PRIVACY POLICY

1.Introduction

Deku Studios LLC ("Deku Studios," "we," "us," or "our") operates the Deku Studios mobile applications, websites (including deku.net, docs.deku.net, support.deku.net, soltara.deku.net, glyphs.deku.net, and nines.deku.net), and related services (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Platform.

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is incorporated into and governed by our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

U.S.-Focused Policy. The Platform is intended for users in the United States. Where required by applicable U.S. state privacy law, we provide additional disclosures and choices, as set forth in Section 8. The Platform is not directed to individuals outside the United States, and we do not knowingly collect personal data from individuals outside the United States.

2.Information We Collect

2.1Information You Provide Directly

We collect information that you provide when you create an account, participate in contests, make deposits or withdrawals, or contact us:

Account Information. Name, email address, username, display name, and avatar selection. If you sign in through Apple or Google, we receive the information you authorize those providers to share (typically name and email address).

Identity Verification Information. When you complete identity verification (KYC) through our third-party identity-verification provider, we receive a photograph of your government-issued identification document, a selfie photograph, and information extracted from your identification document (including full legal name, date of birth, address, and document number). Biometric identifiers (such as the facial-match comparison vector) are processed and retained by the verification provider pursuant to its policies; we retain only the verification results and related records as necessary for compliance, fraud prevention, and dispute resolution. See Section 2.4 for additional biometric-information notice.

Financial Information. When you make deposits or withdrawals, our third-party payment processors collect your payment credentials (credit- or debit-card number, bank-account information, or PayPal-account information). Deku Studios does not directly collect, store, or have access to your full card numbers or bank-account numbers. We receive and store transaction records including amounts, dates, payment-method type, and transaction status.

Tax Information. Once your net contest winnings in a calendar year reach seventy-five percent (75%) of the applicable Form 1099-MISC reporting threshold ($1,500 for calendar year 2026, when the threshold is two thousand dollars ($2,000) under 26 U.S.C. § 6041(a) and IRS Publication 1099 (2026)), we collect an IRS Form W-9 from you before you can make any further withdrawal: your Social Security Number ("SSN") or Individual Taxpayer Identification Number ("ITIN"), your tax mailing address, and your certification. The legal name on your Form W-9 is the name confirmed during identity verification. We use this information for tax reporting only.

Communications. When you contact us for support or other inquiries, we collect the content of your messages, your email address, and any attachments you provide.

2.2Information Collected Automatically

When you use the Platform, we automatically collect certain information about your device and activity:

Device Information. Device model, operating system and version, application version, screen resolution, device language and locale, time zone, and unique device identifiers. Unique device identifiers include identifiers assigned to our apps (such as Apple's Identifier for Vendors) and, where your device settings and permissions allow, advertising identifiers (Apple's Identifier for Advertisers, or "IDFA," on iOS, and the Google Advertising ID and App Set ID on Android). On iOS, our apps access the IDFA only if you allow tracking when the App Tracking Transparency prompt asks. See Sections 4.8 and 7.6.

Location Information. With your permission, we collect precise GPS coordinates from your device to verify that you are in an Eligible Jurisdiction before you enter a cash-entry contest. We also collect the state or jurisdiction determined from your GPS coordinates. Location data is collected at the time of each contest entry and is not continuously tracked in the background.

Gameplay Data. For each contest you enter, we collect your submissions (words, swipe paths, plant routing, sudoku cell-fills, or other contest-specific inputs), scores, input timing, game-session duration, and contest results. We may also record input-replay data (touch positions, swipe paths, and timestamps) for anti-cheat purposes.

Usage Data. Screens viewed, features used, actions taken, time spent on the Platform, and crash or error logs. On our websites, we collect aggregated page-view statistics without using cookies. See our Cookie Policy.

Network Information. IP address, VPN or proxy detection signals, and connection type.

2.3Information from Third Parties

We may receive information about you from our third-party service providers:

Authentication Providers. If you sign in with Apple or Google, we receive the profile information you authorize.

Identity Verification Provider. Verification results including approval or rejection status, document-authenticity assessment, facial-match confidence score, liveness-check result, and anti-money-laundering screening results.

Payment Processors. Transaction status updates, dispute notifications, and fraud-risk assessments.

Mobile Attribution Provider. Information about the advertisement, campaign, or link that led you to install or open one of our apps, such as the advertising network, the campaign name, and the time of the click and the installation.

2.4Biometric Information Notice (BIPA, Tex. Bus. & Com. Code § 503.001, Wash. Rev. Code § 19.375)

In connection with our KYC workflow, biometric identifiers (specifically, a facial-image template and liveness-detection data) may be processed by our verification provider to compare the live selfie to the government-issued identification document. Certain U.S. states impose separate consent and notice requirements for the collection, use, retention, and destruction of biometric identifiers, including the Illinois Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1 et seq. ("BIPA"); the Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001; and the Washington biometric-identifier statute, Wash. Rev. Code § 19.375.020. The Platform collects affirmative written consent prior to processing biometric identifiers from users in these jurisdictions through the in-app KYC consent flow and retains biometric data only for the duration permitted under applicable state law (and in no event longer than three (3) years after the user's last interaction with the Platform). Biometric data is not sold, leased, traded, or otherwise profited from.

2.5SDKs, Cookies, and Similar Technologies

Our apps include software development kits ("SDKs") from service providers and partners that collect some of the information described in this Section 2 directly from your device, for product analytics, crash and error reporting, push notifications, mobile attribution, and optional rewarded video ads. Section 4.8 describes the analytics, attribution, and advertising SDKs, and Section 7.6 describes your choices.

Our websites do not use advertising cookies, advertising pixels, or cross-site tracking technologies. Our Cookie Policy describes the cookies and similar technologies our websites do use.

3.How We Use Your Information

We use the information we collect for the following purposes:

Platform Operation. To create and manage your account, process contest entries, calculate scores, distribute prizes, process deposits and withdrawals, and provide customer support.

Legal Compliance. To verify your age, verify your identity, verify your geographic location, comply with anti-money-laundering and OFAC sanctions-screening requirements, comply with federal tax-reporting obligations under 26 U.S.C. §§ 6041(a) and 6050W, and respond to legal process.

Fair Play and Integrity. To detect and prevent cheating, bot usage, multi-accounting, collusion, external-solver use, and other prohibited conduct; and to monitor gameplay data for anomalies and conduct human review of flagged sessions.

Safety and Security. To detect and prevent fraud, unauthorized access, and other illegal activity; and to protect the security and integrity of the Platform.

Communication. To send you transactional communications (contest results, deposit confirmations, withdrawal status, account alerts), respond to your support inquiries, and send service announcements.

Improvement. To analyze usage patterns, diagnose technical issues, and improve the Platform's features and performance.

Advertising and Marketing Measurement. To understand which of our advertising campaigns and links lead to app installations, registrations, and deposits; to share conversion information with advertising partners so they can measure and improve the campaigns that promote our apps (see Section 4.8); and to offer optional rewarded video ads that you may choose to watch to earn Acorns.

Responsible Gaming. To enforce deposit limits, self-exclusion periods, and other responsible-gaming controls you have configured.

4.How We Share Your Information

We do not sell your personal information in exchange for money. We share your information in the circumstances described in this Section 4. Section 4.8 describes information we share with advertising partners, which certain U.S. state privacy laws treat as a "sale," as "sharing," or as processing for "targeted advertising." Section 7.6 explains how to opt out.

4.1Third-Party Service Providers

We share information with third-party service providers who process data on our behalf to operate the Platform. These providers include services for authentication and session management, payment processing, identity verification and compliance screening, player-funds banking, content delivery and security, application hosting, transactional email delivery, push notifications, product analytics, crash and error reporting, website analytics, and bot protection. Our mobile attribution and rewarded video advertising providers are described in Section 4.8. These providers are contractually required to use your information only for the purposes of providing services to us and to maintain appropriate security measures.

4.2Legal Obligations

We may disclose your information when required to do so by law, regulation, legal process, or governmental request. This includes responding to subpoenas, court orders, or other legal process, and cooperating with law-enforcement or regulatory authorities, including in connection with OFAC sanctions screening, FinCEN information requests under USA PATRIOT Act § 314(a), and grand-jury subpoenas.

4.3Tax Reporting

We report contest winnings to the Internal Revenue Service as required by law. If your net winnings in a calendar year reach or exceed the applicable Form 1099-MISC reporting threshold (currently two thousand dollars ($2,000) for calendar year 2026 under 26 U.S.C. § 6041(a) and IRS Publication 1099 (2026)), we will file an IRS Form 1099-MISC that includes the legal name, tax address, and SSN or ITIN from your Form W-9, and the amount of winnings. We do not share your SSN or ITIN with our payment processors. Our payment processor may separately issue Form 1099-K for payments meeting the 26 U.S.C. § 6050W threshold.

4.4Protection of Rights

We may disclose your information when we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request.

4.5Business Transfers

If Deku Studios is involved in a merger, acquisition, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you of any such change by posting notice on the Platform or by email.

4.6Aggregated and De-identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you (for example, aggregate statistics about contest participation, average scores, or Platform usage trends).

4.7Sharing With Other Players

When you participate in contests, certain information about you — your username, in-app profile (display name and avatar), in-app actions and achievements, and contest results — may be visible to other Players and may become publicly available within the Platform.

4.8Analytics, Attribution, and Advertising

Mobile attribution (AppsFlyer). Our apps use AppsFlyer, a mobile attribution provider, to measure which advertisements and links lead people to install and use our apps. AppsFlyer receives, from our apps and from our servers: your device's advertising identifiers where available (on iOS, the IDFA only if you allow tracking); Apple's Identifier for Vendors; the identifier AppsFlyer assigns to your app installation; your IP address; device and app information; a pseudonymous account identifier (not your name or email address, in readable or hashed form); the game you are playing; and in-app events such as app installations and opens, account registration and onboarding, opening the deposit screen, confirmation that you are eligible for cash-entry contests together with your state, and deposits (including the amount, the currency, a transaction reference, and the time since installation). Where advertising identifiers are not available, AppsFlyer may use your IP address and device information to estimate which advertisement led to an installation.

Advertising partners. We may use AppsFlyer to send conversion information (for example, that an installation came from a particular advertisement, or that a player registered or made a deposit, and the deposit amount), together with device or advertising identifiers, to the advertising platforms we use to promote our apps, which include Meta Platforms, Inc. (Facebook and Instagram), TikTok (TikTok for Business), Google LLC (Google Ads), and Unity Technologies (Unity Ads). The platforms we use may change over time. We do not send advertising platforms your name or email address, in readable or hashed form. Those partners use this information to attribute installations to their advertisements and to measure and improve how our advertising campaigns are delivered, which can include showing our advertisements to people with similar characteristics, and they may combine it with other information they hold about you. Certain U.S. state privacy laws treat this as a "sale" or "sharing" of personal information, or as "targeted advertising." You can opt out as described in Section 7.6.

Rewarded video ads (Google AdMob). Our apps offer optional video ads that you may choose to watch to earn Acorns. These ads are served by Google AdMob. We configure AdMob to turn off ads personalization for every ad request and to apply Google's restricted data processing, so the ads in our apps are not personalized based on your activity in other apps or on other websites. To deliver ads, Google receives device and app information, your IP address, and advertising identifiers where available, which Google may use to serve and measure ads, limit how often an ad is shown, and detect fraud and invalid activity. When we load ads for your account, we also send Google a pseudonymous account identifier so that, if you finish an ad, Google can confirm it to our servers and we can credit your Acorns.

Product analytics (PostHog). Our apps send PostHog a limited set of in-app events, such as completing onboarding, finishing your first game, opening the deposit screen, entering a tournament, and returning to the app after time away, together with device and app information and your IP address, linked to a pseudonymous account identifier and the game you are playing. PostHog processes this information on our behalf to help us operate and improve the Platform. We do not use PostHog to record your screen or for advertising.

Crash, error, and performance monitoring (Sentry). When one of our apps or websites encounters an error, Sentry receives technical details about the error and about the device, browser, or app, including the screens and actions leading up to it. Sentry also receives performance measurements (such as how long pages, screens, and network requests take) for a sample of sessions. In our apps, this information may be linked to your account identifier and, in some apps, your email address, so that we can find and fix problems affecting your account. On our websites, when an error occurs, Sentry may record a replay of the page session leading up to it, with on-page text and form inputs masked.

Websites. Our websites use Vercel Analytics, which counts page views without cookies, and Cloudflare Turnstile, which helps protect our email signup forms from automated abuse. Our websites do not use advertising cookies or advertising pixels. See our Cookie Policy.

5.Data Retention

We retain your personal information for as long as your account is active and for the periods described below after account closure or data collection. After the applicable retention period, data is archived to cold storage and subsequently deleted in accordance with our internal data-lifecycle procedures. We do not hard-delete compliance records before the retention period expires.

6.Data Security

We implement technical, administrative, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction:

Encryption. All data is encrypted in transit using TLS (Transport Layer Security). Data at rest is encrypted using industry-standard encryption at the database and infrastructure level.

Access Controls. Access to personal information is restricted to authorized personnel on a need-to-know basis. Administrative access is role-based with all actions logged in an audit trail.

Payment Security. We are PCI-compliant through our payment-processor integrations. Card data is tokenized before it reaches our servers. Full card numbers never touch Deku Studios systems.

Authentication Security. Player authentication supports Apple Sign-In, Google Sign-In, and email-based authentication. Multi-factor authentication is enforced for administrative access.

Monitoring. We employ automated fraud detection, transaction monitoring, and security alerting.

While we take commercially reasonable steps to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

7.Your Rights and Choices

7.1Account Information

You may update your account information (display name, email address, avatar) at any time through the Platform's settings.

7.2Location Permissions

You may revoke location permissions through your device settings at any time. If you revoke location permissions, you will be unable to enter cash-entry contests but may continue to use free-play features.

7.3Push Notifications

You may opt out of push notifications through your device settings or within the Platform's notification preferences.

7.4Account Deletion

You may request deletion of your account at any time through one of two channels: (i) within the Platform's iOS or Android application, by navigating to Profile → Privacy & Security → Delete Account and confirming by typing "DELETE" in the confirmation field; or (ii) by contacting support@deku.net. Both channels are processed through the same back-end deletion workflow and produce the same outcome.

Pre-Deletion Review. Before a deletion request is finalized, the Platform reviews your account for circumstances that warrant additional handling, including a positive cash-wallet balance, pending withdrawals, open disputes, active tournament entries, open support tickets, or a Form 1099-MISC we owe you. These conditions may require additional steps before completion.

Tax-Form Hold. If your net contest winnings for any calendar year reached the Form 1099-MISC reporting threshold, we cannot complete the deletion of your account until we have issued your Form 1099-MISC for that year, which we normally do by January 31 of the following year. Your request remains pending until then, and you may cancel it at any time. Your tax records are retained after deletion for the period described in Section 5.

Grace Period. If, at the time of your deletion request, your cash-wallet balance is greater than zero, your account enters a seven (7)-day grace period during which you may withdraw your remaining cash balance through the Platform's standard withdrawal flow (subject to identity verification and applicable processing times). Deposited funds that you have not used to enter a contest are not subject to the playthrough requirement described in Section 7.4 of the Terms of Service for this purpose; they are returned to your original payment method as a refund rather than paid out as a withdrawal. During the grace period, your account remains accessible solely for the purpose of completing withdrawals; you may also cancel the deletion request and resume normal use of your account. If your cash-wallet balance is zero at the time of your deletion request, no grace period applies.

Forfeiture and Effect of Deletion. Upon expiration of the grace period (or, if no grace period applies, upon administrative review), and subject to the Tax-Form Hold, your account will be deactivated and: (i) any remaining cash-wallet balance is returned to you by the method described above, and is forfeited only where it cannot be returned after reasonable efforts, in which case it is handled under applicable state unclaimed-property law; (ii) any remaining Acorns and Bonus Cash are forfeited; (iii) your personal information (including email address, display name, and avatar) is anonymized; (iv) financial transaction records, identity-verification records, and other compliance records are retained for the periods described in Section 5 and applicable law; and (v) the email address associated with your account may not be used to create a new Deku Studios account for thirty (30) days following the completion of deletion.

Cancelling a Deletion Request. While your deletion request is pending, you may cancel the request from within the application or by contacting support@deku.net, which will restore your account to its prior state. Once deletion is completed, it cannot be reversed.

7.5Data Access and Portability

You may request a copy of the personal information we hold about you by contacting privacy@deku.net. We will provide your data in a commonly used, machine-readable format within forty-five (45) days, subject to applicable identity-verification requirements.

7.6Tracking, Advertising, and Analytics Choices

Allow Tracking setting. In any of our apps, go to Profile → Privacy & Security and turn off Allow Tracking. This stops the AppsFlyer and PostHog SDKs on that device right away, and our servers stop sending your account's events to AppsFlyer. Because AppsFlyer is how conversion information reaches advertising partners, turning off Allow Tracking also opts you out of the sharing described in Section 4.8. Your choice is saved to your account and applied on another device after you sign in there; until you sign in, a new installation may report its installation and first opens.

Device settings. On iOS, you can decline the App Tracking Transparency prompt, or later turn off tracking for any of our apps in Settings → Privacy & Security → Tracking; our apps then cannot access your IDFA. On Android, you can delete or reset your advertising ID in your device's privacy or Google settings.

Request by email. You can also opt out of the sale or sharing of your personal information, and of targeted advertising, by emailing privacy@deku.net with the subject line "Do Not Sell or Share." If you have an account, write from the email address associated with it and we will turn tracking off for your account. If you have installed one of our apps without creating an account, you can opt out by declining tracking or deleting or resetting your advertising identifier as described above.

Rewarded video ads. Watching rewarded video ads is optional. As described in Section 4.8, the ads in our apps are not personalized.

8.U.S. State Privacy Rights

Depending on your state of residence, you may have additional rights under applicable U.S. state privacy laws, including the right to know, the right to delete, the right to correct, the right to opt out of certain processing activities (such as targeted advertising, sale, or profiling), and the right to data portability. The state privacy laws under which these rights may be conferred include:

• California Consumer Privacy Act / California Privacy Rights Act, Cal. Civ. Code §§ 1798.100 et seq.
• Virginia Consumer Data Protection Act, Va. Code §§ 59.1-575 et seq.
• Colorado Privacy Act, Colo. Rev. Stat. §§ 6-1-1301 et seq.
• Connecticut Data Privacy Act, Conn. Gen. Stat. §§ 42-515 et seq.
• Utah Consumer Privacy Act, Utah Code §§ 13-61-101 et seq.
• Texas Data Privacy and Security Act, Tex. Bus. & Com. Code §§ 541.001 et seq.
• Oregon Consumer Privacy Act, Or. Rev. Stat. §§ 646A.570 et seq.
• Montana Consumer Data Privacy Act, Mont. Code Ann. §§ 30-14-2801 et seq.
• Iowa Consumer Data Protection Act, Iowa Code §§ 715D.1 et seq.
• Tennessee Information Protection Act, Tenn. Code Ann. §§ 47-18-3201 et seq.
• Indiana Consumer Data Protection Act, Ind. Code §§ 24-15-1-1 et seq.
• Florida Digital Bill of Rights, Fla. Stat. §§ 501.701 et seq.
• New Jersey Data Privacy Act, N.J. Stat. §§ 56:8-166.4 et seq.
• Nebraska Data Privacy Act, Neb. Rev. Stat. §§ 87-1101 et seq.
• New Hampshire Data Privacy Act, N.H. Rev. Stat. §§ 507-H:1 et seq.
• Delaware Personal Data Privacy Act, Del. Code tit. 6, §§ 12D-101 et seq.
• Maryland Online Data Privacy Act, Md. Code Ann., Com. Law §§ 14-4601 et seq.
• Minnesota Consumer Data Privacy Act, Minn. Stat. §§ 325O.05 et seq.
• Rhode Island Data Transparency and Privacy Protection Act, R.I. Gen. Laws §§ 6-48.1-1 et seq.
• Kentucky Consumer Data Protection Act, Ky. Rev. Stat. §§ 367.3611 et seq.

8.1California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the rights described in the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"): the right to know what personal information we collect about you, the right to delete personal information, the right to correct inaccurate information, the right to opt out of sale or sharing for cross-context behavioral advertising, the right to limit use of sensitive personal information (as defined in CCPA), and the right to non-discrimination.

Sale and sharing. We do not sell personal information in exchange for money. As described in Section 4.8, we may disclose the following categories of personal information to advertising partners through our mobile attribution provider, which may be considered a "sale," or "sharing" for cross-context behavioral advertising, under the CCPA: identifiers (advertising and device identifiers, a pseudonymous account identifier, and IP address); commercial information (deposit events and amounts); internet or other electronic network activity (app installation, open, registration, onboarding, and deposit-screen events, and the game played); and geolocation data limited to your state. You may opt out at any time as described in Section 7.6. We do not sell or share sensitive personal information. We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age, and the Platform is not available to anyone under eighteen (18).

Categories of personal information collected. Under CCPA categories, we collect: identifiers (name, email, SSN/ITIN where applicable, device and advertising identifiers, and IP address); personal information under Cal. Civ. Code § 1798.80 (name, address, financial information); protected-classification characteristics (age, date of birth); commercial information (transaction records, contest history); internet or electronic-network activity (usage data, device information); geolocation data (GPS coordinates); sensory data (selfie and ID photographs for KYC); sensitive personal information under CCPA § 1798.140(ae) (SSN/ITIN, government-ID information, biometric data, precise geolocation); and inferences drawn from the above (fraud-risk scores, skill ratings).

How to exercise your rights. To exercise any state privacy right, contact us at privacy@deku.net or submit a request through the Platform's settings. We will verify your identity before processing your request. You may designate an authorized agent to submit a request on your behalf with written authorization. We will respond within forty-five (45) days, subject to extensions permitted by applicable law.

Right to appeal. If we deny your request, you may appeal by submitting a request to privacy@deku.net with the subject line "Privacy Appeal." We will respond to appeals within sixty (60) days. If your appeal is denied, you may contact your state attorney general to submit a complaint.

9.Children's Privacy

The Platform is not intended for children under the age of eighteen (18). We do not knowingly collect personal information from children under thirteen (13), and we do not permit users under the age of eighteen (18) on the Platform. If we become aware that we have collected personal information from a child under thirteen (13), we will promptly delete that information. For full details on our compliance with the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506 ("COPPA"), see our COPPA Compliance Statement.

If you are a parent or guardian and believe your child under thirteen (13) has provided us with personal information, please contact us at privacy@deku.net.

10.International Users

The Platform is currently available only in the United States. If you access the Platform from outside the United States, you understand and consent to the transfer, processing, and storage of your information in the United States, where data-protection laws may differ from those of your country.

11.Third-Party Links and Services

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access.

12.Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and, where practicable, by sending notice to the email address associated with your account. The "Last Updated" date at the top of this policy indicates when it was most recently revised. Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

13.Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Privacy Inquiries & Appeals: privacy@deku.net

General Support: support@deku.net

Mail: Deku Studios LLC, 418 Broadway #11209, Albany, NY 12207

Website: https://deku.net