Privacy policy

IOPEX TECHNOLOGIES PTY LTD (ACN 696 561 609, ABN 54 696 561 609) is an Australian proprietary company in Victoria. It works on performance engineering for mobile games and intends to publish its own titles. "We", "us" and "our" mean that company.

Covered

• This website at iopex.co.im.
• Any mobile title published under this company name, on any store.
• Email sent to our published address.

Not covered

• Apple and Google, which collect their own information under their own policies.
• Any advertising network acting on its own account, dealt with below.
• Any site reached by following a link from ours.

The law that governs this policy is the Privacy Act 1988 (Cth) and, in particular, the thirteen Australian Privacy Principles set out in Schedule 1 to that Act. Throughout this document a reference to "APP 6" or similar means the corresponding Australian Privacy Principle.

The small business threshold, and why it does not get us out of this

Section 6D of the Privacy Act exempts most businesses with an annual turnover of $3 million or less from the Australian Privacy Principles. IOPEX TECHNOLOGIES PTY LTD was registered in 2026 and its turnover is presently below that threshold, so on a narrow reading the Act may not yet bind it.

We are not relying on that. Several of the exceptions in section 6D would in any event pull a business like ours back inside the Act as it grows, including a business that discloses personal information about another individual to anyone else for a benefit, service or advantage. More to the point, the exemption is an accident of turnover, not a statement that the information stops mattering. This policy is written as though the Australian Privacy Principles apply in full, and we will handle requests and complaints on that basis.

Other Australian law that applies

• Spam Act 2003 (Cth), which governs commercial electronic messages, requires consent, sender identification and a working unsubscribe facility.
• Do Not Call Register Act 2006 (Cth), which governs unsolicited telemarketing. We do not telemarket.
• Australian Consumer Law, Schedule 2 to the Competition and Consumer Act 2010 (Cth), which gives you consumer guarantees that cannot be excluded by anything we write.
• Part IIIC of the Privacy Act, the Notifiable Data Breaches scheme, dealt with at its own section below.
• Privacy and Other Legislation Amendment Act 2024 (Cth), which introduced a statutory tort for serious invasions of privacy, provided for a Children's Online Privacy Code, and added transparency obligations for certain automated decisions. Those last two are dealt with in their own sections.

Performance work needs telemetry, and telemetry is the part of this policy most worth reading carefully, because "diagnostics" is where a lot of collection gets hidden. These tables are the whole list.

What a published title will collect

Battery data is not health or location data

Charging state and battery percentage can be revealing in aggregate. We use them only within a play session to compute drain per hour of play, we do not sample them when the app is not in the foreground, and we never combine them with anything that would indicate where you are or what your routine is.

From this website

No analytics, no advertising, no pixel and no session recording, and therefore no consent banner.

From correspondence

Your email address, whatever is in the message, and the metadata your mail provider attached. Support threads 24 months, complaint threads 7 years.

Australian Privacy Principle 5 requires that we tell you certain things at or before the time we collect personal information about you, or as soon as practicable afterwards.

We meet that obligation in three places, and deliberately not only here:

• In the store listing. Apple's privacy nutrition labels and Google Play's Data Safety section state what a title collects before you install it. Those declarations are kept consistent with this policy, and if they ever diverge, treat the divergence as a bug and tell us.
• At the point of collection in the app. A permission prompt explains what the permission is for before the operating system dialog appears, not after.
• Here. This document is linked from every screen of the website and from the settings screen of each title.

APP 5 also requires us to tell you the consequences of not providing information. Those consequences are set out against each item in the collection tables, and for the app permissions in the permissions table.

Australian Privacy Principle 2 gives you the option of dealing with us anonymously or under a pseudonym, unless that is impracticable or we are required by law to deal with an identified individual.

In our case this is not a grudging concession. Our titles are playable without an account, without an email address and without a name. If you never sign in, we never learn who you are, and the identifiers described later in this policy are device identifiers rather than identity documents.

Where you write to us, you may use a pseudonymous email address. The one place the option genuinely falls away is a request to access or correct personal information: to answer it we have to be satisfied you are the person the information is about, which is dealt with under access and correction below.

Australian Privacy Principle 4 deals with personal information we receive without having asked for it.

This happens most often when somebody sends us a bug report and includes a full screen recording, a diagnostic export, or a message thread containing other people's details. When we receive personal information we did not solicit, we decide within a reasonable period whether we could have collected it under APP 3. If we could not, and the information is not contained in a Commonwealth record, we destroy it or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.

Practically: unsolicited attachments containing third party personal information are deleted from the inbox and from any backup rotation on its ordinary cycle, and the substance of the bug is recorded without them.

Australian Privacy Principle 6 governs what we may do with personal information once we hold it. The rule is that information collected for one purpose may be used or disclosed for that primary purpose, and for a secondary purpose only where you would reasonably expect it and the secondary purpose is related to the primary one, or where you have consented, or where one of the specific exceptions in the Act applies.

What we use it for

• Delivering the titles and the features you have asked for.
• Diagnosing crashes and defects, and measuring whether a fix worked.
• Preventing fraud, cheating and abuse, including detecting automated play and duplicated installs.
• Serving advertising, which is what makes a free title free, in the manner described in the advertising section.
• Answering your correspondence and complying with a legal obligation.

What we do not do

• We do not sell personal information. Not to data brokers, not to advertisers, not as part of an "audience" product.
• We do not build a profile of you across the products of unrelated companies.
• We do not use your correspondence with us to target advertising.

Disclosure to law enforcement and courts

We may disclose personal information where the Act permits it: where required or authorised by or under an Australian law or a court or tribunal order, where a permitted general situation under section 16A exists (including a serious threat to life, health or safety, or suspected unlawful activity), or to an enforcement body where reasonably necessary for an enforcement related activity.

Where we make such a disclosure to an enforcement body we make a written note of it, as APP 6.5 requires. Where the law allows us to tell you that a request was made, we will.

Where a published title carries advertising, this is what it means. Nothing has shipped, so nothing here is running yet.

Off by default

Advertising requests are marked non-personalised until you choose otherwise in the title's settings. A non-personalised advertisement is chosen from context rather than from a profile of you.

Advertising never sees the performance telemetry

Device profile, frame timing, thermal and battery data are never sent to an advertising network and never used to segment an audience. A device model plus a thermal profile is a good proxy for what phone someone can afford, and that is exactly the kind of inference an advertising system would find valuable. The separation is enforced in the code path, not by policy.

App Tracking Transparency

On iOS the Identifier for Advertisers needs your permission through Apple's prompt. We show it only after you have turned personalisation on in our own settings, so you are never asked cold.

Play Data Safety

Each title's Google Play Data Safety declaration is kept consistent with this policy. A difference is a defect and we want to hear about it at [email protected].

The network is not our processor

For its own fraud prevention and cross-inventory measurement an advertising network acts on its own account rather than on our instructions. We cannot delete what a network holds and will not claim we can. We can stop sending it, which is what turning personalisation off does.

Controls that work regardless of us

• Android: Settings, then Google, then Ads, then delete the advertising ID.
• iOS: Settings, then Privacy and Security, then Tracking.
• Both: uninstalling ends collection from that device immediately.

The complete list of who receives personal information from us.

Not on this list

No data broker, no marketing platform, no customer data platform, no enrichment service, no identity graph, and no third party performance analytics vendor. That last one is worth naming: it is the obvious thing for a company like this to adopt, and adopting one would mean a supplier receiving the device profiles of every player. If it ever happens, this table changes first.

If we ever publish measurements

Any published performance figures will be aggregate, computed from de-identified data, with no cell small enough to identify a person and no individual device record. We will not publish a dataset.

Business transfer

On a sale of the company or a title, personal information may transfer to the buyer. Where lawfully able we give notice on this website before the transfer completes, and the buyer is bound by this policy until it publishes its own.

Australian Privacy Principle 7 restricts the use of personal information for direct marketing. The Spam Act 2003 (Cth) sits on top of it for anything sent by email, SMS or instant message, and it is a strict regime: consent, accurate sender identification, and a functional unsubscribe facility that stays live for at least 30 days and is actioned within 5 working days.

Our position

We do not run a marketing list. We have never sent a marketing email under this company name. If that changes, it will be opt in, the consent will be recorded with a timestamp and the wording you agreed to, and the first message will say where the address came from.

Writing to our support address does not subscribe you to anything. That is the most common way small companies quietly build a list, and we do not do it.

Advertising inside a game is not direct marketing to you

Advertisements shown inside a title are served by an advertising network, not addressed to you by us. That activity is governed by the advertising section of this policy rather than by APP 7, but you can still control it: personalised advertising is off unless you turn it on, and the operating system level controls described in the advertising section work regardless of anything we do.

Australian Privacy Principle 8 governs disclosure of personal information to a recipient outside Australia. Section 16C of the Act makes us accountable for an overseas recipient's act or practice: if an overseas recipient we disclosed information to does something that would have breached the Australian Privacy Principles, that act is taken to have been done by us, and we are liable for it.

We treat that as the operative rule rather than the exceptions, which is why the list of overseas recipients is short and named rather than described as "our trusted partners".

How we meet APP 8

Before disclosing personal information overseas we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, principally by contract. The relevant contractual terms are the data processing terms published by each provider, which bind them to process the data only on our instructions, to keep it secure, to assist with individual rights requests, and to notify us of a breach.

We do not rely on the APP 8.2(a) exception for recipients in countries with substantially similar laws, because assessing that for each jurisdiction is a judgement we are not qualified to make and getting it wrong shifts the risk onto you.

Where the data actually goes

The countries in which personal information may be held or accessed are named in the recipients table in this policy. That table is the authoritative list. If a provider changes region we update the table.

Australian Privacy Principle 9 restricts an organisation from adopting, using or disclosing a government related identifier, which includes a tax file number, Medicare number, driver licence number or passport number.

We do not collect any government related identifier. We have no reason to, our products have no age verification or identity verification step that would need one, and no field in any system we operate is intended to hold one.

If you send us one anyway, for instance by attaching a photograph of a licence to an email, it is treated as unsolicited personal information under the section above and destroyed.

Australian Privacy Principle 10 requires that personal information we collect is accurate, up to date and complete, and that information we use or disclose is also relevant.

Most of what we hold is machine generated and therefore accurate in the narrow sense that it faithfully records what a device reported. The category most likely to go stale is anything you told us yourself, such as an email address in a support thread. We do not periodically re-verify those, because doing so would mean contacting people who have finished dealing with us.

The practical remedy is the correction right under APP 13, described below, which you can use at any time and free of charge.

Australian Privacy Principle 11 requires us to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, and to destroy or de-identify it when it is no longer needed for any purpose for which it may be used or disclosed.

What "reasonable steps" means for a company this size

• Transport encryption on every connection. The website and every app endpoint are served over HTTPS only.
• Encryption at rest for stored data, provided by the underlying platform.
• Multi-factor authentication on every administrative account that can reach production data or a store console.
• Access on a need to know basis. The number of people who can reach production data is small and is reviewed when anyone joins or leaves.
• Separate credentials for development and production, so a compromised development credential does not reach live data.
• Collecting less. The most reliable security control available to a small studio is not holding the data, which is why the collection tables are short.

What we do not have, stated plainly

We say this because the alternative is a paragraph of confident language that means nothing. No system is perfectly secure, and a company that tells you otherwise is either mistaken or selling something.

Australian Privacy Principle 11.2 requires destruction or de-identification once information is no longer needed for any permitted purpose, unless a law requires us to keep it.

Destruction means removal from live systems and expiry from backups on the ordinary rotation, complete within 35 days. De-identification means removing every identifier and any field that could reconstruct one, which for a device profile means dropping the install identifier and coarsening the model into a hardware class.

What performance work does not need

Frame timing, thermal state and battery level are all available through ordinary application programming interfaces with no permission prompt. No special permission is required, none is requested, and any build asking for one is either a mistake or not ours.

Never requested

Location of any precision, camera, microphone, contacts, calendar, photos, SMS, call log, phone state, body sensors, nearby devices, accessibility services, and usage statistics access. The last one would let us see what other apps you run, which would genuinely help attribute a stall to background load, and we have decided the trade is not worth it.

The telemetry switch comes first

Before deletion there is prevention. Frame timing, thermal and battery telemetry can be turned off in the title's settings, and the game runs identically without it. That switch is the strongest control on this page and it needs no request to us.

How to delete

1. In the app: Settings, Data, Delete my data. One confirmation and the request is queued.
2. By email: [email protected], subject "Delete my data", with the support identifier from the title's settings.

What deletion does

We confirm in writing when deletion is complete. We do not flag a record as deleted and keep it.

Australian Privacy Principle 12 gives you the right to ask for access to the personal information we hold about you. Australian Privacy Principle 13 gives you the right to ask us to correct it.

How to ask

Email [email protected] with "Privacy request" in the subject line. Tell us what you want and give us enough to find it. For information tied to a device rather than an account, that usually means the advertising identifier or the in-app support identifier shown in the title's settings screen, because without one of those we cannot connect a record to you.

Verifying who you are

We have to be satisfied you are the person the information is about, or an authorised representative. Where a request relates to an account, we verify through the email address on the account. Where it relates only to a device identifier, possession of that identifier is what we can verify, and we will say so rather than pretend to a higher level of confidence. We will not ask you to send identity documents.

Timing and cost

We respond within 30 days. Access is free. We do not charge for making a request, and we do not charge for correction. If giving access in a particular form imposes a genuine cost, for example producing a bulk export in an unusual format, we will tell you the charge before doing the work and it will not be excessive.

When we can refuse

The Act lists the grounds, and they are narrower than people expect. They include where giving access would have an unreasonable impact on the privacy of others, where the request is frivolous or vexatious, where the information relates to existing or anticipated legal proceedings and would not be discoverable, and where giving access would be unlawful.

If we refuse, in whole or in part, we will give you written reasons, tell you which ground we rely on, and tell you how to complain. Where we can give you part of the information, or give it in another way that meets your need, we will offer that instead of a flat refusal.

Correction

If information is inaccurate, out of date, incomplete, irrelevant or misleading, we will correct it. If we have disclosed the information to someone else and you ask us to notify them of the correction, we will take reasonable steps to do so unless it is impracticable or unlawful.

If we refuse to correct, you may ask us to attach a statement to the record saying that you consider it inaccurate, and we will take reasonable steps to make that statement apparent to anyone who later looks at the record. That right is often overlooked and it is worth knowing about.

Our titles are not directed at children and are not designed to appeal primarily to children. Where a store requires an age rating or a target audience declaration, we declare a general audience.

Australian position

The Privacy Act does not fix an age at which a person can consent for themselves. The OAIC's guidance is that an organisation should assess capacity individually where practicable, and that as a general rule a person aged 15 or over is presumed to have capacity unless there is something to suggest otherwise. We apply that presumption.

The Privacy and Other Legislation Amendment Act 2024 provides for a Children's Online Privacy Code, to be developed by the Information Commissioner and applying to services likely to be accessed by children. We will comply with that Code as it applies to us once it is registered and in force, and we will update this policy at that point rather than in advance of knowing its terms.

Practical measures now

• We do not knowingly collect personal information from a child under 15 without the consent of a parent or guardian.
• Where a title carries advertising and the store signals that a user is a child, personalised advertising is not requested, and the ad request is marked as child directed so the network serves non-personalised inventory.
• There is no social feature, no chat, no user generated content and no player to player messaging in anything we build.

If a child's information has reached us

Write to [email protected]. We will delete it without requiring you to prove a legal relationship beyond what is needed to be satisfied the request is genuine, and we will confirm when it is done.

The Privacy and Other Legislation Amendment Act 2024 inserts a requirement that a privacy policy disclose the kinds of personal information used in substantially automated decisions that significantly affect an individual's rights or interests, together with the kinds of such decisions made. That requirement commences on 10 December 2026.

Our position, disclosed in advance of the commencement date

We make no automated decision that significantly affects your rights or interests. Nothing we run decides whether you get credit, a job, a service, a benefit, or a legal entitlement.

Automated processing does happen in two places, and neither meets that threshold:

• Anti-cheat and abuse detection. Automated signals can restrict an account or a device from a leaderboard. Where a restriction is applied to an account rather than a single score, a person reviews it on request. Write to us and say so.
• Advertising selection. Which advertisement is shown is decided automatically by the advertising network. It does not affect your access to the title or anything you have paid for.

If that ever changes, this section is where it will be described, and it will be described before the processing starts rather than after.

Part IIIC of the Privacy Act establishes the Notifiable Data Breaches scheme. It applies to an eligible data breach, meaning unauthorised access to, unauthorised disclosure of, or loss of personal information where a reasonable person would conclude the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates, and the risk has not been prevented by remedial action.

The process we follow

1. Contain. Stop the access, revoke the credential, take the affected component offline if that is what it takes.
2. Assess. Where we suspect an eligible data breach may have occurred, we carry out a reasonable and expeditious assessment and complete it within 30 days of becoming aware of the grounds for suspicion, which is the period section 26WH allows.
3. Remediate. If remedial action means serious harm is no longer likely, the breach is not notifiable and we record why.
4. Notify. If it is an eligible data breach, we prepare a statement for the Commissioner and notify the Office of the Australian Information Commissioner (OAIC), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au as soon as practicable. We then notify affected individuals, or if that is not practicable, publish the statement on this website and take reasonable steps to publicise it.

What a notification will contain

Our identity and contact details, a description of the breach, the kinds of information concerned, and the steps we recommend you take. We will not pad it with reassurance that has not been earned, and we will say what we do not yet know.

If you think a breach has happened

Write to [email protected] with "Security" in the subject line. We would rather chase a false alarm than miss a real one, and we will not treat a good faith report as hostile.

A statutory tort of serious invasion of privacy commenced on 10 June 2025 under Schedule 2 to the Privacy and Other Legislation Amendment Act 2024. It allows an individual to sue for intrusion upon seclusion or misuse of information, where the invasion was intentional or reckless, where a person in the plaintiff's position would have had a reasonable expectation of privacy, and where the invasion is serious.

This is a right you have against anyone, including us, and it exists independently of the complaints process described below. We mention it because most privacy policies do not, and a right you do not know about is not much of a right.

This website sets no cookies of its own and runs no analytics or advertising. A strictly necessary security cookie may be set by our hosting provider to distinguish automated traffic.

There is no consent banner because nothing here requires consent. The reasoning is in the cookie notice.

Step one: tell us

Email [email protected] with "Privacy complaint" in the subject line. Set out what happened and what you want done. We acknowledge within 5 business days and respond substantively within 30 days. If it will take longer, we will tell you why and give you a date.

Step two: the Commissioner

If you are not satisfied with our response, or we do not respond within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au.

The OAIC will normally expect you to have complained to us first and given us 30 days, but it can accept a complaint without that in appropriate cases. There is no fee. You do not need a lawyer and you do not need our agreement.

What we will not do

We will not require you to sign a non-disclosure agreement as a condition of us dealing with a privacy complaint, and we will not treat making a complaint as a breach of our terms of use.

This policy is written to Australian law because that is the law that binds us. If you are outside Australia, some additional rights may apply to you, and we do not want the absence of a mention to be read as a refusal.

European Economic Area and United Kingdom

Where the General Data Protection Regulation or the UK GDPR applies to our processing, you have rights of access, rectification, erasure, restriction, portability and objection, and a right to complain to your national supervisory authority. Where we rely on legitimate interests, you may object and we will stop unless we can demonstrate compelling legitimate grounds that override your interests. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Send any such request to [email protected] and say which law you are relying on, so we apply the right timetable. We answer GDPR requests within one month.

California

Under the California Consumer Privacy Act as amended, you have rights to know, delete, correct and opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross context behavioural advertising as those terms are defined in that Act. Personalised advertising is off unless you turn it on, which places us outside the sharing definition by default. Global Privacy Control signals sent by your browser to this website are honoured.

Everywhere else

If a right exists where you live and you tell us about it, we will deal with the request on its merits rather than on whether we are technically obliged to.

We may change this policy. When we do, we update the effective date and the version number in the header of this page.

Where a change materially reduces your rights or materially expands what we collect, we will give notice before it takes effect: a notice in the app on next launch, and a note at the top of this page for at least 30 days. We will not make a material change effective retrospectively.

Previous versions are not published as separate pages, but we keep them. If you want to know what this document said on a particular date, ask and we will send you that version.

All privacy matters reach one address.

Email: [email protected]

Entity: IOPEX TECHNOLOGIES PTY LTD, ACN 696 561 609, ABN 54 696 561 609, registered in Australia, Victoria.

We do not publish a postal address on this website. If you need to serve a document, the company's registered office is recorded against ACN 696 561 609 on the register maintained by the Australian Securities and Investments Commission, which is the address that has legal effect for service.

If you would rather not deal with us at all, you can go straight to the Office of the Australian Information Commissioner (OAIC), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au.