Privacy Policy

1. Who we are and what this policy covers

GOG Gaming Private Limited (“GOG Gaming”, “we”, “us”, “our”) is a private limited company incorporated in India under the Companies Act, 2013. We operate the Gully Games platform.

All privacy enquiries, rights requests and grievances: support@gullygames.com

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to every part of the Gully Games platform (together, the “Services”):

• The Gully Games Hub app (the “Hub”), distributed on Google Play under the package identifier online.godofgaming.hub;
• Games published or distributed by us, including titles that embed the Gully Games SDK (package identifiers in the com.godofgaming.* namespace);
• The Gully Games SDK embedded in first-party and partner games, which handles sign-in, the shared coin wallet, advertising and gameplay analytics;
• Our websites and web surfaces, including gullygames.com and the browser-playable games at gullygames.com/play;
• Our backend services and APIs, hosted at api.godofgaming.online, hub.godofgaming.online and link.godofgaming.online;
• The publisher and studio dashboard at dashboard.godofgaming.online; and
• Our support channel, support@gullygames.com.

The Services are currently distributed on Android and on the web. Where we release versions for Apple platforms, this policy applies to them, and the iOS-specific provisions below take effect at that point.

1.1 Names and identifiers you may encounter

Our platform was originally built under the name GOG / God of Gaming and was subsequently rebranded to Gully Games. For technical stability, the underlying package identifiers (com.godofgaming.*, online.godofgaming.hub) and API domains (*.godofgaming.online) were deliberately left unchanged, because changing them would break existing installations and the cryptographic app-association records that make cross-app sign-in safe.

If you see the names GOG, God of Gaming, godofgaming.online, or GG in an app listing, a permission prompt, a network request or an email, these refer to the same platform operated by GOG Gaming Private Limited and are covered by this policy.

1.2 Our role

For data collected through the Hub, our games, the Gully Games SDK and our web surfaces, GOG Gaming Private Limited is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the data controller under the EU and UK General Data Protection Regulation (“GDPR”).

Where a partner studio publishes a game under its own developer account and independently operates its own tools inside that game, the studio is a separate controller for the data those tools collect, and its own privacy policy applies to that processing. Data collected through the Gully Games SDK remains our responsibility, and partner studios receive only the limited, tenancy-restricted view described in Section 8.3.

2. Summary at a glance

This summary is for convenience only. The detailed sections below govern.

3. The information we collect

We group personal data into the categories below. Not every category applies to every user; what we hold about you depends on which parts of the Services you use.

3.1 Information you provide to us

3.2 Information collected automatically

3.3 Information we receive from third parties

• Google and Apple, when you choose to sign in with those providers.
• Google Play, in the form of aggregate install, uninstall and store-performance reporting, and, if in-app purchases are enabled in future, purchase and refund confirmations. We do not receive your payment card number or bank details from the store.
• Advertising partners, in the form of aggregate delivery, fill, impression and revenue reporting. See Section 7.
• Partner studios, where a studio reports an integration issue or a support case on your behalf.

3.4 What an analytics event contains

For transparency, every analytics event we ingest carries a fixed envelope. The fields, and who sets them, are:

Two rules follow from this, and they are enforced in our systems rather than left to convention:

• Identity is server-derived. A game cannot write events attributed to anyone other than the signed-in user, and cannot forge a user identifier.
• Tenancy is server-derived. A game cannot write events into another studio’s dataset, and a studio cannot read another studio’s rows.

Events sent before you sign in carry no user identifier at all. They carry the device and session identifiers only.

3.5 How cross-game sign-in works, and what it does not expose

Signing into a game from the Hub does not hand your credentials to that game. The Hub asks our server for a single-use authorisation code with a 120-second lifetime, bound to that one game. The game’s SDK exchanges the code for a session. The long-lived refresh token never leaves the SDK’s secure storage and is never exposed to game code; game code receives only your basic identity (identifier and email address) and short-lived access tokens that expire and are re-minted as needed.

On Android, tokens are held in EncryptedSharedPreferences backed by the Android Keystore. On Apple platforms, they are held in the system Keychain, scoped to that one device, unavailable before first unlock, and excluded from iCloud synchronisation.

4. What we do not collect

To be explicit, because these are the questions users and store reviewers ask most:

• We do not collect precise or GPS location. No app in our catalogue requests fine or coarse location permission to locate you. We use the city you type, and approximate region from IP address.
• We do not access your contacts, call logs, SMS, calendar, photo library or files, other than a file you deliberately attach to a support email or an image you deliberately upload as an avatar.
• We do not access your camera or microphone.
• We do not record, capture, transmit or store gameplay video, screen recordings, screenshots or audio. If we introduce clip capture or streaming in future, we will update this policy and our store data-safety declarations, and obtain any consent required, before the feature is enabled.
• We do not collect biometric data, health data, or any special-category data such as religious or political affiliation, sexual orientation, or trade union membership.
• We do not store passwords. Authentication is handled by a managed identity provider using one-time email codes or a federated sign-in you choose. Your credentials never reach our servers.
• We do not receive or store payment card numbers, UPI credentials, CVV or bank credentials from players. In-app purchases are not currently offered. If they are introduced, they will be processed entirely by Google Play or the Apple App Store under their own terms, and we will receive only a confirmation that a purchase occurred.
• We do not read data from other applications on your device, and we do not scan your installed application list for profiling or advertising.

5. Why we use your data, and our legal basis

The DPDP Act requires that we tell you the specified purpose for which personal data is processed. The GDPR requires that we identify a legal basis. Both are set out below.

A note on Indian law: the DPDP Act does not recognise “legitimate interest” as a ground. Under the DPDP Act we rely on your consent, or on the narrow set of legitimate uses in Section 7 of that Act, which include data you voluntarily provide for a specified purpose and processing required to comply with law.

Where we rely on consent, you may withdraw it at any time (Section 13). Withdrawal does not affect processing carried out before withdrawal, and parts of the Services will not function without an account.

6. Automated decision-making

We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, solely by automated means, with one exception you should know about.

Automated anti-abuse controls. Our coin economy applies automated rate limits, earn-size caps and anomaly detection. These can decline a transaction, throttle earning, or suspend wallet activity on an account suspected of abuse, without a person reviewing it first.

If this happens to you, write to support@gullygames.com. You have the right to human review, to state your case, and to have the decision reconsidered. We aim to respond within 7 working days.

7. Advertising

7.1 The two kinds of ads you may see

House ads. Advertisements for our own games and features, served directly by our own servers. This is what the great majority of our current inventory is. A house-ad request sends only the game identifier and a rotation index. It does not require you to be signed in, does not use an advertising identifier, and does not build a profile of you.

Network ads. We are introducing third-party network advertising through Google AdMob and its mediation partners. Where a game or surface serves network ads, the advertising SDK operating on your device may collect and process, under Google’s own privacy policy:

• your device’s advertising identifier (the Google Advertising ID on Android, or the Identifier for Advertisers on Apple platforms where you have permitted app tracking);
• device and connection information such as device model, operating system version, language, network type and screen size;
• approximate location derived from your IP address, typically at country or region level;
• ad interaction data, such as which ad was served and whether it was viewed, clicked or dismissed; and
• a signal indicating whether the request must be treated as non-personalised or child-directed.

Google’s handling of this data is governed by the Google Privacy Policy at https://policies.google.com/privacy. Google publishes the list of mediation and bidding partners that may participate at https://support.google.com/admob/answer/9012903.

Where a game does not serve network ads, no advertising identifier is collected or transmitted by that game at all. Our store data-safety declarations reflect, for each app, which of the two applies to that app.

7.2 Personalised advertising and your consent

• In the EEA, the UK and Switzerland, personalised advertising is served only with your consent, collected through a consent interface presented before any advertising identifier is used for personalisation. If you decline, you will still see ads, but non-personalised ones.
• In India and elsewhere, you can control personalised advertising through your device settings in Section 7.3, and by writing to us.
• For anyone we know or reasonably believe to be a child, personalised advertising is switched off, the advertising identifier is suppressed, and ad requests are marked as child-directed. See Section 9.

7.3 How to control advertising

Our Android apps that request an advertising identifier declare the com.google.android.gms.permission.AD_ID permission, as Google Play requires. Apps configured as child-directed do not request it.

7.4 What we do not do with advertising

We do not build or sell advertising profiles about you. We do not give advertisers your email address, your account identifier, or any list of our players. We do not use your gameplay analytics to target you with third-party advertising.

8. Who we share data with

We share personal data only in the circumstances below. We do not sell personal data.

8.1 Service providers

These providers process data on our instructions, under agreements that restrict them to our purposes and require appropriate security. They are not permitted to use your data for their own purposes.

Our analytics warehouse and our live product database are separate systems holding separate credentials. No analytics query has a technical path back into the live database. The only value common to both is the account identifier, which is copied into events as a value and is never used to query back into the product database.

8.2 Advertising partners

As described in Section 7, and only in the manner described there.

8.3 Partner studios and publishers

Studios whose games appear in our catalogue receive access to a dashboard showing analytics for their own games only. That restriction is enforced by row-level access controls in the data warehouse itself, keyed to the studio’s publisher identifier, so that a defect in the dashboard software cannot widen a studio’s view beyond its own rows.

Studios receive metrics for their own titles. They do not receive your email address, your activity in other studios’ games, your wallet balance across the catalogue, or any list of our players. Where a studio needs a specific player identifier to investigate a support case, it is provided case by case and limited to what the investigation requires.

8.4 Professional advisers and corporate transactions

We may share data with our auditors, accountants, bankers, insurers and lawyers where necessary, under duties of confidentiality. If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction. We will notify you, and where required obtain consent, before your data becomes subject to a materially different privacy policy.

8.5 Legal and safety disclosures

We may disclose personal data where we believe in good faith that it is necessary to:

• comply with a law, regulation, court order, or a valid and lawful request from a public authority, including law enforcement and tax authorities in India;
• enforce our Terms of Service, or investigate suspected fraud, cheating or abuse of the coin economy;
• protect the rights, property or safety of our users, our partners, our staff or the public.

Where we are legally permitted to do so, we will attempt to notify you before disclosing your data in response to such a request.

9. Children and young people

Our Services are general-audience and are not directed to children.

9.1 Minimum age

You must be at least 18 years old to create a Gully Games account. If you are under 18, you may use the Services only with the consent and supervision of a parent or legal guardian, who must read and accept this policy on your behalf and who is responsible for the account.

We ask you to confirm this at account creation. We do not knowingly create accounts for, or collect personal data from, anyone below the applicable age without the consent the law requires.

9.2 The thresholds we apply

9.3 What we do in practice

Where a user is, or is reasonably believed to be, below the applicable age, we:

• suppress the advertising identifier and disable personalised advertising for that account;
• mark all advertising requests as child-directed or non-personalised;
• disable behavioural analytics used for advertising purposes; and
• do not carry out behavioural monitoring or profiling of that user.

Any title we publish in Google Play’s Families programme or Apple’s Kids Category is additionally configured to the requirements of those programmes, including the removal of advertising identifiers and the use of certified advertising SDKs where required.

9.4 If a child has given us data

If you are a parent or guardian and believe your child has provided us with personal data without the consent required where you live, contact support@gullygames.com with enough detail to locate the account. We will verify the request, delete the data, and close the account where appropriate, without undue delay and in any event within 30 days.

10. International transfers

We are established in India. Some of our service providers process data outside India, including in the United States and the European Union.

• From India. Transfers outside India are made in accordance with Section 16 of the DPDP Act and the rules made under it, and are limited to countries and territories not restricted by the Central Government. We will update our practices as restrictions are notified.
• From the EEA and the UK. Where personal data is transferred out of the EEA or the UK to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, and the UK International Data Transfer Addendum where applicable, together with supplementary technical measures including encryption in transit and at rest and strict access controls. You may request details of the relevant transfer mechanism by emailing support@gullygames.com.

11. Data retention

We keep personal data only for as long as we need it for the purposes in Section 5, or for as long as the law requires.

12. Deleting your account and your data

This section is our account-deletion resource. You can delete your Gully Games account permanently, at any time, at no cost, and without giving a reason.

How to request deletion. Send an email to support@gullygames.com from the email address registered to your account, with the subject line “Account deletion request”. If you still have the Hub installed, you can also start deletion from your account settings inside the app. We verify that a request genuinely comes from the account holder before acting on it, so please write from the registered address.

You do not need the app installed, and you do not need to be able to sign in, to request deletion.

What happens when you delete

Deletion is permanent and cannot be reversed. Coins, progress, giveaway entries and any unclaimed rewards are forfeited. We complete deletion within 30 days of a verified request, purge encrypted backups within a further 90 days, and confirm to you by email when it is done.

If you want a copy of your data before deleting, ask for it in the same email and we will provide it first.

13. Your rights

Subject to verification of your identity, you have the rights below. To exercise any of them, email support@gullygames.com.

13.1 Rights under India’s DPDP Act

• Access. Information about the personal data we process about you, the processing activities, and the identities of others with whom it has been shared.
• Correction, completion, updating and erasure of your personal data.
• Grievance redressal. A readily available means of raising a grievance with us, which we must respond to. See Section 15.
• Nomination. You may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity. Write to us to record a nomination.

If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India.

13.2 Rights under the GDPR (EEA and UK)

Access; rectification; erasure; restriction of processing; data portability in a structured, commonly used and machine-readable format; objection to processing based on legitimate interests; objection to direct marketing at any time; withdrawal of consent at any time; and the right not to be subject to solely automated decisions with legal or similarly significant effects, as described in Section 6.

You may also lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner’s Office, https://ico.org.uk.

13.3 Rights under the CCPA and CPRA (California residents)

You have the right to know the categories and specific pieces of personal information we have collected, their sources, the business purpose, and the categories of third parties to whom they are disclosed; to delete personal information; to correct inaccurate personal information; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and to non-discrimination for exercising any of these rights.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising as those terms are defined by the CPRA. We do not use or disclose sensitive personal information for purposes beyond those permitted without a limitation right.

Categories collected in the preceding twelve months, using the statutory categories: identifiers (email address, account identifier, device installation identifier, IP address); commercial information (wallet transactions, giveaway entries); internet or other network activity (gameplay and app-usage events, advertising interaction); geolocation data (the city you provide and approximate region from IP address, with no precise geolocation); and inferences drawn for product measurement. Categories disclosed for a business purpose are set out in Section 8.

You may use an authorised agent to submit a request, with written permission and identity verification.

13.4 How we handle requests

14. Security

We apply technical and organisational measures appropriate to the risk, including the following.

• Encryption in transit. All traffic between our apps, our website and our servers uses HTTPS with TLS. Cleartext traffic is disabled in our applications.
• Encryption at rest. Our managed database and analytics warehouse encrypt stored data.
• Secure credential storage on device. Session tokens are held in EncryptedSharedPreferences backed by the Android Keystore, or in the Apple Keychain scoped to the single device, unavailable before first unlock and excluded from iCloud synchronisation.
• A structural token boundary. The long-lived refresh token never leaves the SDK’s native core and is never handed to game code. Games receive only short-lived, re-mintable access tokens. There is no method in our SDK that returns a refresh token, so the boundary is a property of the design rather than a rule someone has to remember.
• Short-lived, single-use sign-in codes. Cross-app sign-in codes expire after 120 seconds, are bound to a single game, are single-use, and are validated using PKCE (RFC 7636, SHA-256 only) with constant-time comparison. Verifier values are never written to logs. Failed exchanges return a single opaque error, so codes cannot be probed or enumerated.
• Server-authoritative identity and tenancy, as described in Section 3.4.
• Row-level security on the transactional database, and row-access policies in the analytics warehouse.
• Least-privilege access. Service accounts are scoped to the narrowest dataset and permission needed rather than granted project-wide roles. Staff access to production data is limited to those who need it.
• Secrets management. Credentials are held in managed secret stores and are never committed to source control.
• Rate limiting, abuse detection and request size caps on all public endpoints.

No system is perfectly secure, and we cannot guarantee absolute security. Because sign-in codes are delivered to your email address, keeping access to that email account secure is an important part of keeping your Gully Games account secure.

14.1 Data breach notification

If a personal data breach occurs, we will notify the Data Protection Board of India and affected users in the form and within the timelines required by the DPDP Act and the DPDP Rules, 2025, which require intimation to affected users without delay. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Our notice will describe, in plain language, the nature of the breach, the data affected, the likely consequences, the measures we have taken, and the steps you can take to protect yourself.

15. Grievance Officer and privacy contact

In accordance with the DPDP Act, 2023, the Information Technology Act, 2000 and the rules made under them:

The Grievance Officer will acknowledge a complaint within 24 hours and dispose of it within 15 days of receipt. If you are dissatisfied with the outcome, you may approach the Data Protection Board of India.

A postal address for written correspondence is available on request by emailing support@gullygames.com.

For all other privacy questions, rights requests and enquiries, write to support@gullygames.com. This is the single contact point for every matter covered by this policy.

16. Cookies and similar technologies

16.1 On our websites

gullygames.com and dashboard.godofgaming.online use the following categories.

Any aggregate usage measurement we carry out on our website is cookieless and does not identify you individually.

We do not place third-party advertising cookies or cross-site tracking cookies on gullygames.com.

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent sign-in from working.

16.2 In our apps

Our apps do not use browser cookies. They use ordinary local device storage for the identifiers and preferences described in Section 3.2, and encrypted device storage for session tokens as described in Section 14.

17. Store data-safety declarations

Our declarations in the Google Play Data safety section, and in Apple’s App Store privacy labels where we distribute on Apple platforms, are derived from and consistent with this policy. Where a store’s categories are broader or narrower than the descriptions here, this policy is the authoritative statement of what we actually collect and why.

If you believe a store declaration and this policy disagree, please tell us at support@gullygames.com so we can correct it.

Our apps are built to comply with the Google Play User Data, Families, Permissions and Ads policies, and with the Apple App Store Review Guidelines, including App Tracking Transparency and the requirement to provide an account deletion route.

18. Third-party games, links and services

Our catalogue includes titles published by partner studios. Once you are inside a partner’s game, that studio may operate its own tools with its own privacy practices for anything outside the Gully Games SDK. We require partners to disclose their practices and to comply with applicable law, but we do not control their independent processing. Please read the privacy policy for any game you play.

Our website and apps may link to third-party sites. We are not responsible for their content or their privacy practices.

19. Changes to this policy

We may update this policy as the Services change or as the law changes. When we do:

• we will update the “Last updated” date at the top of this page;
• for material changes, meaning a new category of data, a new purpose, a new class of recipient, or a change that reduces your rights, we will give at least 14 days’ notice by email and by an in-app notice before the change takes effect, and where the change requires consent under the DPDP Act or the GDPR we will ask for that consent before relying on it;
• we will keep previous versions available on request at support@gullygames.com.

Continuing to use the Services after a change takes effect means you accept the updated policy, except where your consent is separately required.

20. Contact