Effective date: 22 October 2026 Version: 1.0

1. Data Controller

The developer and operator of THE 00 PROJECT – SPY GAME is:

• Name: Kienitz Pál
• Developer name: Conqnet Interactive
• Address: Szinyei M. P. utca 3/A, 2483, Hungary
• Email: pal.kienitz@icloud.com

Hereinafter referred to as the “Data Controller”.

2. Scope of This Privacy Policy

This Privacy Policy applies to the processing of personal data in connection with the THE 00 PROJECT – SPY GAME mobile applications for iOS and Android and its web application.

The Game is an interactive, spy-themed entertainment experience. Depending on the features used, it may involve email registration, GPS-based missions, image and text processing, gameplay analytics and paid digital episodes.

Personal data is processed in accordance with applicable laws, including Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), and applicable Hungarian and European Union legislation.

3. Categories of Personal Data We Process

3.1. Account and Registration Data

When a user registers by email, we may process:

• the user's email address;
• the account identifier and necessary profile information;
• technical information required for authentication, account management and security;
• settings necessary for the operation of the account.

The purposes of this processing are to create and maintain user accounts, authenticate users, save gameplay progress and provide the Game.

The technical method used to handle passwords depends on the authentication system implemented. The actual password storage and authentication arrangements must be verified before publication.

3.2. Gameplay and Mission Data

Depending on the features used, we may process:

• missions started and completed;
• answers, codes and solutions submitted by users;
• scores, experience points, virtual coins and achievements;
• gameplay progress and saved game state;
• timestamps and technical events required to operate missions.

These data are used to provide gameplay features, save progress, verify mission completion and improve the service.

3.3. Location Data and GPS

Certain missions use GPS-based features to activate missions or verify completion at a particular location.

The application requests access to location data for mission-related functionality. The intended operation of the Game does not require continuous background location tracking.

Location processing is limited to what is necessary for the relevant mission. The retention of precise location data is not assumed by default and must be determined according to the actual technical implementation and mission requirements.

Users may deny or revoke location permissions through their device settings. In that case, some GPS-based missions may not be available.

3.4. Photographs and Text Submissions

Some missions may require users to take or upload photographs or submit text responses.

Submitted content may be processed to execute, evaluate or verify the relevant mission. If a mission uses artificial intelligence, the necessary content may also be transmitted to OpenAI for processing.

Users should avoid submitting personal information that is not necessary for the mission. Users should not upload photographs of other people without an appropriate legal basis or permission where required.

The retention period for submitted images and text depends on the purpose of processing and the actual technical implementation.

3.5. Conqnet Analytics

The Game may use Conqnet Analytics to measure and improve application performance and user experience.

The intended analytics purposes include:

• measuring the use of gameplay features;
• analysing events related to starting and completing missions;
• improving the user experience;
• identifying technical problems and opportunities for improvement.

Depending on the actual configuration, analytics events may include information about the feature used, the time of an event and the session in which it occurred. The specific data fields collected, including whether persistent user or device identifiers are used, must be verified against the deployed configuration.

This Privacy Policy does not authorise advertising profiling or the sale of users' personal data.

Where analytics uses personal data, device identifiers or other information subject to consent requirements, an appropriate legal basis and, where required, a consent mechanism must be implemented. Non-essential tracking must not begin before any legally required consent has been obtained.

3.6. Purchases and Paid Episodes

The Game may offer individual digital episodes for purchase.

To complete purchases and verify entitlements, we may process transaction-related information, purchase records and technical data necessary to provide access to purchased content.

Payment information may also be processed by the relevant distribution platform, such as the Apple App Store or Google Play, or by a payment provider used for web purchases.

The actual payment provider, the information transferred and the applicable retention periods depend on the purchasing solution implemented. The availability of a purchase feature does not, by itself, mean that the Data Controller stores payment card details.

4. Legal Bases for Processing

The legal basis for each processing activity depends on its specific purpose and implementation.

An appropriate legal basis must be established for each actual processing activity. Where consent is required, it must be obtained separately, clearly and on the basis of adequate information.

5. Artificial Intelligence and OpenAI

Certain features of the Game use OpenAI services to process images and text.

Depending on the feature, content transmitted to OpenAI may include:

• photographs submitted by the user;
• text responses associated with a mission;
• instructions and context necessary to process the submission;
• technical information strictly necessary to provide the service.

The integration should be configured so that only the information necessary for the relevant feature is transmitted to OpenAI.

OpenAI's data handling and retention practices depend on the service used, API settings and applicable contractual terms. We therefore do not claim that all submitted content is immediately deleted or that all further processing by the service provider is excluded under every circumstance.

The data processing and international transfer arrangements applicable to the specific OpenAI service must be verified before publication.

Further information:

• OpenAI Privacy Policy: https://openai.com/policies/privacy-policy/
• OpenAI policies and service information: https://openai.com/policies/

6. Data Processors and Data Transfers

We may use external service providers to operate the Game, including:

• OpenAI for AI-assisted processing;
• Conqnet Analytics for analytics;
• hosting, database and authentication providers;
• payment providers and application stores, where required by the purchasing process.

The complete list of providers, their roles, the data they process and the locations where data is processed must be determined from the actual technical architecture.

Where personal data is transferred outside the European Economic Area, the transfer must comply with Chapter V of the GDPR, including any safeguards required by law.

We do not sell personal data.

7. Data Retention and Deletion

Personal data is retained only for as long as necessary to fulfil the relevant purpose or to comply with applicable legal retention requirements.

Retention periods must be determined and documented for:

• account data, according to account operation and legal obligations;
• gameplay data, according to the requirements for maintaining progress;
• location data, according to the needs of GPS-based features;
• photographs and text submissions, according to mission processing and related functionality;
• analytics data, according to the actual analytics configuration;
• purchase data, according to transaction processing and statutory requirements.

Deleting an account does not necessarily result in the immediate deletion of information held in backups or external service providers' systems.

8. Data Security

The Data Controller implements technical and organisational measures appropriate to the risks involved in processing personal data.

Depending on the system, these measures may include access restrictions, secure data transmission, authentication, permission management, software updates and security incident handling.

Although reasonable safeguards are implemented, complete security of internet-based transmission cannot be guaranteed.

9. Your Data Protection Rights

Subject to the conditions set out in the GDPR, users may have the right to:

• obtain information about the processing of their personal data and access those data;
• request correction of inaccurate data;
• request deletion of personal data;
• request restriction of processing;
• request data portability;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent.

Requests may be submitted to pal.kienitz@icloud.com.

We will respond within the time limits established by the GDPR. Where necessary, we may request proportionate information to verify the identity of the person making the request.

10. Complaints and Remedies

Users who believe that their personal data has been processed unlawfully may lodge a complaint with the competent supervisory authority or seek judicial remedies under applicable law.

The Hungarian data protection supervisory authority is:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

• Website: https://www.naih.hu/
• Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
• Email: ugyfelszolgalat@naih.hu

Users may also have the right to seek judicial remedies under the GDPR and applicable law.

11. Age Restriction and Minors

The intended minimum age for the Game is 16 years.

The Game is not intended for users under 16. The developer must configure the actual age rating, registration process and platform age settings accordingly.

A stated minimum age of 16 does not replace any applicable contractual, consumer protection or data protection requirements.

12. Changes to This Privacy Policy

The Data Controller may amend this Privacy Policy if the Game's features, technical implementation, service providers or applicable legal requirements change.

The current version will be made available within the Game or on its official website. Users will be appropriately informed of material changes.

Last updated: 22 October 2026