Privacy Policy
This Privacy Policy explains how Zhiwater, the operator of Sweet Pop Match / zhiwater.asia (“we”, “us”), handles information when you visit our website zhiwater.asia (including www.zhiwater.asia) or play Sweet Pop Match (the “Game”) at play.zhiwater.asia. It is one policy for both the website and the Game.
1. Summary
- No sign-up is needed. The Game creates a guest account and an 8-digit Player ID for you automatically.
- We store your game progress, coins, daily rewards, invites and Black Gold VIP membership on our game server, linked to your Player ID.
- The website and the Game show ads from Google. Google may use cookies and similar identifiers for ads. In the Game you choose “Accept” or “Essential only” before any ad is loaded.
- We record your IP address on prize wheel spins to prevent abuse and clear it after 90 days.
- We do not collect device fingerprints.
- We do not sell your personal information. Coins are not sold for real money.
2. Information we collect
2.1 Your game account (linked to your Player ID)
- Identifiers: your 8-digit Player ID, an internal guest account ID, a random device ID created by the Game and stored in your browser, your invite code, and a hashed recovery code. Sign-in tokens are stored only as hashes.
- Device record: your browser’s user-agent string (browser and device type) and when the device was first and last seen.
- Settings: time-zone offset and browser language (used to reset daily rewards at your local midnight), and your privacy choice with its version.
- Cloud save and wallet: level progress, stars and level results, lives, boosters, avatar, tutorial progress, your coin balance and a coin ledger (each coin change with amount, reason and time).
- Daily login rewards: your login streak, the days you claimed a reward and the coins you received.
- Invites and sharing: your invite code, which account invited you or which accounts you invited and when, invite rewards, share links you created and life gifts.
- Linked sign-in (only if you choose it, when offered): the provider name (for example Google), the provider’s account ID and, if the provider reports it as verified, your email address.
- Merged accounts: if you keep one save when linking accounts, the other save is archived rather than deleted.
2.2 Black Gold VIP membership and the prize wheel
- Membership records: your membership status (Black Gold), how you got it (for example the wheel), the start date, the expiry date and the length of the membership. These records are used to give you membership benefits, such as 3x daily login coins.
- Wheel draw records: your Player ID / account, the random device ID, the prize you won (segment and number of days), the odds version and the time of the spin. These records enforce the “one spin per player” rule and record your prize.
- IP address for anti-abuse: when you spin, we store your IP address and its network range (for example the first part of the address) with the draw record to stop mass entries from one network. We automatically clear these values after 90 days. For declined spins we only keep the network range and the reason for up to 90 days.
- Payments: membership payment is not open yet. When it opens, payment will be handled by a payment provider (planned: PayPal), and we will receive only the order ID, amount and status, never your card or bank details. We will update this policy before payments start.
2.3 Information saved in your browser
The Game uses your browser’s local storage to keep the device ID, your account and sign-in tokens, progress, coins, settings, your privacy choice and an ad-spacing counter. The website’s prize wheel uses local storage for a random device ID and a short-lived wheel session token.
2.4 IP address and server logs
Every request to our servers includes your IP address. We use it briefly in memory to limit request rates and keep the service secure. Our game server and web server keep standard technical logs (IP address, time, requested address, browser type), which are rotated weekly and kept for about 8 weeks. Apart from the prize wheel records above, your IP address is not stored in your game account.
2.5 What we do not collect
- We do not collect device fingerprints (we do not combine screen size, hardware, fonts or similar device characteristics to identify your device).
- We do not ask for your name, phone number, postal address, precise location, photos or contacts.
3. Advertising
We show ads to keep the Game free:
- On the website (zhiwater.asia): Google AdSense (publisher ID ca-pub-9102153041495210).
- In the Game (play.zhiwater.asia): Google H5 Games Ads (Ad Placement API), including occasional ads between levels and optional rewarded ads that you choose to watch for an in-game reward such as extra moves, a life or coins. If you close a rewarded ad early, no reward is given.
These ads are provided by Google LLC and, in the EEA, UK and Switzerland, Google Ireland Limited, as an independent third party. Google and its partners may use cookies, mobile ad identifiers and similar technologies and may process information such as your IP address, browser and device information to show ads, measure them, personalise them where allowed, limit how often you see an ad and prevent fraud. Learn how Google uses information from sites and apps that use its services: https://policies.google.com/technologies/partner-sites. More about Google advertising cookies: https://policies.google.com/technologies/ads.
Your choices. In the Game, before any ad script is loaded, you choose Accept (ads may be shown and personalised where allowed) or Essential only (no ad or analytics script is loaded; only “watch an ad” rewards are unavailable). You can change this at any time in Settings → Privacy choices. On the website, where the law requires consent (for example in the EEA, UK and Switzerland), we will ask for it through a consent message before personalised ads are used. You can also turn off personalised ads in Google’s My Ad Center (https://myadcenter.google.com), visit www.aboutads.info, or block or delete cookies in your browser.
4. Cookies and similar technologies
- Essential: local storage used by the Game and the wheel (see 2.3). Our own pages do not set advertising cookies.
- Advertising: cookies and identifiers set by Google for AdSense and H5 Games Ads (see section 3).
- Network and security: our websites are delivered through Cloudflare, which may set strictly necessary security cookies and may collect anonymous page-performance data (Cloudflare Web Analytics, which does not use cookies).
Analytics: we do not currently use Google Analytics. If we add it, it will only run after you choose “Accept”, and we will update this policy first.
5. How we use information and our legal bases
- To run the Game you asked for (performance of a contract): saving and restoring progress, keeping coin balances correct, daily login rewards, invites, and giving you your Black Gold VIP membership and its benefits.
- To keep the service safe and fair (legitimate interests): preventing cheating, multiple-account abuse of the wheel and invites, rate limiting, security and fixing problems.
- To show ads (consent where required, otherwise legitimate interests): see section 3.
- To meet legal obligations, such as answering lawful requests.
6. Who we share information with
- Google: advertising, as described in section 3, and sign-in if you choose to link a Google account.
- Cloudflare, Inc.: hosting of the website and Game files, network delivery and security for all our domains, including the game server.
- Our server hosting provider (Tencent Cloud), which hosts our game server and database in the United States (Virginia).
- A payment provider, only once payments open (see 2.2).
- Authorities, if the law requires it.
We do not sell your personal information. California residents: Google’s personalised advertising may count as “sharing” for cross-context behavioural advertising under the CCPA/CPRA. You can opt out by choosing “Essential only” in the Game, by using a Global Privacy Control signal where supported, or by contacting us.
7. International transfers
Our game server is located in the United States (Virginia), and our providers may process data in other countries, including the United States. Where the law requires it (for example for data from the EEA or UK), we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
8. How long we keep information
- Game account, cloud save, wallet, daily login, invite and membership records: for as long as your account exists, so your progress and membership can be restored.
- Wheel draw records (without IP data): for as long as your account exists, to enforce one spin per player and to record prizes.
- IP address and network range on wheel records: 90 days, then cleared automatically.
- Server logs: about 8 weeks.
- Database backups: made daily and kept for 7 days. Deleted data disappears from backups when they expire.
9. Your rights and choices
Depending on where you live (for example under the GDPR/UK GDPR or the CCPA/CPRA), you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict its use, and to withdraw consent at any time (in the Game: Settings → Privacy choices). To make a request, contact us (see “Contact” below) with your 8-digit Player ID (shown at the top-left of the Game). We may ask you to confirm the account is yours. We respond within one month (45 days for California requests). You may also complain to your local data protection authority.
Deleting your data. Data in your browser: clear the site data for zhiwater.asia and play.zhiwater.asia in your browser settings (this starts a new guest account but does not delete server data). Data on our server, including membership and wheel records: contact us (see “Contact” below) with your Player ID and we will delete your account.
10. Children
Sweet Pop Match is a casual game for a general audience and is not directed at children under 13 (or the minimum age in your country, such as 16 in parts of the EEA). We do not knowingly collect personal information from children under that age. If you believe a child has given us personal information, contact us (see “Contact” below) and we will delete it.
11. Security
Connections are encrypted (HTTPS), tokens and recovery codes are stored only as hashes, and access to our servers is limited to the people who run the Game. No system is perfectly secure.
12. Changes
We may update this policy. We will change the effective date above and, for important changes, show a notice in the Game.
13. Contact
Zhiwater, the operator of Sweet Pop Match / zhiwater.asia
Email: [email protected]