Privacy Policy

Burpees Optional Privacy Policy

Effective: September 10, 2026
Last updated: September 30, 2026

Burpees Optional is designed to work without an account. Your fitness settings and activity stay on your device unless you deliberately choose to send us a feedback email.

This Privacy Policy explains how Mills Collaborative Technologies, LLC (“we,” “us,” or “our”) handles information in connection with the Burpees Optional mobile application (the “App”).

1. Information Handled by the App

You can use the App without creating an account or providing your name, birthdate, mailing address, phone number, or email address. The App asks you to confirm that you are at least 18 years old, but it does not verify your identity or legal age.

The App handles information you enter or create so it can plan workouts, adapt training, and track activity. This may include fitness experience, equipment, space and noise preferences, movement abilities or limitations, exercise exclusions, goals, Event goals, dates and related training information, workout plans and history, Challenge progress and attempts, calibration results, timer preferences, exercise preferences, readiness, effort, discomfort and other workout feedback, adult-use confirmation, and acknowledgment of the Safety & Legal notice.

2. Information Stored on Your Device

The information described above is stored locally in the App on your device. The current App does not provide a Burpees Optional account or cloud synchronization, and we do not automatically receive your Profile, movement information, workouts, Activity history, Challenges, or Event information.

Local App storage is not encrypted by the App. Your device operating system, screen lock, backups, and other device security settings may affect the protection or availability of information stored on your device. Device or operating-system backups are controlled by your platform provider and your device settings, not by us.

3. Feedback and Support Emails

If you choose “Prepare feedback email,” the App creates a draft for you to review in your email application. The draft may contain your written feedback, an optional reply email address, App and build versions, device platform, operating-system version, and the screen where you opened the feedback form. Your Profile, movement or health information, workout history, Challenges, and Event information are not added automatically.

Nothing is sent until you choose to send the email. If you send it, we receive the information included in that message and use it to respond, troubleshoot, improve the App, protect the App and its users, and keep appropriate business records. Your email provider and ours process the message under their own terms and privacy practices.

4. Advertising, Privacy Choices, and Third-Party Services

Burpees Optional includes Google Mobile Ads and Google's User Messaging Platform (UMP). Google and its advertising partners may process device or other identifiers, approximate location derived from information such as IP address, app interactions, and diagnostic information for advertising, analytics, fraud prevention, security, and compliance. Processing may vary with your platform, region, privacy choices, and the App's advertising configuration.

Burpees Optional does not send your Profile, movement abilities or limitations, exercise exclusions, workout history, Challenges, Event goals or other Event information, readiness, discomfort feedback, or other locally stored fitness records to Google or other advertising providers through advertising APIs.

Where available, you can review or change advertising privacy choices through the App's privacy options. These choices do not necessarily make the App ad-free; non-personalized or limited ads may still be shown, depending on the choices available and applicable requirements.

Google and its partners handle advertising and consent information under their own privacy practices. See Google's Privacy Policy and Google's advertising information.

We may disclose information you send to us when reasonably necessary to use service providers that support our email or business operations, comply with law or valid legal process, protect rights and safety, investigate misuse, or complete a business reorganization. We do not permit service providers to use that information for their own advertising.

5. Retention and Deletion

Locally stored fitness information remains on your device until you delete it, uninstall the App, or your device or operating system removes it.

In the App, you can choose “Profile > Privacy & Data > Delete all app data” to remove the Profile, goals, Event information, workout and Activity history, Challenges and attempts, calibration, preferences, adult-use confirmation, and Safety & Legal acknowledgment from that installation. This action cannot be undone. It does not delete Google-managed UMP consent data or other third-party consent data, reset all advertising privacy choices, or delete information already processed by Google or other third parties. Their privacy controls and policies govern that information.

Support and feedback emails are normally deleted within 12 months after the issue is resolved. We may retain a message longer when reasonably necessary to comply with law, resolve a dispute, prevent abuse, protect safety or security, or maintain essential business records.

6. Security

We use reasonable administrative and technical safeguards for information sent to us. No storage or transmission method is completely secure, however. You are responsible for maintaining appropriate security on your device and email account.

7. Your Choices and Rights

You may use the App without sending us feedback. You can review and change App settings, delete the App's locally stored fitness records and settings using the control described above, or uninstall the App.

You can also contact us to ask about, correct, or request deletion of personal information contained in support correspondence. We may need enough information to locate the correspondence and verify the request.

Privacy rights vary by location. If applicable law gives you additional rights, you may exercise them by contacting us. We will not discriminate against you for making a privacy request.

8. Adult Use

Burpees Optional is intended only for adults age 18 and older. We do not knowingly collect personal information from children through the App. If you believe a child has sent us personal information, contact us so we can review and delete it as appropriate.

9. Changes to This Policy

We may update this policy when the App or our practices change. We will revise the “Last updated” date and provide any additional notice required by law. Material changes will apply prospectively unless otherwise stated or permitted by law.

10. Contact Us

Mills Collaborative Technologies, LLC
Email: gaming_info@millsct.com

Mamaw's Rules Privacy Policy

Effective: October 18, 2026

Mills Collaborative Technologies, LLC operates Mamaw's Rules and is responsible for the processing described here. Contact gaming_info@millsct.com for privacy questions or requests. This policy applies to Mamaw's Rules, including Solo play and Private and Public Tables. It does not replace the website's separate Burpees Optional policy.

1. Information we handle

We handle account identifiers, authentication and session information, display names, preferences, table membership, seat ownership, moves, cards, public Melds, scores, results, command receipts and timestamps. Guest accounts also have identifiers and authenticated sessions. Support or privacy correspondence includes the information you send us; please do not send passwords, session tokens, push tokens or unnecessary identity documents.

The authoritative game service processes private hands and unresolved choices to enforce rules. Player-facing views are designed to expose only the information each player is authorized to see. Other players can see your display name, public cards and other public table information. Share private invitation codes only with intended players.

Your device stores session information, preferences and some saved games. Online tables also have server-side records. Solo active saves and completed-result records are separate; clearing an active save does not necessarily clear completed results. Uninstalling or clearing local storage does not automatically delete server records. Operating-system backups and storage controls depend on your device and settings.

Hosting and other service providers may process technical information, including IP addresses, connection information and diagnostics, to deliver and secure their services.

2. Why we process information and our UK/EU lawful bases

Where UK or EU data-protection law applies, our purposes and bases are:

• Authentication and gameplay: legitimate interests under Article 6(1)(f), limited to providing the game you request, recognizing your account and enforcing seat ownership and game rules.
• Multiplayer persistence and reconnects: legitimate interests under Article 6(1)(f) in maintaining shared games, restoring connections, preserving results and preventing duplicate or conflicting actions. These interests include protecting other players' game records.
• Optional game notifications: legitimate interests under Article 6(1)(f) in delivering the nonmarketing game-attention alerts you separately enable. We honor the in-game opt-out and operating-system permission controls. Enabling notifications is not consent to advertising.
• Advertising: consent under Article 6(1)(a) for our processing where advertising consent is required, together with applicable consent requirements for nonessential device storage or access. Advertising consent is separate from gameplay and notifications. We do not use legitimate interests to bypass required advertising consent. Google explains its own processing purposes and bases through its privacy information and applicable consent messages.
• Minimal privacy-choice, age-eligibility and advertising-coordination records: legitimate interests under Article 6(1)(f) in honoring your choices, protecting younger users, preventing repeated ads and keeping multiplayer play synchronized. Where an applicable law requires a particular compliance record, Article 6(1)(c) applies to that record. These purposes do not authorize behavioral advertising.
• Security, abuse and fraud prevention, troubleshooting and operational records: legitimate interests under Article 6(1)(f) in protecting players and the service, preventing replay or unauthorized access, resolving faults and establishing or defending legal claims. A particular legal disclosure or record required by applicable law is processed under Article 6(1)(c).
• Privacy requests and deletion: Article 6(1)(c) when necessary to comply with applicable rights, security and accountability duties, including the applicable requirements of GDPR Articles 12-22, 5(2), 24 and 32. Voluntary deletion functionality and proportionate safeguards beyond a statutory requirement rely on legitimate interests under Article 6(1)(f) in honoring your request, protecting shared records and preventing account or notification reactivation.

We limit legitimate-interest processing to what is necessary and proportionate, taking account of players' rights and giving additional weight to children's interests. You may object to this processing by contacting us. We will assess the objection and stop where required by law. We do not presume that every player, including a minor, has entered an enforceable contract, or treat advertising consent as permission for unrelated processing.

Withdrawing consent does not affect processing that was lawful before withdrawal. Information necessary for online authentication or gameplay is required to use those functions; optional notifications and advertising are not required to play.

3. Optional notifications

We process installation identifiers, push tokens, permissions, preferences, table presence and delivery records for eligible game-attention alerts, duplicate prevention, foreground suppression and navigation to an authorized table. Alert text is generic and excludes private cards and invitation codes. Routing data includes identifiers for the table and notification event.

Turn notifications can be disabled in the game or device settings. Audible and Silent choices remain subject to operating-system settings, Do Not Disturb and connected devices. Disabling notifications stops eligible delivery; it does not itself delete registrations, delivery history or saved games. Invalid tokens may be cleared, while limited suppression and delivery records remain to prevent repeated invalid delivery or reactivation after recovery.

4. Advertising and privacy choices

Live advertising is currently disabled. Isolated test versions integrate Google demonstration interstitials and Google's User Messaging Platform (UMP). Test advertisements are requested only when enabled by the tester and permitted by the age, country and consent checks. The following describes the prepared behavior when available in an advertising-enabled version.

Initial automatic ad eligibility is after every two completed hands, with at least eight minutes between automatic ads. Ads are shown only after completed Score Review and before the next hand, or after a completed game. They do not interrupt active gameplay, NIXED response windows or private CHOICE decisions. Missing or declined ads do not prevent you from playing; players may briefly wait for other participants.

The server records ad authorization, readiness and completion. Multiplayer advertising protection lasts at most two minutes from server authorization and cannot be extended by heartbeats. If a participant remains unresolved, Public Tables permanently transfer that seat to MamawBot; Private Tables use temporary MamawBot assistance while preserving the human's right to return. The SDK advertisement is not forcibly dismissed. Public ordinary-turn and absence penalties are paused during the protected intermission.

Google may process device identifiers, approximate location derived from IP addresses, ad interactions, diagnostics and privacy signals, depending on the platform, region and configuration. The game does not add private cards, decisions, invitation codes, scores, gameplay history or push tokens to advertising requests. See Google's privacy policy at https://policies.google.com/privacy.

The prepared configuration uses nonpersonalized requests, disabled publisher personalization and a maximum PG ad content rating. Eligible minors receive SDK teen treatment. These restrictions do not eliminate data processing or replace consent. The app checks UMP permission before loading and again before presenting an ad. If eligibility or required permission is insufficient, advertising remains blocked.

AD PRIVACY & AGE on eligible lobby or completed-game screens allows you to update answers, turn ads off locally and access previously available Google privacy choices. Access to prior choices does not require renewing expired answers or becoming eligible for ads. The GOOGLE PRIVACY OPTIONS button itself does not gather new consent, initialize the advertising SDK or request an ad. Separately, saving eligible answers with SAVE & REVIEW AD CHOICES can start Google consent gathering and, if permitted, prepare a test advertisement in an isolated test version. Google controls whether its form can be displayed. If it cannot, the app reports the failure, blocks ads for the session and provides local opt-out and our support contact; it does not report successful withdrawal.

Privacy screens do not intentionally interrupt active play or Score Review. Opening them invalidates prepared ad inventory. Local opt-out and Google's consent record are separate; local opt-out does not erase Google's prior processing. Google privacy choices are installation-level, while local age/country answers are account-scoped. Shared-device users should review their choices. Consent is not assumed to transfer between devices.

5. Age and country

Mamaw's Rules is intended for ages 13 and older and is not directed to children under 13. The advertising questionnaire is not an account-age verification service.

The optional questionnaire asks for an age band and the country you are playing from, not a birthday, identity document, GPS location or parental contact. The answers, local ad preference, policy version and confirmation date are stored in protected device storage, separated by account and environment. The game does not send raw answers to the multiplayer backend or include them in ad requests. The backend receives availability signals and retains cooldown, coordination and duplicate-prevention records.

You can decline to answer and continue without ads. Update your answers when they change. Answers stop authorizing ads after 180 days or a policy-version change until reconfirmed; this does not automatically erase them or age you into eligibility. Previous Google privacy choices remain accessible where Google makes them available.

Current advertising screening permits UK players aged 13+, France 15+, Ireland 16+ and US adults 18+, subject to all other eligibility and consent requirements. US minors, unreviewed countries, unknown answers and ages below the supported threshold are blocked. The US threshold is a conservative product restriction, not a statement that every US advertising law requires age 18. Age thresholds do not establish worldwide compliance or remove other protections for minors. We do not offer verified parental consent. Contact us if you believe a child under 13 has provided personal information.

6. Providers, disclosures and international processing

Render hosts the backend. Supabase provides database and authentication services. Expo Push Service and Apple/Google push services deliver notifications. Google Mobile Ads and UMP support the prepared advertising and privacy controls. Providers may act as processors for some data and independently for their own account, security or other purposes. Google describes AdMob publishers and Google as independent controllers for relevant advertising processing.

Our current Supabase database and Render backend are hosted in Oregon, United States. Information can also be processed in other countries through provider support, operations and subprocessors. Supabase identifies Singapore and US operational processing. Google uses international infrastructure, and Expo describes US processing. Selecting a hosting region does not guarantee that support, logs, notification routing or other service processing stays in that region.

The providers describe the following transfer mechanisms in their published documents:

• Google describes reliance on the EU-US Data Privacy Framework and its UK Extension for applicable transfers, and Standard Contractual Clauses for certain other transfers under its advertising terms: https://business.safety.google/adsdatatransfers/.
• Supabase's published Data Processing Addendum includes EU Standard Contractual Clauses and a UK Addendum. Its transfer guidance explains regional hosting and processing outside the selected region: https://supabase.com/legal/customer-resources/data-processing-addendum and https://supabase.com/legal/privacy-resources/data-residency-and-transfers-faq.
• Render's published Data Processing Addendum describes Data Privacy Framework transfers and contractual mechanisms, including EU Standard Contractual Clauses and a UK Addendum, in the circumstances specified there: https://render.com/dpa.
• Expo's standard terms describe processor responsibilities and EU Standard Contractual Clauses for covered service data. Its privacy policy describes US processing and Data Privacy Framework participation, including the UK Extension: https://expo.dev/terms and https://expo.dev/privacy.

These descriptions report the providers' published arrangements; they are not a claim that we have signed a separate agreement with every provider or that one mechanism covers every transfer. Which safeguards apply depends on the recipient, service, governing terms and transfer. Contact gaming_info@millsct.com for information about applicable safeguards or to request a copy, subject to necessary redaction of confidential information. Using the game or accepting advertising is not blanket consent to otherwise unprotected international transfers.

Providers' retention and independent processing vary by purpose and terms. Changing Google consent or deleting a game account does not itself erase every record previously processed by Google or another provider. We may make disclosures required by law or proportionate disclosures for security, legal claims or a business transfer, subject to applicable requirements. Nonpersonalized advertising does not automatically remove sale/sharing or advertising opt-out obligations.

7. Retention and backups

There is no general automatic age-based erasure schedule for online game histories, account-linked records, command receipts, notification history, advertising ledgers or local completed results. Records may remain until reviewed maintenance or a privacy action addresses them. Expired notification deadlines stop delivery attempts, not necessarily record storage. The 180-day questionnaire interval invalidates advertising eligibility, not storage.

Our manual review and disposal targets are:

• Unused accounts: review after 12 months.
• Completed-game detail, terminal notification/ad detail and inactive registrations: review after 90 days.
• Minimal privacy-case records: review after 24 months.
• Temporary verification/export files: remove within 30 days after case closure.
• Company-held sanitized logs and routine company backups: target no more than 30 days, subject to documented security, legal and recovery needs.

These are operational targets, not automatic expiry guarantees. Active games, shared results, disputes and records necessary to prevent replay or account resurrection may require longer retention. Retention must remain tied to those needs. Shared records may be de-identified rather than deleted to preserve other players' history. Provider logs and backups have separate arrangements; a provider backup window does not determine retention of our primary records or independent recovery copies.

8. Local deletion, permanent account deletion and recovery

Self-service deletion is currently disabled in the family release. Until available, contact gaming_info@millsct.com for an authenticated privacy request. The following describes the approved functionality when enabled in a compatible version.

Settings > Privacy & Account contains separate options. Delete Local Data removes that device's Solo and Pass & Play saved games and completed results, not the online account or shared server records. Delete My Account requires authenticated ownership and explicit confirmation by typing DELETE MY ACCOUNT.

Account deletion is permanent once accepted, with no grace period, cancellation or recovery window. Account access is disabled immediately; interrupted cleanup is retried. A processing message is not a recovery opportunity. If acceptance is not confirmed, contact us rather than assuming deletion succeeded.

Deletion removes the Auth account through our authentication provider, revokes notification registrations, removes advertising account preferences and deletes associated privacy-case content. The requesting device removes its signed-in session and account-linked advertising answers. Other devices lose online access, but their local information and operating-system backups may remain until cleared through their own storage controls.

Shared games preserve other players' cards, scores and results. Your displayed identity becomes Player Deleted, including saved player snapshots, and MamawBot assumes active seats under existing rules. Shared and delivery records may retain opaque identifiers, receipts and timestamps for integrity, duplicate prevention and recovery. De-identification is not a claim that every remaining record is anonymous. Superseded narrative notices may be removed to avoid retaining your name.

A restricted deletion/suppression record outside ordinary database restore history prevents restored accounts, old sessions or notifications from becoming active again. It retains limited identifiers, decision times, status and necessary suppression information, not private cards or usable push tokens. It remains necessary while a retained backup could restore the account or notification access. Backups are not necessarily immediately rewritten, but recovery must reapply accepted decisions before protected access resumes. Missing or unreliable recovery evidence must not re-enable access or notification delivery.

9. Privacy requests and rights

Contact gaming_info@millsct.com for access, correction, deletion or other applicable rights. We verify ownership before disclosing information. A display name or room code alone is insufficient, and you cannot use another player's account as proof. Guest users may be asked to verify through their existing authenticated session using a short-lived, single-use verification process where available. We do not require unnecessary identity information. If ownership cannot be established, we will explain the limitation without disclosing another player's information.

Exports are restricted to the requesting player's permitted information. Privacy requests do not entitle a player to another player's private hand, choices or personal records. Manual review applies to legal holds, shared records, backup disposal and requests that cannot be authenticated; it is not an approval step for authenticated self-service deletion.

We target acknowledgement within seven days and completion within thirty days, subject to applicable legal deadlines and permitted extensions. Depending on your location and the processing, rights may include access, correction, erasure, portability, restriction, objection, consent withdrawal, advertising opt-outs and appeal. You can complain to the UK Information Commissioner's Office or the relevant EU supervisory authority where applicable. We will not penalize you for exercising applicable privacy rights; some requested restrictions or deletion may make online account functions unavailable.

10. Security and changes

We use access controls and other safeguards appropriate to the service, but no system is completely secure. Protect your device and authenticated session. We may update this policy when practices change and provide additional notice where required.

Contact: Mills Collaborative Technologies, LLC

Email: gaming_info@millsct.com