Adda Central — Privacy Policy
DRAFT — prepared for review by Skycast Media Network Private Limited's counsel. Not legal advice.
Last updated: [DATE]
This policy explains what personal data the Adda Central app and website collect, why, who we share it with, how long we keep it and how you can control it. It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). Most duties under the DPDP Act and Rules apply from May 2027 (eighteen months after the Rules were notified in November 2025); we follow this policy from launch.
This is the privacy policy linked from our Google Play and Apple App Store listings.
At a glance
| Question | Short answer |
|---|---|
| Who is responsible for your data? | Skycast Media Network Private Limited, India (the "Data Fiduciary") |
| What do we collect? | Device and app identifiers, a display name and illustrated avatar you choose, month from which you are an adult (never your birth date), gameplay and purchase records, ad and crash data, approximate region from your IP address, and — only if you choose them — your phone number or Google/Apple sign-in details |
| What do we never collect? | Your contacts, your precise location, your photos, your birth date, your card or UPI details, or free-text chat messages (there is no free-text chat) |
| Do we sell your data? | No. |
| Ads | Ads are served by Google AdMob and partners. Personalised ads for adults only, with your permission where required. Players aged 13–17 get non-personalised ads, with no advertising ID used |
| Children | Under 13s cannot use the app. 13–17 accounts run in a data-minimal mode with no tracking for ads, no targeted ads and no purchases |
| Where is it stored? | Mainly on servers in AWS Mumbai, India. Some service providers process data outside India |
| Your rights | Access, correction, erasure, withdraw consent, nominate someone, and complain — in the app (Privacy Centre) or by email |
| Delete your account | In the app (Profile > Privacy Centre > Delete my account) or at https://addacentral.com/delete-account |
| Contact | Grievance Officer: Rajesh K, [email protected] · Privacy: [email protected] |
1. Who we are
Skycast Media Network Private Limited ("Skycast", "we", "us"), CIN U60200TN2024PTC175526, registered office VO144, WeWork Olympia Cyberspace, SIDCO Industrial Estate, Guindy, Chennai, Tamil Nadu 600032, India, owns and operates Adda Central. For the purposes of the DPDP Act, we are the Data Fiduciary: we decide why and how your personal data is processed.
Our Grievance Officer, who also answers questions about this policy, is named in section 15.
2. What personal data we collect
We collect only what we need to run the games and the features described below. The table lists every category.
| # | Data | When and how we get it | Applies to 13–17 accounts? |
|---|---|---|---|
| 1 | Device and app identifiers: a device record we create, app version, device class (e.g. low-end or high-end), operating system version, network type (Wi-Fi or mobile) | Automatically when you use the app | Yes |
| 2 | Firebase installation ID and Firebase Authentication user ID (including the anonymous ID of a guest account) | Automatically when the app first opens | Yes |
| 3 | Display name, avatar and frame (chosen from our illustrated set; no photos) | When you set up your profile | Yes |
| 4 | State (optional; you pick it from a list) | Only if you choose to add it | Yes, if chosen |
| 5 | Language | When you pick a language | Yes |
| 6 | Age band: the year and month from which you are 18 ("adult_from") | You enter your month and year of birth once; we calculate this month and discard the month and year of birth | Yes |
| 7 | Gameplay data: matches and runs (game, mode, number of players, whether bots were present, room type, duration, result, rewards, the match seed and its hash, the move/event log), ratings, scores and leaderboard entries, quiz answers, missions, streaks, season pass and tournament progress, wallet ledger (Coins and Gems granted and spent), friends you have played with, clubs ("Mohallas"), invites and referrals (including a hashed room code), creator codes used, share cards created (we record that you made one, not the image), and app lifecycle events (app open, session start and end) | Automatically as you play | Yes, without advertising identifiers |
| 8 | Purchase records: product, price, date, store order ID and the purchase receipt or transaction record from Google Play or the App Store; subscription start, renewal and cancellation | When an adult player buys something | No (no purchases) |
| 9 | Advertising data: advertising ID (Android Advertising ID or Apple IDFA, only if you allow it), ad impressions, ad rewards and skips, ad network and placement | When ads are shown | No advertising ID for 13–17; only non-personalised ads |
| 10 | Crash and performance logs: crash reports, stack traces, device model and OS version, app state at crash | Automatically when the app crashes or has an error | Yes |
| 11 | IP address and approximate region (country, state or city level, derived from your IP address) | Automatically when your device connects to our servers or service providers | Yes |
| 12 | Push notification token | If you allow notifications | Yes (gameplay notifications only) |
| 13 | Phone number | Only if you choose to sign in with phone OTP | Not until parental consent is live (no account linking) |
| 14 | Google or Apple account identifier and the email address they share (Apple may share a private relay email) | Only if you choose to link a Google or Apple account | Not until parental consent is live |
| 15 | Install referrer (Android) — used to drop you into the room a friend invited you to | When you install from an invite link | Yes |
| 16 | Reports, blocks and mutes you make or receive | When you or another player use these tools | Yes |
| 17 | Grievances and support requests: what you write to us, attachments, and our replies | When you contact us | Yes |
| 18 | Consent log: what notices you saw, what you agreed to or withdrew, and when | When you give or withdraw consent | Yes |
| 19 | Parental consent records (once the flow is live): the fact and method of verification and the time — see the Parental Consent Notice | When a parent gives consent | Yes |
| 20 | Deletion requests and their status | When you ask us to delete your account | Yes |
| 21 | Integrity signals from Google Play Integrity (Android) or Apple App Attest (iOS) — whether the app and device look genuine | At sign-in and purchase | Yes |
What we do not collect. We do not upload or read your contacts (friends are suggested only from rooms you played in together). We do not collect your precise or GPS location — only the approximate region shown by your IP address and the state you choose to add. We do not keep your birth date. We do not see or store your card, bank or UPI details (the stores handle payment). There is no free-text chat, and you cannot upload photos. On iOS, the app reads a room code from your clipboard only when you tap the system "Paste" button on the "Joining a friend?" card.
3. Why we use your data
| Purpose | Data used (numbers from section 2) |
|---|---|
| Create and run your account, keep your progress, merge guest progress when you link an account | 1, 2, 3, 5, 6, 13, 14 |
| Run games: matchmaking, rooms, timers, fair random results, reconnection, leaderboards, friends and clubs | 1, 2, 3, 4, 7, 11 |
| Apply age protections (under-13 block, 13–17 restricted mode, automatic adult account at 18) | 6, 19 |
| Provably fair play, dispute review, detect cheating, farming and fraud | 1, 2, 7, 16, 21 |
| Process and verify purchases and subscriptions, deliver what you bought, handle refunds, meet tax and accounting law | 8, 21 |
| Show ads, give rewards for rewarded videos, cap how many ads you see | 1, 9, 11 |
| Send notifications you allowed (gameplay; and for adults, reminders and events) | 12 |
| Fix crashes and keep the service fast and secure | 1, 10, 11 |
| Understand how the app is used and improve it (product analytics and A/B tests) | 1, 2, 5, 7, 11 |
| Invites and referrals (put you in your friend's room; give referral rewards) | 7, 15 |
| Handle grievances, support requests, reports and rights requests | 16, 17, 20 |
| Record and prove consent; meet legal obligations, respond to lawful requests from authorities | 18, 19, and any data needed |
We do not use your data to make decisions that produce legal effects about you by automated means, except the automated checks that keep games fair (for example, flagging impossible scores for review). A person reviews any permanent ban before it takes effect [PLACEHOLDER: confirm this matches the console's ban-approval flow].
4. Our legal basis
- Consent (DPDP Act, section 6). When you first open the app we show you a notice
and ask for your consent to process your data for the purposes above. Some features ask separately, for
example:
- personalised ads (on iOS through Apple's App Tracking Transparency prompt, never shown to 13–17 accounts; on Android, through [PLACEHOLDER: confirm an in-app personalised-ads consent toggle — the blueprint does not yet specify one; until it exists, treat Android ads as personalised for adults only under the general consent and disclose this]);
- notifications (through your phone's permission prompt, asked after your first win);
- phone or Google/Apple sign-in, when you choose it.
- Legitimate uses (DPDP Act, section 7). Where the law allows us to process data without separate consent — for example where you voluntarily give data for a specific purpose and have not said you object (such as sending a grievance), or to comply with law, a court order or a request from a government authority, or to respond to a medical emergency or threat to safety.
- Children (DPDP Act, section 9). See section 7.
You can withdraw consent at any time (section 10). Withdrawal does not affect processing already done. If you withdraw consent needed to run the core games, we may not be able to keep providing the Service, and we will tell you before you confirm.
5. Who we share data with
We do not sell your personal data, and we do not share it with data brokers. We share it only with service providers ("Data Processors") who process it on our behalf under contract, with the stores and ad networks described below, and where the law requires.
| Provider | What it does for us | Data involved |
|---|---|---|
| Google Firebase — Authentication, Analytics, Crashlytics, Remote Config, Cloud Messaging (FCM) | Sign-in (including phone OTP SMS), product analytics (exported to Google BigQuery and viewed in Looker Studio), crash reports, feature settings, push notifications | 1, 2, 5, 6 (as a flag), 7, 10, 11, 12, 13, 14 |
| Google AdMob and its mediation partners Meta Audience Network, AppLovin, Unity Ads, Mintegral, InMobi | Serving and measuring ads | 1, 9, 11. For 13–17 accounts, ad requests are marked non-personalised and no advertising ID is used |
| Google Play (Billing, Play Integrity, Install Referrer) | Payments on Android, app/device integrity, invite referrals | 8, 15, 21 |
| Apple (App Store, App Attest, Sign in with Apple) | Payments on iOS, app/device integrity, sign-in | 8, 14, 21 |
| Amazon Web Services (Mumbai region, India) | Hosting our game and API servers, databases and storage | All categories stored on our servers |
| Cloudflare | Domain name service, content delivery and web application firewall for our website and servers | 11, and data in transit to our website |
| Sentry | Error monitoring for our servers | 1, 2, 11 where they appear in server errors |
| Grafana Cloud | Server performance monitoring | Technical logs that may include 2 and 11 |
Ad networks and stores may also act as independent controllers of some data under their own privacy policies (for example, Google for your Google account, Apple for your Apple ID).
We may also disclose data:
- to other players — your display name, avatar, frame, level, state (if added), ratings, leaderboard positions and in-game actions are visible to other players in rooms, leaderboards and clubs;
- to comply with law, a court order or a lawful request from a government body or regulator, including the Online Gaming Authority of India and the Data Protection Board of India;
- to protect players or the public, or to defend legal claims;
- to a buyer or successor if Skycast's business is sold or merged — your data would stay protected by this policy and we would tell you.
6. Location
We do not request your phone's location permission and do not collect precise location. We use only the approximate region inferred from your IP address (to choose servers, apply country-specific settings, understand usage by region, and fight fraud) and the state you choose to add to your profile.
7. Children and teenagers
Under the DPDP Act, anyone under 18 is a child.
Under 13: not permitted. Our age gate asks for your month and year of birth. If you are under 13, no account is created and the app offers nothing further. If we learn that a user is under 13, we will delete the account.
13 to 17: data-minimal mode. For these accounts:
- no advertising ID is collected or used; only non-personalised ads, no full-screen ads;
- no tracking or behavioural monitoring for advertising, and no targeted ads;
- no purchases and no spend prompts;
- no account linking (so no phone number, Google or Apple identifier is collected);
- no open matchmaking with strangers;
- no marketing notifications (gameplay notifications only);
- no contacts upload (this applies to everyone).
We still process the gameplay and technical data needed to run the games, keep them fair and fix crashes (categories 1–7, 10–12, 15–18, 21).
Verifiable parental consent. We are building a verifiable parental consent process that will let a parent or guardian give consent for their child, as required by the DPDP Act and DPDP Rules. It will be switched on before the relevant duties apply in May 2027. Until then, 13–17 accounts run only in the data-minimal mode above. Details are in the Parental Consent Notice.
A parent or guardian can contact us at [email protected] to ask about or delete their child's account.
[PLACEHOLDER: counsel to confirm (a) whether processing gameplay analytics for 13–17 accounts before parental consent is live is acceptable, and (b) what must happen to existing 13–17 accounts that have no verified parental consent once the consent duty applies — for example, consent requested at next launch, with the account paused until consent is given.]
8. How long we keep data
We keep data only as long as needed for the purpose, or as long as the law requires. The periods below are proposed and must be confirmed by counsel and the product before publication.
| Data | Proposed retention |
|---|---|
| Account, profile, wallet and progress | While your account is active. If you do not use the app for 3 years, we will erase it after giving you at least 48 hours' notice (in the app or by any contact we hold) |
| Guest accounts never linked | Erased after [PLACEHOLDER: e.g. 3 years] of inactivity, as above |
| Match logs (move/event logs used for disputes) | 180 days after the match, then kept only in aggregated or de-identified form |
| Analytics events | 14 months in identifiable form, then aggregated or de-identified |
| Crash and error logs | 90 days |
| Server and security logs (including IP addresses) | 1 year (the DPDP Rules require certain logs to be kept for at least one year), longer only if needed for an ongoing investigation |
| Purchase and subscription records | 8 years from the end of the financial year, to meet tax and company-law record-keeping [PLACEHOLDER: CA to confirm period] |
| Grievances and support requests | 3 years after closure |
| Reports, blocks and enforcement records | 2 years after the last action, or longer for repeat offenders while their ban stands |
| Consent log and parental consent records | For as long as the consent is relied on, plus 3 years to show compliance |
| Push tokens | Until the token expires, you turn off notifications, or you delete your account |
| Deletion request records | 3 years after completion (we keep only the request, not the deleted data) |
After you delete your account, we erase or anonymise your data within [PLACEHOLDER: e.g. 30] days from our live systems, and from backups within [PLACEHOLDER: e.g. 90] days, except records we must keep by law (as above). Data held by Google Firebase Analytics follows the retention setting we configure there ([PLACEHOLDER: confirm setting, e.g. 14 months]).
9. Your rights
You have the right to:
- Access — get a summary of the personal data we process about you, the processing we do, and who we have shared it with. In the Privacy Centre you can see and download your data.
- Correction and updating — correct inaccurate or incomplete data. You can change your display name, avatar, state and language in your profile at any time.
- Erasure — ask us to delete your data. See section 11.
- Withdraw consent — see section 10.
- Grievance redressal — complain to us and get a response (section 15).
- Nominate — nominate another person to exercise your rights if you die or become incapable. You can do this in the Privacy Centre [PLACEHOLDER: confirm the Privacy Centre has a nominee field; otherwise by email].
How to use your rights:
- In the app: Profile > Privacy Centre.
- By email: [email protected] from, or mentioning, the account concerned. We may ask you to confirm the request from inside the app so we know it is your account.
We will respond as soon as we can and no later than 90 days, the outer limit in the DPDP Rules; we aim for 15 days. There is no charge.
Under the DPDP Act you also have duties: please do not give false information, impersonate anyone, or file frivolous complaints.
10. Withdrawing consent
You can withdraw consent as easily as you gave it:
- in the Privacy Centre (each optional consent can be switched off there, and your consent log shows the history);
- by turning off notifications or ad tracking in your phone's settings;
- by deleting your account.
When you withdraw, we stop the processing that relied on that consent within a reasonable time and tell our processors to stop too, unless the law requires or permits us to continue.
11. Deleting your account
- In the app: Profile > Privacy Centre > Delete my account.
- On the web: https://addacentral.com/delete-account — use this if you have uninstalled the app. You will be asked to prove the account is yours [PLACEHOLDER: confirm method, e.g. signing in with the linked Google/Apple/phone account, or a code shown in the app].
Deletion erases your profile, progress, Coins, Gems and items permanently. Records we must keep by law (section 8) are kept separately and used only for that purpose. Deleting your account does not cancel a store subscription — cancel it in Google Play or your Apple ID settings.
12. Consent managers
The DPDP Act allows you to give, manage and withdraw consent through a Consent Manager registered with the Data Protection Board. Our consent log is built so that we can work with registered Consent Managers once they are available. We will update this policy when we support one.
13. Security and breaches
We protect your data with measures suited to the risk, including: encryption in transit (HTTPS and secure WebSocket connections); hosting with access controls in AWS; a web application firewall (Cloudflare); server-side verification of purchases; integrity checks (Play Integrity and App Attest); restricted access to our admin console through an allow-listed sign-in; and logging and monitoring. [PLACEHOLDER: confirm encryption at rest for the database, backups and object storage before stating it.]
No system is perfectly secure. If a personal data breach happens, we follow a written breach response plan. We will inform the Data Protection Board of India without delay and give it a detailed report within 72 hours of becoming aware of the breach (or any longer time the Board allows), and we will inform affected users without delay, in the app and through any contact we hold, explaining what happened, the likely consequences, what we are doing and what you can do to protect yourself.
14. Transfers outside India
Our main servers are in India (AWS Mumbai). Some service providers listed in section 5 — such as Google, Apple, the ad networks, Sentry and Grafana Cloud — may process data in other countries. We transfer data outside India only as permitted by the DPDP Act, and not to any country the Government of India restricts by notification. We require our processors to protect data to the standard set out in this policy.
15. Grievance Officer and contact
Grievance Officer: Rajesh K Skycast Media Network Private Limited, VO144, WeWork Olympia Cyberspace, SIDCO Industrial Estate, Guindy, Chennai, Tamil Nadu 600032, India Email: [email protected] Privacy questions: [email protected] In the app: Profile > Help > Raise a grievance
How we handle complaints is set out in our Grievance Redressal Policy.
16. Complaining to the Data Protection Board
If you are not satisfied with how we have handled your complaint, you can complain to the Data Protection Board of India through its online process [PLACEHOLDER: insert Board's official complaint URL once confirmed]. The DPDP Act asks you to use our grievance process first.
17. Changes to this policy
We will update this policy when our app or the law changes. The date at the top shows the latest version. If we make a material change — especially a new purpose or a new kind of data — we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.
18. Languages
You can read this policy in English and [PLACEHOLDER: list of the nine app languages once translated]. The DPDP Act gives you the right to receive the consent notice in English or any language in the Eighth Schedule to the Constitution. [PLACEHOLDER: counsel to confirm which translation prevails.]