Privacy Policy

This Privacy Policy describes how neowire GmbH ("neowire", "we", "us", "our") processes personal information when you use the Flikk website, mobile apps and related services (collectively, the "App"). It explains what we collect, how we use and share it, how long we keep it, and the rights you have over it.

You can access this Privacy Policy at any time at https://getflikk.com/privacy or under the "Privacy" heading within the App.

Last updated: October 5, 2026

Who We Are

neowire GmbH (full contact details in the imprint at https://getflikk.com/imprint) is the entity responsible for personal information collected through Flikk. In US privacy-law terminology, neowire is the "business."

This Privacy Policy covers Flikk. neowire also supplies games to other companies' apps, websites and services; the notice for that is at https://neowire.ai/partner/privacy and it does not apply to your use of Flikk.

If you have questions about this Privacy Policy or about our handling of your personal information, please contact us by email at privacy@neowire.ai or by post at the address in the "Contact" section below.

Data Protection Officer

We have appointed an external data protection officer. You can contact him directly about anything in this Privacy Policy; you do not have to come through us first.

• Nils Möllers, Keyed GmbH, Siemensstraße 12, 48341 Altenberge, Germany
• Email: info@keyed.de

Geographic Availability

Flikk is offered only to residents of the United States. We do not direct, market, or make Flikk available to users outside of the United States. If you are located outside the United States, please do not register for or use the App. If you become aware that a person located outside the United States has registered for Flikk, please contact us at privacy@neowire.ai so that we can close the account.

Although Flikk is offered only to US residents, our infrastructure is operated by neowire GmbH from Germany, and personal information collected through Flikk is stored and processed on servers located in the European Union — see "Where Your Personal Information Is Processed" below.

If you are visiting our website from outside the United States. Our website at https://getflikk.com is reachable worldwide, and visitors from outside the United States are shown a notice that Flikk is not available in their country. If you only browse the website without registering, the sole personal information we process about you is the technical data described under "Server Log Files" below, together with the strictly necessary storage described under "Cookies and Information Stored on Your Device". We do not analyse your visit, we set no analytics or advertising cookies, and we do not build a profile of you. Because we are established in Germany, the GDPR governs that processing wherever you are — see "Provisions for Users Under EU Law" below — and you can contact us at privacy@neowire.ai to exercise the rights it gives you.

Server Log Files

Each time our website or app back end is accessed, an automated system collects data and stores it in our server log files. The following may be collected: browser type and version used; the operating system of your device; your internet service provider; your IP address; the date and time of access; the page or endpoint requested and the page previously visited (referrer); and the volume of data transferred together with the delivery status code.

This data is technically necessary in order to deliver the website and the App to you, to ensure their stability and security, and to detect and defend against attacks. It is not stored together with the other personal information held for your account, and we do not use the log files to identify you as a person. IP addresses in server logs are deleted after 30 days (see "How Long We Keep Your Personal Information").

Cookies and Information Stored on Your Device

Both the website and the App store information on your device, or access information already stored there. In Germany, whether that storage and access is permitted is governed by § 25 TDDDG (Telecommunications Digital Services Data Protection Act, formerly the TTDSG); the subsequent processing of any personal information obtained is governed by the GDPR. In the other EU/EEA states the national implementations of Art. 5(3) of Directive 2002/58/EC apply; in the United Kingdom, Regulation 6 PECR applies.

On the website: the only storage we use is strictly necessary to deliver the site you asked for (§ 25(2) no. 2 TDDDG). That is the NEXT_LOCALE cookie, which remembers your language selection. We use no analytics cookies, no advertising cookies and no tracking pixels on the website, and there is therefore no cookie consent banner — there is nothing to consent to. You can block or delete cookies in your browser settings at any time; if you do, the site will simply stop remembering your language.

In the App — strictly necessary (§ 25(2) no. 2 TDDDG, no consent required): your sign-in session (Firebase Authentication), your language and currency settings, your consent status, technical information needed to deliver the content you asked for, and the device signals read by our fraud-prevention provider Verisoul when you sign in or request a payout. We treat that last one as strictly necessary because rewards are what Flikk pays out, and reward fraud — one person running many accounts, emulators, automation — is what would make paying them out impossible. Those signals are read at sign-in and payout only, are used to score that request for fraud, and are not used for advertising, analytics or personalisation. See "Automated Decision-Making and Fraud Prevention".

In the App — consent-based (§ 25(1) TDDDG): access to the device identifiers described under "Personal Information We Collect", including the Advertising ID (GAID/IDFA) and the identifiers set by our analytics and advertising SDKs, for the data flows described under "Advertising". The same consents decide whether our purchase provider receives those identifiers — see "Flikk Tokens". This takes place only where you have given the relevant consent in the App (Settings → Privacy & data → Your consents) — and on iOS, only where you have also accepted the App Tracking Transparency (ATT) prompt. You can reset or withhold the advertising identifier at any time in your device settings: on iOS by declining or revoking the ATT prompt for Flikk, and on Android by enabling "Delete advertising ID". See "How to opt out" for the full set of advertising choices.

You can withdraw any consent at any time with effect for the future, in the App under Settings → Privacy & data → Your consents. You can also delete the information stored on your device — for the App through your device's system settings, and for the website through your browser settings. If strictly necessary storage is deleted or blocked, some functions may not work, or may not work fully.

Personal Information We Collect

We collect the following personal information when you use Flikk. Where relevant, the corresponding category under the California Consumer Privacy Act ("CCPA") is shown in parentheses.

Authentication. We use Firebase Authentication (provided by Google Ireland Limited) to authenticate you. Where you register via email, your password is collected and stored by Firebase Authentication, not by us; we never see, store or have access to your password.

You provide directly when you register or use the App:

• Email address, nickname, date of birth, gender, profile picture if you register via social login and one is available (CCPA: identifiers; customer records information).
• If you contact us or use the AI support chat: the content of your message (CCPA: contents of communications between you and us as the intended recipient).
• If applicable, the email address used by you to receive payouts via Tremendous (CCPA: identifiers; commercial information).
• If you buy Flikk Tokens: which pack you bought, how many tokens it granted, when, and any refund the store made — see "Flikk Tokens" below (CCPA: commercial information).
• If your payout request is selected for additional verification and you are asked to verify your phone number: your phone number. We ourselves store only the verification result and a cryptographic hash of the number, not the number itself — see "Automated Decision-Making and Fraud Prevention" below (CCPA: identifiers).

Collected automatically when you use the App:

• Device identifiers including Firebase UID, Firebase App Instance ID and the Advertising ID (GAID/IDFA); push token (CCPA: identifiers).
• Technical information about your device: model and product name, operating system version, general device specifications, carrier name and country, platform (web, Android, iOS), language and currency settings (CCPA: internet or other electronic network activity).
• IP address allocated to your device (CCPA: identifiers; internet activity).
• Country (United States) and postal code, but not precise geolocation (CCPA: approximate geolocation).
• Information about your use of the App, such as which games you have played and how you played them, the games you have liked, games you have asked us to create, games you have reported, the rewards you have earned, the points you have exchanged for Flikk Tokens, the tokens you have spent and your interactions with marketing communications (CCPA: internet activity; commercial information).
• Campaign attribution data (source, campaign name) when you install Flikk from a marketing channel (CCPA: internet activity).

We do not collect, and Flikk is not designed to collect, the following: precise geolocation; government identification numbers; financial-account numbers, debit-card or credit-card numbers; racial or ethnic origin; religious or philosophical beliefs; union membership; genetic or biometric data; health information; data concerning sex life or sexual orientation; or other sensitive personal information beyond what is described under "Sensitive Personal Information" below. Please do not enter information of that kind into the AI support chat or into a game description — none of it is needed for either.

How We Use Your Personal Information

We use your personal information for the following purposes:

• To provide and operate Flikk — set up and maintain your account, identify you, deliver the AI-generated games available to you, generate a game where you ask us to, sell you Flikk Tokens and credit them to your balance, calculate and pay out your rewards, act on the reports you send us about a game, process your support requests.
• To prevent fraud and protect Flikk — detect and prevent fraudulent activity, enforce our Terms of Service, ensure the technical security of Flikk (see "Automated Decision-Making and Fraud Prevention" below).
• To improve Flikk — analyse pseudonymous use of the App to understand how it is used and to improve our services. We do this only where you have given the relevant consent or where local law otherwise permits.
• To display advertising within the App — serve ads around and between games through AppLovin MAX (see "Advertising" below).
• To send you marketing communications — send you marketing emails and push notifications and track your interactions with them, where you have given the relevant consent or where local law otherwise permits.
• To comply with our legal obligations — including tax retention obligations, and responses to lawful requests from authorities.
• To establish, exercise or defend legal claims.

Legal Bases for Processing

We are established in Germany, so the GDPR applies to the processing described in this Privacy Policy in addition to the US laws set out below, and applies wherever you are — see "Provisions for Users Under EU Law". The legal basis for each purpose is:

AI-Generated Games

Every game in Flikk is generated by neowire using AI-based generation tools rather than built by hand. The finished games are stored on our servers and delivered to your device when you play them. We do not transmit your personal information to any third-party AI provider in connection with the games you play, and no AI provider receives information about which games you play or how you play them. Which games are presented to you is decided by our own systems. Where you ask us to create a game for you, a different flow applies and what you write does leave our infrastructure — that is described separately under "Creating Your Own Game" below.

If you report a game. Because the games are generated rather than written by hand, the App lets you report one you believe is unlawful, harmful, infringing or otherwise wrong — whether we generated it on our own initiative or another user asked us to build it. We process what you tell us, which game it concerns, and which account the report came from (CCPA: contents of communications between you and us as the intended recipient). We keep the report linked to your account so that we can come back to you about it and so that we can tell a genuine report from an abusive one. We do not disclose your identity to the user who requested the game. What we may then do about a reported game is set out in our Terms of Service.

Playing Games

What we record while you play. When you play a game we record how the session went: which game it was, when you started and stopped, how far you got, scores and progress, in-game events, and technical signals about how the game ran on your device (CCPA: internet or other electronic network activity; commercial information). We use this to run the game, to save your progress, to determine your rewards, and to detect automated or manipulated play.

Games you like, and what you are shown next. You can "like" a game. We record which games you have liked and use that, together with what you have played, to choose which games to put in front of you (CCPA: internet or other electronic network activity). A like is not published: it is not shown to other users, it does not appear anywhere on the game, and it creates no public content. The one thing you can publish through Flikk is a game you ask us to create, which carries your nickname — see "Creating Your Own Game" below.

How your rewards are determined. Rewards on Flikk are not a published rate per action: there is no set of tasks to complete and no fixed schedule of what a given activity pays. Our systems determine what, if anything, is credited to your account, based on how the games have been played on your account — the session you just finished and the history of play on the account, taken together. Because that determination looks at your history and not only at what you have just done, we keep gameplay records for longer than a single session; the period is in the table under "How Long We Keep Your Personal Information". What the reward mechanism is as a matter of contract is set out in our Terms of Service rather than here.

The determination is made by our systems without a person looking at each case. All it decides is how many points are added to your balance. It does not produce legal effects concerning you and does not similarly significantly affect you, so it is not the kind of automated decision-making that Art. 22(1) GDPR restricts and no separate disclosure is owed for it. If you think a reward is wrong you can raise it with us and a person will look at it; the route is in our Terms of Service.

Advertising breaks. Our systems decide when an ad break fits, based on a natural pause in the game you are playing. That decision is about timing only: nothing about which ad you are shown is decided by us, and no gameplay information is sent to the advertising partners. What those partners do receive is described under "Advertising" below.

Creating Your Own Game

You can describe a game you would like to exist and spend Flikk Tokens to have it built, and spend tokens again to change it afterwards. If we build it, the finished game is published in the App for all users to play, with your nickname shown as its creator.

What we process. The description you write and the rest of your conversation with the Flikk AI about the game (CCPA: contents of communications between you and us as the intended recipient — the same category as the AI support chat); the generated game itself, and any changes you ask for to it; the tokens you spent and any tokens refunded; and our decision on whether to build the game, including the reason where we decline (CCPA: commercial information). We keep the decision record so that we can answer a question about it later.

What you write leaves our infrastructure. To build the game, your description is sent to the AI provider that runs the generation. It is sent for the sole purpose of generating the game you asked for, under a contract that prohibits the provider from using it for its own purposes. Please do not put personal information about yourself or anyone else into a game description — none of it is needed to build a game. The generation itself takes place in the European Union. The provider is a United States company, so it can reach that processing from outside the European Economic Area; that transfer is made on the basis of the EU Standard Contractual Clauses.

Your nickname becomes public, and it cannot be un-seen. A published game carries your nickname as its creator, visible to every other Flikk user and to anyone who opens a share link to it. This is different in kind from everything else in this Privacy Policy: it is a deliberate publication of information about you to people we do not control. You can ask us to take a game offline or to remove your creator credit from it by writing to hello@getflikk.com, and we delete the credit if you delete your account — but taking a game offline does not reach what has already been seen or shared: other users have already played it, and share links to it may already exist. If you would rather not be credited, do not publish a game.

If you delete your account. A game you created stays in the App, because other users are playing it. What we remove is the link between the game and you: the creator credit is anonymised, so the game remains playable but is no longer shown as yours, and the record connecting it to your account is erased with the rest of your account data after the 30-day grace period described under "How Long We Keep Your Personal Information". Tokens you spent on a game are not refunded when you close your account. The contractual side of this is in our Terms of Service.

Flikk Tokens

Flikk has two balances. Points are what you earn, by playing games and when other users play a game you created, and they are what gift cards cost. Flikk Tokens are what you spend to have a game built or to change one you created, and they can be used for nothing else. You get tokens in two ways: you buy a pack in the App's Token Shop, or you exchange points for them. The exchange only goes one way: tokens can never be turned back into points, into gift cards or into money. For every exchange we record how many points you gave and how many tokens you received (CCPA: commercial information).

Buying tokens

You can buy packs of tokens in the App's Token Shop. The purchase is made through the App Store or Google Play, which take your payment as the seller. We never receive your card or bank details, and neither does our purchase provider.

Our purchase provider, RevenueCat. RevenueCat checks your purchase with the store and tells our servers how many tokens to credit. Its software runs inside the App from the moment you sign in, whether or not you ever open the Token Shop. We set it up that way so that a purchase that completes later is still credited to your account, for example one approved through Ask to Buy, a delayed payment, or a purchase made on another device. While you are signed in, it receives your Flikk user ID, your IP address and basic information about your device and the App. If you buy, it also receives the store's record of the purchase (CCPA: identifiers; commercial information). It does not receive your name, your email address or anything about the games you play.

With your consent, your purchases are passed on for analytics and campaign measurement. If you have consented to analytics, the App gives RevenueCat the identifiers our analytics provider (Firebase) and our attribution provider (Adjust) already use for you. RevenueCat then reports each purchase and refund, with its value, to those two providers on our behalf (CCPA: identifiers; commercial information). If you have also consented to advertising, and on iOS accepted the App Tracking Transparency prompt, it also receives your Advertising ID (IDFA/GAID), your device's vendor identifier and your IP address. From there a purchase can reach our advertising partners as a conversion, in the same way as the other events described under "Marketing campaign measurement". If you withdraw a consent, the identifiers that depend on it are deleted from RevenueCat and nothing further is passed on.

What we keep. For each purchase we record the pack, the number of tokens, when the store reported it, and whether it was a test purchase. We record a refund the same way, as tokens taken back. If the store refunds a purchase after you have spent the tokens, they are still taken back, and your token balance can go below zero. We keep these records as part of our books — see "How Long We Keep Your Personal Information".

Advertising

Flikk uses two distinct forms of advertising data flows. Both are described here so you can understand what is shared, with whom, and how to opt out.

In-app advertising (AppLovin MAX)

We use AppLovin MAX (provided by AppLovin Corporation), an ad-mediation platform, to display advertisements around and between games. AppLovin MAX connects to a range of advertising networks ("demand partners") that bid to serve ads to you.

When an ad is shown:

• AppLovin MAX and the participating demand partners receive your Advertising ID (GAID/IDFA), IP address, basic device information (model, operating system, language) and app-context information (e.g., that the ad is being shown in Flikk).
• They use this information to select and serve a relevant ad, to measure ad performance and frequency, and — where you have not opted out — for cross-context behavioral advertising (i.e., showing you ads based on your activity across other apps and websites).
• We receive ad revenue in return for ads being shown to you in Flikk.

Because we receive valuable consideration (ad revenue) and demand partners receive personal information (device identifiers) for their own advertising purposes, this constitutes both a "sale" and a "sharing" of personal information under the CCPA. You have the right to opt out — see "Sale and Sharing of Personal Information" below.

The current list of AppLovin MAX demand partners we use is available at https://getflikk.com/partners. The list is updated as partners are added or removed.

AppLovin's privacy policy is available at https://www.applovin.com/privacy/.

Marketing campaign measurement

To measure the performance of our advertising campaigns and to find new users similar to those who already enjoy Flikk, we work with advertising and attribution partners. These partners receive limited information about your install and certain in-app events (such as registration, first reward earned or a token purchase, with its value), which they use both on our behalf — to measure the performance of our campaigns — and on their own behalf — to improve their advertising and audience models, including to identify similar audiences for our future campaigns.

The data transmitted is limited to pseudonymous identifiers (such as your Firebase App Instance ID, your Advertising ID, or a hashed installation token) and event names, together with the value of a token purchase. We do not transmit your email address, account information, or gameplay history to these partners. The data flows through our analytics provider (Firebase) and our attribution provider (Adjust) — token purchases reach them through our purchase provider, RevenueCat — which forward conversion events to our advertising partners on our behalf.

Under the CCPA, this also constitutes "sharing" of personal information for cross-context behavioral advertising.

The current list of advertising and attribution partners is available at https://getflikk.com/partners.

How to opt out

You can opt out of both forms of advertising sharing/sale at any time by:

• turning off the "Advertising" toggle in the App's privacy settings (Settings → Privacy & data → Your consents) — this disables AppLovin MAX-mediated ads (you will still see non-personalized ads where required for the App to function) and disables outbound conversion sharing with our marketing partners;
• on iOS, declining or revoking the App Tracking Transparency (ATT) permission for Flikk;
• on Android, enabling "Delete advertising ID" (or the equivalent setting) in your device settings;
• sending a "Do Not Sell or Share" request to privacy@neowire.ai;

Who We Share Your Personal Information With

Recipients acting on our behalf (service providers)

We use the following recipients to help us provide Flikk. They process personal information on our behalf under written contracts that require them to process the data only on our instructions, to keep it confidential, to implement appropriate security measures, and to engage sub-processors only with our authorisation. For US users, every recipient in this section is a service provider or contractor under the CCPA, so disclosing personal information to them is neither a "sale" nor a "share". The flows that are a sale or a share are the advertising ones, described under "Advertising" and "Sale and Sharing of Personal Information".

We name a provider where naming it is what makes this notice useful to you: because you deal with it directly, because its technology stores or reads something on your device, or because its own notice governs part of what happens to your data. For everything else we give the category of provider rather than the company, which is what data-protection law asks of a privacy notice. You have the right to be told the actual identity of the recipients, not only their categories (Art. 15(1)(c) GDPR). If you want to know which specific provider handles a given category, ask us at privacy@neowire.ai and we will tell you, free of charge, within one month.

Named:

• Firebase Authentication (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — Authenticates you and holds your password, which we never see, together with the social-login plumbing. https://firebase.google.com/support/privacy
• Firebase Analytics (Google Ireland Limited) — App analytics, and the source of the conversion events reported to Google Ads for campaign measurement (see "Marketing campaign measurement" above). It reads and stores identifiers on your device under your consent. https://firebase.google.com/support/privacy
• Adjust (Adjust GmbH, Saarbrücker Str. 38a, 10405 Berlin, Germany) — Mobile analytics and attribution. It reads on-device identifiers under your consent and forwards conversion events to our advertising partners on our behalf. Data is processed within the EU. https://www.adjust.com/terms/privacy-policy/
• Prelude (DING NEGOCE SAS, 82 rue Dutot, 75015 Paris, France) — Phone (SMS) verification. Its SDK inside the App is what sends you the verification code, so you deal with it directly. We do not store your phone number: we retain only the verification result and a cryptographic hash of the number, which lets us detect duplicate accounts. Data is processed within the EU. https://prelude-so.notion.site/Privacy-Policy-2c60b602719a80d8944cf5ca632dadea
• Tremendous (Tremendous, LLC, 228 Park Ave S #62949, New York, NY 10003, USA) — Issues your gift cards and reward payouts and emails them to you, so you deal with it directly. Your payout email address is transmitted. https://www.tremendous.com/privacy
• RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA) — Handles in-app purchases of Flikk Tokens. We name it because its software runs inside the App on your device from the moment you sign in. It receives your Flikk user ID, your IP address, basic device and app information and, when you buy, the store's record of the purchase. With your consent, it also receives the identifiers described there and passes your purchases on to our analytics and attribution providers. Data is processed in the United States. See "Flikk Tokens" above. https://www.revenuecat.com/privacy
• Sentry (Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) — Error and performance diagnostics. We name it because its script is loaded into your own browser on the web pages we serve you: the AI support chat (support.getflikk.com) and the account management page — see "Account Management Page" below. On the support chat it receives the address of the page you are on — including the chatId parameter that identifies a conversation, but not the access token, which we keep in the part of the address that browsers never transmit — technical information about your browser and device, page-load and navigation timing for every visit, and, when something goes wrong, the error together with the console output and the network calls that led up to it. Your IP address reaches Sentry's servers because your browser connects to them directly, but "Prevent Storing of IP Addresses" is enabled on all our Sentry projects, so it is not stored with the report. Your session is not recorded. Data is processed in Sentry's EU region. https://sentry.io/privacy/

By category:

• Our cloud hosting provider (EU) — Hosting, databases and storage. Your account data is held on its servers in the European Union. Support access from outside the EEA rests on the EU–US Data Privacy Framework and the Standard Contractual Clauses.
• Our content delivery and network security provider (EU and US) — Carries the App's traffic and defends it against attack. It handles your requests in transit and keeps short-lived request logs — see "Where Your Personal Information Is Processed". Transfers to the United States rest on the EU–US Data Privacy Framework and the Standard Contractual Clauses.
• Our AI providers (EU and US) — Generate the answers in the AI support chat, and generate a game where you ask us to create one. Transfers to the United States rest on the EU–US Data Privacy Framework or the Standard Contractual Clauses. See "AI Support Chat" and "Creating Your Own Game".
• Our fraud-detection and account-verification providers (EU and US) — Assess sign-ins and payout requests for signs of fraud, and return a risk score and supporting signals. Transfers outside the EEA rest on the Standard Contractual Clauses. See "Automated Decision-Making and Fraud Prevention".
• Our transactional email provider (EU) — Sends account emails and, where you have consented, marketing emails.
• Our monitoring provider (EU) — Receives the technical telemetry and logs we use to keep the App running.
• Our internal alerting tool (US) — Receives our engineers' error alerts. Transfers rest on the provider's binding corporate rules under Art. 46(2)(b) GDPR.
• The AI assistant our staff use (US) and our staff email and identity systems (EU and US) — The tools our own people work in when they handle your support request or administer your account. Transfers rest on the Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

What we do to limit what these providers see. The last four categories exist to keep the App running, not to do anything with you in particular. We do not hand them your account record. What reaches them is what our own systems write into a log line or an alert — a request, an error, an identifier — and we write those to record what happened rather than who it happened to.

The limits of that approach. There is no redaction layer in front of the alerting tool or the monitoring provider. The control is what our code writes in the first place, plus how long it is kept: 30 days for logs and alerts, and the other periods in the table under "How Long We Keep Your Personal Information". If a log line contains something it should not, that provider holds it until the retention period runs out. We would rather tell you that than describe a filter that does not exist.

Recipients acting on their own behalf (independent businesses / third parties)

The following recipients process personal information as independent businesses (third parties), because they use the data for their own advertising or service purposes. For these recipients you should consult their own privacy policies for full information.

• AppLovin and its mediated demand partners — In-app advertising. See "Advertising" above. Current list at https://getflikk.com/partners.
• Marketing and attribution partners — Cross-context behavioral advertising for our user-acquisition campaigns. Current list at https://getflikk.com/partners.
• Social login providers (Google, Apple) — Where you use social login to register. Each provider acts as an independent business for the processing it performs on its own platform.
• App Store and Google Play (Apple, Google) — When you buy Flikk Tokens, the store sells you the pack, takes your payment and handles any refund under its own terms and privacy policy. You deal with the store directly.

Other recipients

We may also disclose personal information:

• to public authorities where required by law (for example, law enforcement, regulators, tax authorities);
• to professional advisors (lawyers, accountants, auditors) under confidentiality obligations, where necessary for the establishment, exercise or defence of legal claims;
• in connection with a corporate transaction (sale, merger, restructuring or insolvency), in which case customer information may be transferred with the relevant part of the business;
• to anyone you send a share link to. If you share a game from Flikk, the page that opens shows your nickname ("Shared by @…") together with your automatically generated profile picture, above the game you shared. Nothing else from your account — not your email address, your balance, your gameplay history or the points you have spent — appears on a share page. Anyone holding the link can open it, and link previews may be generated by the messaging or social platform you send it through, so please only share links with people you intend to.
• to every other user of the App, if you create a game. A game you ask us to build is published with your nickname shown as its creator. That is a deliberate publication, it reaches people we do not control, and it cannot be undone afterwards — see "Creating Your Own Game" above, which sets out what that means before you decide to create one.

Account Management Page (getflikk.com/usermgmt)

The "account management" page (/usermgmt) handles the links in our account emails — for example resetting your password, confirming your email address, or reversing an email change. It is only opened when you click such a link; it is not part of an ordinary visit to the website and is blocked from search engines.

Two third-party scripts are loaded on this page, without which the function cannot be provided:

• Firebase JavaScript SDK, loaded from www.gstatic.com (a content delivery network operated by Google LLC). The SDK carries out the account action you requested against Firebase Authentication. In doing so, the one-time code contained in your email link is processed, along with your IP address and technical information about your browser.
• Sentry, loaded from js-de.sentry-cdn.com (Functional Software, Inc., d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA; processed in Sentry's EU region). Sentry is used solely for error diagnostics: if a technical error occurs on this page, the error message, the address requested and technical information about your browser and device are transmitted to Sentry so that we can fix the cause. Your IP address necessarily reaches Sentry's servers because your browser connects to them directly, but the "Prevent Storing of IP Addresses" setting is enabled on our Sentry projects, so it is not stored with the error report. Sentry is enabled for error reporting only: your session is not recorded, and no usage or performance data is transmitted — data is sent only when an error actually occurs.

Where Your Personal Information Is Processed

Flikk's core infrastructure is operated by neowire GmbH from Germany, and personal information about US users is stored on Google Cloud servers located in the European Union. Two things qualify that, and we would rather state them than let "processed in the EU" stand as a bare claim. Our content delivery and network security provider serves from the edge location nearest to you, and every Flikk user is in the United States — so the handling of your requests in transit takes place in the United States for practically our whole user base, and that provider's short-lived request logs may sit in a US data centre. And where you ask us to create a game, what you write is sent to the AI provider that generates it, and the generation runs in the European Union — though that provider is a United States company and can reach it from there. Storage of your account data stays in the European Union.

Some of the recipients described above are located outside the European Economic Area. Where personal information about you is transmitted to them, the transmission is made from our EU-based infrastructure and rests on one of the following safeguards under Chapter V of the GDPR:

You can ask us for a copy of the safeguards that apply to a particular transfer at privacy@neowire.ai.

Within the European Union, your personal information benefits from the protections of European data-protection law in addition to your rights under US law as set out in this Privacy Policy.

How Long We Keep Your Personal Information

We store personal information only for as long as we need it for the purposes for which it was collected, or for as long as we are permitted or required to by law. The following retention periods apply:

If you request the deletion of your account, the deletion is scheduled for execution after a 30-day grace period during which you may cancel the request. After that period your personal information will be permanently erased from our systems and from those of our service providers, with the exception of data subject to the statutory retention obligations above (which is then restricted from further processing). Two things that erasure does not reach are named in the table above and are not statutory retention: our own analytics data warehouse, which is deleted in full on 1 December 2026, and the log and alert entries held by our monitoring and alerting providers until their retention periods run out.

How We Protect Your Personal Information

We implement appropriate technical and organisational measures to protect your personal information against loss, unauthorised access, alteration and misuse — including modern encryption in transit and at rest, access controls, logging, and regular review of our security posture. These measures are regularly tested and adapted to technological developments.

Where we use service providers to process your data, we contractually require them to maintain at least equivalent security measures. Authentication credentials (passwords) are managed by Firebase Authentication, not by us. No system can guarantee absolute security; we encourage you to use a strong, unique password and to protect your device against unauthorised access.

Automated Decision-Making and Fraud Prevention

We use the fraud-prevention service Verisoul to assess sign-in and payout attempts for indicators of fraudulent activity. Its SDK runs inside the App and reads the device signals described under "Cookies and Information Stored on Your Device"; your user ID, email address and a session identifier are transmitted to it, and it returns a risk score and a set of underlying fraud signals. We retain this output alongside your account.

In addition, selected payout requests undergo enhanced verification before they are processed. Where your payout request is selected for review, we may: (a) transmit your email address to an account-verification provider, which analyses the digital footprint associated with the address and returns a risk score and underlying signals; and (b) ask you to verify your phone number, in which case the number is transmitted to our verification partner Prelude, which sends you a verification code and confirms the result. We retain the responses from these services (risk scores and signals) alongside your account. We do not store your phone number: once verified, we retain only the verification result and a cryptographic hash of the number, which lets us detect when the same number is used across multiple accounts without keeping the number itself.

These scores and signals are treated as inputs to our review, not as final decisions. No payout or account decision that produces legal effects concerning you, or similarly significantly affects you, is made solely on the basis of automated processing. Where the score indicates an elevated risk, a member of our staff reviews the case before any restrictive measure (such as suspension or refusal of a payout) is taken. You can ask us for human review, express your point of view and contest any decision in this context by contacting privacy@neowire.ai.

AI Support Chat

Description and purpose. In the contact section of the App, you can use our AI support chat to get assistance with your questions, so that enquiries can be answered quickly and efficiently. When you use the AI support chat, the content of your message is transmitted to our AI provider in order to generate a response. Your email address is not transmitted to the AI provider. The chat is powered by large-language-model providers acting as our service providers under contracts that prohibit them from using your data for their own purposes. If necessary, a human support agent may contact you via email to follow up on your issue.

Data processed. We process the content of your chat messages, including any personal information you choose to enter, together with technical information about your use (such as the time of the request and the connection data technically required for transmission). Where a technical error occurs on the chat page, the error, the page address and the console output leading up to it are also transmitted to Sentry for diagnosis — see Sentry under "Who We Share Your Personal Information With".

Where it is processed. Our contractual partners for the AI support chat are established in the European Union, and the chat is operated from our EU-based infrastructure — see "Where Your Personal Information Is Processed".

Retention. Chat content is deleted 3 months after the support interaction (see "How Long We Keep Your Personal Information"), and otherwise as soon as it is no longer needed for the purpose for which it was collected.

Voluntary. Using the AI support chat is voluntary; you are under no obligation to provide us with this data and can instead email our support team at hello@getflikk.com at any time. Please do not enter your password or other credentials into the chat, and please do not enter sensitive personal information (such as health information) — none of it is needed in order to deal with your matter.

Contacting Us by Email and Post

If you contact us by email (privacy@neowire.ai) or by post, we process the information you send us — in particular your email address or postal address, your name where you provide it, and the content of your message — solely in order to deal with your matter and in case of any follow-up questions. It is not passed on to unauthorised third parties. We delete the correspondence once your matter has been finally resolved and no statutory retention obligations apply; the retention periods are set out in the table under "How Long We Keep Your Personal Information".

Please note that emails are generally sent unencrypted and that we cannot accept responsibility for the transmission path between you and receipt on our server. You should therefore not send us sensitive information by unencrypted email.

Marketing Communications

We may send you marketing emails and push notifications, where you have given the relevant consent or where local law otherwise permits, and we may track your interactions with those communications to improve their relevance. So that we can demonstrate the basis on which we contacted you, we record which consent you gave or withdrew and when. You can unsubscribe from marketing communications at any time using the link in any marketing email, or in the App settings, or by contacting us at privacy@neowire.ai; unsubscribing is free of charge and requires no reason. Even after unsubscribing, we may still send you transactional messages (such as payout confirmations) that you cannot opt out of while you have an active account.

Children's Privacy

Flikk is intended for users aged 18 or over. We do not knowingly collect personal information from anyone under 18. If you believe that a person under 18 has provided us with personal information, please contact us at privacy@neowire.ai so that we can delete it.

We do not knowingly sell or share the personal information of US users under the age of 16 within the meaning of the CCPA.

Provisions for Users Under EU Law

Flikk is offered only in the United States, so you are almost certainly reading this from there. European data-protection law still governs what we do with your information, because we are established in Germany and the GDPR follows the establishment of the controller rather than the residence of the user (Art. 3(1) GDPR). The rights below are therefore available to you wherever you are, in addition to the US rights set out in the next part of this Privacy Policy. Where the two overlap, you may use whichever is more favourable to you.

• Access (Art. 15) — confirmation of whether we process personal information about you, a copy of it, and the details of the processing. If you ask, we will name the specific providers behind the categories used above, not just the categories.
• Rectification (Art. 16) — correction of inaccurate information, and completion of incomplete information.
• Erasure (Art. 17) — deletion of your personal information, subject to the statutory retention duties in the table above.
• Restriction of processing (Art. 18) — in the cases the Article sets out, for example while a correction request is being checked.
• Portability (Art. 20) — a copy of the information you gave us, in a structured, commonly used and machine-readable format.
• Objection (Art. 21) — you may object at any time to processing we carry out on the basis of our legitimate interests, on grounds relating to your particular situation. Those purposes are marked Art. 6(1)(f) in the table under "Legal Bases for Processing". If you object we will stop, unless we can show compelling legitimate grounds that override your interests, or the processing is needed for legal claims. Where we process your information for direct marketing, you may object at any time and without giving a reason, and we will stop.
• Withdrawal of consent (Art. 7(3)) — where we process on the basis of your consent, you may withdraw it at any time, with effect for the future. Withdrawing does not affect the lawfulness of what we did before. The advertising and analytics consents can be withdrawn in the App under Settings → Privacy & data → Your consents, and marketing consent through the unsubscribe link in any marketing email.
• Not to be subject to automated decisions (Art. 22) — we do not take decisions producing legal effects concerning you, or similarly significantly affecting you, on a solely automated basis. See "Automated Decision-Making and Fraud Prevention" and "Playing Games".

To exercise any of these rights, contact us at privacy@neowire.ai or write to the address in the "Contact" section. You can also contact our data protection officer directly — see "Data Protection Officer" above.

Right to lodge a complaint (Art. 77). You may complain to a supervisory authority, in particular in the Member State of your habitual residence or place of work or of the alleged infringement. Because we are established in Monheim am Rhein, the authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany — https://www.ldi.nrw.de

One thing that does not follow from this. The rules on storing and reading information on your device — the ePrivacy Directive and § 25(1) TDDDG — apply according to where the device is, not where we are established. Our website therefore still needs no cookie banner: the only thing it stores is the NEXT_LOCALE cookie that remembers your language, which is strictly necessary to deliver the page you asked for. The consents described in this Privacy Policy are the ones the App takes — see "Cookies and Information Stored on Your Device", which sets out separately what the App stores or reads without consent because it is strictly necessary, and what it accesses only with your consent — and they are unaffected.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The most current version is always available at https://getflikk.com/privacy and via the "Privacy" heading within the App. If we make material changes, we will inform you through a notification in the App or via email. Where the changes require new consent, we will ask you to consent to the amended Privacy Policy again.

Contact

For any questions or to exercise your rights under this Privacy Policy, contact us at:

• Email: privacy@neowire.ai
• Post: neowire GmbH, Rheinpromenade 13, 40789 Monheim am Rhein, Germany

Notices and Rights Under US Privacy Laws

This section sets out additional information for US users. Depending on your state of residence, your rights and our obligations are governed by one or more of the following laws: the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"); the Virginia Consumer Data Protection Act (VCDPA); the Colorado Privacy Act (CPA); the Connecticut Data Privacy Act (CTDPA); the Utah Consumer Privacy Act (UCPA); the Texas Data Privacy and Security Act (TDPSA); the Oregon Consumer Privacy Act (OCPA); the Montana Consumer Data Privacy Act; the Iowa Consumer Data Protection Act; the Tennessee Information Protection Act; the Indiana Consumer Data Protection Act; the Delaware Personal Data Privacy Act; the New Hampshire Privacy Act; the New Jersey Data Privacy Act; the Maryland Online Data Privacy Act; the Minnesota Consumer Data Privacy Act; the Rhode Island Data Transparency and Privacy Protection Act; the Kentucky Consumer Data Protection Act; or other applicable state laws.

This section serves as our notice at collection for the purposes of the CCPA.

Categories of Personal Information We Collect

In the past twelve months, we have collected the following categories of personal information about US users:

• Identifiers — email address, nickname, device identifiers (Firebase UID, Firebase App Instance ID, Advertising ID), push token, IP address, pseudonymous user identifier, phone number (only where you are asked to verify it during a payout review; retained only as a cryptographic hash).
• Customer records information — date of birth, gender.
• Commercial information — rewards earned, points exchanged for Flikk Tokens, Flikk Tokens bought, spent and refunded, payouts requested and received, games played, games you asked us to create.
• Internet or other electronic network activity information — interactions with Flikk, the games you have liked, technical device information, language and currency settings, campaign attribution data, ad-interaction data.
• Geolocation data — country (United States) and postal code (not precise geolocation).
• Sensory information — none.
• Professional or employment-related information — none.
• Education information — none.
• Inferences drawn from the above — limited, for the purpose of selecting and recommending games, determining rewards, and detecting fraud.

Sensitive Personal Information

The CCPA's category of "sensitive personal information" includes specific data types such as government IDs, account log-in credentials, precise geolocation, racial or ethnic origin, religious beliefs, health information, contents of certain communications, and data concerning sex life or sexual orientation. Of these, we collect only:

• Contents of communications between you and us where we are the intended recipient — the messages you send to our AI support chat or to our human support agents, the description you write when you ask us to create a game, and what you tell us when you report a game. Used solely to handle your support request, to build the game you asked for, or to act on your report.

We do not collect or store account log-in credentials, since authentication is performed by Firebase Authentication and your password is not visible to us.

We do not collect government IDs, financial-account numbers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data, health information, or data concerning sex life or sexual orientation.

Sources of Personal Information

We collect personal information from:

• You directly (when you register, set preferences, or contact us);
• Your device automatically (when you use the App, and from the strictly necessary cookie described under "Cookies and Information Stored on Your Device" when you visit the website);
• Social login providers (Google, Apple) where you choose to register via social login;
• Our service providers (our analytics, attribution, fraud-detection and account-verification, reward-issuance and purchase providers — for the purpose of operating Flikk; the purchase provider passes on what the App Store or Google Play reports about a purchase you made).

Purposes of Collection and Use

We use personal information for the purposes set out above and, in the language of US privacy laws, for the following business purposes: providing Flikk; auditing related to consumer interactions; detecting security incidents and protecting against fraudulent or illegal activity; debugging and repair; performing services on our behalf; serving and measuring advertising; internal research and quality assurance; complying with legal obligations.

Categories of Recipients

We disclose personal information to the categories of recipients listed in the section "Who We Share Your Personal Information With" above, consisting of:

• Service providers and contractors under the CCPA — listed under "Recipients acting on our behalf";
• Third parties / other businesses — AppLovin and its mediated demand partners; our marketing and attribution partners; social login providers; the App Store and Google Play, for purchases you make through them; public authorities where required by law; and parties to a corporate transaction.

Sale and Sharing of Personal Information

For the purposes of the CCPA and equivalent state laws:

We "sell" and "share" personal information for advertising purposes. Specifically:

• In-app advertising through AppLovin MAX. AppLovin and its mediated demand partners receive your Advertising ID, IP address and basic device information when ads are shown to you in Flikk, and we receive ad revenue in return. This constitutes both a "sale" (because we receive monetary consideration) and a "sharing" (because the data is used for cross-context behavioral advertising) of personal information under the CCPA.
• Marketing campaign measurement. We share limited install and conversion data (pseudonymous identifiers, event names and the value of token purchases) with our marketing and attribution partners for cross-context behavioral advertising as defined by the CCPA. We do not share your email address, account information, or gameplay history with these partners.

The categories of personal information involved are: identifiers (Advertising ID, Firebase App Instance ID, hashed installation token, IP address) and internet or other electronic network activity information (ad-interaction events, install and conversion events).

The categories of third parties to whom personal information is sold or shared are: advertising networks, ad-mediation platforms, mobile measurement and attribution providers, and marketing analytics providers. The current list is at https://getflikk.com/partners.

You have the right to opt out of this sale and sharing at any time by:

• turning off the "Advertising" toggle in the App's privacy settings (Settings → Privacy & data → Your consents);
• on iOS, declining or revoking the App Tracking Transparency (ATT) permission for Flikk;
• on Android, enabling "Delete advertising ID" in your device settings;
• sending a "Do Not Sell or Share" request to privacy@neowire.ai;

We do not knowingly sell or share the personal information of US users under the age of 16.

Retention

We retain personal information for the periods set out in the section "How Long We Keep Your Personal Information" above.

Your Rights

Subject to the state law that applies to you, you have one or more of the following rights:

• Right to know / right of access — what personal information we have collected about you, the sources, the purposes, and the categories of recipients.
• Right to delete — request deletion of personal information we have collected from you.
• Right to correct — request correction of inaccurate personal information.
• Right to portability — receive a copy of your personal information in a portable format.
• Right to opt out of the sale or sharing of personal information — see "Sale and Sharing of Personal Information" above.
• Right to limit the use and disclosure of sensitive personal information — to direct us to use sensitive personal information only for the limited purposes permitted by law. As explained above, we already use the limited sensitive personal information we hold only for permitted purposes.
• Right to opt out of profiling — that produces legal or similarly significant effects (under VCDPA, CPA, CTDPA and other state laws). We do not engage in such profiling outside the fraud-prevention context described under "Automated Decision-Making and Fraud Prevention" (which includes meaningful human review).
• Right to opt out of targeted advertising — under VCDPA, CPA, CTDPA and similar laws. You may exercise this right by following the opt-out instructions in "Sale and Sharing of Personal Information" above.
• Right to non-discrimination for exercising your privacy rights.
• Right to appeal (under VCDPA, CPA, CTDPA and similar laws) — if we deny a rights request.

How to Exercise Your Rights

To exercise any of the above rights, please email us at privacy@neowire.ai with a description of your request, or write to us at the postal address in the "Contact" section. You may also submit a request through the in-app account settings.

We will acknowledge receipt of your request within 10 business days (where required) and respond within the applicable statutory deadline:

• California (CCPA/CPRA): 45 calendar days, with one possible 45-day extension.
• Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Rhode Island, Kentucky and other applicable states: typically 45 calendar days, with one possible 45-day extension where permitted.

Verification of Your Identity

To protect your information, we will take reasonable steps to verify your identity before acting on rights requests. Verification will typically require you to confirm information already associated with your account (such as your email address) or, for more sensitive requests, to provide additional information matching our records. We will not use information collected for verification for any other purpose.

Authorised Agents

You may designate an authorised agent to make a rights request on your behalf. We will require the agent to provide signed written permission demonstrating their authority, and we may also require you to verify your identity directly or to confirm that you have granted the agent permission.

Right to Appeal

If we deny your request in whole or in part, you may appeal the decision by replying to our response within 60 days. We will respond to your appeal within 45 calendar days (or other period required by your state law). If your appeal is denied, you may contact your state attorney general or — in California — the California Privacy Protection Agency.

Financial Incentives

The reward payments you can earn through Flikk are paid in connection with your use of the App — playing the games, and creating them — and not in exchange for the disclosure of personal information. Points can also be exchanged inside the App for Flikk Tokens, which are what a game build or a change to a game costs; that is a use of the App rather than a payment for data. We do not offer a different price, level or quality of service depending on whether you exercise a privacy right, and turning off the "Advertising" setting does not change what you can earn. Accordingly, we do not consider Flikk to be operating a "financial incentive" program within the meaning of CCPA § 1798.125(b). If you disagree with this characterisation, please contact us at privacy@neowire.ai.

Notice for Nevada Residents

Nevada law (NRS 603A.340) gives Nevada residents the right to opt out of the sale of certain covered personal information. To submit a verified request related to this notice, contact privacy@neowire.ai.

Notice for Other US Users

If you reside in a US state with a comprehensive privacy law not specifically named above, your rights under that law generally mirror those listed in this section. Please contact us at privacy@neowire.ai to exercise any of them.

This Privacy Policy is intended to comply with applicable data-protection laws in the United States. Where any provision of this policy conflicts with mandatory local law, the local law prevails.