Privacy Policy — PLAYER 3

1Who processes your data

PLAYER 3 is operated by BARBOSA E FOLLE DESENVOLVIMENTO DE SOFTWARE LTDA ("Três Limões", "we"), CNPJ 68.586.378/0001-52, registered at Av. Paulista, 91, Brazil.

For anything to do with your privacy — questions, requests for access, correction or deletion of data — write to us at privacidade@treslimoes.com.br.

Data Protection Officer: in accordance with Art. 41 of the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018), Três Limões appoints Logan Cunha Folle as the officer responsible for personal data processing. The channel is free and direct:

• E-mail: dpo@treslimoes.com.br
• Hours: Monday to Friday, 9am to 6pm (BRT), except public holidays

Section 9 describes the rights you can exercise through that channel and the response deadline.

2Minimum age

PLAYER 3 requires a minimum age of 13 to create an account. The date of birth given at sign-up is checked at the moment of registration, and an account is only created if the age calculated from it is 13 full years or more. PLAYER 3 therefore declares itself an app not directed at children under 13.

3Data we collect

We collect only what the app needs to work:

• E-mail address, used to identify the account, for authentication, and to send the password recovery code when you ask for it. Besides that code, PLAYER 3 may write to you only about your own account, and only in these cases: a request to change your nickname (or a notice that we changed it), a suspension of the account, or a change to the Terms of Use or to this policy. There is no newsletter, no product announcement and no marketing communication.
• Nickname, chosen by the person at sign-up and editable at any time in Profile › Account settings. It is the name the app uses to address them. In this version, the nickname is shown only to the person themselves — it is not displayed to other users.
• Password, when you create one, always stored as a hash — never in readable text, not even by us. Someone who signs in only with Apple or Google may have no password.
• Sign-in methods: when you sign in with Apple or Google, we receive from the provider your account's identifier there and the e-mail address it confirmed — which, at Apple, may be a relay address Apple created. We use them to sign you in and to link your account to the provider. The name the provider shows the app is used only on the device, to greet you, and is not sent to our servers.
• Apple credential: when you link Apple, we keep a code Apple gives us (a refresh token), with a single use: revoking PLAYER 3's access to your Apple account when you delete your account.
• Date of birth, used exclusively to verify the minimum age described in section 2. It is not shown to other users.
• Ratings: the scores, tags and other information a person records when rating a game (overall score, per-attribute scores, context tags, verdict tags, whether they would recommend the game, play-time range and, where applicable, the platform played on).
• Favorites and lists: the games a person favorites and the lists they build — the list's name, the filters chosen (genres, platforms, minimum score and criterion, playtime and sort order) and the games they took out of each one. They are used only to show this back to the person; nobody else sees them.
• Suggestions and ideas: a suggestion to add a game (the game's name and the note, when there is one) and the idea or problem told in Profile › Send feedback (the text, up to 1000 characters, and the version of the app it came from). Only the PLAYER 3 team reads them, and the app does not reply there. Do not write personal data in that text — phone number, address, ID document: the team does not need it, and does not ask for it.

PLAYER 3 has no free-text field visible to other users on any screen of the app. A suggestion to add a game and an idea sent by a user are visible only to the PLAYER 3 team, never to other users of the app.

4Reports with aggregate, anonymised data

Beyond direct use inside the app (calculating and displaying the game ranking), PLAYER 3 may produce reports with aggregate, anonymised data — for example, average scores by criterion and by platform — and share or sell those reports to third parties, such as game studios and publishers interested in understanding how their titles were received.

Every report follows three rules, without exception:

• A minimum number of people per breakdown. No figure appears in a report if the breakdown it refers to — a game, a criterion, a platform, or any combination of them — gathers ratings from fewer than 5 distinct people. A breakdown below that floor is left out of the report, and does not appear even as "fewer than 5".
• People under 18 are left out. The ratings of anyone under 18 do not go into any report. The cut-off is age on the date the report is generated.
• Nothing individual leaves. A report never includes one person's rating, nor an e-mail address, nickname, date of birth or any account identifier.

Only ratings go in. Favorites, lists, suggestions and ideas do not go into any report.

Why this does not depend on consent. The three rules above guarantee that no breakdown with fewer than 5 people is published, that anyone under 18 is left out, and that nothing individual appears. The reports are built so that these rules also hold up under comparison: no published breakdown, nor the difference between two breakdowns or between reports from different dates, isolates the ratings of fewer than 5 people. That is why the report is anonymised data (Art. 12 of the LGPD): it is not personal data, and it does not depend on your consent. To produce the report from your ratings, the legal basis is legitimate interest (Art. 7, IX of the LGPD) — and that is why you can object to that use (section 9).

What changed. Up to version 1.3 of this policy, these reports depended on your consent, requested at sign-up and with a switch in the app to turn it on and off. That switch leaves the app from its next version onwards. What you answered there is still stored in your account and appears in the copy of your data if you request one (section 9). If your account existed before 28 September 2026 and you had not consented — because you declined, because you never answered, or because you turned the switch off — that answer still holds, and you stay out of the reports just as you would under 1.3. If you consented, or if your account dates from 28 September 2026 onwards, whether your ratings go in is decided by the three rules above.

If you do not want your ratings to go into the reports, you can object to that use through the channel in section 9, and they stop going into the reports generated after your request.

Calculating and displaying the ranking inside the app is the purpose for which you created the account: without it, the app would have no function.

5Account deletion

PLAYER 3 offers account deletion directly from the app, with no need to contact support externally — this is a requirement from Apple itself for apps with sign-up, and an obligation under this policy. The control is in Profile › Account settings, available to anyone with an active session, and it asks for explicit confirmation before deleting anything: your password or, for someone who signs in only with Apple or Google, signing in with them again.

When exercised, account deletion permanently removes the e-mail address, the password (the stored hash) and the date of birth associated with the account, as well as all the data dependent on it: ratings, favorites, lists, suggestions and ideas — including an idea the team has already read. Deletion also erases the sign-in methods linked to the account and revokes PLAYER 3's access to your Apple account, if it is linked. After deletion, the account cannot be recovered.

About the record of access requests handled. If you request a copy of your data through the channel in section 9 and we fulfil it, we keep a record of that: the e-mail address the copy was delivered to and the date of delivery — nothing of the exported content. That record survives account deletion, and it is the only exception to the paragraph above. The reason is the same as for reports already produced: it does not exist to give us access to you, it exists to prove what was done. A record of a request handled that disappears along with the data accounts for nothing — not to you, if you one day need to show that you exercised the right, and not to the authority, if it asks. The legal basis is compliance with a legal and regulatory obligation by the controller (Art. 7, II of the LGPD), together with the principle of accountability (Art. 6, X).

About reports already produced. An aggregate report that has already been generated and delivered to a third party is not undone by the deletion of your account, because it contains no data that allows you to be identified — there is nothing in it of yours to delete. What deletion guarantees is that your data does not enter any future report.

6Ads and tracking

PLAYER 3 plans to display third-party ads (via AdMob) as part of how it sustains itself financially, alongside the store links described in the last item of this list. This section is written into this first version of the policy even though the ad SDK will only be integrated at a later stage of development — so that introducing ads does not require a change of policy, nor fresh consent, at the moment the feature launches.

• App Tracking Transparency (ATT): before any tracking across third-party apps or sites for personalised advertising purposes, PLAYER 3 asks for the user's consent through Apple's ATT mechanism. Without that consent, the app carries on working normally and shows only non-personalised ads — the app's behaviour does not change between the two choices, only the type of ad shown.
• Ad consent (UMP): for users in Brazil (LGPD) and in the European Union (GDPR), PLAYER 3 presents an ad consent form before loading any personalised ad, following the User Messaging Platform message standard.
• Privacy manifest: the app declares, in its privacy manifest (PrivacyInfo.xcprivacy), the tracking domains used by the integrated ad SDK.
• Store links ("Where to buy"). A game's page may include links to stores that sell it. Some are affiliate links: if you buy through them, we may earn a commission from the store, at no extra cost to you. Tapping a link opens the store outside the app, in your browser or in the store's own app. PLAYER 3 counts taps on store links without knowing who tapped: we keep only which link was tapped, for which game and store, when, and on which app version, without your account, your IP address or any identifier of your device, to learn which links are used. And we send none of your data to the store: the link carries only PLAYER 3's identification in the affiliate program. What you do in the store is governed by its own privacy policy. Store links are not ads, no store pays for its position, and they never change any game's rating.

Ads never appear inside the game ranking list, nor on a game's detail screen, nor while a rating is being filled in.

7Data security

Passwords are stored only as hashes. Authenticated access to the app uses session tokens with limited validity. Communication between the app and the server runs over an encrypted connection (HTTPS).

Signing in with Apple or Google is checked by the provider's signature, every time. PLAYER 3 never receives nor stores the password of your Apple or Google account.

8Service providers

To work, PLAYER 3 depends on three companies, which process data on our behalf:

• Fly.io — hosts the application and the database, in the São Paulo region.
• Cloudflare — publishes the site and the admin panel, and handles DNS.
• Resend — delivers PLAYER 3's e-mails: the password recovery code and, when there are any, the notices about your account described in section 3. It receives your e-mail address, and only when one of those messages is sent.

Apple and Google, when you choose to sign in with them, do not process data on our behalf: they are the source of the sign-in data (the account identifier and the confirmed e-mail) and process your data under their own policies — Apple's and Google's. To revoke PLAYER 3's access to your Apple account when you delete your account, we send Apple the code described in section 3 and the app's identifier. This is an international data transfer (art. 33 of the LGPD), made to fulfil your deletion request.

9Your rights and how to exercise them

Questions about this policy, about the data on a specific account, or the exercise of any right under the LGPD go to dpo@treslimoes.com.br, the officer's channel named in section 1. Once the app is published, the support channels on the App Store listing apply as well, without replacing that address.

Through the same channel you may request:

• Confirmation and access — to know whether we process your data and to receive a copy of it, with your ratings, favorites, lists (with the filters and the games taken out of each one), suggestions, ideas and sign-in methods — and what was done with each idea and each suggestion (read, discarded).
• Correction — to update incomplete, inaccurate or outdated data.
• Deletion or anonymisation — to erase or block data that is unnecessary or processed in breach of the law. Deleting the whole account is also done inside the app itself, without needing this channel (section 5).
• Withdrawal of consent — to take back an authorisation given earlier.
• Objection — to object to a processing activity, including the use of your ratings in the reports in section 4.
• Portability — to receive your data in order to take it to another service provider.

Requests are answered within 15 (fifteen) days of the date of the request. Before fulfilling one, we may ask you to confirm your identity — without that, anyone who knew your e-mail address could ask for a copy of your data.

10Version history

• Version 1.5 — 30 September 2026: automatic lists and "Send feedback" entered the app. Section 3 now lists favorites, lists (the name, the filters and the games taken out of each one), suggestions to add a game and the ideas sent in Profile › Send feedback (the text, up to 1000 characters, and the app version), with the request not to write personal data in that text, and says that the idea, like the suggestion, is seen only by the team. Section 4 now says that none of this goes into the reports — only ratings. Section 5 now lists what account deletion erases, and section 9 says that the copy of your data includes lists and ideas, with what was done with each idea. Favorites and suggestions were already collected; what changed for them is that the text now names them. Section 6 now describes the store links ("Where to buy") on each game's page, and the counting of taps on them, done without knowing who tapped. Before going live, this version also gained signing in with Apple and with Google. Section 3 now says the password exists when you create one, and lists the sign-in methods (the account's identifier at the provider and the e-mail it confirmed) and the code Apple gives us to revoke access on deletion; the name the provider shows the app stays on the device. Section 5 now says deletion asks for the password or for signing in with the provider again, erases the sign-in methods and revokes PLAYER 3's access at Apple; section 7, that signing in through the providers is checked by their signature; section 8, that Apple and Google are the source of the sign-in data when you choose them, and the international transfer that revocation at Apple involves; and section 9, that the copy of your data includes the sign-in methods.
• Version 1.4 — 28 September 2026: section 4 was rewritten. Reports with aggregate data became anonymised data — with a floor of 5 distinct people per breakdown, people under 18 left out, and nothing individual — and therefore no longer depend on consent; the legal basis for producing them became legitimate interest (Art. 7, IX of the LGPD). Up to version 1.3 the reports depended on consent, requested at sign-up and through a switch in the app; that switch leaves the app from its next version onwards, and every refusal, absence of an answer or withdrawal recorded by an account created before 28 September 2026 still holds — those accounts stay out of the reports just as they would under 1.3. Section 5 no longer speaks of withdrawing that consent, section 9 now names the right to object and what it does, sections 3 and 5 now point to Profile › Account settings, where the nickname is edited and the account is deleted since the app's visual redesign, and the beginning of the document gained the link to the Terms of Use. Section 3 now says that, besides the password recovery code, PLAYER 3 may write to you about the account itself — a request to change the nickname, a suspension, a change to the Terms of Use or to this policy —, and section 8 now says that Resend also delivers those notices. No new data began to be collected.
• Version 1.3 — 26 September 2026: the nickname entered the product and section 3, among the data collected: chosen at sign-up, editable in the Profile and, for now, visible only to the person themselves. It also began to appear in the data export in section 9.
• Version 1.2 — 20 September 2026: section 5 now declares the record of access requests handled — the e-mail address the copy was delivered to and the date of delivery, nothing of the exported content — and that this record survives account deletion. It is the only exception to deletion, and it has existed since the request handling stopped being manual; version 1.1 already practised it without declaring it, and that is what this version corrects. No new data began to be collected: what changed is the text saying what the system does.
• Version 1.1 — 11 September 2026: password recovery by e-mail entered the product, and two things changed because of it. Section 3 now says that the e-mail address is also used to send the recovery code, and not only to identify the account. And section 8, "Service providers", was born, naming the three companies that process data on our behalf — Fly.io (hosting and database), Cloudflare (site, panel and DNS) and Resend (delivery of the e-mail with the code) — which until then were not declared anywhere.
• Version 1.0 — 25 August 2026: first published version, covering identification of the controller and the officer, the data subject's rights, minimum age, data collected, account deletion, use of aggregate data, and the ads and tracking section (written before the corresponding SDK was integrated).