PRIVACY POLICY — DIEGUITO THE FROG AND NEWRAX

Specific notice: Android gameplay test build 1.0.0(10)

Publication date of this notice: October 12, 2026.

This notice describes Android gameplay build 1.0.0(10). It offers no ads, purchases, restoration or advertising or paid continuations. It does not integrate Google AdMob, UMP, RevenueCat or Play Billing and does not ask for a date of birth. The commercial sections of this policy continue to describe other versions when those services are present and enabled; this notice does not remove them.

Results, badges, language, sound and vibration settings are processed and stored on your device. Audio libraries play resources bundled with the game; the app does not record your voice. Age or purchase preferences from an earlier installation may remain locally: this build does not delete them or use them to grant a purchase or extra time. NEWRAX cannot remotely access that progress. Section 10 explains device deletion controls and system backups.

Website, privacy and support buttons open an external browser or email client when you tap them. The app does not send an email automatically or attach messages, screenshots, receipts or player identifiers. If you choose to write to support@newrax.dev, NEWRAX receives your address, message and any files you voluntarily send to respond or handle your feedback. The mailbox uses Namecheap Private Email; the support rule in sections 6 and 10 applies, up to 12 months after resolution except for the reasons stated there. If you are a child, ask an adult for help and share only what is needed; avoid other people's data, passwords and financial information.

Visiting newrax.dev in a browser involves the website's technical requests and Firebase Hosting, including IP processing and retention described in section 7. Your browser and email service have their own data practices. The APK's lack of Internet permission does not mean these external services, or NEWRAX when receiving a message, do not process data. Requests about support, local data or earlier commercial records follow the channels and limits in section 11. This notice does not promise deletion of data independently controlled by stores or providers.

1. Responsible person and contact

Raúl Eduardo Méndez Reyes, an individual operating from Guatemala under the name NEWRAX, is responsible for the processing he determines for Dieguito The Frog and newrax.dev. NEWRAX is not an incorporated company. For privacy questions, data requests and support, email support@newrax.dev.

You do not need a NEWRAX account to play. This policy also applies when you visit our website or contact us; stores and providers may process information for their own purposes, as explained below.

2. Information stored on your device

The game locally stores results, progress, achievements, language, music, effects and voice volumes, vibration settings, ad-frequency information and local remove-ads entitlement status, where applicable. These preserve your choices and allow you to keep using the game. NEWRAX does not transmit that progress to its own server or incorporate its own player-analytics service.

This does not mean all information stays on your device: advertising, consent, purchases and support may involve the processing described here. We do not incorporate Firebase Analytics or Crashlytics into the game. The website uses Firebase Hosting, a different service. Device backups depend on Apple, Google and your settings.

We do not request camera, microphone, contacts or precise-location permissions to play. Included voices and sounds are prerecorded assets; the app does not record players' voices. Approximate location a provider may infer from IP is not a GPS permission.

3. Age and protection of minors

Dieguito is a mixed-audience game, not a service that requires identifying players personally. If you provide a birth date, it is processed on your device to classify your age. We do not retain the full date or send it as a provider attribute. Only the adult, minor or unknown category, classification date and rule version persist. The classification becomes invalid after one year; expiration does not automatically erase the previous record.

The V1 configuration does not authorize ad requests or presentation for players under 18, unknown ages or expired classifications, and does not open adult consent forms for them. You can play without providing a date. Age selection is not verifiable parental consent. We do not promise that including SDKs means no technical communication occurs; their data is described in the provider sections.

The purchase configuration does not automatically initialize RevenueCat through the adult path for a minor or unknown age; explicitly requesting purchase restoration may start that service. A parent or guardian can contact us about a minor's data. We do not request photographs, recordings or contact details from minors to play. If we receive unnecessary information from a minor, we will assess deletion and measures required by applicable law.

If the purchase service was already configured in this session, changing or expiring the age classification does not shut it down. On iOS it may continue checking purchase status and handling store updates. Requesting a restoration can also configure it without an adult classification, even if no purchase was previously made. Blocking ads for minors or unknown ages does not stop that service.

4. Advertising and consent choices

When enabled, Google AdMob provides between-run ads and optional videos for a five-second continuation. Recognizing the remove-ads purchase blocks both formats and allows the optional continuation without a video, once per run. A purchase is not required to play.

The app requests non-personalized ads and advertising content rated G. These settings do not mean advertising without data or guarantee every creative. The SDK and consent components may process IP, approximate location, permitted technical identifiers, device information, activity and ad interactions, performance and diagnostics to deliver and measure ads, maintain the service and prevent fraud.

On Android we remove the advertising-ID permission and optional Ad Services permissions. On iOS we do not request ATT and disable the publisher's first-party identifier through the SDK control before initializing advertising. We do not equate these controls with anonymization or the absence of all identifiers. Google's network may include advertising partners and authorized buyers; we do not claim only one company is involved. Relevant recipients and choices are shown in applicable consent messages.

For the iOS configuration reviewed with Google on October 20, 2026 —without ATT, with non-personalized requests, a G content rating and Publisher First-Party ID disabled— Google confirmed that IDFA and Publisher First-Party ID are not used. IDFV, approximate location derived from IP and diagnostics may still be processed. Google stated that this configuration uses Google infrastructure without mediation by other SDKs. We do not extend that confirmation to future or different configurations or present it as Apple's approval.

Google User Messaging Platform manages required choices according to region. You can revisit Settings > Privacy options where that option applies; providing an age does not authorize advertising. If required effective authorization is missing, ads are unavailable or the flow fails, play can continue without ads. Withdrawing or changing a choice affects future processing and does not automatically erase records previously processed lawfully. Non-personalized advertising may still require consent. We do not treat test settings as proof of worldwide consent.

Google privacy: https://policies.google.com/privacy
Advertising technologies: https://policies.google.com/technologies/ads
Google advertising partners: https://support.google.com/admob/answer/9012903

5. Purchases and RevenueCat

The optional V1 Remove Ads purchase is permanent and is not a subscription. It removes all in-game advertising and includes one optional five-second continuation per run without an ad. The store displays the price and confirms the purchase. Apple App Store or Google Play handles payment; we do not request or receive your full card number in the app.

When the purchase service is configured, RevenueCat validates and restores the entitlement and updates its status, for example following a refund. It may process product, status and purchase history, transaction or receipt data, a random service-user identifier and necessary technical information. That identifier can link records: it is not irreversible anonymization. Configuring the service can involve communication even if you do not complete a purchase.

Records support validation, fraud prevention, restoration and the purchase dashboard we consult for business monitoring and troubleshooting. The dashboard includes purchase analytics; the absence of our own analytics SDK does not remove that purpose. We do not add names, email addresses, birth dates or marketing attributes to RevenueCat. We do not connect external advertising integrations to RevenueCat in the reviewed configuration.

Restore does not make a new purchase. On iOS, even without previous purchases, RevenueCat may check CustomerInfo or send app-transaction information with an empty receipt, depending on store data and its cache. We disable optional automatic identifier collection and request that optional diagnostics be disabled; RevenueCat confirmed on October 20 that they are disabled for this app. These settings do not remove all identifiers or technical service logs: the random user identifier, IDFV, IP address and request or receipt data may be processed for service functions and logs. On iOS, a local diagnostic-event file may temporarily persist while remote configuration is pending, including across restarts. It is not uploaded while the decision is pending, and its events are discarded when disabling is confirmed. The provider's log retention and scope must be distinguished from optional diagnostics.

Local deletion or a request to NEWRAX does not by itself cancel or erase records independently controlled by Apple or Google. The app does not create a player account you must close. To exercise rights over RevenueCat records managed for NEWRAX, use section 11. You do not need to share passwords, complete card details or purchase tokens.

RevenueCat: https://www.revenuecat.com/privacy
Data-processing agreement and subprocessors: https://www.revenuecat.com/dpa
Apple: https://www.apple.com/legal/privacy/
Google: https://policies.google.com/privacy

6. Email support

When you email support@newrax.dev, we receive your address, message and any attachments you choose to send. We use them to respond, resolve issues and follow up on your request, not to build an advertising mailing list. The mailbox uses Namecheap Private Email; Raúl Eduardo Méndez Reyes is the only person at NEWRAX managing it. The provider processes information needed to host, deliver and protect messages.

Send only necessary information. Before attaching screenshots, hide notifications, other people's information, cards and passwords. We do not ordinarily request complete identity documents for support. Communications with a parent or guardian are also limited to what is necessary.

Namecheap: https://www.namecheap.com/legal/general/privacy-policy/
Private Email: https://www.namecheap.com/legal/hosting/netos/

7. Website and external links

newrax.dev uses Google's Firebase Hosting. We do not add forms, ads, analytics cookies, remote fonts or tracking scripts to the website. Visiting does not create a player account. Support links open your email app and external links lead to services with their own policies.

Hosting processes technical request information, including IP, to serve pages, prevent abuse and provide service-usage information. Google states that Firebase Hosting retains IP data for a few months. This must not be confused with Firebase Analytics or game records. We do not treat the absence of scripts as a guarantee that hosting processes no data.

Firebase: https://firebase.google.com/support/privacy

8. Purposes and legal grounds

We use necessary information to provide requested features, preserve preferences and progress, recognize purchase entitlements, handle inquiries and protect the service. Where GDPR or an equivalent law applies, providing the requested service is the ground for information strictly necessary for those features, subject to that law's requirements.

Responding to general inquiries and preventing abuse rely on the corresponding legitimate interest, balanced against your rights. We will request consent where required for advertising or related technologies; you can withdraw it through available choices. A legal obligation may justify keeping the records it requires. Neither age selection nor a purchase replaces advertising consent.

We do not create advertising profiles from local progress or support emails. Information unnecessary to play is not a condition of play. If you do not provide information indispensable for a particular inquiry, we may be unable to resolve it. We do not use automated decisions about players with legal or similarly significant effects; local age classification is limited to applying the protections described.

9. Providers and international processing

Google provides Hosting and, when enabled, advertising and consent; Namecheap provides email; Apple and Google handle store payments; RevenueCat validates purchases. We may disclose necessary information to these providers for the stated purposes, to comply with a valid legal obligation or to handle a claim. We do not independently trade player or support-email lists.

For end-user data processed on NEWRAX's instructions, RevenueCat's DPA identifies it as processor and NEWRAX as controller. Other providers may act as processors or independent controllers for their own services, depending on the operation and terms. Advertising, hosting providers and stores do not necessarily have the same role or retention periods.

NEWRAX operates in Guatemala. Providers and their subprocessors may process data in other countries, including the United States. RevenueCat identifies US hosting and publishes standard contractual clauses for transfers subject to European law and the UK addendum where applicable; Google and Namecheap publish data-protection terms. The appropriate safeguard depends on the provider, operation and applicable law: referring to those terms does not mean all transfers automatically have the same coverage. For information about the recipients, countries and safeguards applicable to particular processing, or to request copies subject to necessary confidentiality protections, email support@newrax.dev.

10. Retention

Local data: retained until the corresponding data is cleared through the system or the app and its data are deleted. There is currently no general in-app delete button. Android allows clearing app storage/data; on iOS deleting an app differs from offloading it while keeping data. Progress may be lost. Backups require their own controls; we do not promise uninstalling deletes them.

Support: while handling the inquiry and for up to 12 months after resolution, unless a legal obligation or pending claim requires necessary records. Namecheap logs and backups may have other periods. This rule concerns support, not purchases or advertising.

Purchases: records needed for a permanent entitlement may be retained while necessary to recognize it, restore it and resolve issues, subject to valid deletion requests and legal obligations. We do not assign them a 12-month expiry or a generic period taken from another service. If we retain data when responding to a request, we will explain the purpose, scope and applicable criterion. Stores retain their own records under their obligations.

RevenueCat's local diagnostic-event file may persist while the remote decision has not arrived; disabling discards its events. This does not itself erase logs, requests or purchase records in the provider's systems. The 12-month support-email period does not apply to those records. We are clarifying the applicable log and backup retention criteria and the scope of deletion with the provider.

Hosting: Google reports a few months for IP. Advertising and consent: records, preferences and technical information are kept according to their purposes and the provider's controls and rules; there is no single period for all of them. Consult provider policies or contact us about the relevant processing. When NEWRAX no longer needs data it controls and there is no valid reason to retain it, it will be deleted or anonymized.

11. Rights and deletion requests

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, withdraw consent without affecting previous lawful use and complain to a competent authority. No purchase or advertising consent is required to submit a request. Email support@newrax.dev with the subject Privacy — Dieguito and explain your request.

For local-only progress NEWRAX has no remote access: use device controls and check backups. For support, write from the email originally used when possible. For purchases, indicate platform and an order reference or approximate date if available; hide information unrelated to the inquiry. Do not send credentials, complete technical receipts, tokens or card numbers. We will request only proportionate verification if needed.

If we can locate and verify RevenueCat records managed for NEWRAX, we will handle the request through its access or deletion tools, explaining possible consequences for entitlement restoration. We will not delete another person's record without verification. If available information does not identify it, we will explain the limitation and what minimum information could help, without creating unnecessary additional identification. Deleting RevenueCat data does not automatically erase a store purchase; later restoration may create necessary records again.

We will respond within applicable legal deadlines and explain permitted extensions or retention reasons. If another provider independently controls a record, we will indicate the relevant channel where we can identify it. A request does not mean accepting charges or waiving privacy rights.

12. Security

We limit NEWRAX access to what is necessary and avoid including personal data, receipts, tokens or credentials in public project reports. The website uses HTTPS; advertising and purchase SDKs use protected connections according to their documentation. Keep devices and store accounts protected. No transmission or system provides absolute security. If we discover an incident, we will assess measures and notices required by applicable law.

13. Changes and availability

This policy is available in Spanish at https://newrax.dev/privacidad/ and in English at https://newrax.dev/en/privacy/. Changes will be reflected here with their effective date. Before enabling new processing requiring additional information or consent, we will provide those measures. Provider policies supplement this information and do not replace NEWRAX's obligations. For clarification, email support@newrax.dev.