Privacy Policy — Moyako Games (Web & 13+ Apps)

Last updated: 18 May 2026 (PP3)

1. Who We Are

Hanalytic Limited is a company registered in England and Wales. We operate the Moyako brand as a trading name of Hanalytic Limited.

2. Scope & Age

The services covered by this policy are intended for users aged 13 and over.

• games.moyako.com web service — playable in any modern browser; 13+.
• 13+ apps on Google Play — Sudoku, Chess, Backgammon, Word Puzzle, Block Puzzle, Maze, Memory, and the Moyako Games hub app (plus future releases) that load games.moyako.com content inside the app. Each app's Play Store listing declares 13+ audience.

Playing in an app does not change scope. Our Android apps load the games.moyako.com pages inside the app; the running content is the same web game, and the data practices in §3–§6 apply identically. How advertising works in the apps is described in §5.

For our Kids apps (Animal Kingdom, Sliding Puzzle, Memory Match — all native Android under Google Play's Families Policy with COPPA safeguards), see the separate policy at moyako.com/privacy-policy-kids/.

Medical disclaimer: games.moyako.com is not a medical device. The Skill Tests (pattern, reaction, spatial, and similar) are for entertainment and self-insight only, and are not a diagnostic tool.

3. Data We Collect

To use games.moyako.com (whether via browser or via a TWA/Capacitor app) you create an account. We collect and store:

• Email address — for account verification and password recovery
• Nickname — shown on leaderboards (public)
• Age range (e.g. 13–17, 18–24, 25–34) — used to gate adult features and regional consent flows
• Avatar ID — your chosen avatar from the preset set
• Scores, game results, streaks — tied to your user ID to show personal progress and populate leaderboards
• Notification preferences — if you enable streak or comeback reminders, we store a push-subscription endpoint so reminders can be delivered
• Skill Test results (pattern, reaction, spatial) — tied to your user ID for your personal dashboard
• Moyako+ subscription data — if you subscribe to Moyako+, we store your current subscription status (active or cancelled), plan (monthly or annual), renewal date, and a payment-processor reference — a Stripe customer and subscription ID for web purchases, or a Google Play / Apple purchase token for mobile — so we can confirm your entitlement and let you manage the subscription. We do not store card numbers, payment details, or transaction records; all payment data is held entirely by the payment processor (see §7).

We also process standard server-side technical data: IP address, user-agent, and request timestamps, used for security, rate-limiting, and short-term troubleshooting.

Scores on public leaderboards are shown under your nickname only. Your email address and age range are never displayed publicly.

4. How We Use Your Data

• Provide the service — authenticate you, render your dashboard, save and retrieve scores and Skill Test results.
• Process Moyako+ subscriptions — confirm your entitlement, manage renewals and cancellations, and unlock premium features across your signed-in devices. The lawful basis is performance of a contract (UK GDPR / EU GDPR Article 6(1)(b)). Taking payment, issuing receipts and VAT invoices, and retaining transaction records for tax purposes are handled by our payment processors (see §7) — Moyako does not process or store payments itself.
• Improve the service — aggregate, de-identified product-usage analytics to understand which games and features are used.
• Communicate with you — transactional emails (verification codes, password reset), and optional streak reminders if you opt in.
• Serve advertisements — see §5.
• Comply with legal obligations — fulfil data-subject rights (§8), respond to lawful requests, defend against fraud or abuse.
• Personalise your experience — we use your test results and game-score history to compute your Moyako Game Score (MGS) and suggest a Daily Mix of games suited to your score profile. This constitutes profiling under UK GDPR / EU GDPR (automated processing of personal data to evaluate personal aspects). It is used solely to present personalised information on your own dashboard and is never shared or used for advertising. You may object to or disable this at any time via Profile → Privacy & Data → 📊 MGS Settings → Compute my MGS → Off. Turning it off clears your stored MGS history. Re-enabling MGS starts a fresh history from your next test; previously deleted snapshots cannot be restored.

We do not sell your personal data. We do not use your Skill Test results or scores for advertising targeting or for any purpose other than providing and personalising your own dashboard experience.

5. Advertising

5.1 Web (games.moyako.com in a browser)

• Advertisements are served by Google AdSense. AdSense uses cookies and similar technologies to display ads based on your visits to this and other sites on the internet.
• For users in the EEA, UK, and Switzerland, a Google CMP (Consent Management Platform) banner is shown before any personalised ad cookies are set. You may accept, reject, or manage individual vendor consents.
• You can opt out of personalised advertising at any time via Google Ads Settings; non-personalised ads may still be shown.
• Google's use of advertising cookies is governed by the Google Partner Sites policy.

5.2 Mobile (13+ apps on Google Play)

• Advertisements in the 13+ Android apps on Google Play are served by Google AdMob.
• AdMob uses the Android Advertising ID (AAID), a pseudonymous identifier assigned by the device. It is not linked to your name or email.
• You can reset the AAID at any time from your device's Settings → Privacy → Ads → Reset advertising ID, or opt out of interest-based advertising on the same screen.
• When a user declines personalised ads (either through Google UMP in the EEA / UK / Switzerland, or through the device setting), non-personalised ads are served via AdMob's Consent SDK — the app still shows ads, but without behavioural targeting.
• AdMob's handling of data is governed by Google Ads & Privacy and the AdMob Data Disclosure.

Browser vs app: AdSense (§5.1) runs only in the browser version of games.moyako.com. The Moyako Games Android apps serve advertising through the native Google AdMob SDK described above; AdSense is not used inside the apps.

Kids apps use separate rules. Our Kids apps (Animal Kingdom, Sliding Puzzle, Memory Match) apply Google Play Families Policy safeguards, certified kid-safe ad networks, and COPPA-compliant non-personalised ads. See moyako.com/privacy-policy-kids/ for detail.

6. Cookies & Consent

games.moyako.com uses the following cookies and storage categories:

• Essential — authentication token (after sign-in), theme preference, consent-banner acknowledgement (localStorage). These cannot be disabled.
• Advertising — set by Google AdSense and its partners to serve and measure ads. In the EEA, UK, and Switzerland these are set only after you grant consent via the Google CMP banner.

When the Google CMP banner is shown, you can:

• Consent — allow personalised ads and related cookies.
• Manage options — enable or disable individual purposes (e.g. personalisation, measurement) or individual vendors.
• Do not consent — only non-personalised ads are shown; no personalised-advertising cookies are set.

You can change your CMP choice at any time from the privacy-settings link in the page footer. For a full list of cookies, see our Cookie Policy.

7. Third-Party Services

• Google AdSense — advertising on games.moyako.com. Partner Sites policy.
• Google CMP (Consent Management Platform) — consent collection for EEA / UK / Switzerland users. Google CMP documentation.
• Google AdMob — advertising in 13+ Android apps on Google Play. AdMob Data Disclosure.
• Google Play Services — required for Play-distributed apps. Google Privacy Policy.
• Hostinger — web hosting for games.moyako.com. Standard server logs may be recorded. Hostinger Privacy Policy.
• SendGrid (Twilio) — transactional email for account verification and password reset. Twilio Privacy.
• Firebase Analytics (Google) — session and event analytics for games.moyako.com. No advertising identifiers are collected via Firebase Analytics on this platform. Firebase Privacy.
• Stripe — payment processing for Moyako+ subscriptions bought on games.moyako.com. Stripe handles card data directly as a PCI-DSS Level 1 provider; Moyako never receives full card numbers. Stripe Privacy Policy.
• Google Play Billing — payment processing for Moyako+ and any in-app purchases made in our Android apps. Google Privacy Policy.
• Apple App Store — payment processing for Moyako+ purchased in our iOS app, where available. Apple Privacy Policy.

8. Your Rights (UK GDPR / EU GDPR)

Under UK GDPR, EU GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (see §9)
• Object to processing
• Data portability — download a copy of your data as JSON directly from Profile → Privacy & Data → ⬇️ Download my data, or request it by email (see below)
• Withdraw consent for personalised advertising at any time via the CMP settings link in the footer, the Google Ads Settings page, or on-device for the 13+ apps
• Lodge a complaint with the Information Commissioner's Office (ICO) or your local EU supervisory authority

To exercise any right, email info@moyako.com with the subject line "Data Subject Request" and describe what you would like us to do. We will verify your identity and respond within one month, as required by law.

You can exercise your rights without contacting us for two actions: sign in at games.moyako.com → Profile → Privacy & Data → ⬇️ Download my data to export all your data as JSON (available once per 24 hours), or Profile → Privacy & Data → 🗑️ Delete account to erase your account immediately and permanently (cascading delete of profile, scores, Skill Test results, push subscriptions). For every other right — including rectification, objection to processing, restriction, or any request you need to make when you cannot sign in — please use the email route above.

9. Data Retention

• Account data (email, nickname, age range, avatar, scores, Skill Test results, notification preferences): retained while your account is active; deleted on your request, or after 24 months of inactivity.
• Server logs (IP address, access time): up to 30 days on the hosting provider, then purged.
• Moyako+ subscription data (status, plan, payment-processor reference IDs): retained while your account is active and deleted when you delete your account. The underlying payment and transaction records — including invoices and anything needed for tax and accounting — are held by the payment processors (Stripe, Google, Apple) under their own retention policies; Moyako neither stores nor retains them.
• AdSense / AdMob identifiers: governed by Google's retention policies.
• Transactional email logs: retained by SendGrid (Twilio) per their retention policy, typically 30 days.

10. International Transfers

Some of our service providers (Google, Twilio, Stripe) process data outside the UK / EEA. These transfers are covered by the EU-US Data Privacy Framework, the UK International Data Transfer Addendum, or equivalent standard contractual clauses. Our primary hosting (Hostinger) operates within the UK / EEA.

11. Changes to This Policy

We may update this policy. Material changes will be announced on this page, and for signed-in users via in-product notice on next session. The "Last updated" date above reflects the most recent revision.

12. Contact Us

Data Protection queries: please use the same email and include "Data Protection" in the subject line.