Privacy Policy
This policy explains what personal data Womb of Gold collects, why, who it's shared with, how long it's kept, and your rights. It's written to meet India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (the "DPDP law"), the Information Technology Act, 2000 and its rules, and, for players in the EU or UK, the GDPR.
Who is responsible for your data: Sumit S (trading as Sage Ventures), 2902 A, B Ward, Jawhar Nagar, Kolhapur, Maharashtra 416012, India ("we"), is the Data Fiduciary (data controller). Contact: info@sageventures.co.in.
1. What we collect
| Data | Where it comes from | Why we use it |
|---|---|---|
| Name, email address, profile photo link and Google account ID | Google, if you sign in with Google | Creating and securing your account. Your Google name and photo are not shown publicly. |
| Email address | You, if you sign in with an emailed code | Sending your one-time sign-in code and recognising your account. It is never shown on leaderboards. |
| Display name | You | Shown on leaderboards |
| Game data: scores, levels reached, runs, progress and live status | Your play | Running the Game, leaderboards, saving progress, detecting cheating |
| Payment records: plan, amount, date, Razorpay payment/order IDs if used, or the UPI transaction ID (UTR) you submit | You, your UPI app for QR payment, and Razorpay if used | Verifying and unlocking paid levels, refunds, fraud prevention, tax and accounting records |
| Consent record: policy versions agreed, your 18+ confirmation, sign-in method and time | You | Showing that you agreed, as the law requires |
| Child profiles: nickname, birth month and year, whether shown on boards, status, game progress and scores | The child's parent or guardian, and the child's play | Running the child's profile under the guardian's account (see section 10) |
| Guardian record: full name, year of birth, relationship (parent or legal guardian), a scrambled code (hash) of the parent PIN, policy versions and time of consent | The guardian | Verifying and proving parental consent for each child profile, as the DPDP Rules require |
| Network address (IP), browser and device details | Your device, through our hosting | Security, fraud and abuse prevention. IPs used for sign-in rate limits are stored only as keyed hashes, for about an hour. |
| Settings and offline progress | Stored in your own browser | Remembering sound, tab and progress on your device |
We don't collect card numbers, CVVs, UPI PINs or bank passwords. These stay with Razorpay or your UPI app. For QR purchases, we receive the UTR you submit and manually check the payment before approving access. We don't run advertising, we don't sell or rent personal data, and we don't use it to build marketing profiles.
2. Our legal basis
We process your data on the basis of the consent you give at sign-up and, where the law allows, for legitimate uses such as meeting legal obligations, for example keeping tax records. In the EU and UK, our bases are performance of our contract with you, consent, legal obligation and our legitimate interest in keeping the Game secure and fair.
3. What is public
Leaderboards are public. (Child profiles have their own, stricter rules in section 10.) Anyone using the Game can see the nickname you choose, your scores and the level you reached. We never show your Google name, Google photo, email address or phone number on leaderboards.
Sharing your achievements. When you tap Share, the Game makes an image of your result (your display name, score, level and rank) on your own device and hands it, with a link back to the Game, to the app you choose (for example WhatsApp, Instagram, X or Facebook). Nothing is shared unless you do it, and we don't add tracking or social-media code to the Game. Anyone who opens a shared link sees your display name, score and level from that run. What you post is then governed by that platform's own terms. Child profiles can't share.
4. Who we share data with
We share data only with service providers who help us run the Game, under contracts that require them to protect it:
- Hostinger (our web host): runs the website, the game server and the database, and sends email sign-in codes. Your data is stored on Hostinger's servers in the data-centre region of our hosting plan.
- Google: only if you choose "Continue with Google". Google confirms who you are and gives us your name, email address and profile photo link for account sign-in. You choose a separate public nickname; the Google name and photo are not shown publicly.
- Your UPI app, such as PhonePe: QR payment. Razorpay processes payments only when its checkout is enabled.
- Google Fonts and content delivery networks: they receive your IP address when your browser loads fonts and scripts.
We also disclose data when the law requires it, for example to courts, regulators or law enforcement acting under a valid legal order, or to protect people from harm or fraud.
5. Data outside India
Some providers (Hostinger, Google, Razorpay's partners if used) may process data in other countries. The DPDP law allows this except to countries the Government of India restricts, and we follow any such restriction. For players in the EU or UK, transfers rely on the providers' standard contractual clauses or equivalent safeguards.
6. How long we keep data
- Account, display name, best score, progress and consent records: while your account exists. Then deleted within 30 days of a deletion request, except as noted below.
- Run history: deleted automatically after 60 days. Live status: after 1 day. Sign-in code records: after 1 day.
- Payment records: as long as Indian tax and accounting laws require, generally up to 8 years, even after you delete your account.
- Child profiles: until the guardian deletes the profile or the account, and in any case we delete them once the guardian asks or the account is deleted. Guardian records are kept while any child profile exists and for as long as needed to prove consent afterwards.
- Consent records: for as long as we need them to prove consent if questioned, and no longer than the law allows.
- Backups: rotated and overwritten automatically within about 14 days.
- Inactive accounts: if you don't sign in for 3 years, we may delete your account. Where the law requires, we'll warn you first.
7. How we protect your data
All traffic is encrypted (HTTPS). Our server checks every change, so each player can change only their own records. The admin dashboard requires Google sign-in plus a second factor (an authenticator app), and its secret is stored encrypted. Sign-in codes, parent PINs and network addresses are stored only as one-way hashes. Sign-in attempts are rate-limited. Card and UPI details never reach us. No system is completely secure, but we follow reasonable security practices as the IT Act requires and keep them under review.
8. If there's a breach
If a personal-data breach affects you, we'll inform you and the Data Protection Board of India as the DPDP law requires. Where applicable, we'll also report to CERT-In. We'll tell you what happened, what data was involved and what you can do.
9. Your rights
You can ask us to:
- tell you what personal data we hold about you and how we use it, and who we've shared it with;
- correct, complete or update it;
- erase it, unless we must keep it by law;
- withdraw your consent at any time. This doesn't affect processing already done. Withdrawing consent means we must close your account, which ends any paid pass;
- nominate someone to exercise your rights if you die or become unable to;
- handle a grievance about how we treat your data.
In the EU and UK you also have rights to data portability, to object, to restrict processing, and to complain to your local data-protection authority. Residents of California and other US states also have rights to know about and delete data. We don't sell or "share" personal data for advertising.
To use any right, email info@sageventures.co.in from your account email, or from the email address you sign in with, so we can verify you. We'll reply within the time limits set by law, and we aim to reply within 30 days. If you're unhappy with our answer, you can complain to the Data Protection Board of India.
10. Children
Accounts are only for people aged 18 or over. Under India's Digital Personal Data Protection Act, 2023, anyone under 18 is a child, so we process a child's data only with the verifiable consent of their parent or legal guardian.
- How consent is verified. Child profiles can only be created from inside an adult's own signed-in account, which has already been verified through Google or a one-time code sent to their email and whose holder has confirmed they are 18 or older. Before adding a child, the guardian gives their full name, year of birth (which must show they are 18 or older) and relationship to the child, sets a parent PIN, and ticks a separate consent box for each child. We rely on these identity and age details, which we hold for that adult account, as the DPDP Rules allow.
- Ages. Child profiles are for ages 13 to 17. We don't allow anyone under 13 to play.
- What we collect, and nothing more. The child's nickname (we ask guardians not to use the child's real name), birth month and year, and their game progress and scores. We never collect a child's email, phone number, photo or location.
- What we never do. We don't track children's behaviour, monitor them, profile them, or show them advertising or targeted content. Child profiles can't make payments.
- What is public. Nothing, unless the guardian chooses to show the child's nickname and scores on the Today and All-time boards. Child profiles never appear on the Live board.
- The guardian's rights. The guardian can pause, hide or delete a child profile at any time from Family profiles in the Game, and can use all the rights in section 9 on the child's behalf. Deleting a profile erases its progress and scores straight away (backups roll over within about 14 days).
- If you believe a child under 18 has created their own account, or a child profile was added without a real parent's or guardian's consent, email info@sageventures.co.in and we'll pause and review it promptly.
11. Cookies and local storage
We use no advertising or tracking cookies. Our own server sets one sign-in cookie (marked secure and HTTP-only, so page scripts can't read it), and your browser stores game settings so the Game works. You can clear these in your browser at any time, which signs you out.
12. Accidental loss
We keep regular backups, but we can't guarantee that game data will never be lost. See section 6 of the Terms of Use for what happens if data is lost, and keep your payment receipts.
13. Changes
We'll post any update here with a new version date. If a change materially affects how we use your data, we'll ask for your consent again the next time you sign in.
14. Grievance Officer and contact
Sumit S, Grievance Officer, Womb of Gold
2902 A, B Ward, Jawhar Nagar, Kolhapur, Maharashtra 416012, India
Email: info@sageventures.co.in
Hours: Monday to Saturday, 10:00 to 18:00 IST