play a game created from your idea, or under some promotional programs, and they are what gift cards cost; points you earned by playing before October 26, 2026 stay in your balance. Flikk Tokens are what you spend to have a game built or to change one you requested, and they can be used for nothing else. You collect tokens by playing games, and you can also buy a pack on the App's "Get tokens" screen, exchange points for them, or receive them in other ways the App offers, such as a welcome grant or a video you choose to watch on the "Get tokens" screen. The exchange only goes one way: tokens can never be turned back into points, into gift cards or into money. For every exchange we record how many points you gave and how many tokens you received (CCPA: commercial information).

Buying tokens

You can buy packs of tokens on the App's "Get tokens" screen. The purchase is made through the App Store or Google Play, which take your payment as the seller. We never receive your card or bank details, and neither does our purchase provider.

Our purchase provider, RevenueCat. RevenueCat checks your purchase with the store and tells our servers how many tokens to credit. Its software runs inside the App from the moment you sign in, whether or not you ever open the "Get tokens" screen. We set it up that way so that a purchase that completes later is still credited to your account, for example one approved through Ask to Buy, a delayed payment, or a purchase made on another device. While you are signed in, it receives your Flikk user ID, your IP address and basic information about your device and the App. If you buy, it also receives the store's record of the purchase (CCPA: identifiers; commercial information). It does not receive your name, your email address or anything about the games you play.

With your consent, your purchases are passed on for analytics and campaign measurement. If you have consented to analytics, the App gives RevenueCat the identifiers our analytics provider (Firebase) and our attribution provider (Adjust) already use for you. RevenueCat then reports each purchase and refund, with its value, to those two providers on our behalf (CCPA: identifiers; commercial information). If you have also consented to advertising, and on iOS accepted the App Tracking Transparency prompt, it also receives your Advertising ID (IDFA/GAID), your device's vendor identifier and your IP address. From there a purchase can reach our advertising partners as a conversion, in the same way as the other events described under "Marketing campaign measurement". If you withdraw a consent, the identifiers that depend on it are deleted from RevenueCat and nothing further is passed on.

What we keep. For each purchase we record the pack, the number of tokens, when the store reported it, and whether it was a test purchase. We record a refund the same way, as tokens taken back. If the store refunds a purchase after you have spent the tokens, they are still taken back, and your token balance can go below zero. We keep these records as part of our books — see "How Long We Keep Your Personal Information".

Advertising

Flikk uses two distinct forms of advertising data flows. Both are described here so you can understand what is shared, with whom, and how to opt out.

In the United States, neither takes place on the basis of a profile of a user under 18. If your device reports that you are 16 or 17, the App turns off your "Advertising" consent and keeps it off for two years from then, by which time you are 18. The advertising software then tells the demand partners with each ad request that you have opted out of the sale and sharing of your personal information, and the campaign measurement described below does not take place for you. You may still see ads selected without a profile of you, as described under "If you refuse". This means we do not sell or share your personal information (see Annex C); your analytics and marketing choices are unaffected. Outside the United States, users aged 16 and 17 make the choices described below like any other user.

In-app advertising (AppLovin MAX)

We use AppLovin MAX (provided by AppLovin Corporation), an ad-mediation platform, to display advertisements around and between games. AppLovin MAX connects to a range of advertising networks ("demand partners") that bid to serve ads to you.

When an ad is shown:

• AppLovin MAX and the participating demand partners receive your Advertising ID (GAID/IDFA), IP address, basic device information (model, operating system, language) and app-context information (e.g., that the ad is being shown in Flikk).
• They use this information to select and serve a relevant ad, to measure ad performance and frequency, and — where you have consented, or in the US where you have not opted out — for cross-context behavioral advertising (i.e., showing you ads based on your activity across other apps and websites).
• We receive ad revenue in return for ads being shown to you in Flikk.

Your choice before any ad is requested (EU/EEA and UK). If you are in the EU/EEA or the UK, the App asks for your choices on a consent screen after you have registered and before the advertising software is started. The screen is provided by Google, whose consent management platform is registered under the IAB Europe Transparency & Consent Framework (TCF), and it follows that framework: it lists the purposes for which the advertising partners want to store or read information on your device and to process your data — for example to select basic ads, to create a profile for personalised ads, or to measure ad performance — and the partners themselves, and lets you accept all of them, refuse all of them, or choose purpose by purpose and partner by partner. Refusing is as easy as accepting. Your choices are stored on your device as a consent record, which the advertising software reads and passes to the demand partners with each ad request, so that each of them knows what you allowed. Storing that record is strictly necessary to respect your choice and needs no consent of its own. You can reopen the screen and change your choices at any time under Settings → Privacy & data → Your consents ("Manage ad choices").

Loading the consent screen. To find out whether the consent screen has to be shown to you, the App asks Google once per session, after you have registered — wherever you are, so also in the United States, although there the screen is never shown to you. With that request Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) receives your IP address, the App's identifier and basic device and language information; from your location it decides whether a screen is required and, where it is, supplies it. Google acts as an independent controller for this, under its own privacy policy (https://policies.google.com/privacy). Legal basis: our legitimate interest in asking for your consent where the law requires it, and only there (Art. 6(1)(f) GDPR).

If you refuse. The advertising software passes your refusal on with each ad request. A partner may then not store or read information on your device, and may not use your data to personalise ads or to build a profile of you, for any purpose you refused. You may still see ads that are selected without a profile of you — on the basis of the App and the moment — or, where no partner can serve one within the choices you made, no ad at all. Refusing does not change what you can earn or which games you can play.

Who is responsible for what. The advertising software that collects your data runs inside Flikk because we put it there, so for the collection of your data in the App and its transmission to AppLovin and the demand partners we and they are jointly responsible (joint controllers under Art. 26 GDPR). What each partner does with the data once it has received it — selecting, serving and measuring ads, and building or using advertising profiles — it decides alone, as an independent controller under its own privacy policy. Between us, we are responsible for telling you about the collection (this Privacy Policy), for asking for your consent and for passing your choices on; each partner is responsible for respecting those choices and for its own processing. You can exercise your rights against us or against any of them; a request that concerns a partner's own processing we will pass on to it. One demand partner takes part differently: Digital Turbine acts for its DT Exchange as our processor (Art. 28 GDPR), on our instructions, and it is the buyers on its exchange that are in the position just described.

For US users, this is both a "sale" and a "sharing" of personal information under the CCPA — see "Sale and Sharing of Personal Information" in Annex C.

The current list of AppLovin MAX demand partners we use is available at https://getflikk.com/partners. The list is updated as partners are added or removed. In the EU/EEA and the UK, the consent screen shows the full list of partners that take part in the framework.

AppLovin's privacy policy is available at https://www.applovin.com/privacy/.

Marketing campaign measurement

To measure the performance of our advertising campaigns and to find new users similar to those who already enjoy Flikk, we work with advertising and attribution partners. These partners receive limited information about your install and certain in-app events (such as registration, first reward earned or a token purchase, with its value), which they use both on our behalf — to measure the performance of our campaigns — and on their own behalf — to improve their advertising and audience models, including to identify similar audiences for our future campaigns. For the on-their-own-behalf use, these partners act as joint controllers with us.

The data transmitted is limited to pseudonymous identifiers (such as your Firebase App Instance ID, your Advertising ID, or a hashed installation token) and event names, together with the value of a token purchase. We do not transmit your email address, account information, or gameplay history to these partners. The data flows through our analytics provider (Firebase) and our attribution provider (Adjust) — token purchases reach them through our purchase provider, RevenueCat — which forward conversion events to our advertising partners on our behalf.

This takes place only where you have given the "Advertising" consent in the App (Settings → Privacy & data → Your consents) — except for token purchases, which are reported where you have given the "Product analytics" consent, as described under "Flikk Tokens". For US users, it is also a "sharing" of personal information for cross-context behavioral advertising under the CCPA.

Who is responsible for what. When the partners measure our campaigns, they act on our behalf. For their own-behalf use — improving their advertising and audience models — we and each partner are jointly responsible (joint controllers under Art. 26 GDPR). Between us, we are responsible for deciding which events are shared and limiting them to the data described above, for asking for your "Advertising" consent and stopping the sharing when you withdraw it, and for telling you about it (this Privacy Policy); each partner is responsible for its own-behalf use of the data it has received, including how long it keeps it, which its own privacy policy sets out. You can exercise your rights against us or against any of them; a request that concerns a partner's own-behalf use we will pass on to it.

The current list of advertising and attribution partners is available at https://getflikk.com/partners.

How to opt out

You can withdraw your consent to, or opt out of, both forms of advertising data flow at any time by:

• changing your choices in the App's privacy settings (Settings → Privacy & data → Your consents) — turning off "Advertising" stops the conversion sharing the App does with our marketing partners and stops personalised ads — a token purchase can still reach them as a conversion while "Product analytics" is on, so turn that off too to stop it (see "Flikk Tokens"); in the EU/EEA and the UK, the same place reopens the consent screen described under "In-app advertising" ("Manage ad choices"), where you can refuse the advertising purposes and partners, and see "If you refuse" for what you are shown then;
• on iOS, declining or revoking the App Tracking Transparency (ATT) permission for Flikk;
• on Android, enabling "Delete advertising ID" (or the equivalent setting) in your device settings;
• in the US, sending a "Do Not Sell or Share" request to privacy@neowire.ai.

Withdrawing a consent does not affect the lawfulness of what took place before you withdrew it.

Who We Share Your Personal Information With

Recipients acting on our behalf (service providers)

We use the following recipients to help us provide Flikk. They process personal information on our behalf under written contracts that require them to process the data only on our instructions, to keep it confidential, to implement appropriate security measures, and to engage sub-processors only with our authorisation. For US users, every recipient in this section is a service provider or contractor under the CCPA, so disclosing personal information to them is neither a "sale" nor a "share". The flows that are a sale or a share are the advertising ones, described under "Advertising" and "Sale and Sharing of Personal Information".

We name a provider where naming it is what makes this notice useful to you: because you deal with it directly, because its technology stores or reads something on your device, or because its own notice governs part of what happens to your data. For everything else we give the category of provider rather than the company, which is what data-protection law asks of a privacy notice. You have the right to be told the actual identity of the recipients, not only their categories (Art. 15(1)(c) GDPR). If you want to know which specific provider handles a given category, ask us at privacy@neowire.ai and we will tell you, free of charge, within one month.

Named:

• Firebase Authentication (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — Authenticates you and holds your password, which we never see, together with the social-login plumbing. https://firebase.google.com/support/privacy
• Firebase Analytics (Google Ireland Limited) — App analytics, and the source of the conversion events reported to Google Ads for campaign measurement (see "Marketing campaign measurement" above). It reads and stores identifiers on your device under your consent. https://firebase.google.com/support/privacy
• Adjust (Adjust GmbH, Saarbrücker Str. 38a, 10405 Berlin, Germany) — Mobile analytics and attribution. It reads on-device identifiers under your consent and forwards conversion events to our advertising partners on our behalf. Data is processed within the EU. https://www.adjust.com/terms/privacy-policy/
• Prelude (DING NEGOCE SAS, 82 rue Dutot, 75015 Paris, France) — Phone (SMS) verification. Its SDK inside the App is what sends you the verification code, so you deal with it directly. We do not store your phone number: we retain only the verification result and a cryptographic hash of the number, which lets us detect duplicate accounts. Data is processed within the EU. https://prelude-so.notion.site/Privacy-Policy-2c60b602719a80d8944cf5ca632dadea
• Tremendous (Tremendous, LLC, 228 Park Ave S #62949, New York, NY 10003, USA) — Issues your gift cards and reward payouts and emails them to you, so you deal with it directly. Your payout email address is transmitted. https://www.tremendous.com/privacy
• RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA) — Handles in-app purchases of Flikk Tokens. We name it because its software runs inside the App on your device from the moment you sign in. It receives your Flikk user ID, your IP address, basic device and app information and, when you buy, the store's record of the purchase. With your consent, it also receives the identifiers described there and passes your purchases on to our analytics and attribution providers. Data is processed in the United States. See "Flikk Tokens" above. https://www.revenuecat.com/privacy
• Sentry (Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) — Error and performance diagnostics. We name it because its script is loaded into your own browser on the web pages we serve you: the AI support chat (support.getflikk.com) and the account management page — see "Account Management Page" below. On the support chat it receives the address of the page you are on — including the chatId parameter that identifies a conversation, but not the access token, which we keep in the part of the address that browsers never transmit — technical information about your browser and device, page-load and navigation timing for every visit, and, when something goes wrong, the error together with the console output and the network calls that led up to it. Your IP address reaches Sentry's servers because your browser connects to them directly, but "Prevent Storing of IP Addresses" is enabled on all our Sentry projects, so it is not stored with the report. Your session is not recorded. Data is processed in Sentry's EU region. https://sentry.io/privacy/

By category:

• Our cloud hosting provider (EU) — Hosting, databases and storage. Your account data is held on its servers in the European Union. Support access from outside the EEA rests on the EU–US Data Privacy Framework and the Standard Contractual Clauses.
• Our content delivery and network security provider (EU and US) — Carries the App's traffic and defends it against attack. It handles your requests in transit and keeps short-lived request logs — see "Where Your Personal Information Is Processed". Transfers to the United States rest on the EU–US Data Privacy Framework and the Standard Contractual Clauses.
• Our AI providers (EU, US and other countries) — Generate the answers in the AI support chat, generate a game where you ask us to create one, and turn a description you speak into text. Transfers to the United States rest on the EU–US Data Privacy Framework or the Standard Contractual Clauses. See "AI Support Chat" and "Creating Your Own Game".
• Our fraud-detection and account-verification providers (EU and US) — Assess selected payout requests for signs of fraud and for links to other accounts, and return a risk score and supporting signals. Transfers outside the EEA rest on the Standard Contractual Clauses. See "Automated Decision-Making and Fraud Prevention".
• Our transactional email provider (EU) — Sends account emails and, where you have consented, marketing emails.
• Our monitoring provider (EU) — Receives the technical telemetry and logs we use to keep the App running.
• Our internal alerting tool (US) — Receives our engineers' error alerts. Transfers rest on the provider's binding corporate rules under Art. 46(2)(b) GDPR.
• The AI assistant our staff use (US) and our staff email and identity systems (EU and US) — The tools our own people work in when they handle your support request or administer your account. Transfers rest on the Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

The last four categories exist to keep the App running. We do not hand them your account record; what reaches them is what our systems write into a log line or an alert — a request, an error, an identifier — for the periods in the table under "How Long We Keep Your Personal Information".

Recipients acting on their own behalf (independent controllers / third parties)

The following recipients process personal information as independent data controllers (or, in US terms, independent businesses / third parties), because they use the data for their own advertising or service purposes. For these recipients you should consult their own privacy policies for full information.

• AppLovin and its mediated demand partners — In-app advertising. Jointly responsible with us for the collection of your data in the App and its transmission to them, and independent controllers for what they do with it afterwards. See "Advertising" above. Current list at https://getflikk.com/partners.
• Google (Google Ireland Limited) — Provides the consent screen for in-app advertising and decides, from the request the App makes once per session, whether it has to be shown to you. See "Loading the consent screen" above.
• Marketing and attribution partners — Cross-context behavioral advertising for our user-acquisition campaigns, as joint controllers with us for their own-behalf use. Current list at https://getflikk.com/partners.
• Social login providers (Google, Apple) — Where you use social login to register. Each provider acts as an independent controller for the processing it performs on its own platform.
• Discord (Discord Inc.) — Only if you link your Discord account; see "Linking Discord" above.
• App Store and Google Play (Apple, Google) — When you buy Flikk Tokens, the store sells you the pack, takes your payment and handles any refund under its own terms and privacy policy. You deal with the store directly.

Other recipients

We may also disclose personal information:

• to public authorities where required by law (for example, law enforcement, regulators, tax authorities);
• to professional advisors (lawyers, accountants, auditors) under confidentiality obligations, where necessary for the establishment, exercise or defence of legal claims;
• in connection with a corporate transaction (sale, merger, restructuring or insolvency), in which case customer information may be transferred with the relevant part of the business;
• to anyone you send a share link to. If you share a game from Flikk, the page that opens shows your nickname ("Shared by @…") together with your avatar, above the game you shared, and your score if you shared one. Nothing else from your account — not your email address, your balance, your gameplay history or the points you have spent — appears on a share page. Anyone holding the link can open it, and link previews may be generated by the messaging or social platform you send it through, so please only share links with people you intend to.
• to other users of the App. Your profile, your scores on leaderboards and your entries in the live feed are shown to other signed-in users — see "Your Profile and Social Features". A game you ask us to build is published with your nickname shown as the person whose idea it is. That is a deliberate publication, it reaches people we do not control, and it cannot be undone afterwards — see "Creating Your Own Game" above, which sets out what that means before you decide to request one.

Account Management Page (getflikk.com/usermgmt)

The "account management" page (/usermgmt) handles the links in our account emails — for example resetting your password, confirming your email address, or reversing an email change. It is only opened when you click such a link; it is not part of an ordinary visit to the website and is blocked from search engines.

Two third-party scripts are loaded on this page, without which the function cannot be provided:

• Firebase JavaScript SDK, loaded from www.gstatic.com (a content delivery network operated by Google LLC). The SDK carries out the account action you requested against Firebase Authentication. In doing so, the one-time code contained in your email link is processed, along with your IP address and technical information about your browser.
• Sentry, loaded from js-de.sentry-cdn.com (Functional Software, Inc., d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA; processed in Sentry's EU region). Sentry is used solely for error diagnostics: if a technical error occurs on this page, the error message, the address requested and technical information about your browser and device are transmitted to Sentry so that we can fix the cause. Your IP address necessarily reaches Sentry's servers because your browser connects to them directly, but the "Prevent Storing of IP Addresses" setting is enabled on our Sentry projects, so it is not stored with the error report. Sentry is enabled for error reporting only: your session is not recorded, and no usage or performance data is transmitted — data is sent only when an error actually occurs.

Where Your Personal Information Is Processed

Flikk's core infrastructure is operated by neowire GmbH from Germany, and personal information about every Flikk user, wherever they are, is stored on Google Cloud servers located in the European Union. There are two exceptions. Our content delivery and network security provider handles your requests at the edge location nearest to you — in the United States if you are there — and its short-lived request logs may sit in a US data centre whichever country you are in. And where you ask us to create a game, what you write or say is sent to the AI provider that generates it, a United States company, and the AI model that does the work may run in the United States or in another country outside the European Economic Area. Storage of your account data stays in the European Union.

Some of the recipients described above are located outside the European Economic Area. Where personal information about you is transmitted to them, the transmission is made from our EU-based infrastructure and rests on one of the following safeguards under Chapter V of the GDPR — an adequacy decision of the European Commission, which includes the EU–US Data Privacy Framework for recipients certified under it, or the European Commission's Standard Contractual Clauses together with supplementary measures where required:

Your consent is not what makes these transfers lawful. The advertising transfers take place only where you have given your consent, but that consent decides whether the advertising happens at all; the transfer itself rests on the safeguards in the table, not on a consent derogation under Art. 49(1)(a) GDPR. You are not obliged to give that consent: you can use Flikk without it, and you can withdraw a consent you have given at any time with effect for the future (Settings → Privacy & data → Your consents). For transfers from the United Kingdom, the safeguards are set out in Annex B.

You can ask us for a copy of the safeguards that apply to a particular transfer at privacy@neowire.ai.

How Long We Keep Your Personal Information

We store personal information only for as long as we need it for the purposes for which it was collected, or for as long as we are permitted or required to by law. The following retention periods apply:

If you request the deletion of your account, the deletion is scheduled for execution after a 30-day grace period during which you may cancel the request. After that period your personal information will be permanently erased from our systems and from those of our service providers, with the exception of data subject to the statutory retention obligations above (which is then restricted from further processing). Three things that erasure does not reach are named in the table above and are not statutory retention: your game descriptions, which we keep without the link to your account; our own analytics data warehouse, which is deleted in full on 1 December 2026; and the log and alert entries held by our monitoring and alerting providers until their retention periods run out.

How We Protect Your Personal Information

We implement appropriate technical and organisational measures to protect your personal information against loss, unauthorised access, alteration and misuse — including modern encryption in transit and at rest, access controls, logging, and regular review of our security posture. These measures are regularly tested and adapted to technological developments.

Where we use service providers to process your data, we contractually require them to maintain at least equivalent security measures. Authentication credentials (passwords) are managed by Firebase Authentication, not by us. No system can guarantee absolute security; we encourage you to use a strong, unique password and to protect your device against unauthorised access.

Automated Decision-Making and Fraud Prevention

We check sign-ins, play and payout requests for indicators of fraudulent activity — one person running many accounts, emulators, automation — using the information described in this Policy, such as your IP address, device information and how you play. We carry out these checks ourselves. For some payout requests we also ask our fraud-prevention provider Verisoul whether your account is linked to other accounts; it receives your user ID and returns the linked accounts it knows of. We retain the results alongside your account.

In addition, selected payout requests undergo enhanced verification before they are processed. Where your payout request is selected for review, we may: (a) transmit your email address to an account-verification provider, which analyses the digital footprint associated with the address and returns a risk score and underlying signals; and (b) ask you to verify your phone number, in which case the number is transmitted to our verification partner Prelude, which sends you a verification code and confirms the result. We retain the responses from these services (risk scores and signals) alongside your account. We do not store your phone number: once verified, we retain only the verification result and a cryptographic hash of the number, which lets us detect when the same number is used across multiple accounts without keeping the number itself.

These scores and signals are treated as inputs to our review, not as final decisions. No payout or account decision that produces legal effects concerning you, or similarly significantly affects you, is made solely on the basis of automated processing. Where the score indicates an elevated risk, a member of our staff reviews the case before any restrictive measure (such as suspension or refusal of a payout) is taken. You can ask us for human review, express your point of view and contest any decision in this context by contacting privacy@neowire.ai.

AI Support Chat

Description and purpose. In the contact section of the App, you can use our AI support chat to get assistance with your questions, so that enquiries can be answered quickly and efficiently. When you use the AI support chat, the content of your message is transmitted to our AI provider in order to generate a response. Your email address is not transmitted to the AI provider. The chat is powered by large-language-model providers acting as our service providers under contracts that prohibit them from using your data for their own purposes. If necessary, a human support agent may contact you via email to follow up on your issue.

Data processed. We process the content of your chat messages, including any personal information you choose to enter, together with technical information about your use (such as the time of the request and the connection data technically required for transmission). Where a technical error occurs on the chat page, the error, the page address and the console output leading up to it are also transmitted to Sentry for diagnosis — see Sentry under "Who We Share Your Personal Information With".

Where it is processed. Our contractual partners for the AI support chat are established in the European Union, and the chat is operated from our EU-based infrastructure. Where they rely on sub-processors outside the EU/EEA in providing their services, this only takes place subject to the safeguards under Chapter V GDPR — see "Where Your Personal Information Is Processed".

Retention. Chat content is deleted 3 months after the support interaction (see "How Long We Keep Your Personal Information"), and otherwise as soon as it is no longer needed for the purpose for which it was collected.

Voluntary. Using the AI support chat is voluntary; you are under no obligation to provide us with this data and can instead email our support team at help@getflikk.com at any time. Please do not enter your password or other credentials into the chat, and please do not enter sensitive personal information (such as health information) — none of it is needed in order to deal with your matter.

Contacting Us by Email and Post

If you contact us by email (privacy@neowire.ai) or by post, we process the information you send us — in particular your email address or postal address, your name where you provide it, and the content of your message — solely in order to deal with your matter and in case of any follow-up questions. It is not passed on to unauthorised third parties. We delete the correspondence once your matter has been finally resolved and no statutory retention obligations apply; the retention periods are set out in the table under "How Long We Keep Your Personal Information".

Please note that emails are generally sent unencrypted and that we cannot accept responsibility for the transmission path between you and receipt on our server. You should therefore not send us sensitive information by unencrypted email.

Marketing Communications

We may send you marketing emails and push notifications where you have given the relevant consent, and marketing emails about similar services to the email address of an existing user where the law allows it without consent — see "Marketing under § 7(3) UWG" in Annex A and "Cookies and Marketing under PECR" in Annex B. We may track your interactions with those communications to improve their relevance. So that we can demonstrate the basis on which we contacted you (Art. 7(1) GDPR), we record which consent you gave or withdrew and when. You can unsubscribe from marketing communications at any time using the link in any marketing email, or in the App settings, or by contacting us at privacy@neowire.ai; unsubscribing is free of charge and requires no reason. Even after unsubscribing, we may still send you transactional messages (such as payout confirmations) that you cannot opt out of while you have an active account.

Children and Users Under 18

Flikk is intended for users aged 16 or over. You confirm that you are at least 16 when you register, and where your device's operating system shares an age range with the App, the App reads that too. We use them to check that you are at least 16 and, in the United States, to apply the setting below.

Children under 16. We do not knowingly collect personal information from anyone under 16. If your device reports that you are under 16, you cannot register. If we learn that an account belongs to someone under 16, we close it and delete its personal information, except what the law requires us to keep, such as the tax records listed under "How Long We Keep Your Personal Information". If you believe that a child under 16 has provided us with personal information, please contact us at privacy@neowire.ai so that we can delete it.

If you are 16 or 17, this Privacy Policy applies to you as it does to any other user — including the social features described under "Your Profile and Social Features", so choose a nickname that does not identify you — and you make the choices described under "Advertising" and in "Consents We Ask For" in Annex A yourself. In the United States there is one difference: if your device reports that you are 16 or 17, the App turns off your "Advertising" consent and keeps it off for two years from then, by which time you are 18, so we do not use your personal information for personalised advertising, and we do not sell or share it — see "Advertising" and Annex C.

You can exercise the rights described in this Privacy Policy yourself. Our Terms of Service require you to have the consent of a parent or guardian to use Flikk; a parent or guardian can also contact us at privacy@neowire.ai on your behalf.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The most current version is always available at https://getflikk.com/privacy and in the App under "Privacy & data" ("Your Privacy Choices" in the United States). If we make material changes, we will inform you through a notification in the App or via email. Where the changes require new consent, we will ask you to consent to the amended Privacy Policy again.

Contact

For any questions or to exercise your rights under this Privacy Policy, contact us at:

• Email: privacy@neowire.ai
• Post: neowire GmbH, Rheinpromenade 13, 40789 Monheim am Rhein, Germany

Annex A — Provisions for Users in the EU/EEA

This Annex applies to users located in the European Union or the European Economic Area. It supplements the General Provisions above. Because the GDPR applies to everything we do wherever you are (Art. 3(1) GDPR), the rights in this Annex are also available to users in the United Kingdom and the United States, in addition to the rights in their own annex.

Controller

The controller within the meaning of Art. 4(7) GDPR is neowire GmbH, Rheinpromenade 13, 40789 Monheim am Rhein, Germany.

Legal Bases for Processing

The legal basis for each purpose is:

For the storage of information on your device and access to information already stored there, § 25 TDDDG (or the relevant national implementation of Art. 5(3) of Directive 2002/58/EC) applies in addition to the legal bases above — see "Cookies and Information Stored on Your Device" in the General Provisions.

We do not process special categories of personal data within the meaning of Art. 9(1) GDPR. Please do not enter such data into the AI support chat or into a game description — none of it is needed for either.

Your Rights as a Data Subject

You have the following rights under the GDPR. To exercise any of them, contact us at privacy@neowire.ai or write to the address in the "Contact" section. You can also contact our data protection officer directly — see "Data Protection Officer" above. We may request proof of identity before acting on your request.

• Access (Art. 15) — confirmation of whether we process personal information about you, a copy of it, and the details of the processing: its purposes, its recipients, how long it is kept, where it came from, and the existence of any automated decision-making. If you ask, we will name the specific providers behind the categories used above, not just the categories. You can also ask whether your data is transferred to a third country, and be told the appropriate safeguards under Art. 46 GDPR for that transfer.
• Rectification (Art. 16) — correction of inaccurate information, and completion of incomplete information.
• Erasure (Art. 17) — deletion of your personal information, subject to the statutory retention duties in the table under "How Long We Keep Your Personal Information".
• Restriction of processing (Art. 18) — in the cases the Article sets out, for example while a correction request is being checked.
• Notification (Art. 19) — where you have obtained rectification, erasure or restriction, we tell every recipient to whom we disclosed your data, unless that proves impossible or would involve disproportionate effort. On request we will tell you who those recipients are.
• Portability (Art. 20) — a copy of the information you gave us, in a structured, commonly used and machine-readable format, or its transmission to another controller where technically feasible.
• Objection (Art. 21) — you may object at any time to processing we carry out on the basis of our legitimate interests, on grounds relating to your particular situation. Those purposes are marked Art. 6(1)(f) in the table under "Legal Bases for Processing". If you object we will stop, unless we can show compelling legitimate grounds that override your interests, or the processing is needed for legal claims. Where we process your information for direct marketing, you may object at any time and without giving a reason, and we will stop.
• Withdrawal of consent (Art. 7(3)) — where we process on the basis of your consent, you may withdraw it at any time, with effect for the future. Withdrawing does not affect the lawfulness of what we did before. The advertising and analytics consents can be withdrawn in the App under Settings → Privacy & data → Your consents, and marketing consent through the unsubscribe link in any marketing email.
• Not to be subject to automated decisions (Art. 22) — we do not take decisions producing legal effects concerning you, or similarly significantly affecting you, on a solely automated basis. See "Automated Decision-Making and Fraud Prevention" and "Playing Games".

Right to Lodge a Complaint with a Supervisory Authority (Art. 77)

You may complain to a supervisory authority, in particular in the Member State of your habitual residence or place of work or of the alleged infringement. Because we are established in Monheim am Rhein, the authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany — https://www.ldi.nrw.de

Consents We Ask For

When you use Flikk for the first time, you accept our Terms of Service. The processing needed to provide Flikk under them — your account, the games, Flikk Tokens, your rewards — rests on that contract (Art. 6(1)(b) GDPR) and is not a matter of consent. Everything below is optional, can be given separately, and can be withdrawn at any time with effect for the future; using Flikk does not depend on any of it.

1. Analytics. Processing of pseudonymous use data, and access to the identifiers our analytics SDKs set on your device, to analyse use of the App and improve our services, and the reporting of your token purchases described under "Flikk Tokens". Legal basis: Art. 6(1)(a) GDPR, with § 25(1) TDDDG for the device access. 2. Advertising. In-app advertising through AppLovin MAX and its demand partners, and the campaign measurement described under "Marketing campaign measurement", including access to your Advertising ID. For in-app advertising you give or refuse this on the consent screen described under "In-app advertising", purpose by purpose and partner by partner if you wish. Legal basis: Art. 6(1)(a) GDPR, with § 25(1) TDDDG for the device access. 3. Marketing communications. Marketing emails and push notifications, and tracking of your interactions with them. Legal basis: Art. 6(1)(a) GDPR.

The App also asks your device's own permission before it uses your microphone (only if you choose to speak a game description) and, on iOS, before it accesses your Advertising ID (App Tracking Transparency). Those are permissions of your operating system, which you can change at any time in your device settings. The website takes no consents of its own: it stores only what is strictly necessary and shows no cookie banner — see "Cookies and Information Stored on Your Device".

Marketing under § 7(3) UWG

In accordance with § 7(3) UWG (German Act against Unfair Competition), we may send marketing emails about similar products or services to existing users' email addresses, even without separate consent, provided that at the time we collected the email address we informed you and you did not object, and provided that each communication contains a free and easy opt-out option. You can object to such use at any time at privacy@neowire.ai or through the unsubscribe link in any such email.

Annex B — Provisions for Users in the United Kingdom

This Annex applies to users located in the United Kingdom. It supplements the General Provisions above. References to "GDPR" in this Annex mean the UK GDPR as supplemented by the Data Protection Act 2018.

Controller and UK Representative

The controller is neowire GmbH, address as above. As neowire is not established in the United Kingdom, we have appointed a UK representative pursuant to Art. 27 UK GDPR.

Our UK representative's contact details are:

• Name: Legal Nodes Ltd
• Address: Office 2, Bennet's House, 21 Leyton Road, Harpenden, England, AL5 2HU
• Email: neowire.uk.rep@legalnodes.com

Legal Bases for Processing

The legal bases under UK GDPR mirror those listed in Annex A (Art. 6(1)(a)–(f)). The UK GDPR has no equivalent of § 25 TDDDG and § 7(3) UWG; their place is taken by PECR, below. We do not process special categories of personal data within the meaning of Art. 9(1) UK GDPR.

Your Rights

Your rights under the UK GDPR substantially mirror those described in Annex A: access, rectification, erasure, restriction, notification of recipients, portability, objection (including objection to direct marketing without any need to give reasons), automated decision-making, and withdrawal of consent.

Right to Lodge a Complaint with the ICO

The competent supervisory authority for the United Kingdom is the Information Commissioner's Office (ICO) — https://ico.org.uk/. You may lodge a complaint with the ICO if you believe we have not complied with applicable UK data-protection law.

Cookies and Marketing under PECR

Regulation 6 PECR applies to the storage of information on your device and to access to information already stored there: where that storage or access is not strictly necessary in order to provide the service you have requested, we rely on your consent — see "Cookies and Information Stored on Your Device" and "In-app advertising" in the General Provisions.

Marketing emails and push notifications to UK recipients are governed additionally by the Privacy and Electronic Communications Regulations 2003 (PECR). Where permitted by Regulation 22(3) PECR (soft opt-in), we may send marketing about similar products or services to existing users without separate consent, provided that you were given the opportunity to object at the time we collected your email address and in each subsequent communication. You can opt out at any time using the unsubscribe link or by contacting privacy@neowire.ai.

International Data Transfers (from the UK)

For transfers from the United Kingdom to third countries, we rely on:

• UK adequacy regulations where they apply — this covers our transfers to recipients in the EEA, which is where our hosting, our email sending, our attribution provider and our phone-verification provider sit;
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs for transfers to the United States and other third countries — this is what carries our content delivery and network security provider, our monitoring providers, our internal alerting tool, the AI assistant our staff use, our staff email and identity systems, our AI providers (including the one that generates a game you asked for and turns a description you speak into text), the fraud-detection leg, Tremendous, RevenueCat, AppLovin and its demand partners, and our marketing and attribution partners;
• other legally recognised mechanisms where applicable.

Annex C — Provisions for Users in the United States

This Annex applies to users located in the United States. It supplements the General Provisions above, and it adds to Annex A rather than replacing it: the GDPR applies to what we do wherever you are, so you have the rights in this Annex and those in Annex A, and may use whichever is more favourable to you. Depending on your state of residence, your rights and our obligations are governed by the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), or by the comprehensive privacy law of your state. Which of the rights below you have depends on that law.

This Annex serves as our notice at collection for the purposes of the CCPA.

Categories of Personal Information We Collect

In the past twelve months, we have collected the following categories of personal information about US users:

• Identifiers — email address, nickname, device identifiers (Firebase UID, Firebase App Instance ID, Advertising ID), push token, IP address, pseudonymous user identifier, phone number (only where you are asked to verify it during a payout review; retained only as a cryptographic hash).
• Customer records information — age range, gender.
• Commercial information — rewards earned, Flikk Tokens collected for playing, points exchanged for Flikk Tokens, Flikk Tokens bought, spent and refunded, payouts requested and received, games played, games you asked us to create.
• Internet or other electronic network activity information — interactions with Flikk, your reactions to games, technical device information, language and currency settings, campaign attribution data, ad-interaction data.
• Geolocation data — country and postal code (not precise geolocation).
• Sensory information — a recording of your voice, only if you speak a game description or a change instead of typing it; it is turned into text and not kept.
• Professional or employment-related information — none.
• Education information — none.
• Inferences drawn from the above — limited, for the purpose of selecting and recommending games, determining rewards, and detecting fraud.

Sensitive Personal Information

The CCPA's category of "sensitive personal information" includes specific data types such as government IDs, account log-in credentials, precise geolocation, racial or ethnic origin, religious beliefs, health information, the contents of mail, email and text messages unless the business is their intended recipient, and data concerning sex life or sexual orientation. We do not collect sensitive personal information in that sense.

• What you send to us is not sensitive personal information. The messages you send to our AI support chat or to our human support agents, the description you write or speak when you ask us to create a game, and what you tell us when you report a game are addressed to us as their intended recipient, so the CCPA does not count them as sensitive personal information. We use them to handle your support request, to build the game you asked for and for the further purposes described under "Creating Your Own Game", and to act on your report.

We do not collect or store account log-in credentials, since authentication is performed by Firebase Authentication and your password is not visible to us.

We do not collect government IDs, financial-account numbers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data, health information, or data concerning sex life or sexual orientation.

Sources of Personal Information

We collect personal information from:

• You directly (when you register, set preferences, or contact us);
• Your device automatically (when you use the App, and from the strictly necessary cookie described under "Cookies and Information Stored on Your Device" when you visit the website);
• Social login providers (Google, Apple) where you choose to register via social login;
• Our service providers (our analytics, attribution, fraud-detection and account-verification, reward-issuance and purchase providers — for the purpose of operating Flikk; the purchase provider passes on what the App Store or Google Play reports about a purchase you made).

Purposes of Collection and Use

We use personal information for the purposes set out above and, in the language of US privacy laws, for the following business purposes: providing Flikk; auditing related to consumer interactions; detecting security incidents and protecting against fraudulent or illegal activity; debugging and repair; performing services on our behalf; serving and measuring advertising; internal research for technological development, including on game descriptions (see "Creating Your Own Game"), and quality assurance; complying with legal obligations.

Categories of Recipients

We disclose personal information to the categories of recipients listed in the section "Who We Share Your Personal Information With" above, consisting of:

• Service providers and contractors under the CCPA — listed under "Recipients acting on our behalf";
• Third parties / other businesses — AppLovin and its mediated demand partners; Google, which provides the advertising consent screen; our marketing and attribution partners; social login providers; the App Store and Google Play, for purchases you make through them; public authorities where required by law; and parties to a corporate transaction.

Sale and Sharing of Personal Information

For the purposes of the CCPA and equivalent state laws:

We "sell" and "share" personal information for advertising purposes. Specifically:

• In-app advertising through AppLovin MAX. AppLovin and its mediated demand partners receive your Advertising ID, IP address and basic device information when ads are shown to you in Flikk, and we receive ad revenue in return. This constitutes both a "sale" (because we receive monetary consideration) and a "sharing" (because the data is used for cross-context behavioral advertising) of personal information under the CCPA.
• Marketing campaign measurement. We share limited install and conversion data (pseudonymous identifiers, event names and the value of token purchases) with our marketing and attribution partners for cross-context behavioral advertising as defined by the CCPA. We do not share your email address, account information, or gameplay history with these partners.

The categories of personal information involved are: identifiers (Advertising ID, Firebase App Instance ID, hashed installation token, IP address) and internet or other electronic network activity information (ad-interaction events, install and conversion events).

The categories of third parties to whom personal information is sold or shared are: advertising networks, ad-mediation platforms, mobile measurement and attribution providers, and marketing analytics providers. The current list is at https://getflikk.com/partners.

You have the right to opt out of this sale and sharing at any time by:

• turning off the "Advertising" toggle in the App's privacy settings (Settings → Your Privacy Choices → Your consents), and the "Product analytics" toggle as well to stop token purchases being reported as conversions;
• on iOS, declining or revoking the App Tracking Transparency (ATT) permission for Flikk;
• on Android, enabling "Delete advertising ID" in your device settings;
• sending a "Do Not Sell or Share" request to privacy@neowire.ai.

We do not knowingly sell or share the personal information of US users under the age of 18. A user whose device reports that they are 16 or 17 is treated as having opted out, and the App keeps their "Advertising" toggle off for two years from then, by which time they are 18 — see "Children and Users Under 18".

Retention

We retain personal information for the periods set out in the section "How Long We Keep Your Personal Information" above.

Your Rights

Subject to the state law that applies to you, you have one or more of the following rights:

• Right to know / right of access — what personal information we have collected about you, the sources, the purposes, and the categories of recipients.
• Right to delete — request deletion of personal information we have collected from you.
• Right to correct — request correction of inaccurate personal information.
• Right to portability — receive a copy of your personal information in a portable format.
• Right to opt out of the sale or sharing of personal information — see "Sale and Sharing of Personal Information" above.
• Right to limit the use and disclosure of sensitive personal information — to direct us to use sensitive personal information only for the limited purposes permitted by law. As explained under "Sensitive Personal Information", we do not collect sensitive personal information, so this right has nothing to apply to.
• Right to opt out of profiling — that produces legal or similarly significant effects. We do not engage in such profiling outside the fraud-prevention context described under "Automated Decision-Making and Fraud Prevention" (which includes meaningful human review).
• Right to opt out of targeted advertising — you may exercise this right by following the opt-out instructions in "Sale and Sharing of Personal Information" above.
• Right to non-discrimination for exercising your privacy rights.
• Right to appeal — if we deny a rights request.

How to Exercise Your Rights

To exercise any of the above rights, please email us at privacy@neowire.ai with a description of your request, or write to us at the postal address in the "Contact" section. You may also submit a request through the in-app account settings.

We will acknowledge receipt of your request within 10 business days where required, and respond within 45 calendar days, with one further 45-day extension where the law allows and we tell you we are taking it.

Verification of Your Identity

To protect your information, we will take reasonable steps to verify your identity before acting on rights requests. Verification will typically require you to confirm information already associated with your account (such as your email address) or, for more sensitive requests, to provide additional information matching our records. We will not use information collected for verification for any other purpose.

Authorised Agents

You may designate an authorised agent to make a rights request on your behalf. We will require the agent to provide signed written permission demonstrating their authority, and we may also require you to verify your identity directly or to confirm that you have granted the agent permission.

Right to Appeal

If we deny your request in whole or in part, you may appeal the decision by replying to our response within 60 days. We will respond to your appeal within 45 calendar days (or other period required by your state law). If your appeal is denied, you may contact your state attorney general or — in California — the California Privacy Protection Agency.

Financial Incentives

The Flikk Tokens you collect for playing, and the reward payments you can earn through Flikk, are given in connection with your use of the App — playing the games, and giving us ideas for games that other users then play — and not in exchange for the disclosure of personal information. Points can also be exchanged inside the App for Flikk Tokens, which are what a game build or a change to a game costs; that is a use of the App rather than a payment for data. We do not offer a different price, level or quality of service depending on whether you exercise a privacy right, and turning off the "Advertising" setting does not change what you can earn. Accordingly, we do not consider Flikk to be operating a "financial incentive" program within the meaning of CCPA § 1798.125(b). If you disagree with this characterisation, please contact us at privacy@neowire.ai.

Notice for Nevada Residents

Nevada law (NRS 603A.340) gives Nevada residents the right to opt out of the sale of certain covered personal information. To submit a verified request related to this notice, contact privacy@neowire.ai.

This Privacy Policy is intended to comply with applicable data-protection laws in the EU/EEA, the United Kingdom and the United States. Where any provision of this policy conflicts with mandatory local law, the local law prevails.