Privacy Policy

This Privacy Policy explains how Bilibala Shadowpaw Limited collects, uses, holds, and discloses personal data in connection with Math Villain. It applies to all versions of the Game, including the web application, Progressive Web App, and Android mobile application distributed via the Google Play Store. It is issued in compliance with the Personal Data (Privacy) Ordinance, Cap. 486 of the Laws of Hong Kong ("PDPO") and reflects the six Data Protection Principles ("DPPs") in Schedule 1 to the PDPO.

This Privacy Policy should be read together with our Personal Information Collection Statement ("PICS"), which is provided at or before the point of data collection.

1. Who We Are

Bilibala Shadowpaw Limited is a company incorporated in the Hong Kong Special Administrative Region and is the data user for personal data collected via the Game.

2. Personal Data We Collect

We deliberately keep collection minimal. The categories below are exhaustive for the current version of the Game.

2.1 If you do not sign in

• Game progress and settings, stored only in your browser's local storage on your device (e.g., current mission, stamps collected, selected cat, difficulty mode, audio settings). This data does not leave your device and is not personal data when held in this form.

2.2 If you sign in with Google

In addition to the above, when you choose to sign in with your Google account, the following personal data is collected:

• Google account identifier (UID issued by Firebase Authentication);
• Email address associated with your Google account;
• Display name as set on your Google account;
• Profile photo URL as set on your Google account; and
• Game state document under users/{uid} in Cloud Firestore, containing your progress, statistics, unlocked items, and difficulty preferences.

2.3 Automatically collected when you use the deployed Game

• Analytics data via Google Analytics for Firebase, which may include an app-instance identifier, approximate geographic region inferred from IP, device/browser type, operating system, session timing, screen views, and language. Analytics is disabled when the Game runs on localhost.
• Standard server logs generated by Firebase Hosting (IP address, user agent, timestamps).

We do not collect or store: payment card details or billing information (payment processing is handled entirely by Stripe, Inc. — see Section 5). We also do not collect: Hong Kong Identity Card numbers or other government identifiers, precise geolocation, contacts, microphone or camera input, or freeform user-generated text content.

If you make a voluntary support contribution through Stripe, a permanent supporter flag is stored in your cloud-save document to unlock a cosmetic in-game item. This flag does not contain any payment information.

3. Purposes of Collection (DPP 1 & DPP 3)

Personal data is collected and used only for the following purposes:

1. operating the Game and authenticating you when you sign in;
2. synchronising your progress across devices ("cloud save"), including your supporter status, and recovering progress on re-installation;
3. maintaining the security, integrity, and performance of the Game (e.g., rate-limiting, fraud and abuse detection);
4. producing aggregated and de-identified statistics to understand how the Game is used and to improve it; and
5. complying with applicable legal and regulatory obligations and responding to lawful requests from authorities.

We will not use your personal data for any new purpose that is materially different from the above without first obtaining your prescribed consent in accordance with DPP 3.

4. Direct Marketing

We do not use your personal data for direct marketing. If this changes in the future, we will obtain your express, voluntary, indicated consent in accordance with sections 35A–35M of the PDPO before doing so, and you will be entitled to opt out free of charge at any time.

5. Disclosure and Transfer of Data

5.1 We do not sell your personal data.

5.2 We disclose personal data only to:

• Google LLC and its affiliates, as our processor for Firebase Authentication, Cloud Firestore, Firebase Hosting, and Google Analytics for Firebase. These services may process and store data on servers located outside Hong Kong (including in the United States and other regions where Google operates). Google acts on our written instructions under its Data Processing Terms.
• Stripe, Inc. and its affiliates, as our processor for voluntary support payment processing. When you choose to make a support contribution, you are redirected to Stripe's hosted payment page. Stripe processes your payment card details and billing information directly; we do not receive or store this data. Stripe may process data on servers outside Hong Kong. Stripe's handling of your data is governed by its own privacy policy (stripe.com/privacy).
• Professional advisers, auditors, or insurers, where reasonably necessary, under duties of confidentiality.
• Law enforcement, courts, or regulators, where required by law or pursuant to a lawful request.
• A successor entity, in the event of a corporate restructuring, merger, or sale of all or substantially all of our assets, subject to equivalent protection.

5.3 In each case, before transferring personal data outside Hong Kong we take reasonable steps to ensure that the data is afforded a level of protection comparable to that required under the PDPO, including by relying on the data-processing terms of the receiving service provider.

6. Retention (DPP 2)

6.1 We retain personal data only for as long as is necessary to fulfil the purposes set out above.

• Local storage on your device: retained until you clear it or uninstall the Game.
• Cloud save (Firestore users/{uid} document): retained while your Google account remains linked to the Game. If you request deletion (see Section 8), we will delete it within 30 days of verifying your request.
• Analytics data: retained according to the default retention settings of Google Analytics for Firebase (subject to change by Google).
• Server logs: retained for a short period for security and diagnostic purposes, typically not more than 90 days.

6.2 We will erase personal data when it is no longer required, unless retention is required or permitted by law.

7. Security (DPP 4)

We take practical steps to safeguard personal data against unauthorised or accidental access, processing, erasure, loss, or use, including:

• HTTPS/TLS in transit for all communication with Firebase services;
• Firestore Security Rules that restrict each user's read and write access to their own document and validate document structure;
• Disabling cloud writes when the Game runs on localhost to prevent development data from contaminating the production database; and
• Reliance on Google's data-centre and platform security controls for stored data.

No system is perfectly secure. You are responsible for keeping your Google account credentials confidential.

8. Your Rights (DPP 5 & DPP 6)

Under the PDPO you have the right to:

1. Be informed whether we hold personal data about you and, if so, to be supplied with a copy of that data (a "data access request");
2. Request correction of personal data that is inaccurate (a "data correction request");
3. Request deletion of personal data that is no longer necessary for the purposes for which it was collected; and
4. Withdraw consent to optional processing (for example, by signing out and discontinuing use of the Game).

To exercise these rights, contact us at info@bilishadowpaw.com. We may need to verify your identity (for example, by confirming control of the Google account used to sign in). We will respond to a data access or correction request within 40 days of receipt as required by sections 19 and 23 of the PDPO. A reasonable fee may be charged for compliance with a data access request as permitted by section 28 of the PDPO.

If you are not satisfied with how we have handled your personal data, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong ("PCPD") at www.pcpd.org.hk.

9. Children's Privacy

The Game is intended for general audiences. It is not directed at children under the age of 13, and we do not knowingly target or market the Game to children under 13. We do not knowingly collect personal data from children under 13 except through the optional Google sign-in, which is itself subject to Google's age requirements. If you are a parent or guardian and believe your child has provided personal data to us, please contact info@bilishadowpaw.com and we will take reasonable steps to delete it.

10. Cookies and Local Storage

The Game does not set advertising cookies. We use:

• Browser local storage to save your game progress and settings on your device;
• Service Worker cache (Progressive Web App) to enable offline use and faster loading; and
• Firebase Authentication storage (set by Google) to keep you signed in across sessions.

You can clear this data at any time through your browser's site-settings controls.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date will be revised, and material changes will be brought to your attention through the Game where reasonably practicable. Your continued use of the Game after changes take effect constitutes acceptance of the updated Privacy Policy.

12. Contact

For any question, request, or complaint relating to personal data, contact:

Bilibala Shadowpaw Limited
Attn: Data Protection Contact
Email: info@bilishadowpaw.com