Privacy Policy
1. Who we are
Astuto Ltd, a company incorporated in England and Wales, company number 17263058, with its registered office at 66 Paul Street, London, England, United Kingdom, EC2A 4NA ("Astuto", "we", "us", "our"). Operates the Astuto mobile application (the "App").
This Privacy Policy explains how we collect, use, store, and share information about you.
Contact — Email: privacy@astuto.gg · Website: astuto.gg
2. What this policy covers
This Privacy Policy applies to users in the territories where the App is currently available: the United Kingdom, the United States of America, Australia, and Mexico.
The App is not currently available in the European Union or EEA; EU/EEA coverage is planned for a future phase and is not addressed by this version.
3. Information we collect
3.1 Information you provide directly
| Information | When collected | Why required |
|---|---|---|
| Display name | At registration | Identify you on leaderboards |
| Country | At registration | Country-specific leaderboards and prizes |
| Birth year (year only) | At registration | Age eligibility (16+ to use the App; 18+ for prizes) and age-appropriate content and ad treatment. Self-declared; not verified. |
| Topic preferences | At registration / when updated | Personalise quiz questions |
| Prize email address | Optionally, in Profile | To send Amazon gift card prizes |
Your email address is optional. You can use the App fully without providing one; an email address is only required to claim a prize.
3.2 Information generated automatically
| Information | Details |
|---|---|
| Device ID | A randomly generated anonymous identifier stored on your device. Not linked to your name or email unless you choose to provide one. |
| Quiz answers and scores | Your responses to daily questions, time taken per answer, and calculated scores. |
| Leaderboard position | Your daily and monthly rank within your country. |
| Streak, XP and lifelines | Consecutive-play streak, experience points, and reveal/streak-shield balances. |
| Rewards and entitlements | Streak Shields, ad-free time earned by referring friends, and Astuto Plus subscription status. |
| Friend connections | Player IDs of users you connect with via the Friends feature. |
| App usage data | Screens visited, features used, session duration. |
| Device and network info | Device type, OS version, app version, country-level location via IP at onboarding only. |
3.3 Information from third parties
- Google AdMob: advertising identifiers (IDFA/GAID) for ad serving, subject to your consent. Non-personalised (contextual) ads only for users who indicate they are under 18.
- RevenueCat: purchase receipts and subscription status for the Astuto Plus subscription.
- Amazon: gift card issuance when prizes are awarded.
- Expo / Firebase Cloud Messaging: push notification delivery tokens.
4. How we use your information
4.1 To operate the App
- Authenticate your device and maintain your account
- Deliver the daily quiz and record your answers
- Calculate scores, maintain streaks and lifelines, and update leaderboards
- Process and issue gift card prizes to winners
- Enable the Friends leaderboard feature
- Deliver push notifications (daily reminders, prize alerts, streak warnings)
Legal basis (UK GDPR): Performance of a contract (Article 6(1)(b)).
4.2 To improve the App
Legal basis (UK GDPR): Legitimate interests (Article 6(1)(f)) — improving a service we provide.
4.3 To serve advertising
Google AdMob serves advertisements in the ad-supported version, including rewarded ads you may choose to watch to earn Streak Shields. Advertising treatment depends on territory and declared age:
- United Kingdom: personalised advertising only after explicit opt-in via a consent prompt on first launch (AdMob UMP).
- USA, Australia and Mexico: opt-out model via your device advertising settings.
- Users who indicate at registration that they are under 18 are served only non-personalised (contextual) advertising, in every territory, and AdMob is configured with under-age / child-directed treatment for those users.
Legal basis (UK GDPR): Consent (Article 6(1)(a)) where required.
4.4 Aggregate statistics
We may produce anonymised, aggregated statistics that do not identify any individual. We do not sell individual user profiles or personal data. At launch, the only use of data for advertising revenue is AdMob ad serving as described in §4.3.
4.5 Legal compliance
- Verify age eligibility (18+ for prizes) in all territories
- Respond to lawful regulatory requests
- Enforce our Terms and Fair Play rules
- Prevent fraud and detect anomalous scoring activity
5. Prizes and age verification
Prize competitions are open to residents of the countries listed in the Prize Rules (the UK at launch) who are 18 or older. We collect your birth year (year only) at registration to enforce this requirement; this information is self-declared and we do not independently verify it, so we rely on the accuracy of what you tell us. Providing false age information to claim a prize may result in disqualification and account suspension.
US state exclusions: prizes are not available to residents of New York, Florida, and Rhode Island. Users in those states may play but are excluded from prize eligibility until Astuto completes registration there (see Terms §6).
6. Third-party services
| Service | Purpose | Privacy policy |
|---|---|---|
| Google AdMob (Alphabet Inc.) | Serve advertisements (personalised subject to consent; contextual for under-18s) | policies.google.com/privacy |
| RevenueCat Inc. | Manage the Astuto Plus subscription | revenuecat.com/privacy |
| Amazon Web Services | Infrastructure (eu-west-2, London) | aws.amazon.com/privacy |
| Amazon (gift cards) | Gift card issuance | amazon.co.uk/privacy |
| Expo / Firebase (Google) | Push notifications | policies.google.com/privacy |
7. Data storage and security
7.1 Where your data is stored
All personal data is stored in the United Kingdom on AWS infrastructure in eu-west-2 (London). We do not transfer personal data outside the UK without an appropriate legal mechanism (UK IDTA, EU SCCs, or an adequacy decision).
7.2 Security measures
- All data transmitted uses TLS encryption
- Database encrypted at rest using AES-256 (AWS KMS)
- Access to production systems restricted to authorised personnel
- Authentication uses device-level anonymous identifiers and signed tokens (JWT)
- Prize email addresses stored encrypted
7.3 Retention
| Data type | Retention period |
|---|---|
| Quiz history (submissions, answers) | 90 days, then automatically deleted |
| Streak shield history (what added or used a shield, and when) | 90 days, then automatically deleted |
| Leaderboard records (score, rank, date) | 12 months |
| Account data (display name, topics, streak, lifelines) | Until account deletion is requested |
| Prize email address | Until deletion requested, or 7 years if a prize was issued (tax records) |
| Device ID and JWT tokens | Until account deletion |
| Ad-free / subscription entitlements | Until account deletion |
| Push notification tokens | Until you disable notifications or delete your account |
8. Your rights
8.1 Rights applicable in all territories
- Access: request a copy of the personal data we hold about you
- Deletion: request deletion of your account and associated personal data
- Correction: ask us to correct inaccurate information
- Opt out of push notifications via device settings or the in-app Notification Preferences screen
- Opt out of personalised advertising via device advertising settings
Contact privacy@astuto.gg. We will respond within 30 days.
8.2 United Kingdom (UK GDPR)
You have the right to access, rectification, erasure, restriction, data portability, and to object to processing. Lodge a complaint with the ICO: ico.org.uk · 0303 123 1113.
8.3 European Union / EEA — future market (not yet live)
The App is not currently available in the EU/EEA. When the App launches there (Phase 2), EU GDPR rights and the relevant national supervisory-authority contacts will be added to this section.
8.4 United States of America
California residents (CCPA/CPRA): right to know, opt out of sale/sharing (we do not sell or share individual data), delete, and non-discrimination. The same rights are available to residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws.
Note: prize eligibility is not available in New York, Florida, or Rhode Island (a competition rule, not a data right — see Terms §6).
8.5 Australia
The Privacy Act 1988 (Cth) and the Australian Privacy Principles apply. Complaints: Office of the Australian Information Commissioner (oaic.gov.au).
8.6 Mexico — Aviso de Privacidad
La Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) aplica a los usuarios mexicanos. Astuto Ltd, con domicilio en 66 Paul Street, Londres, EC2A 4NA, Reino Unido, es responsable del tratamiento de sus datos. Usted tiene Derechos ARCO: contactar privacy@astuto.gg. Quejas: INAI (inai.org.mx).
9. Children
Astuto is for users aged 16 and over. Prize competitions are open only to users aged 18 and over. We do not knowingly collect personal data from anyone under 16.
In the United Kingdom, the age of consent for information society services is 13 (Data Protection Act 2018); in parts of the EU/EEA it is 16, but the App is not yet available there.
Because age is self-declared, users who indicate they are under 18 are served only non-personalised (contextual) advertising and are not profiled for advertising. These measures are designed to align with the UK Age Appropriate Design Code (Children's Code).
Contact privacy@astuto.gg to request deletion of any data relating to someone under 16.
10. Cookies and tracking technologies
The App does not use browser cookies. On mobile devices we use:
- The device advertising identifier (IDFA/GAID) for AdMob, subject to your consent and used only contextually for under-18 users
- An anonymous UUID stored in device local storage
- Firebase tokens used solely to route push notifications
11. Automated decision-making
We use automated systems to calculate quiz scores, apply lifelines (reveals and streak shields), rank players on leaderboards, and determine prize eligibility. These processes do not produce legal effects beyond determining prize eligibility within the competition rules. Fraud detection may flag accounts for human review.
12. Changes to this policy
We will notify you of material changes by displaying a notice in the App and updating the effective date above. Continued use constitutes acceptance of the updated policy.
13. Contact and complaints
| Purpose | |
|---|---|
| Privacy and data rights | privacy@astuto.gg |
| General support | support@astuto.gg |
UK supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk · 0303 123 1113.