Privacy Policy

Effective Date: 21st October, 2026

Welcome to Secret Planner: Merge & Story, and thanks for playing our game! This Privacy Policy is designed to provide clarity about how we process the information we collect, and how you can exercise your privacy rights, where applicable. This Privacy Policy applies whenever you play our game; otherwise access any of our other products, services, content, websites and/or other domains provided by us; any other digital properties or services that link to this Privacy Policy; and our marketing activities and other activities described in this Privacy Policy (together, the "Services"). The Services are operated by Dyumn Tech Private Limited, a company incorporated in India with its registered office at 101, D Definity Premises Co-operative Society Limited, Survey No. 95, Hissa No. CTS No. 364, Jayprakash Road No. 01, Goregaon East, Mumbai, Maharashtra, India – 400063, and its affiliates (the "Company", "we", "us" or "our").

By using the Services, you acknowledge the collection, disclosure, storage and use of your information as outlined in this Privacy Policy. Where the law requires your consent for a particular use (for example tailoring or personalised advertising), we ask for it separately in the game, and you can withdraw it at any time. If you do not want us to collect, store, use or disclose your information in the ways described in this Privacy Policy, you should not play our game or use our Services. We reserve the right to modify this Privacy Policy at any time. If we make material changes, we will notify you by updating the date of this Privacy Policy and posting it on the Services or by other appropriate means.

Territorial availability: the Services are offered in the United States, India, Australia, New Zealand, the Philippines, the European Economic Area, the United Kingdom and other markets where we choose to distribute them. If you access the Services from a territory where they are not offered, you do so on your own initiative.

Regional notices: if you are in a U.S. state, see Section 11. If you are in India, Australia, New Zealand or the Philippines, see Section 11A. If you are in the European Economic Area or the United Kingdom, see Sections 2, 4 and 5. Where the law of your country gives you more rights than this Privacy Policy, those rights apply.

1. Information We Collect and Process

The personal information we may collect and process about you through the Services falls into the following general categories.

1.1 Information you provide voluntarily

• Communication information: your messages to us, such as player-support tickets or emails, and any information you choose to give our customer service team (for example, information needed to identify a lost account or purchase).
• In-game profile information: an optional character/display name you may set within the game.
• In-game feedback: if you rate the game in the app, we store your star rating, the reasons you pick and any comment you type, with your player ID, game version and device platform.
• Other information: any other information you choose to provide to us.

We do not require your real name, email address or phone number to play the game.

1.2 Information we collect automatically

When you access our Services, we may also collect certain information automatically from you and/or your device, such as:

• Device information: your device identifiers, including advertising identifiers (such as Apple's IDFA, subject to your App Tracking Transparency choice, and Google's Advertising ID, subject to your Ads settings); IP address (which only allows us to determine your general geographic area and does not reveal your precise location); device type, operating system and version, device language, network and carrier data; your country/region; and application performance and de-bugging information (such as crash logs).
• Online activity information: details about your use of and interaction with our Services, such as in-game events, game version, your current progress, session length, purchases of Virtual Items (as recorded through platform receipts), and the date and time of activity.
• Gameplay information: your progress, the items on your board, the boosters and boosts you hold and use, the orders you complete, when you run out of energy, and what you buy, plus the time of each of these.
• Age information: a one-time neutral age screen collects your month and year of birth solely to confirm that you are at least 18 and to derive your region for legal purposes; the raw date of birth is not retained. We count you as 18 only once the month in which you turn 18 has ended. We keep only a yes/no confirmation that you passed the screen or, if you did not, a marker on your device so that the screen cannot simply be repeated with a different date.

Like most online services, any website we operate may use cookies and similar technologies to enhance your experience and prevent fraud. Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies; in that case, some aspects of the website may not function properly.

1.3 Information we obtain from third-party sources

• Platform sign-in: sign-in to the Services is provided through the platform's own services — Google Play Games Services on Android and Apple Game Center / Sign in with Apple on Apple devices. If you sign in, the platform provides us with an opaque platform identifier and, where applicable, your platform gamertag/avatar, in accordance with your settings with that platform.
• Purchases: all purchases are made through the Google Play Store (including Google Pay and Google Play billing) or the Apple App Store (including Apple Pay and Apple's in-app purchase system). Payment is collected and processed entirely by Google or Apple as the payment processor under their own terms and privacy policies; we never receive or store your payment card, bank or Google Pay/Apple Pay details. We receive transaction confirmations and related identifiers (receipts) from the relevant store, which we use to grant and restore your purchases and to prevent fraud.
• Advertising and attribution partners: the game displays third-party advertising served through advertising networks and mediation services, such as Google AdMob and other advertising partners we may integrate from time to time. These partners may collect or receive device information and advertising identifiers through their SDKs in order to serve, cap, measure and (where permitted and subject to your choices) personalize advertisements, in accordance with their own privacy policies. We may also receive information from analytics and attribution partners, for example telling us which advertising network and campaign an install originated from, so that we can measure our marketing.

2. How We Use the Information We Collect

We may use your personal information for the following purposes or as otherwise described at the time of collection:

• Service delivery, operations and account management: to provide, operate and improve the Services; save and restore your game progress; personalize the Services, including remembering your selections and preferences; enable security features; grant, restore and manage purchases; communicate with you about the Services, including service-related announcements, updates and support messages; and respond to your requests, questions and feedback.
• Tailoring your in-game experience: we use your gameplay information (see Section 1) and automated systems, which may include machine learning, to decide which gifts, boosters, in-game events and offers you receive, and when. For example, we may offer help when you are stuck. This is described in Section 5.7 of our Terms of Use. You can object at any time (see Section 5). If you are in India or the Philippines (or another place where the law requires consent for this), we tailor your experience only after asking for your consent in the game, and you can withdraw it at any time in Settings → Privacy.
• Shaping in-game rewards: in some in-game events, we use your game state (such as how much energy you have had over the last day, how full your board is, and what your current orders need) to choose the form of a reward you are about to earn, for example energy instead of a box. Every option is worth the same, the reward is shown before you earn it, and the same game state always leads to the same choice. We do not use your purchases or payment information for this.
• Improvement and development: to analyze and improve the Services and our business, understand how players use the game, tune game content and the game economy, diagnose and fix issues, and develop new products and services. As part of these activities, we may create aggregated, de-identified and/or anonymized data from personal information we collect, and we may use and share such data for our lawful business purposes.
• In-game feedback: to understand what players enjoy or find difficult and to improve the game. Comments are read only by our team and are never published.
• Marketing and advertising: we and our advertising partners may use device information and advertising identifiers to display third-party advertisements within the game, including, where permitted and subject to your choices and applicable consent requirements, interest-based (personalized) advertising, and to measure and cap advertising. We will only send marketing messages to you where we have your consent or as otherwise permitted by law, and you may opt out at any time using the unsubscribe option in the message or the in-app notification settings. We may also use information as described in Section 1.3 to measure the effectiveness of our own marketing campaigns.
• Compliance, protection and anti-fraud: to comply with applicable laws, lawful requests and legal process; protect our, your or others' rights, privacy, safety or property (including making and defending legal claims); enforce the terms that govern the Services; and prevent, investigate and deter fraudulent, harmful, unauthorized or illegal activity.
• With your consent: in some cases we may specifically ask for your consent to collect, use or share your personal information.
• Further uses: where a further use is not compatible with the initial purpose of collection, we will ask for your consent for that further use.

Legal bases (European Economic Area and United Kingdom)

If you are in the European Economic Area or the United Kingdom, our legal basis for tailoring your in-game experience is our legitimate interest in making the game more helpful and enjoyable and in offering relevant gifts and offers. Our legal basis for shaping in-game event rewards is our legitimate interest in making the game more helpful; it never changes the value of what you receive. Our legal basis for in-game feedback is our legitimate interest in improving the game; no consent is needed to type a comment, and you should not include anything you do not want us to hold. You have the right to object to each of these at any time (see Section 5). For our other purposes, we rely on performing our contract with you (providing the game and processing purchases), our legitimate interests (security, fraud prevention, analytics and improving the Services), compliance with legal obligations, or your consent where we ask for it (for example, for personalized advertising).

Other regions: for India, Australia, New Zealand and the Philippines, see Section 11A.

3. Sharing of Your Information

We may share your personal information with the following parties and as otherwise described in this Privacy Policy or at the time of collection:

• Affiliates: our corporate parent, subsidiaries and affiliates, or any other entity under common control with us.
• Service providers: third parties that provide services on our behalf or help us operate the Services or our business like Google AdMob, Firebase, Mixpanel (Mixpanel, Inc., analytics), LinkRunner and Singular (such as cloud hosting, analytics, crash reporting, attribution, and customer support tooling), under contractual obligations of confidentiality and data protection. A current list of our service providers and the countries where they process data is available on request from the Grievance Officer (Section 10).
• Payment processors: all payments are collected and processed directly by Google (Google Play / Google Pay) or Apple (App Store / Apple Pay) as described in Section 1.3; we do not receive your payment instrument details.
• Platform providers: if you sign in with Google Play Games Services, Apple Game Center or Sign in with Apple, or otherwise link your game to a platform account, we may share information with that platform as needed to operate the sign-in and cloud-save features; the platform's use of information is governed by its own privacy policy and your settings with it.
• Advertising and attribution partners: advertising networks and mediation services (such as Google AdMob and other partners we may integrate) for delivering, measuring and, subject to your choices, personalizing in-game advertising, and attribution partners for measuring our marketing campaigns — in each case subject to the opt-outs described in Sections 5 and 11.
• Business transferees: parties to a corporate transaction (merger, acquisition, financing, reorganization, bankruptcy or sale of assets), in which personal information may be among the assets transferred.
• Professional advisors: lawyers, auditors, bankers and insurers, where necessary in the course of the professional services they render to us.
• Authorities and others: law enforcement, government authorities and private parties, as we believe in good faith to be necessary or appropriate for compliance and protection purposes.
• With your consent: any other third party where you have instructed us or provided your consent.

Rating-comment text you type in the app is not sent to our analytics tools (Firebase, Mixpanel, Singular). Those tools receive only your star rating, which reasons you picked, and whether a comment was typed (yes or no). When you give a 5-star rating, the Apple or Google store rating card may open; what you enter there is handled by the store, and we do not see it.

4. Data Storage and International Transfers

We are an India-incorporated company and provide the Services in the markets where we choose to distribute them. Your personal information may be stored and processed in India, the United States, or any other country where we or our service providers operate infrastructure (for example, Mixpanel, Inc. processes analytics data in the United States). Where personal information is transferred to a country other than your own, we take steps designed to ensure the transfer complies with applicable law, including, where required, contractual and other lawful transfer safeguards, and we ask for your consent where the law of your country requires it for the transfer. Where the law of Australia, New Zealand, India or the Philippines applies, we also take reasonable steps to make sure overseas recipients protect your information consistently with that law, and we remain accountable for it. For personal information transferred from the European Economic Area or the United Kingdom to India, the United States or other countries, we rely on a lawful transfer mechanism such as an adequacy decision or standard contractual clauses (including the UK International Data Transfer Addendum), as applicable.

5. How to Exercise Your Rights

Users located in U.S. states with privacy laws applicable to us can find more information in the U.S. State Privacy Rights Notice (Section 11).

• In-app Privacy Center: the game includes a Privacy Center (Settings → Privacy) where you can manage consents, exercise "Do Not Sell or Share My Personal Information" preferences, download your data, and delete your data and account. Your data download and deletion include any in-game feedback you have given.
• Object to tailoring: you can turn off tailored gifts and offers at any time in the Privacy Center (Settings → Privacy), or by contacting us through Help & Support. If you turn it off, you still get the regular gifts and event rewards that everyone gets, but we stop using your gameplay information to choose gifts, offers and event reward forms for you. Turning it off does not undo a reward that has already been shown to you for a milestone.
• Marketing opt-out: you may opt out of marketing communications at any time using the unsubscribe option in the message or the in-app notification settings; service-related communications (such as purchase confirmations and security or policy notices) will continue as needed to operate the Services.
• Push notifications: you can turn off push notifications in the in-app settings or your device settings.
• Interest-based advertising opt-out: you can opt out of interest-based advertising at the device level by using "Allow Apps to Request to Track" / App Tracking Transparency settings (Apple iOS) or "Delete advertising ID" / "Opt out of Ads Personalization" (Android), and through the in-app "Do Not Sell or Share My Personal Information" control described in Section 11. Opting out does not remove advertising from the game; ads will simply be less relevant to you.
• EEA and UK rights: if you are in the European Economic Area or the United Kingdom, you also have the right to access your personal information, have it corrected or erased, restrict or object to its processing, and receive it in a portable format, and you may withdraw any consent you have given at any time. You may also complain to your local data protection authority (in the United Kingdom, the Information Commissioner's Office).
• Rights in India, Australia, New Zealand, the Philippines and other regions: see Section 11A.
• Support: you can also submit requests through the in-app Help & Support screen or by contacting the Grievance Officer (Section 10).

We may need to verify your identity before processing a request, and we may decline requests as permitted by applicable law. We respond to requests within the time the law requires and, where it sets no time, within 30 days.

6. Data Retention and Deletion

We retain personal information for as long as necessary to fulfil the purposes for which we collected it, including satisfying legal, accounting or reporting requirements, establishing or defending legal claims, and compliance and protection purposes. To determine appropriate retention periods, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether those purposes can be achieved by other means, and applicable legal requirements. When we no longer require personal information, we may delete it, anonymize it, or isolate it from further processing. You can delete your data and account at any time through the in-app Privacy Center, and deletion completes subject to a short grace period and legally required retention (for example, transaction records for tax and fraud-prevention purposes).

Where the law requires us to keep transaction and accounting records (for example under tax and company law), we keep them for the period the law requires (for example 8 years under Indian company law) and keep only the minimum needed. Because that is a legal duty, we may keep those records after you delete your Account.

We may delete an Account that has had no activity for 180 days (or 24 months if it holds paid, unspent items), after the notice described in Section 3.4 of the Terms of Use. When we delete an Account we delete or anonymize its personal information, subject to the retention described in this Section 6.

We keep a record of which gifts and offers were chosen for you, and why, for 12 months after the decision so that we can check that the system works fairly and answer your questions. After that we delete the record or make it anonymous.

We keep a record of which form of event reward was chosen for you and why for 90 days after the event ends, then delete it or keep only the reason without the game-state details. Aggregated, non-identifying measurements may be kept longer.

We keep your in-game feedback (star rating, reasons and any comment) for 24 months, then delete it or make it anonymous.

7. Children

The Services are for adults only. You must be at least 18 years old to use them. The game asks for your month and year of birth when you first open it, and if you are under 18 you cannot play. We do not knowingly collect personal information from anyone under 18. If you think someone under 18 has used the Services, contact us (Section 10) and we will delete their data. We also do not wait to be contacted: if we learn that someone under 18 has used the Services, we close the Account and delete the personal information linked to it, except what the law requires us to keep. Earlier versions of the game were open to younger players; we delete the personal information we hold about any player who is under 18 when we identify it. We do not track, profile or show targeted advertising to anyone we know to be under 18. Parents and guardians can contact us at any time (Section 10).

8. Privacy Policies of Linked Sites and Advertisers

The Services may contain links to websites, mobile applications and other online services from companies other than the Company, and may in the future contain advertisements. We are not responsible for the privacy practices or content of such third parties. If you have questions about how these third parties use your information, you should review their policies and contact them directly.

9. Security of Your Information

We have taken steps designed to protect your information. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information. If a data breach is likely to cause you serious harm, we will notify you and the regulators as the law requires (for example in Australia, New Zealand, India, the Philippines, the European Economic Area, the United Kingdom and U.S. states).

10. Contact Us / Grievance Officer

Support is available in-app via Settings → Help & Support. You may also contact:

Grievance Officer: Mr. Kamal Upadhyay

The Grievance Officer is also our contact for privacy and data protection complaints in every region. We acknowledge complaints promptly and respond within the time the law requires or, if the law sets none, within 30 days.

Email: grievance@virbhumi.com
Address: 101, D Definity Premises Co-operative Society Limited, Survey No. 95, Hissa No. CTS No. 364, Jayprakash Road No. 01, Goregaon East, Mumbai, Maharashtra, India – 400063

11. US State Privacy Rights Notice

Except as otherwise provided, this section applies to residents of U.S. states to the extent they have privacy laws applicable to us that grant their residents the rights described below (collectively, the "State Privacy Laws"). Not all rights listed below are included in each State Privacy Law, so all of the listed rights may not be afforded to all users. We may not be able to process your request if you do not provide sufficient detail to allow us to confirm your identity or understand and respond to it, and we may decline requests as permitted by law.

Your privacy rights. The State Privacy Laws may provide residents with some or all of the following rights:

• Information / Know: you can request information about the categories of personal information we have collected, the categories of sources, the business or commercial purposes for collection, the categories of third parties with which we share personal information, and the categories of personal information sold or disclosed for a business purpose.
• Access: you can request a copy of the personal information we have collected about you.
• Correction: you can ask us to correct inaccurate personal information.
• Deletion: you can ask us to delete the personal information we have collected from you.
• Appeal: you can appeal our denial of any request validly submitted.
• Opt-out of targeted advertising / sale / sharing: while we do not sell personal information for money, like many game companies we use services that help deliver interest-based advertisements to you, and the State Privacy Laws may classify our use of some of these services as "selling" or "sharing" your personal information with the advertising partners that provide them. You can opt out at any time using the persistent "Do Not Sell or Share My Personal Information" control in the in-app Privacy Center, and/or the device-level settings described in Section 5; we also honor Global Privacy Control (GPC) signals where applicable.
• Profiling / automated decision-making: we use your gameplay information to tailor your in-game experience, which is a form of profiling. This tailoring does not produce legal or similarly significant effects on you. It never affects your access to the Services or any item you already own, and it never decides whether you may play, and never removes anything you already own. Choosing the form of an event reward from your game state is a limited form of profiling. It has no legal or similarly significant effect on you: every option is worth the same and the choice is shown to you, with its reason, before you earn the reward. Where a price shown to you has been personalised, we tell you at the point of offer. Where a law requires a specific notice for personalized prices (for example in the State of New York), we show that notice in the form the law requires. You can object at any time (see Section 5).
• Nondiscrimination: you are entitled to exercise these rights free from discrimination as prohibited by the State Privacy Laws.

Consumers under 18: the Services are for adults only (Section 7), so we do not intentionally collect personal information from anyone under 18, and we do not have actual knowledge that we sell or share the personal information of consumers under 18 years of age.

Sensitive Personal Information: we do not intentionally collect or process Sensitive Personal Information (as defined under State Privacy Laws), and we do not process any such information for the purpose of inferring characteristics about consumers.

Categories of personal information. The personal information we collect corresponds to the following CCPA statutory categories: Identifiers (device identifiers including advertising identifiers, pseudonymous player ID, platform sign-in identifier); Internet or other electronic network activity information (online activity information, gameplay information, device/log information); Commercial information (platform purchase receipts); and other information you voluntarily provide (communication information, in-game feedback, optional character name). We disclose these categories to service providers, platform providers, business transferees, professional advisors, and authorities as described in Section 3, for the purposes described in Section 2, and we may "sell" or "share" (as defined by State Privacy Laws) Identifiers and Internet activity information with advertising partners for interest-based advertising purposes, subject to the opt-outs above.

Verification of identity; authorized agents. We may need to verify your identity to process requests and reserve the right to confirm your residency. Under some State Privacy Laws you may enable an authorized agent to make a request on your behalf; we may need to verify the agent's identity and authority, including a valid power of attorney or written signed permission, and confirmation of your own identity.

Shine the Light (California): California residents may request the names of third parties to which we have disclosed certain personal information for their own direct marketing purposes during the preceding calendar year (we make no such disclosures). Oregon and Minnesota: residents may request a list of specific third parties to which we have disclosed personal information. Submit requests through the in-app Support screen or to the Grievance Officer (Section 10).

11A. Notice for India, Australia, New Zealand, the Philippines and Other Regions

This section applies in addition to the rest of this Privacy Policy to people in these places, to the extent the local law applies to us. It does not limit any right the law of your country gives you.

India (Digital Personal Data Protection Act, 2023): we process your personal data with your consent or for other uses the Act allows. Where we rely on consent, we tell you what data we use and why, we ask for it in the game, and you can withdraw it as easily as you gave it in Settings → Privacy. You may ask us for a summary of the personal data we process and who we share it with, ask for it to be corrected, completed, updated or erased, nominate another person to exercise your rights if you die or become unable to act, and raise any complaint with the Grievance Officer (Section 10). If you are not satisfied with our response, you may complain to the Data Protection Board of India. We do not knowingly process the personal data of anyone under 18 (Section 7).

Australia (Privacy Act 1988 and the Australian Privacy Principles): we collect and use your information for the purposes in this Privacy Policy, we take reasonable steps to protect it, and we take reasonable steps to make sure overseas recipients handle it consistently with the Australian Privacy Principles. You may ask for access to and correction of your information. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner.

New Zealand (Privacy Act 2020 and the Information Privacy Principles): you may ask for access to and correction of your personal information. We disclose personal information overseas only as the Privacy Act permits. If you are not satisfied with our response to a complaint, you may contact the Office of the Privacy Commissioner.

Philippines (Data Privacy Act of 2012): you have the rights to be informed, to object, to access, to correct, to erasure or blocking, to data portability, to be indemnified for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your data, and to file a complaint with the National Privacy Commission. Where the law requires your consent, we ask for it in the game before we process your data for that purpose.

Other regions: where another country's law gives you privacy rights, we honor them as described in Section 5, and you may contact the Grievance Officer to exercise them.

12. Governing Law and Disputes

To the fullest extent permitted by the mandatory law of your country of residence, this Privacy Policy shall be governed by and construed in accordance with the laws of India, and the courts at Mumbai, India shall have exclusive jurisdiction over any matter not subject to arbitration, without prejudice to any mandatory rights you have under the laws of your own country of residence, which are not waived by this Policy. Any dispute arising out of or in relation to this Privacy Policy shall be resolved in accordance with the dispute resolution provisions of our Terms of Use (binding individual arbitration seated in Mumbai, India, with remote participation for overseas Users and a 30-day opt-out right). Nothing in this section limits your right to complain to a privacy or data protection regulator, or to bring a claim before a court, tribunal or consumer forum where the law of your country gives you that right and does not allow you to waive it.