Privacy policy

CLOUDRIDGE TECHNOLOGIES PTY LTD (ACN 696 705 478, ABN 69 696 705 478) handles personal information in two different capacities, and almost every question about your rights depends on which one applies. Getting this wrong is the most common defect in a supplier's privacy policy, so it is dealt with first rather than buried.

Why we cannot act on a player's request directly

Where we act as a processor we hold player data on a customer's documented instructions. We have no product that uses it, no analytics built on it, and no purpose of our own for it. If a player asked us to delete their save and we did, we would have acted against our customer's instructions and destroyed data the customer is accountable for. A supplier willing to do that is a supplier no studio should use.

What we do instead is route the request to the studio within 5 business days and tell the player we have done it, and act on the studio's instruction when it arrives.

The law that governs this policy is the Privacy Act 1988 (Cth) and, in particular, the thirteen Australian Privacy Principles set out in Schedule 1 to that Act. Throughout this document a reference to "APP 6" or similar means the corresponding Australian Privacy Principle.

The small business threshold, and why it does not get us out of this

Section 6D of the Privacy Act exempts most businesses with an annual turnover of $3 million or less from the Australian Privacy Principles. CLOUDRIDGE TECHNOLOGIES PTY LTD was registered in 2026 and its turnover is presently below that threshold, so on a narrow reading the Act may not yet bind it.

We are not relying on that. Several of the exceptions in section 6D would in any event pull a business like ours back inside the Act as it grows, including a business that discloses personal information about another individual to anyone else for a benefit, service or advantage. More to the point, the exemption is an accident of turnover, not a statement that the information stops mattering. This policy is written as though the Australian Privacy Principles apply in full, and we will handle requests and complaints on that basis.

Other Australian law that applies

• Spam Act 2003 (Cth), which governs commercial electronic messages, requires consent, sender identification and a working unsubscribe facility.
• Do Not Call Register Act 2006 (Cth), which governs unsolicited telemarketing. We do not telemarket.
• Australian Consumer Law, Schedule 2 to the Competition and Consumer Act 2010 (Cth), which gives you consumer guarantees that cannot be excluded by anything we write.
• Part IIIC of the Privacy Act, the Notifiable Data Breaches scheme, dealt with at its own section below.
• Privacy and Other Legislation Amendment Act 2024 (Cth), which introduced a statutory tort for serious invasions of privacy, provided for a Children's Online Privacy Code, and added transparency obligations for certain automated decisions. Those last two are dealt with in their own sections.

This section covers information we decide about ourselves.

No analytics, no advertising, no pixel and no session recording on this website, and therefore no consent banner. See the cookie notice.

Not collected

No marketing list, no lead enrichment, no scraped contact data, no visitor identification service of the kind that resolves an IP address to a company and puts it in a sales queue. That last one is common on infrastructure websites and it is worth saying explicitly that this site does not do it.

This section covers player data held on a customer studio's instructions. It is written as a commitment to those studios as much as to their players, because a processor's obligations are contractual first and the contract should not contradict the public page.

What we would receive

What we commit to as processor

• Instructions only. We process player data only on the customer's documented instructions, including for any transfer, unless an Australian law requires otherwise, in which case we tell the customer before processing unless the law forbids that.
• No secondary use. We do not use player data for our own purposes. Not for product development, not for benchmarks, not for an aggregate industry report, not for training anything.
• Confidentiality. Everyone with access is under a confidentiality obligation, and access is limited to those who need it to run the service.
• Assistance. We assist the customer to answer access, correction and deletion requests, and to meet its own notification obligations after a breach.
• Sub-processors. Named in the recipients table below. We give the customer at least 30 days notice before adding or replacing one, and the customer may object.
• Deletion or return. On the end of a contract, and at the customer's election, we delete or return the player data within 30 days, and delete existing copies unless a law requires retention.
• Audit. We make available the information needed to demonstrate compliance and allow a reasonable audit by the customer or its auditor, on reasonable notice and no more than once a year unless a breach has occurred.

Breach notification to the customer

If we become aware of unauthorised access to, unauthorised disclosure of, or loss of player data, we notify the affected customer without undue delay and in any event within 24 hours, with what we know at the time, and we keep updating as we learn more. The customer, as the entity accountable under Part IIIC of the Privacy Act, decides whether the incident is an eligible data breach and makes any notification to the Commissioner and to individuals. We assist and we do not obstruct.

Australian Privacy Principle 5 requires that we tell you certain things at or before the time we collect personal information about you, or as soon as practicable afterwards.

We meet that obligation in three places, and deliberately not only here:

• In the store listing. Apple's privacy nutrition labels and Google Play's Data Safety section state what a title collects before you install it. Those declarations are kept consistent with this policy, and if they ever diverge, treat the divergence as a bug and tell us.
• At the point of collection in the app. A permission prompt explains what the permission is for before the operating system dialog appears, not after.
• Here. This document is linked from every screen of the website and from the settings screen of each title.

APP 5 also requires us to tell you the consequences of not providing information. Those consequences are set out against each item in the collection tables, and for the app permissions in the permissions table.

Australian Privacy Principle 2 gives you the option of dealing with us anonymously or under a pseudonym, unless that is impracticable or we are required by law to deal with an identified individual.

In our case this is not a grudging concession. Our services are playable without an account, without an email address and without a name. If you never sign in, we never learn who you are, and the identifiers described later in this policy are device identifiers rather than identity documents.

Where you write to us, you may use a pseudonymous email address. The one place the option genuinely falls away is a request to access or correct personal information: to answer it we have to be satisfied you are the person the information is about, which is dealt with under access and correction below.

Australian Privacy Principle 4 deals with personal information we receive without having asked for it.

This happens most often when somebody sends us a bug report and includes a full screen recording, a diagnostic export, or a message thread containing other people's details. When we receive personal information we did not solicit, we decide within a reasonable period whether we could have collected it under APP 3. If we could not, and the information is not contained in a Commonwealth record, we destroy it or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.

Practically: unsolicited attachments containing third party personal information are deleted from the inbox and from any backup rotation on its ordinary cycle, and the substance of the bug is recorded without them.

Australian Privacy Principle 6 governs what we may do with personal information once we hold it. The rule is that information collected for one purpose may be used or disclosed for that primary purpose, and for a secondary purpose only where you would reasonably expect it and the secondary purpose is related to the primary one, or where you have consented, or where one of the specific exceptions in the Act applies.

What we use it for

• Delivering the services and the features you have asked for.
• Diagnosing crashes and defects, and measuring whether a fix worked.
• Preventing fraud, cheating and abuse, including detecting automated play and duplicated installs.
• Serving advertising, which is what makes a free title free, in the manner described in the advertising section.
• Answering your correspondence and complying with a legal obligation.

What we do not do

• We do not sell personal information. Not to data brokers, not to advertisers, not as part of an "audience" product.
• We do not build a profile of you across the products of unrelated companies.
• We do not use your correspondence with us to target advertising.

Disclosure to law enforcement and courts

We may disclose personal information where the Act permits it: where required or authorised by or under an Australian law or a court or tribunal order, where a permitted general situation under section 16A exists (including a serious threat to life, health or safety, or suspected unlawful activity), or to an enforcement body where reasonably necessary for an enforcement related activity.

Where we make such a disclosure to an enforcement body we make a written note of it, as APP 6.5 requires. Where the law allows us to tell you that a request was made, we will.

The complete list. Where a recipient touches player data it is marked as a sub-processor, which triggers the notice obligation described above.

Not on this list

No data broker, no marketing platform, no customer data platform, no visitor identification service, no analytics vendor. An infrastructure company adding an analytics vendor that can see customer data is exactly the change that should be announced rather than absorbed, so it would go through the sub-processor notice process even where the strict definition might not require it.

Business transfer

On a sale of the company, personal information may transfer to the buyer. For customer data held as processor, that transfer is governed by the contract with the customer, which we will not sidestep by structuring the deal differently. Where lawfully able we give notice before the transfer completes.

Australian Privacy Principle 7 restricts the use of personal information for direct marketing. The Spam Act 2003 (Cth) sits on top of it for anything sent by email, SMS or instant message, and it is a strict regime: consent, accurate sender identification, and a functional unsubscribe facility that stays live for at least 30 days and is actioned within 5 working days.

Our position

We do not run a marketing list. We have never sent a marketing email under this company name. If that changes, it will be opt in, the consent will be recorded with a timestamp and the wording you agreed to, and the first message will say where the address came from.

Writing to our support address does not subscribe you to anything. That is the most common way small companies quietly build a list, and we do not do it.

Advertising inside a game is not direct marketing to you

Advertisements shown inside a title are served by an advertising network, not addressed to you by us. That activity is governed by the advertising section of this policy rather than by APP 7, but you can still control it: personalised advertising is off unless you turn it on, and the operating system level controls described in the advertising section work regardless of anything we do.

Australian Privacy Principle 8 governs disclosure of personal information to a recipient outside Australia. Section 16C of the Act makes us accountable for an overseas recipient's act or practice: if an overseas recipient we disclosed information to does something that would have breached the Australian Privacy Principles, that act is taken to have been done by us, and we are liable for it.

We treat that as the operative rule rather than the exceptions, which is why the list of overseas recipients is short and named rather than described as "our trusted partners".

How we meet APP 8

Before disclosing personal information overseas we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, principally by contract. The relevant contractual terms are the data processing terms published by each provider, which bind them to process the data only on our instructions, to keep it secure, to assist with individual rights requests, and to notify us of a breach.

We do not rely on the APP 8.2(a) exception for recipients in countries with substantially similar laws, because assessing that for each jurisdiction is a judgement we are not qualified to make and getting it wrong shifts the risk onto you.

Where the data actually goes

The countries in which personal information may be held or accessed are named in the recipients table in this policy. That table is the authoritative list. If a provider changes region we update the table.

Australian Privacy Principle 9 restricts an organisation from adopting, using or disclosing a government related identifier, which includes a tax file number, Medicare number, driver licence number or passport number.

We do not collect any government related identifier. We have no reason to, our products have no age verification or identity verification step that would need one, and no field in any system we operate is intended to hold one.

If you send us one anyway, for instance by attaching a photograph of a licence to an email, it is treated as unsolicited personal information under the section above and destroyed.

Australian Privacy Principle 10 requires that personal information we collect is accurate, up to date and complete, and that information we use or disclose is also relevant.

Most of what we hold is machine generated and therefore accurate in the narrow sense that it faithfully records what a device reported. The category most likely to go stale is anything you told us yourself, such as an email address in a support thread. We do not periodically re-verify those, because doing so would mean contacting people who have finished dealing with us.

The practical remedy is the correction right under APP 13, described below, which you can use at any time and free of charge.

Australian Privacy Principle 11 requires us to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, and to destroy or de-identify it when it is no longer needed for any purpose for which it may be used or disclosed.

What "reasonable steps" means for a company this size

• Transport encryption on every connection. The website and every app endpoint are served over HTTPS only.
• Encryption at rest for stored data, provided by the underlying platform.
• Multi-factor authentication on every administrative account that can reach production data or a store console.
• Access on a need to know basis. The number of people who can reach production data is small and is reviewed when anyone joins or leaves.
• Separate credentials for development and production, so a compromised development credential does not reach live data.
• Collecting less. The most reliable security control available to a small studio is not holding the data, which is why the collection tables are short.

What we do not have, stated plainly

We say this because the alternative is a paragraph of confident language that means nothing. No system is perfectly secure, and a company that tells you otherwise is either mistaken or selling something.

Australian Privacy Principle 11.2 requires destruction or de-identification once information is no longer needed for any permitted purpose. For processor data the permitted purpose is set by the customer's instruction, which is why those rows point at the contract rather than at a number we chose.

Australian Privacy Principles 12 and 13 give you rights of access and correction. Which door to knock on depends on the capacity, so here it is stated twice.

Controller Information we decide about

Correspondence, customer contact records and billing records. Email [email protected] with "Privacy request" in the subject. We respond within 30 days, access is free, and a refusal comes with written reasons, the ground relied on, and how to complain.

Processor Player data

Write to the studio whose game you play. They decide, and they are the ones who can connect an identifier to you. If you write to us instead we will route it within 5 business days and tell you where it went. We will not simply ignore it, and we will not pretend we can grant it.

Where a studio instructs us to produce or delete a player's data, we action it within 10 business days of the instruction, or sooner if that studio's contract requires it, so the studio can meet its own 30 day obligation with room to spare.

Verifying who you are

We have to be satisfied you are the person the information is about, or an authorised representative. Where a request relates to an account, we verify through the email address on the account. Where it relates only to a device identifier, possession of that identifier is what we can verify, and we will say so rather than pretend to a higher level of confidence. We will not ask you to send identity documents.

Timing and cost

We respond within 30 days. Access is free. We do not charge for making a request, and we do not charge for correction. If giving access in a particular form imposes a genuine cost, for example producing a bulk export in an unusual format, we will tell you the charge before doing the work and it will not be excessive.

When we can refuse

The Act lists the grounds, and they are narrower than people expect. They include where giving access would have an unreasonable impact on the privacy of others, where the request is frivolous or vexatious, where the information relates to existing or anticipated legal proceedings and would not be discoverable, and where giving access would be unlawful.

If we refuse, in whole or in part, we will give you written reasons, tell you which ground we rely on, and tell you how to complain. Where we can give you part of the information, or give it in another way that meets your need, we will offer that instead of a flat refusal.

Correction

If information is inaccurate, out of date, incomplete, irrelevant or misleading, we will correct it. If we have disclosed the information to someone else and you ask us to notify them of the correction, we will take reasonable steps to do so unless it is impracticable or unlawful.

If we refuse to correct, you may ask us to attach a statement to the record saying that you consider it inaccurate, and we will take reasonable steps to make that statement apparent to anyone who later looks at the record. That right is often overlooked and it is worth knowing about.

Our services are not directed at children and are not designed to appeal primarily to children. Where a store requires an age rating or a target audience declaration, we declare a general audience.

Australian position

The Privacy Act does not fix an age at which a person can consent for themselves. The OAIC's guidance is that an organisation should assess capacity individually where practicable, and that as a general rule a person aged 15 or over is presumed to have capacity unless there is something to suggest otherwise. We apply that presumption.

The Privacy and Other Legislation Amendment Act 2024 provides for a Children's Online Privacy Code, to be developed by the Information Commissioner and applying to services likely to be accessed by children. We will comply with that Code as it applies to us once it is registered and in force, and we will update this policy at that point rather than in advance of knowing its terms.

Practical measures now

• We do not knowingly collect personal information from a child under 15 without the consent of a parent or guardian.
• Where a title carries advertising and the store signals that a user is a child, personalised advertising is not requested, and the ad request is marked as child directed so the network serves non-personalised inventory.
• There is no social feature, no chat, no user generated content and no player to player messaging in anything we build.

If a child's information has reached us

Write to [email protected]. We will delete it without requiring you to prove a legal relationship beyond what is needed to be satisfied the request is genuine, and we will confirm when it is done.

The Privacy and Other Legislation Amendment Act 2024 inserts a requirement that a privacy policy disclose the kinds of personal information used in substantially automated decisions that significantly affect an individual's rights or interests, together with the kinds of such decisions made. That requirement commences on 10 December 2026.

Our position, disclosed in advance of the commencement date

We make no automated decision that significantly affects your rights or interests. Nothing we run decides whether you get credit, a job, a service, a benefit, or a legal entitlement.

Automated processing does happen in two places, and neither meets that threshold:

• Anti-cheat and abuse detection. Automated signals can restrict an account or a device from a leaderboard. Where a restriction is applied to an account rather than a single score, a person reviews it on request. Write to us and say so.
• Advertising selection. Which advertisement is shown is decided automatically by the advertising network. It does not affect your access to the title or anything you have paid for.

If that ever changes, this section is where it will be described, and it will be described before the processing starts rather than after.

Part IIIC of the Privacy Act establishes the Notifiable Data Breaches scheme. It applies to an eligible data breach, meaning unauthorised access to, unauthorised disclosure of, or loss of personal information where a reasonable person would conclude the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates, and the risk has not been prevented by remedial action.

The process we follow

1. Contain. Stop the access, revoke the credential, take the affected component offline if that is what it takes.
2. Assess. Where we suspect an eligible data breach may have occurred, we carry out a reasonable and expeditious assessment and complete it within 30 days of becoming aware of the grounds for suspicion, which is the period section 26WH allows.
3. Remediate. If remedial action means serious harm is no longer likely, the breach is not notifiable and we record why.
4. Notify. If it is an eligible data breach, we prepare a statement for the Commissioner and notify the Office of the Australian Information Commissioner (OAIC), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au as soon as practicable. We then notify affected individuals, or if that is not practicable, publish the statement on this website and take reasonable steps to publicise it.

What a notification will contain

Our identity and contact details, a description of the breach, the kinds of information concerned, and the steps we recommend you take. We will not pad it with reassurance that has not been earned, and we will say what we do not yet know.

If you think a breach has happened

Write to [email protected] with "Security" in the subject line. We would rather chase a false alarm than miss a real one, and we will not treat a good faith report as hostile.

A statutory tort of serious invasion of privacy commenced on 10 June 2025 under Schedule 2 to the Privacy and Other Legislation Amendment Act 2024. It allows an individual to sue for intrusion upon seclusion or misuse of information, where the invasion was intentional or reckless, where a person in the plaintiff's position would have had a reasonable expectation of privacy, and where the invasion is serious.

This is a right you have against anyone, including us, and it exists independently of the complaints process described below. We mention it because most privacy policies do not, and a right you do not know about is not much of a right.

This website sets no cookies of its own and runs no analytics or advertising. A strictly necessary security cookie may be set by our hosting provider to distinguish automated traffic.

There is no consent banner because nothing here requires consent. The reasoning is in the cookie notice.

Step one: tell us

Email [email protected] with "Privacy complaint" in the subject line. Set out what happened and what you want done. We acknowledge within 5 business days and respond substantively within 30 days. If it will take longer, we will tell you why and give you a date.

Step two: the Commissioner

If you are not satisfied with our response, or we do not respond within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au.

The OAIC will normally expect you to have complained to us first and given us 30 days, but it can accept a complaint without that in appropriate cases. There is no fee. You do not need a lawyer and you do not need our agreement.

What we will not do

We will not require you to sign a non-disclosure agreement as a condition of us dealing with a privacy complaint, and we will not treat making a complaint as a breach of our terms of use.

This policy is written to Australian law because that is the law that binds us. If you are outside Australia, some additional rights may apply to you, and we do not want the absence of a mention to be read as a refusal.

European Economic Area and United Kingdom

Where the General Data Protection Regulation or the UK GDPR applies to our processing, you have rights of access, rectification, erasure, restriction, portability and objection, and a right to complain to your national supervisory authority. Where we rely on legitimate interests, you may object and we will stop unless we can demonstrate compelling legitimate grounds that override your interests. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Send any such request to [email protected] and say which law you are relying on, so we apply the right timetable. We answer GDPR requests within one month.

California

Under the California Consumer Privacy Act as amended, you have rights to know, delete, correct and opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross context behavioural advertising as those terms are defined in that Act. Personalised advertising is off unless you turn it on, which places us outside the sharing definition by default. Global Privacy Control signals sent by your browser to this website are honoured.

Everywhere else

If a right exists where you live and you tell us about it, we will deal with the request on its merits rather than on whether we are technically obliged to.

We may change this policy. When we do, we update the effective date and the version number in the header of this page.

Where a change materially reduces your rights or materially expands what we collect, we will give notice before it takes effect: a notice in the app on next launch, and a note at the top of this page for at least 30 days. We will not make a material change effective retrospectively.

Previous versions are not published as separate pages, but we keep them. If you want to know what this document said on a particular date, ask and we will send you that version.

All privacy matters reach one address.

Email: [email protected]

Entity: CLOUDRIDGE TECHNOLOGIES PTY LTD, ACN 696 705 478, ABN 69 696 705 478, registered in Australia, Queensland.

We do not publish a postal address on this website. If you need to serve a document, the company's registered office is recorded against ACN 696 705 478 on the register maintained by the Australian Securities and Investments Commission, which is the address that has legal effect for service.

If you would rather not deal with us at all, you can go straight to the Office of the Australian Information Commissioner (OAIC), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au.