FlipACoin Privacy Policy

Effective date: 9 November 2026 · Version 1.0

The short version (for everyone, including teens)

• Who we are: FlipACoin is made by Menso Digital Ltd, a company in the United Kingdom.
• What we collect: what the game needs to work. That covers your game account, your username, your flips and scores, the coins you earn, whether you bought the ad-free version, and technical data that keeps the app working and safe.
• What we do not collect: your real name, phone number, contacts, photos, precise location or payment card details.
• The game is free. The only thing you can buy is an optional one-time purchase that removes ads. It is sold only in the App Store and Google Play. If your account is linked, it also applies on the web.
• Coins are not money. They cannot be bought, sold, sent to others or cashed out.
• Ads: the free version shows ads. Ads are personalised only if you are 18 or over and you agree where the law requires it. If you are under 18, ads are never personalised and we never ask to track you.
• Under 13: you cannot create an account. You can only use offline practice flips. We do not collect or store personal data about you.
• You are in control: you can download your data, change your choices or delete your account from Settings at any time.
• Questions: [email protected]

The full policy follows.

1. Who is responsible for your data

The controller is Menso Digital Ltd, Company No. 17010102, registered with the UK Information Commissioner's Office under ZC089517, Suite 10477, 5 Brayford Square, London E1 0SG, United Kingdom.

Menso Digital Ltd is the controller under the UK GDPR, the EU GDPR and the Turkish Personal Data Protection Law No. 6698 (KVKK).

Contact for data protection requests under these laws, and for support and everything else: [email protected]. You can also write to the postal address above.

We have not appointed a Data Protection Officer because the law does not require one for our processing. Our privacy lead can be reached at [email protected].

This policy covers the FlipACoin app for iOS and Android (my.flipacoin) and the website and web app at flipacoin.my, including the link sub-domains go.flipacoin.my and l.flipacoin.my. Together these are "the service".

2. What data we process and why

Our servers run on machines we rent from Hetzner in Helsinki, Finland (EU). The database, sign-in system, product analytics, feature flags, error logging and monitoring on those machines are our own systems, not third-party services. Hetzner hosts the machines for us as our processor.

2.1 Data inventory

Legal bases

We rely on the following bases under UK and EU GDPR Art. 6 and the equivalent provisions of KVKK Art. 5:

• performance of a contract: running your account, the game and the ad-free version you bought
• legal obligation: tax and accounting records, age-appropriate design, online safety duties and answering lawful requests
• legitimate interests: security, fraud and cheat prevention, fair play, crash reports, first-party analytics in the apps, non-personalised ads and invites. You can object to these at any time (section 7).
• consent: device storage for ads in the UK, EEA and Switzerland, personalised ads and ad measurement (adults only), website analytics, and marketing. For users in Türkiye this is explicit consent (açık rıza) under KVKK Art. 5(1).

2.2 What we do not do

• We do not sell your personal data.
• We do not collect precise location, contacts, photos, microphone or camera data.
• We do not use biometric data.
• We do not fingerprint devices to identify you.
• We do not make decisions with legal or similarly significant effects about you solely by automated means. Our anti-fraud system can flag an account or hold back rewards. A person reviews every suspension, and you can ask for a person to review a held reward. You can always appeal (section 9).

3. Children and teens

FlipACoin is not directed at children under 13. We follow the UK ICO Age Appropriate Design Code (Children's Code).

Age check first. When the app first opens, it asks for your year and month of birth in a neutral way. It does this before any advertising, analytics, crash-reporting or attribution tool starts. We keep only the age band. Where Apple or Google give us an age signal for your device, we use it too, and we apply the younger result.

Under 13:

• You cannot create an account or play online.
• You can use offline practice mode. Practice flips are not saved, earn no coins and are not sent to us.
• No advertising, analytics, crash-reporting or attribution tool is started. We do not collect or store personal data about you. The app may still contact our servers to check for app updates, and that request is used only for that purpose.
• A short lock on the device stops the age being changed straight away.

13 to 17:

• High-privacy settings are on by default.
• Ads are never personalised. We tell Google that you are under the age of consent, request non-personalised ads only, ask that your data is not sold or shared, and allow teen-suitable ad content only. Google passes these settings to the mediation networks, and Meta Audience Network is never used for you. You do not see the ad consent form.
• We never show Apple's tracking prompt and never read the IDFA.
• No ad-measurement analytics (row 14) and no paid-campaign attribution.
• No profiling for advertising.
• Communication with other players is limited to preset phrases and emoji.
• Your username is not shown in the public "recent winners" feed. You appear as "a player from" your chosen country.
• Notifications stay off until you turn them on.
• Purchases are possible only in the apps and go through Apple's or Google's family controls (Ask to Buy, Family Link).

We apply these rules to everyone under 18 in every country, so we do not rely on consent from anyone under 18 for any optional processing.

If we learn that an account belongs to a child under 13, we close it and delete its data. To tell us about such an account, write to [email protected].

Parents and guardians can contact [email protected] about a teen's account, including to ask us to delete it.

4. Who we share data with

We share data only with the providers below. Each receives only what it needs and is bound by a data processing contract, or acts as an independent controller for its own service.

We may also disclose data when the law requires it (for example to police, regulators or a court), to protect people's safety or our legal rights, or to a buyer or successor if our business is sold or reorganised. You would be told before your data falls under a different policy.

4.1 Ad networks

Ads in the apps are served by Google AdMob. AdMob mediation can also ask the other networks below to fill an ad slot. Google passes your consent choices and age settings to every network. Each network is an independent controller for its own ad processing and applies its own privacy policy. There are no ads on the website at launch.

Before we add another network, we name it here and in the consent form.

5. International transfers

Your data is stored in the EU (Finland). The controller is in the UK.

• Transfers from the EU to the UK rely on the European Commission's adequacy decision for the UK.
• Transfers to other countries rely on adequacy decisions or regulations where they exist (for example the EU-US Data Privacy Framework and its UK Extension), and otherwise on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
• The ad networks in section 4.1 receive ad data in the USA and other countries. These transfers rely on the Data Privacy Framework where the network is certified, and otherwise on the EU Standard Contractual Clauses and the UK Addendum.
• For users in Türkiye, transfers abroad rely on KVKK Art. 9, using the standard contracts published by the Personal Data Protection Authority. We notify the Authority of each signed standard contract within five business days.

Write to [email protected] for a copy of the relevant safeguards.

6. How long we keep data

7. Your rights

Under UK GDPR, EU GDPR and KVKK Art. 11 (subject to legal conditions), you can:

• access your data and get a copy
• correct it
• erase it
• restrict processing
• object to processing, including at any time to processing based on legitimate interests and to direct marketing
• take your data with you (portability)
• withdraw consent at any time. This does not affect processing that already took place.
• under KVKK, learn whether your data is processed and who it was transferred to, and ask for the consequences of unlawful processing to be remedied

How to use your rights:

We reply within one month. For complex requests this can be extended by two further months, and we will tell you if so. For users in Türkiye the deadline is 30 days. We may ask you to confirm that the account is yours.

Complaints. You can complain to the UK Information Commissioner's Office (ico.org.uk), to the data protection authority where you live or work in the EU, or to the Kişisel Verileri Koruma Kurumu in Türkiye. We would be grateful for the chance to resolve your concern first.

US residents. We do not sell personal data for money. Some US state laws treat personalised advertising as "sharing" or "targeted advertising". You can opt out at Settings → Privacy → Ad choices, or on our website through the Your Privacy Choices link in the footer. We honour Global Privacy Control signals on the website. We never personalise ads for anyone under 18. You can use your other state-law rights (access, deletion, correction) as described above, and you may appeal a refusal by writing to [email protected] with the subject "Privacy appeal".

8. Security

We protect your data with encryption in transit (TLS) and at rest, encrypted off-site backups, staff access based on roles behind single sign-on and multi-factor authentication, an audit log of staff actions, database row-level security and device integrity checks.

No system is completely secure. If a personal data breach puts you at risk, we will tell you and the competent authority (the ICO within 72 hours, and authorities in other countries where required). To report a security issue, write to [email protected].

9. Moderation and automated tools

Usernames, room names and Decision Mode text are checked automatically against a list of prohibited words. Reported content is reviewed by a person.

Our anti-fraud system uses device integrity results and account signals to spot bots and multiple accounts. It may delay or hold back rewards automatically. Suspensions are always confirmed by a person. You can appeal any decision (see the Community Guidelines).

10. Marketing

• We send marketing emails or marketing push notifications only if you are 18 or over and opt in. You can opt out at any time in Settings or through the link in each email.
• Service messages such as sign-in codes and receipts are not marketing.
• In Türkiye, we send commercial electronic messages only with your prior consent, recorded in the İYS (Message Management System).

11. Changes to this policy

We will post updates here and change the effective date. We will tell you in the app or by email before material changes take effect.

12. Contact

Menso Digital Ltd, Suite 10477, 5 Brayford Square, London E1 0SG, United Kingdom · [email protected]

Annex A: KVKK information notice (Türkiye)

For users in Türkiye, the information required by KVKK Art. 10 (the data controller, the purposes, the recipients and the purposes of transfer, the method of collection, the legal reasons and your rights) is given in sections 1 to 7 above.

Method of collection: electronically, through the app, the website and the tools listed in section 4.

Explicit consents: the explicit consent texts for personalised advertising, ad measurement and commercial electronic messages are shown separately at the point of consent. They are not part of this notice, and saying no does not stop you using the service.

Applications under KVKK Art. 13: send them to [email protected] or in writing to our postal address in section 1. We reply within 30 days.