Privacy policy

Last updated: 2026-08-13

1. Who we are and what this policy covers

Only Good Ideas develops and publishes mobile applications, available on the Apple App Store and Google Play (collectively, the "Services"). This Privacy Policy explains what personal information we collect, why, how we share it, and the rights you have over it, depending on where you live.

We are the data controller (GDPR) / organization (PIPEDA) / business (CCPA) responsible for the personal information described in this policy, unless stated otherwise.

Controller contact: Luc Bessette

EU/UK representative: Luc Bessette

Privacy inquiries: Gurinder Kaur

Data Protection Officer: Gurinder Kaur

Contact can be reached via email at: onlygoodideas2026@gmail.com

Or by mail at: Only Good Ideas, CP 99900 AR 768 993, CSP Blainville, Québec, J7C 0M3

2. Information we collect

2.1 Information you provide directly

●       Account identifiers (username/nickname, email if you register)

●       Profile information (avatar/profile photo, if customizable)

●       Communications you send us (support requests, feedback, survey/contest responses)

●       Purchase-related identifiers when you buy in-app content (see §2.3 — we do not receive your card number)

2.2 Information collected automatically

●       Device identifiers: IDFA/GAID, IDFV/Android ID

●       Device/system data: OS and version, device model, language, time zone, carrier, hardware specs

●       IP address and coarse (country/region/city-level) location derived from it — we do not collect precise GPS location

●       App usage data: session length, screens/features used, crash logs, performance telemetry

●       Gameplay/app-interaction data: progress, scores, in-app actions, feature usage

●       Cookies identifiers on our websites and within the apps (see §7)

2.3 Information from third parties

●       If you sign in via Apple, Google, or Facebook: your third-party account ID and the profile fields you authorize

●       Purchase/subscription metadata (order ID, product SKU, purchase time, transaction status) from the Apple App Store and Google Play, received because those platforms process the payment, not us. We never receive or store your card or bank details.

●       Data from analytics partners as described in §5

We collect only what's needed for the specific feature you're using. Where an offline/guest mode exists, data may be generated and stored locally on-device only, without transmission to us.

3. Why we process your information, and our legal basis (GDPR)

Purpose GDPR Legal Basis

Operate the Services, save progress, provide features you request Contract (Art. 6(1)(b))

Customer support Contract / Legitimate interest (Art. 6(1)(b)/(f))

Security, fraud prevention, abuse detection Legitimate interest (Art. 6(1)(f))

Legal/tax/regulatory compliance, responding to lawful requests Legal obligation (Art. 6(1)(c))

Analytics and product improvement Legitimate interest (Art. 6(1)(f)), balanced against your rights

Marketing emails, promotions Consent (Art. 6(1)(a)) — required before any ad SDK is initialized for EEA/UK/Swiss/Quebec users

Sharing with M&A counterparties in a corporate transaction Legitimate interest (Art. 6(1)(f))

4. Children's privacy

Our Services are not directed at, marketed to, or intended for use by anyone under 16 years old, worldwide. We enforce a single global age gate of 16+ at account creation, regardless of jurisdiction.

We chose one global threshold, set at the highest age floor among the laws that apply to us (GDPR's default digital-consent age), rather than a patchwork of regional ages. This means:

●       No account, profile, or personal information is collected from anyone who declares an age under 16, in any country.

●       We do not need a parental-consent workflow, because no one under the gate is let past it in the first place. Parental consent mechanisms (verifiable consent capture, guardian identity checks, ongoing consent records) are themselves a source of compliance risk and operational cost.

●       This satisfies COPPA (13), Quebec's Law 25 (14), and GDPR/UK-GDPR (13–16 depending on member state) simultaneously, because 16 sits at or above every one of those thresholds.

Enforcement requirements:

●       Users who self-declare under 16 must be blocked from proceeding, not just shown a warning.

●       We do not use "age-gate cracking" patterns (e.g., unlimited re-entry attempts, no persistence of a failed age check).

●       If we later learn that we collected personal information from someone under 16, we will delete it without requiring the user or a parent to first request it, and will document the incident.

Parents/guardians who believe a child under 16 has bypassed the gate and provided personal information can contact us at onlygoodideas2026@gmail.com  with subject line "Underage User Report," including the account/device identifier. We will verify the report and delete the associated data.

5. How we share your information

We do not sell your personal information for money. Some jurisdictions define "sale" and "sharing" broadly enough to include ad-technology data flows — see §6.3/§6.4 for your opt-out rights if that applies to you.

We disclose personal information to:

Service providers (processors): under contract, limited to the purpose we hired them for:

●       Platform/payment processing:

o   Apple App Store (https://www.apple.com/legal/privacy/)

o   Google Play (https://policies.google.com/privacy)

Within our corporate group: for the same purposes described in this policy.

In a corporate transaction: merger, acquisition, asset sale, subject to the acquirer being bound by this policy or obtaining fresh consent.

Legal/safety disclosures: to comply with valid legal process, protect our rights, or protect users' safety.

With your consent: anything beyond the above, only if you direct us to.

6. Your rights

6.1 If you're in the EEA, UK, or Switzerland (GDPR / UK GDPR)

You have the right to: access, rectify, erase, restrict processing, object to processing based on legitimate interest, data portability, and withdraw consent at any time without affecting prior lawful processing. You may lodge a complaint with your national supervisory authority (https://www.edpb.europa.eu/about-edpb/our-members_en ), the UK ICO (https://ico.org.uk ), or the Swiss FDPIC (https://www.edoeb.admin.ch ).

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

International transfers: where we transfer EEA/UK/Swiss personal data outside those regions (e.g., to US-based servers or vendors), we rely on the European Commission's Standard Contractual Clauses, the UK's International Data Transfer Addendum, or an applicable adequacy decision.

6.2 If you're in Canada

●       PIPEDA (federal, applies outside Québec): you have the right to know why we collect your information, access it, challenge its accuracy, and expect us to safeguard it and limit use to the purposes we disclosed. We only collect what's reasonably required for the stated purpose (PIPEDA's proportionality principle).

●       Québec — Law 25 (An Act to modernize legislative provisions as regards the protection of personal information): in addition to the above, you have the right to:

o   Request a copy of your personal information in a structured, commonly used technology format (portability)

o   Be informed of, and object to, any decision based exclusively on automated processing that affects you, and to have such a decision explained

o   Object to profiling

o   Be notified of confidentiality incidents (breaches) presenting a risk of serious injury

We have designated Gurinder Kaur as the person in charge of the protection of personal information, reachable at onlygoodideas2026@gmail.com , as required under Law 25.

Complaints: you may contact the Commission d'accès à l'information du Québec (https://www.cai.gouv.qc.ca ) or, for matters outside Québec, the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca ).

6.3 If you're a California resident (CCPA/CPRA)

You have the right to: know what personal information we've collected, correct it, delete it, receive it in portable form, opt out of "sale" or "sharing" of personal information, limit use of sensitive personal information, non-discrimination for exercising these rights, and appeal a denied request. To opt out of sale/sharing: use in operating system's Settings → Privacy Preferences, or set the Global Privacy Control (GPC) signal in your browser, which we honor.

6.4 If you're a resident of another US state with a comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Utah, and others as they take effect)

You generally have rights to access, correct, delete, port your data, and opt out of targeted advertising, sale, and profiling with legal effect. Contact us to exercise these; we'll verify your identity first.

6.5 Exercising any of the above

Email onlygoodideas2026@gmail.com with the subject "Privacy Rights Request," specifying which right you're exercising. We will verify your identity before acting and respond within the timeframe required by the law that applies to you. We may decline a request where permitted by law (e.g., it conflicts with a legal retention obligation, would harm another person's rights, or can't be verified) and will explain why.

7. Cookies and tracking technologies

We and our partners use cookies, and similar identifiers to operate the Services, remember settings, and measure usage. You can control cookies through your browser settings. Blocking some technologies may limit functionality.

8. Data retention

We retain personal information for the purpose it was collected, or as required by law (e.g., tax, accounting). The standard retention periods are:

●      Account data: until account deletion + 30 days;

●      Support tickets: 24 months;

●      Analytics data: 26 months.

9. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold. No system is 100% secure. If we experience a breach that creates a real risk of harm to you, we will notify affected users and the relevant regulator(s) — including Québec's CAI where required — within the timeframe the applicable law requires.

10. Third-party links and platform policies

Our apps run on and interact with platforms operated by Apple and Google, whose own privacy practices govern data they process independently of us:

●       Apple: https://www.apple.com/legal/privacy 

●       Google: https://policies.google.com/privacy

Linking to these does not substitute for our own disclosures above — it covers only the processing Apple and Google do in their own capacity (e.g., payment processing, OS-level services).

We do not use SDKs in our products.

11. Changes to this policy

We'll update the "Last updated" date above and, for material changes affecting your rights, provide additional notice (in-app notice or email) before the change takes effect.

12. Contact us

Only Good Ideas, CP 99900 AR 768 993, CSP Blainville, Québec, J7C 0M3, onlygoodideas2026@gmail.com