1. INTRODUCTION
GSP Technologies EOOD ("we", "our", or "us"), a company registered in Bulgaria under UIC/EIK 208842857, with registered address at Popova Shapka № 44a, Slatina District, Sofia Municipality, 1505 Sofia, Bulgaria, trades as Nostalgia Games and publishes the following mobile games (together, the "Apps"), plus the website at nostalgiagames.bg:
- Snake Classic: Retro Arcade — iOS and Android
- AI Tic Tac Toe X O — iOS and Android
This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use the Apps or visit our website, and describes your rights under the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection law.
By using our Apps or website, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use our services.
We have not appointed a Data Protection Officer, as our processing does not meet the GDPR thresholds that require one. You can still reach us using the contact details in Section 15 for any data protection question.
2. INFORMATION WE COLLECT
The categories below are all "personal data" under GDPR because they relate to an identifiable device or user, even though none of them are your name or postal address:
- Device information — device model, operating system version, unique device identifiers, and mobile network information.
- Gameplay and app-usage data — collected via Google Analytics for Firebase: which mode and difficulty you play, match results, how you interact with ads, which visual theme you choose, and similar in-app activity. See Section 5.
- Advertising identifiers — mobile advertising IDs (IDFA on iOS, GAID on Android) used by Google AdMob and the ad networks it mediates to, to show ads and, where you consent, personalised ads. See Section 6.
- Correspondence — if you email us, we collect your email address and the contents of your message.
What we don't do. We have no backend server of our own — the Apps never send data to servers we operate. We don't have user accounts, logins, registration, or in-app purchases, so we never collect your name, postal address, or email address through the Apps themselves. We don't run any crash-reporting SDK (no Crashlytics, no Sentry). We don't request access to your contacts, camera, microphone, photos, or location, and we don't offer social login.
Push notifications are scheduled locally on your device — there is no push server on our side, and no device token is ever transmitted to us.
3. DATA STORED ONLY ON YOUR DEVICE
Some settings never leave your device and are not part of any database we or our partners maintain: your chosen visual theme, sound and vibration preferences, how many times you've opened the app, the time of the last full-screen ad you saw, whether you've unlocked the hardest difficulty, and whether you've already been shown the notification permission prompt. All of this is deleted automatically when you uninstall the app.
4. LEGAL BASIS AND HOW WE USE YOUR INFORMATION
For each purpose below, GDPR requires us to state the legal basis we rely on:
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Operate, maintain, and improve our games | Device info, gameplay data | Legitimate interest — providing the service you installed the app for |
| Understand gameplay patterns and app performance | Gameplay/usage events (Firebase Analytics) | Legitimate interest; for EEA/UK/CH users, the analytics SDK's access to device storage is also covered by our in-app consent prompt (Section 6) |
| Show non-personalised advertising | Device info, coarse context | Legitimate interest — this is how the free games are funded |
| Show personalised advertising | Advertising identifiers | Consent — collected via our in-app consent prompt before any personalised ad loads |
| Respond to your emails | Correspondence | Legitimate interest / steps to respond to your request |
| Comply with legal obligations | Any of the above, as required | Legal obligation |
Where we rely on legitimate interest, we have concluded that our interest in operating and funding free-to-play games is not overridden by your rights and freedoms, given the limited and non-sensitive nature of the data involved.
5. ANALYTICS
We use Google Analytics for Firebase to understand how people play our games. We log events such as starting or finishing a match, completing a series, being offered or accepting a rewarded ad, an interstitial ad being shown, changing the visual theme, interacting with cross-promotion for our other games, and what triggered an app-store rating prompt. These events carry gameplay parameters (like difficulty or result) — none of them contain your name, email, or any other directly-identifying information.
Firebase also automatically collects a randomly generated, resettable app instance identifier
(not tied to your device or identity), device model, OS version, app version, language, an
approximate country/region derived from your IP address, and standard events like first open and
session start. Where AdMob and Firebase Analytics are linked for revenue reporting, an
ad_impression event carrying the ad format and estimated
value is also recorded.
We do not assign a user ID within Firebase Analytics and do not link this data to any identity — we don't hold one to link it to. See Section 9 for how long this data is retained.
6. ADVERTISING AND CONSENT
Our games are free to play and supported by advertising. We use Google AdMob as our ad mediation platform. AdMob in turn mediates ad requests to a number of third-party ad networks — see the full list in Section 7.
Ads appear in three formats: a persistent banner on most screens; a full-screen interstitial ad, rate-limited and shown only at the end of a match series; and an optional rewarded video, which you choose to watch in exchange for an in-game benefit (such as undoing a move, replaying a deciding game, or unlocking a harder difficulty). Rewarded ads are never forced and never block your progress.
If you are located in the European Economic Area, the UK, or Switzerland, we ask for your consent through an in-app consent prompt — implemented via Google's User Messaging Platform (UMP) as our IAB Transparency & Consent Framework (TCF) certified Consent Management Platform — before showing you personalised advertising or before any advertising SDK accesses your device's advertising identifier for that purpose. If you decline, we show non-personalised ads instead. On iOS, Apple's App Tracking Transparency (ATT) prompt is also shown to request permission before we access your device's advertising identifier for tracking, where that permission is not already established through our GDPR consent flow. You can change or withdraw your consent at any time by opening Consent Settings from the app's settings menu.
If you are located elsewhere, you can still limit ad personalisation through your device settings:
- iOS: Settings → Privacy → Tracking → disable "Allow Apps to Request to Track"
- Android: Settings → Google → Ads → "Opt out of Ads Personalisation"
On iOS, we also declare Apple's SKAdNetwork identifiers for ad attribution. SKAdNetwork is Apple's privacy-preserving attribution technology — it does not use your advertising identifier and does not require separate consent.
7. THIRD-PARTY SERVICES AND INTERNATIONAL TRANSFERS
Our apps integrate the following third-party services, each of which has its own Privacy Policy governing its use of data. Google AdMob mediates ad requests to the networks listed below:
- Google AdMob — Ad mediation and monetisation
- Google Analytics for Firebase — App analytics
Mediated ad networks:
Our apps are also distributed through:
- Google Play Services — App distribution on Android
- Apple App Store — App distribution on iOS
These providers are based in, or transfer data to, the United States. Where personal data is transferred outside the EEA, we and our processors rely on the European Commission's Standard Contractual Clauses or another valid transfer mechanism recognised under GDPR Chapter V. We do not control these providers' internal processing and encourage you to review their own privacy policies.
8. ROLES: CONTROLLER AND PROCESSORS
GSP Technologies EOOD is the data controller for personal data processed in connection with our Apps and website. Google acts as our processor for AdMob mediation and Firebase Analytics, and as an independent controller for its own purposes (such as safety, fraud prevention, and its own aggregated reporting). Each ad network listed in Section 7 acts as an independent controller when it receives and fulfils an ad request, subject to its own privacy policy.
9. DATA RETENTION
Gameplay and analytics event data collected via Firebase Analytics is retained for up to 14 months from collection, after which it is deleted or aggregated, or as otherwise required by law. Advertising identifiers are retained by AdMob and the mediated ad networks under their own retention schedules — see Section 7.
If you contact us by email, we retain that correspondence for as long as necessary to address your inquiry and for a reasonable period thereafter.
10. AUTOMATED DECISION-MAKING
Personalised advertising involves automated processing of your advertising identifier and device signals to select which ads to show you ("profiling"). This does not produce legal or similarly significant effects on you, and you can always choose non-personalised ads instead (see Section 6).
11. CHILDREN'S PRIVACY
Our games are intended for a general audience aged 13 and over. On Google Play, we have declared our target age group as 13–15, 16–17, and 18 and over, which excludes children under 13 and means our apps are not part of Google Play's Families program. Our games are not marketed or designed to appeal primarily to young children, and we do not knowingly collect personal data from children under 13.
Apple's "4+" content rating on the App Store reflects that our content contains nothing objectionable for any age — it is a content-maturity rating, not an audience-targeting declaration, and our apps are not listed in Apple's Kids Category.
If you are a parent or guardian and believe a child under 13 has used our apps or provided us with personal information, please contact us at contact@nostalgiagames.bg and we will take steps to delete such information and, where relevant, adjust advertising settings for that user.
12. YOUR RIGHTS
We don't operate accounts, so there's no login to manage your data through — every right below is exercised by emailing us directly.
If you are in the EEA, UK, or Switzerland, under GDPR you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data
- Object to or restrict certain processing of your data
- Receive your data in a portable format
- Withdraw consent at any time, without affecting processing carried out before withdrawal
- Lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (cpdp.bg), or with the supervisory authority in your own country of residence
If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the "sharing" of personal information for cross-context behavioural advertising.
To exercise any of these rights, please contact us at contact@nostalgiagames.bg. We will respond within one month, as required by GDPR.
13. SECURITY
We use commercially reasonable measures to protect the information we collect. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
14. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Where a change materially affects how we use data for which we rely on your consent, we will request renewed consent before the change takes effect. We encourage you to review this policy periodically to stay informed about how we protect your information.
Your continued use of our apps or website after any changes indicates your acceptance of the updated policy.
15. GOVERNING LAW AND CONTACT
This policy is governed by the laws of Bulgaria and, where applicable, EU law.
If you have any questions about this Privacy Policy or our data practices, please contact us:
GSP Technologies EOOD, trading as Nostalgia Games
UIC/EIK: 208842857
Registered address: Popova Shapka № 44a, Slatina District, Sofia Municipality, 1505 Sofia, Bulgaria
Email: contact@nostalgiagames.bg
Website: nostalgiagames.bg