Privacy Policy for DeckPilot Last Updated: May 2026 | Effective Date: May 1, 2026 | Version 1.0
This Privacy Policy applies to the DeckPilot mobile application (“App”), developed and operated by Vibhutix Private Limited, a company incorporated under the laws of India (“Company”, “we”, “our”, or “us”).
This policy explains what information we collect, how we use it, with whom we share it, and what rights you have. By downloading or using DeckPilot, you agree to this Privacy Policy. If you do not agree, please discontinue use of the App.
DeckPilot is a companion tool designed to assist players with game-related insights and analysis. It does not require account registration and does not collect sensitive personal information such as names, email addresses, or payment details directly from users.
1. Information We Collect
DeckPilot does not require users to create an account or directly provide personally identifiable information (PII). However, certain information is automatically collected to operate and improve the App.
We automatically collect the following categories of data:
- Device information — device model, operating system version, device type
- Device identifiers — Google Advertising ID (GAID) on Android; IDFA on iOS (only with explicit ATT consent)
- IP address and approximate geographic location derived from IP
- App usage data — features used, session duration, in-app interactions, screen views
- Crash logs and diagnostic data — error reports, performance metrics
- Purchase and subscription data — processed via RevenueCat (we do not store payment card details)
All of the above may constitute personal data under applicable law (GDPR, CCPA, India DPDP Act 2023) depending on your jurisdiction. We treat it accordingly.
We do not collect your real name, email address, precise GPS location, photos, camera or microphone data, contacts, call logs, or financial/payment card information.
2. Legal Basis for Processing (GDPR / DPDP)
For users in the European Economic Area (EEA), United Kingdom, or any jurisdiction requiring a stated legal basis, we process data under the following grounds:
- Legitimate interests — analytics, crash reporting, performance monitoring, and fraud prevention, where our interests do not override your rights
- Consent — personalized advertising, obtained via in-app consent prompt or Apple ATT / Android CMP mechanisms before any ad tracking begins
- Contractual necessity — processing subscription and purchase data to fulfill your in-app purchases
- Legal obligation — retaining transaction records as required by applicable tax or corporate law
You may withdraw consent for advertising at any time via device settings or our in-app controls. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
3. Third-Party Services
We use the following third-party service providers who may independently collect and process data in accordance with their own privacy policies. We require all processors to maintain appropriate security and comply with applicable data protection law.
We may integrate additional advertising or analytics partners in the future. Any new partner will be disclosed in an updated version of this policy prior to integration.
4. How We Use Information
We use collected information solely for the following purposes:
- To operate, maintain, and improve the App
- To analyze usage patterns and enhance user experience
- To detect, investigate, and resolve technical issues and crashes
- To process in-app purchases and manage subscriptions
- To display relevant advertisements (contextual or personalized, subject to consent)
- To comply with legal obligations
We do not independently create user profiles outside the scope of third-party services used for analytics and advertising for purposes other than those stated above. We do not sell your data.
5. Advertising and Tracking Technologies
DeckPilot may display advertisements using third-party advertising SDKs including Google AdMob and Meta Audience Network. These SDKs may use device identifiers (GAID on Android, IDFA on iOS), cookies, and similar tracking technologies to deliver contextual or interest-based advertisements, measure ad performance and attribution, and limit ad frequency.
Consent Mechanism
On iOS, we display Apple’s App Tracking Transparency (ATT) prompt before enabling any ad tracking. Personalized ads are only shown if you grant permission.
For users in regions where consent is required (such as the EEA/UK), we present a consent mechanism before enabling personalized advertising.
Opting Out
- iOS: Settings → Privacy & Security → Tracking → disable for DeckPilot
- Android: Settings → Google → Ads → Delete Advertising ID, or opt out of Ads Personalization
- In-App: Settings → Privacy → Ad Preferences (where available)
6. Data Sharing
We do not sell your personal data to any third party.
We may share data only in the following circumstances:
- Service providers — third-party processors listed in Section 3, for the stated purposes only, under contractual data processing agreements
- Legal compliance — when required by applicable law, regulation, court order, or governmental authority
- Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred; you will be notified via in-app notice
- Aggregated, non-identifiable data — anonymized analytics may be shared without restriction
7. Data Retention
We retain data only for as long as necessary for its stated purpose. Approximate retention periods are as follows:
- Subscription and purchase records — 7 years (statutory financial record-keeping requirement under Indian Companies Act, GST laws, and equivalent laws in other jurisdictions)
- Advertising identifiers — retained by third-party SDKs per their own policies; we do not independently store them
Upon a verified deletion request (see Section 8), we will delete or anonymize your data within 30 days, except where retention is required by law.
Data is retained for periods determined by operational needs and third-party service configurations.
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Right to access — request a copy of data we hold about you
- Right to correction — request correction of inaccurate data
- Right to deletion — request deletion of your data, subject to legal retention requirements
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests
- Right to restrict processing — request that we limit how we use your data
- Right to withdraw consent — for consent-based processing such as personalized ads, withdraw at any time
To exercise any of these rights, email us at privacy@vibhutix.com. We will respond within 30 days. We may request identity verification before fulfilling requests.
EU/EEA users may also lodge a complaint with your local Data Protection Authority (DPA). UK users may contact the ICO at ico.org.uk. Indian users may file a complaint with the Data Protection Board of India once operational under the DPDP Act 2023.
9. Children’s Privacy
DeckPilot is not directed at children. We apply the following minimum age thresholds by jurisdiction:
- United States (COPPA): under 13
- European Union (GDPR): under 16 (or as low as 13 in member states that have exercised the derogation)
- United Kingdom (UK GDPR): under 13
- India (DPDP Act 2023): under 18
- All other jurisdictions: under 13, or the applicable local minimum age
We do not knowingly collect personal data from users below these thresholds. If we discover that such data has been collected without verifiable parental consent, we will delete it promptly. Parents or guardians who believe their child has provided data to us should contact us at privacy@vibhutix.com.
10. International Data Transfers
Vibhutix Private Limited is incorporated in India and our primary data processing occurs in India. However, our third-party service providers (Firebase, RevenueCat, AdMob, Meta) may process data in the United States or other jurisdictions.
For users in the EEA or UK: data transfers to processors outside the EEA/UK are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, or equivalent transfer mechanisms. India does not currently hold an EU adequacy decision; we rely on SCCs with our processors for this transfer.
By using the App, you acknowledge that your data may be transferred to and processed in countries with different data protection standards than your country of residence.
11. Data Security
We implement industry-standard technical and organizational measures to protect your data, including encryption in transit via TLS/HTTPS for all API communications, access controls limiting data access to authorized personnel, regular review of third-party security practices, and Firebase Security Rules to restrict unauthorized database access.
No method of transmission over the Internet is 100% secure. In the event of a data breach affecting your rights or freedoms, we will notify you and relevant authorities as required by applicable law (within 72 hours for GDPR).
12. India-Specific Disclosures (DPDP Act 2023)
As an Indian company, Vibhutix Private Limited is a Data Fiduciary under the Digital Personal Data Protection Act, 2023. In accordance with the Act, we process personal data only for the purposes stated in this policy, take reasonable steps to ensure data accuracy, implement appropriate security safeguards, and will notify the Data Protection Board of India and affected users in the event of a data breach.
Grievance Officer
In accordance with applicable Indian law, users may contact our Grievance Officer for privacy-related concerns:
Name: Grievance Officer, Vibhutix Private Limited Email: grievance@vibhutix.com
We will acknowledge your complaint within 48 hours and resolve it within 30 days.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The “Last Updated” date at the top will reflect the most recent revision.
For material changes — such as changes to data types collected, new third-party processors, or changes to user rights — we will notify you via in-app notification at least 7 days before the changes take effect. Continued use of the App after the effective date constitutes acceptance of the updated policy. Previous versions of this policy are available upon request.
14. Contact Us
For any privacy-related questions, requests, or concerns:
Company: Vibhutix Private Limited Privacy Email: privacy@vibhutix.com Grievance Officer: grievance@vibhutix.com Support: support@vibhutix.com Registered Office: B46 Amardeep Homes, Ajwa Road, Vadodara 390019 Gujarat, India
This Privacy Policy is designed to align with applicable data protection laws. This document does not constitute legal advice. Consult a qualified attorney for jurisdiction-specific compliance requirements.