Privacy Policy

Novapex Studio ("we", "us", "our") is a digital studio operated by an independent developer based in India. We design and build mobile apps, games, websites, web apps, browser games and digital tools for people around the world. This Privacy Policy explains what information we collect when you visit novapexstudio.com (the "Site") or contact us, how we use it, who we share it with and the choices and rights you have.

It also serves as the base policy for our products. Each app or game may have its own privacy policy, linked from its page on this Site; where it does, that policy takes precedence for that product (see section 9).

In short

• We do not ask you to create an account to use this Site, and we do not sell your personal information.
• If you contact us, we receive what you send (name, email, message) and use it only to reply.
• Like every website, the Site receives technical data (such as your IP address and browser type) through our hosting provider, Cloudflare, mainly for security and performance.
• The Site currently shows no advertising. If that changes, this policy and our Cookie Policy will be updated first.
• You can exercise your privacy rights by emailing [email protected].

1. Information we collect

1.1 Information you give us

• Contact form. Your name, email address, chosen topic and message. The form is protected against spam by a hidden honeypot field. Your message is delivered by email to our support inbox and is not stored in any database, log or analytics tool on our side.
• Email. If you write to [email protected] or [email protected], we receive your email address, the content of your message and any attachments.
• Store reviews and support requests made through Google Play, the App Store or another store are governed by that store's privacy policy; we see only what the store shows to developers.

1.2 Information collected automatically

When you visit the Site, our hosting and security provider processes technical data to deliver pages and protect the Site: your IP address, approximate country derived from it, browser type and version, device type and operating system, language, the pages you request, the referring page, timestamps and basic performance and error data. We see this data in aggregated form in Cloudflare's dashboard; raw request logs are kept by Cloudflare for a short time for security purposes.

1.3 Cookies and similar technologies

The Site uses a small number of cookies and similar technologies (local storage, pixels, scripts). Strictly necessary ones keep the Site secure and remember choices such as your theme. Our Cookie Policy lists each category, provider and duration, and explains how to change your choices.

2. How we use information and our legal bases

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the legal basis shown for each purpose.

Purpose	Data	Legal basis (GDPR)
Answering your messages and support requests	Name, email, message	Our legitimate interest in responding to you; performance of a contract where you are a customer
Delivering, securing and debugging the Site (including blocking abuse and bots)	Technical data (section 1.2)	Legitimate interest in running a safe, reliable website
Handling privacy, copyright and other legal requests	The information you provide in the request	Legal obligation; legitimate interest in establishing or defending legal claims

We do not use your information for automated decisions that have legal or similarly significant effects on you.

3. Third parties we work with

We share information only with the service providers below, who process it on our behalf or as independent controllers under their own policies. We do not sell personal information.

Cloudflare (hosting, security, email routing)

The Site is hosted on Cloudflare Pages and delivered through Cloudflare's global network, which also provides DDoS protection, bot filtering and TLS encryption. Cloudflare processes the technical data described in section 1.2 and may set a strictly necessary security cookie. Our @novapexstudio.com mailboxes are delivered through Cloudflare Email Routing, so email you send us passes through Cloudflare's servers in transit. See the Cloudflare Privacy Policy, Cloudflare Cookie Policy and Cloudflare's GDPR commitments.

Resend (contact form delivery)

Messages sent through the contact form are delivered to our support inbox by Resend, a transactional email service. It processes the message only to deliver it. See the Resend privacy policy.

Other disclosures

We may disclose information if required by law, a court order or a competent authority; to investigate or prevent fraud, abuse or security incidents; to enforce our Terms of Use; or, if the studio or a product is transferred to another operator, to the successor, who will be bound by this policy for that data.

4. How long we keep information

• Contact-form messages and emails: kept in our mailbox for as long as needed to resolve your request, and normally deleted within 24 months of the last exchange. Threads needed to establish or defend legal claims may be kept longer.
• Privacy, copyright and legal requests: kept for up to 3 years as a record of how we handled them.
• Technical logs: held by Cloudflare for a short, rolling period for security and debugging; we retain only aggregated statistics.

5. International transfers

We are based in India and our providers operate globally, so your information may be processed in India, the United States, the European Union and other countries. Where data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, our providers rely on recognised safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and, where applicable, the EU-US Data Privacy Framework. Each provider describes its transfer mechanisms in the policy linked above.

6. Security

The Site is served only over HTTPS with HTTP Strict Transport Security, a Content Security Policy and other protective headers. It is a static website with no user database, which keeps the amount of data at risk small. Access to our mailboxes and provider accounts is protected with strong, unique passwords and two-factor authentication wherever the provider offers it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take reasonable technical and organisational measures appropriate to the small amount of data we hold.

7. Your rights and choices

The rights below depend on where you live. To exercise any of them, email [email protected] with "Privacy request" in the subject. We may ask for enough information to confirm that the request relates to you (for example, that you write from the email address in question). We respond within the time the law allows, usually within 30 days, and we will not discriminate against you for exercising your rights. You may also use an authorised agent where the law permits it.

7.1 European Economic Area, United Kingdom and Switzerland (GDPR, UK GDPR, FADP)

• Access to the personal data we hold about you, and a copy of it;
• Rectification of inaccurate data and completion of incomplete data;
• Erasure ("right to be forgotten") in the circumstances the law provides;
• Restriction of processing, and objection to processing based on legitimate interests, including direct marketing;
• Data portability of information you provided to us;
• Withdrawal of consent at any time where processing is based on consent (for example, advertising cookies via "Cookie settings"), without affecting earlier processing;
• Lodging a complaint with your local supervisory authority. We would appreciate the chance to resolve any concern first.

7.2 California (CCPA/CPRA) and other US states

If you are a California resident you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to limit the use of sensitive personal information (we do not collect any); and to opt out of the "sale" or "sharing" of personal information. We do not sell personal information for money. We do not currently share personal information for cross-context behavioural advertising.

Do Not Sell or Share My Personal Information. To opt out, enable the Global Privacy Control (GPC) signal in your browser, which we treat as an opt-out request where the law requires it, or email us at [email protected]. Residents of other US states with comparable privacy laws may exercise equivalent rights in the same way.

7.3 India (Digital Personal Data Protection Act, 2023)

If you are in India, you have the right to access a summary of the personal data we process and how it is used; to correction, completion, updating and erasure of your data; to withdraw consent where processing is based on consent; to nominate another person to exercise your rights if you are unable to; and to grievance redressal. Requests and grievances can be sent to [email protected], which acts as our point of contact for the purposes of the Act. If you are not satisfied with our response, you may approach the Data Protection Board of India.

7.4 Everyone

• You can use the Site without giving us any personal information; the contact form and email are optional.
• You can block or delete cookies in your browser at any time (see the Cookie Policy). Some strictly necessary features may stop working.
• You can ask us to delete the messages you have sent us.

8. Children

The Site and our general-audience products are not directed to children under 13, or under the minimum age for consenting to data processing in your country (for example 16 in some EU countries; in India anyone under 18 is a child and a parent or guardian must consent on their behalf), and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, or that a child is using one of our products in a way that involves their data, email [email protected] and we will delete the information promptly. Products aimed at children, if we ever publish any, will carry their own policy and comply with the applicable children's privacy rules.

9. Our apps and games

Each app or game we publish may have its own privacy policy, linked from its page on this Site at /apps/[app]/privacy and from its store listing. Those policies describe the data that specific product collects, the permissions it uses and the SDKs it contains (for example advertising or analytics providers), and they take precedence over this policy for that product. Where a product has no separate policy, this policy applies. Products distributed through app stores are also subject to the store's own privacy terms and controls, such as Google Play's Data safety section and Android's advertising ID settings.

10. Changes to this policy

We may update this policy when our services, providers or the law change. The "Last updated" date at the top shows the current version. For significant changes we will add a notice on the Site before they take effect. Continued use of the Site after a change means the updated policy applies.

11. Contact

Novapex Studio, operated by an independent developer based in India.
Privacy, data and legal requests: [email protected]
General enquiries: [email protected]
We usually reply within 2 to 3 business days.