Privacy Policy (Android) | Cursed House Multiplayer 2 (GMM2)

Effective 28 October 2026

This policy covers the Android version of Cursed House Multiplayer 2 (GMM2) from Google Play. Using an iPhone or iPad? See the iOS privacy policy.

This privacy policy is applicable to the Cursed House Multiplayer 2 (GMM2) app for mobile devices, together with any related services operated by Abdul Rafy Muhammad, trading as SUSSY BAKA DEV (collectively, the "Application"). Abdul Rafy Muhammad is hereinafter referred to as the "Service Provider".

Data Controller Information

Abdul Rafy Muhammad acts as the Data Controller responsible for the processing of your personal data.

Name: Abdul Rafy Muhammad (trading as SUSSY BAKA DEV)
Address: Via Ernesto Breda 138, Milan, Italy
Email: rafya263@gmail.com

For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.

What information does the Application obtain and how is it used?

The Application and related services acquire the information you supply when you download, access, or register for the service. Registration with the Service Provider is not mandatory. However, you might not be able to use some of the features offered by the service unless you register.

Specifically, the Application collects and stores:

Account information. You can sign in with Google, Google Play Games, or an email address and password. If you sign in with Google or Google Play Games, the Service Provider receives your account identifier, display name and profile picture, and with Google sign-in also your email address. If you sign in with email, your email address is stored; your password is handled by Firebase Authentication and is never visible to the Service Provider. You may instead play as a guest, in which case only an anonymous account identifier and a randomly generated guest name are created.
Game data. Your display name, level and experience, in-game currency balances, owned and equipped skins, badges, daily reward progress and achievements. Your display name and badges may be visible to other players. If you are signed in to Google Play Games Services, achievements are also reported there.
Player ID. The Application displays an identifier generated from your device as your "player ID", which you can copy and send to the Service Provider when asking for support.
Purchase records. A receipt, the product purchased and the store it came from, so purchases can be verified and restored. Payment is processed by Google Play; the Service Provider never receives your card or billing details.
Moderation data. If an account is banned, the ban status is stored against that account in order to enforce the decision.
Anti-cheat. The Application includes on-device protection against tampering with game memory and saved data. These checks run locally on your device and do not send personal data to the Service Provider.

The Service Provider may also use the information you provide to send important information, required notices, and, where permitted by law, marketing communications.

Multiplayer and voice chat

To connect you to other players, the Application transmits your network address, session identifier and in-game name to its multiplayer provider (Photon).

Voice chat is provided by Vivox, a Unity service. To use it, the Application creates an anonymous Unity player identifier. If you grant microphone permission and join a match with voice chat, your audio is transmitted in real time to the other players in that match. Voice audio is not recorded, stored or listened to by the Service Provider. You can decline the microphone permission or mute yourself at any time.

Advertising

The Application is free to play and shows banner, interstitial and optional rewarded advertisements. To serve and measure ads, advertising networks receive your device's advertising identifier (where available), IP address, device information, and information about the ads you view and interact with.

Most regions: ads are served by Google AdMob, which may use the mediation partners Liftoff Monetize (Vungle) and Mintegral.
Versions distributed for users in Russia: ads are served by Yandex Mobile Ads, which may use the mediation partners myTarget, Liftoff Monetize (Vungle) and Mintegral, and includes Yandex AppMetrica for ad measurement.

Where required by law, the Application asks for your consent before personalised advertising is used: through Google's User Messaging Platform for AdMob, or through the Application's own consent window for Yandex. If you do not consent, ads may still be shown but will not be personalised. You can also reset your advertising ID or opt out of ads personalisation in your device's Google settings.

Analytics

The Application includes Google Analytics for Firebase, which collects usage information such as app opens, session length, device model, operating system version, approximate location derived from your IP address, an app instance identifier and, where permitted, your advertising identifier. This helps the Service Provider understand how the Application is used and fix problems. Versions using Yandex ads also include Yandex AppMetrica, which collects similar device and usage information.

Legal basis for processing your personal data

Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data, including:

Contract performance: processing necessary to provide the Application or fulfil a contract with you.
Consent: where you have given explicit consent to processing, including for personalised advertising, marketing, analytics, or optional features such as voice chat. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
Legitimate interests: where processing is necessary for the Service Provider's specific legitimate interests, such as maintaining network and information security, preventing fraud and abuse, or improving the Application's core functionality through analytics, provided those interests are not overridden by your data protection rights or fundamental freedoms.
Legal obligation: to comply with laws or government requests.

Cookies and similar technologies

The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, advertising and service delivery.

Where required by law, the Application presents a consent form before any non-essential tracking technology is used, using Google's User Messaging Platform or, in versions using Yandex ads, the Application's own consent window. Advertising is only requested once the required consent state has been established.

Automated decision-making and profiling

If the Application uses automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, you have the right to request human review, express your point of view, and contest the decision. Information about the logic involved and the likely consequences of that processing will be provided where required by law.

What information does the Application collect automatically?

In addition, the Application may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device's unique device ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browsers you use, and information about the way you use the Application.

Does the Application collect precise real time location information of the device?

This Application does not gather precise information about the location of your mobile device, and does not request Android's location permissions. Your IP address is collected as described above, and third parties such as advertising and analytics networks may use it to estimate your approximate, city-level location.

Does the Application use Artificial Intelligence (AI) technologies?

The Application does not use Artificial Intelligence (AI) technologies to process your data or provide features.

Do third parties see and/or have access to information obtained by the Application?

Yes. The Application relies on third-party services to operate, and those services receive personal data as part of providing their function. Account and game data is stored with the Service Provider's cloud hosting provider; network traffic passes through the multiplayer provider and voice traffic through the voice chat provider; purchase receipts are verified with the store; and advertising and analytics networks receive the data described in their own policies. The Service Provider does not sell your personal data.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data outside the European Economic Area (EEA). Where such transfers occur, the Service Provider will use an appropriate transfer mechanism required by GDPR Chapter V.

Adequacy decisions by the European Commission
Standard Contractual Clauses (SCCs) approved by the European Commission
Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted

Countries outside the EEA may not provide the same level of data protection as the EEA. In versions that use Yandex services, data may be processed in the Russian Federation, which the European Commission has not recognised as providing an adequate level of protection. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

The Service Provider may disclose User Provided and Automatically Collected Information:

as required by law, such as to comply with a subpoena, or similar legal process;
when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.

Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR. These DPAs impose the same data protection obligations on those service providers as described in this Privacy Policy.

What are my opt-out rights?

You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.

To request deletion of your personal data, withdraw consent, or exercise any of your rights, contact the Service Provider at rafya263@gmail.com.

What is the data retention policy and how can you manage your information?

The Service Provider retains personal data based on its necessity for the stated purposes:

Account and game data: retained for as long as your account exists, and deleted when you delete your account
Purchase records: retained for as long as required by tax and accounting obligations
Ban records: retained for as long as needed to enforce moderation decisions
Analytics data: retained according to the retention settings of the analytics providers listed above
Voice audio: not retained; it is transmitted in real time only
Aggregated and anonymized data: retained indefinitely as it no longer identifies you
Data required for legal compliance: retained as long as required by applicable law

You have the right to request deletion of your personal data at any time, except where retention is required by law. Please note that some User Provided Data may be required in order for the Application to function properly.

Data Deletion

You can delete your account and its associated data from within the Application.

You can also request deletion by contacting the Service Provider at rafya263@gmail.com. The Service Provider will process your request within the timeframes required by applicable law.

Upon verification of your identity, the Service Provider will delete your personal data from its systems, except where retention is required for legal compliance or legitimate business purposes, such as records relating to an active ban.

How does the Application address children's privacy?

The Application is not intended for children under 13 years of age, or where a higher age of digital consent is established under applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children under 13 years of age, or where a higher age of digital consent is established by applicable law, in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (rafya263@gmail.com) so that they will be able to take the necessary actions.

How is your information kept secure?

The Service Provider is committed to safeguarding the confidentiality of your information. The Service Provider implements physical, electronic, and procedural safeguards to protect information it processes and maintains. For example, access is limited to authorized employees and contractors who need to know that information to operate, develop, or improve the Application. However, no security system can prevent all potential security breaches.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay, providing information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach.

How will you be informed of changes to this Privacy Policy?

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at rafya263@gmail.com.

This privacy policy is effective as of 2026-10-28

What are your GDPR data protection rights?

Under the GDPR, you have the following rights:

Right of Access: You can request access to your personal data.
Right to Rectification: You can request correction of inaccurate data.
Right to Erasure: You can request deletion of your personal data (the "right to be forgotten").
Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
Right to Object: You can object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing purposes at any time.
Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time.
Rights Regarding Automated Decision-Making: You have rights related to automated decisions that affect you.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. The Service Provider is established in Italy, and its lead supervisory authority is the Garante per la protezione dei dati personali. Contact details for each country's Data Protection Authority can be found at edpb.ec.europa.eu.

If you are located in the United Kingdom, you may contact the Information Commissioner's Office at ico.org.uk.

What are your California privacy rights (CCPA/CPRA)?

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

Right to Know: You can request disclosure of the categories and specific pieces of personal information the Service Provider has collected about you.
Right to Delete: You can request deletion of personal information the Service Provider has collected from you, subject to certain exceptions.
Right to Correct: You can request correction of inaccurate personal information.
Right to Opt-Out: You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: You can limit the use of your sensitive personal information to essential purposes.
Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, please contact the Service Provider at rafya263@gmail.com. The Service Provider will verify your request using the information you provide and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf.

How do you give your consent?

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases, including contract performance, legitimate interests, or legal obligations, is carried out as described above.

How can you contact the Data Controller?

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at rafya263@gmail.com.

To request deletion of your personal data or to exercise any of your rights, contact the Service Provider using the details provided above. The Service Provider will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.

← Back to the site