Privacy Policy

1. Built for a young audience

Dilly is rated 4+ and is designed to be safe for players of all ages, including children. We build the app to comply with laws that protect young people, including the U.S. Children’s Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code, the EU General Data Protection Regulation as it applies to children (GDPR, including Article 8), and Apple’s requirements for apps that may be used by kids.

In practice this means, for every user regardless of age:

• Ads are non-personalized. We do not use your activity to target ads, and we do not build an advertising profile about you. (See Section 6.)
• We do not track you across other apps or websites for advertising, and we do not sell or “share” your personal information for cross-context behavioral advertising.
• Analytics are privacy-first and pseudonymous. We measure how features are used to improve the app; we do not attach your name, email, or phone number to analytics. (See Section 5.)
• We collect the minimum we need to run the app and keep it secure.

2. Information we collect

2.1 Information you provide

• Account information — an identifier from your sign-in provider, plus a display name, profile image, and email or phone number, depending on how you sign in. Collected when you create an account or sign in.
• Profile content — items you add to your locker or wishlist, your display name, and your avatar. Collected when you use profile features.

We support sign-in with Apple, Google, email (a one-time code sent to your email address), and phone (a one-time code sent by SMS). We use passwordless sign-in — we do not ask you to create or store a password.

• With Sign in with Apple, you may choose to hide your email; Apple then gives us a private relay address instead of your real one, and that works fine with Dilly.
• With email or phone sign-in, we store the email address or phone number you use so we can send your one-time code and identify your account.

2.2 Age check

Before you use certain features, we may ask you to confirm your age. The age check happens on your device, and we store only a pass/fail result — we never collect or store your actual date of birth.

2.3 Information collected automatically

• Device and technical data — basic device information (such as device model and operating-system version) and a non-personalized ad request identifier used by Google AdMob to serve and cap ads.
• IP address — used to deliver the service, prevent abuse, and apply rate limiting. We do not use your IP address to profile you for advertising.
• Product-interaction analytics — which screens and features you use, sent as a fixed, curated set of events with no personal information attached. (See Section 5.)
• Crash and performance data — diagnostic information if the app crashes or misbehaves, so we can fix it.

2.4 What we do not collect

• We do not collect payment information. Dilly is currently free and ad-supported. If we add in-app purchases in the future, they will be handled by Apple’s App Store, and Apple — not Dilly — will process your payment. We would never receive your full card number.
• We do not collect precise location, your contacts, photos, microphone, camera, health, or biometric data.
• We do not knowingly collect more personal information from children than is necessary to provide the app.

3. How we use information

We use the information above to:

• create and secure your account and let you sign in;
• provide core features — the item shop, combos, wishlist, locker, and your public profile;
• show non-personalized ads that keep the app free;
• understand which features are used so we can improve them (privacy-first analytics); and
• diagnose crashes, prevent abuse and fraud, enforce our Terms, and comply with the law.

We do not use your information to build an advertising profile, and we do not sell your personal information.

4. How we share information

We share information only in these limited ways:

• Service providers who run the app on our behalf and may only use the data to provide their service to us — including Google AdMob (serving non-personalized ads; Google’s policy), PostHog (privacy-first product analytics, hosted in the EU; PostHog’s policy), Firebase (Google) (crash reporting and remote configuration; Firebase / Google policy), and our hosting and backend provider (storing your account and profile data and running the Dilly API).
• Sign-in providers — Apple and Google — when you choose to sign in with them. Signing in is governed by their own privacy policies.
• Social networks, only when you choose to share. If you share a Dilly card or image to a network such as Snapchat or TikTok, that share is handled by that platform and governed by its own policy. If you don’t tap share, nothing is sent.
• Only when you choose to share. Your account content — such as your locker, wishlist, display name, and avatar — is tied to your account and is not published to a public profile. It is shown to other people only through features you actively choose to use (for example, tapping share to create a card, or posting a combo to the community activity feed).
• For legal reasons — to comply with the law, respond to lawful requests, protect our rights, or protect the safety of our users.

We never sell your personal information, and we do not share it for cross-context behavioral advertising.

5. Analytics and diagnostics

We use PostHog to understand how people use Dilly so we can make it better. Our analytics are deliberately privacy-first:

• Pseudonymous. Person profiles are anonymous until you sign in, and even then we only ever attach an opaque internal account ID — never your name, email, or phone number.
• No hidden capture. We disable automatic screen capture, session replay, and lifecycle auto-events. We send only a fixed, curated list of feature-usage events, and we do not put personal information into any event.
• EU-hosted by default, an appropriate posture for a young, partly-European audience.
• IP handling. Our analytics events do not contain your name, email, or phone number. A device IP address may be processed transiently for coarse regional measurement and abuse prevention; we do not use it to build a profile of you or to target ads, and we minimize or discard it as soon as it is no longer needed.

We also use Firebase Crashlytics to collect crash and performance diagnostics so we can fix problems, and Firebase Remote Config to manage app settings. Firebase is a Google service and may process this diagnostic data in the United States.

6. Advertising

Dilly is free because it shows ads through Google AdMob. Our advertising is designed to be child-safe:

• Non-personalized only. Ads are not targeted using your behavior or an advertising profile.
• Child-directed treatment. We tag our ad requests as child-directed (COPPA) and, where applicable, for users under the age of consent in Europe, and we limit ad content to a general (G-rated) audience.
• No cross-app tracking for ads. We do not use Apple’s App Tracking Transparency permission to track you across other companies’ apps and websites for advertising, and we do not share an advertising identifier for that purpose.

You may still see an ad, but it is contextual and non-personalized rather than based on a profile of you.

7. Children’s privacy

Dilly is intended to be safe for users of all ages.

• We apply the non-personalized-ads, no-tracking, and privacy-first-analytics protections in this policy to all users.
• We do not knowingly collect more personal information from a child than is reasonably necessary to let them use the app.
• We do not condition a child’s participation on disclosing more information than is needed.

Parental rights. Parents and guardians have the right to review the personal information we have collected from their child, to ask us to delete it, and to refuse to permit any further collection or use of it. To exercise any of these rights, or if you believe your child has provided us with personal information, contact us at support@dilly.gg and we will act promptly. You can also delete an account at any time (see Section 8).

8. Your choices and rights

• Access, correction, and deletion. You can request a copy of your personal information, ask us to correct it, or ask us to delete it by emailing support@dilly.gg.
• Delete your account. You can delete your account and its associated profile content at any time from Settings → Delete Account in the app (you may be asked to re-authenticate), or by contacting us. Deleting your account removes your public profile.
• Regional rights. Depending on where you live (for example, the EEA/UK under GDPR, or California under the CCPA/CPRA), you may have additional rights, including the right to object to or restrict certain processing, to data portability, and to lodge a complaint with your data protection authority. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of in that respect — but you may still exercise your other rights by contacting us.

We will not discriminate against you for exercising any of these rights.

9. Data retention

We keep your account and profile information for as long as your account is active. When you delete your account, we delete or de-identify the associated personal information within a reasonable period, except where we must retain limited data to comply with the law, resolve disputes, prevent abuse, or enforce our agreements. Pseudonymous analytics and aggregated data may be retained for product measurement.

10. Security

We use reasonable technical and organizational measures — including passwordless sign-in, rate limiting, and access controls — to protect your information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

11. International users, legal bases, and transfers

Dilly operates from the United States, and our analytics are ingested in the European Union. Your information may be processed in the United States, the EU, or other countries where we or our service providers operate. Where required, we rely on appropriate safeguards for such transfers.

If you are in the EEA or UK, our legal bases for processing your information are: performance of our agreement with you (to provide the app and your account); our legitimate interests (to secure the service, prevent abuse, show non-personalized ads, and measure product usage in a privacy-first way), balanced against your rights; and, where a child uses the app, consent given or authorized by the holder of parental responsibility under Article 8 of the GDPR. You may object to processing based on legitimate interests at any time.

EU/UK representative. As a controller established outside the EEA/UK, we have appointed a representative for data-protection matters: [EU/UK representative name and contact — to be completed before publication]. You may also contact us directly at support@dilly.gg.

12. Third-party services and links

Dilly links to and integrates with third-party services (such as sign-in providers, social networks, and the App Store). We are not responsible for the privacy practices of those services. Please review their policies. Dilly also displays information about a third-party game (Fortnite); that game and its content belong to Epic Games and are governed by Epic’s own terms and policies.

13. Apple App Store

Dilly is distributed through Apple’s App Store. Your download and use of the app are also subject to Apple’s terms and privacy practices. Apple may collect certain information as the app marketplace independently of us.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and provide affirmative notice in the app. Where a change materially affects how we handle a child’s information, we will, where required by law, obtain renewed parental consent before the change applies to that child rather than relying on continued use.

15. Contact us

Questions, requests, or concerns about privacy — including parental requests — can be sent to:

Dilly Entertainment Inc.
One Austin Avenue, #104, Greenville, RI 02828
[Phone number — to be completed]
Email: support@dilly.gg

Dilly is an independent, fan-made app and is not affiliated with Epic Games, Inc.