Privacy Policy – SXZ Universe

SXZ UNIVERSE ("we," "our," or "us") is operated by:

Sole Proprietor (IP): Vladimir Stepan Atasyan
Registration No: 43101053
Address: Nairyan 16/37, Abovyan, Armenia

We act as the Data Controller for all personal data processed through our applications and services.

This Privacy Policy complies with:

• GDPR
• CCPA / CPRA
• Google Play User Data Policy

This Policy applies to:

• Mobile applications (including Wear OS watch faces)
• Companion applications
• Official website
• Email communications

We process personal data under the following lawful bases:

3.1 Consent

Used for:

• Marketing communications
• Analytics (where required)
• Non-essential cookies

Users may withdraw consent at any time.

3.2 Contractual Necessity

Used to:

• Provide app functionality
• Enable account features (authentication, personalization)

3.3 Legal Obligation

Used to comply with:

• Tax and accounting laws
• Legal requests

3.4 Legitimate Interests

We process limited data where:

• Necessary for service operation
• Minimal impact on privacy
• Reasonably expected by users

Includes:

• App performance monitoring
• Crash reporting
• Security monitoring

Users may opt out where applicable via device or app settings.

4.1 Account Data

We collect:

• Google Account ID (UID)
• Email address
• In-app account data: reward points/coins balance, daily check-in streaks, claimed rewards, and saved/favorite watch faces
• User preferences and system configuration settings within the companion application

Used for:

• Authentication
• Account management
• Feature personalization and reward tracking
• Communication

We do not store passwords.

4.2 Email Communications

If you opt in, we may send:

• Product updates
• Promotions
• Feature announcements

Safeguards:

• Explicit opt-in only
• No pre-checked boxes
• One-click unsubscribe

4.3 Technical & Analytics Data

We collect:

• Device model, operating system version, and companion app version
• Number of connected Wear OS devices and watch face installation status
• Crash logs and app performance diagnostics
• Pseudonymized interaction events (screen views, button taps, and feature engagement)
• Push notification delivery and interaction status (via Firebase Cloud Messaging)

Characteristics:

• Pseudonymized (analytics identifiers use an opaque, one-way hashed account ID)
• No advertising identifiers (AD_ID is explicitly disabled)
• No direct identification
• Used strictly to improve performance, user experience, and stability

5.1 Mobile Applications

We use SDK-based analytics tools (not cookies), which may collect:

• App usage events
• Device information
• Crash data

5.2 Website Cookies

Our website may use:

• Essential cookies
• Analytics cookies (with consent)

Users can manage cookie preferences via the website interface.

We use trusted providers:

Services used

Services used:

• Firebase Analytics
• Firebase Crashlytics
• Firebase Authentication

Data processed:Services used:

• Firebase Analytics
• Firebase Crashlytics
• Firebase Authentication
• Firebase Cloud Messaging (FCM)
• Google Cloud Platform (BigQuery raw analytics storage)

Data processed:

• Device information
• App interaction events
• Crash data
• Authentication identifiers (UID)
• Push notification delivery status
• Device information
• App interaction events
• Crash data
• Authentication identifiers (UID)

Processing location:

• United States and other regions

Safeguards:

• Standard Contractual Clauses (SCCs)
• Applicable data protection frameworks

Email Service Providers

We use third-party providers (AWS SES or Brevo) for:

• Transactional emails
• Marketing emails

Data processed:

• Email address
• Email interaction (open/click data)

All providers operate under Data Processing Agreements (DPA).

Our Wear OS watch faces may display health-related information (such as heart rate or step count) provided by the device's operating system for visual representation only.

No Collection

We do NOT collect, store, or transmit any health or fitness data to our servers or any third parties.

No Medical Use

SXZ UNIVERSE applications are NOT medical devices. They are intended for informational and aesthetic purposes only and do not provide medical advice, diagnostics, or treatment recommendations.

We do not sell or share personal data as defined under CCPA/CPRA.

Data is shared only with: Service providers (e.g., Firebase, email platforms)

When legally required

Your data may be processed outside your country, including:

• United States (Google infrastructure)

Safeguards:

• Standard Contractual Clauses (SCCs)
• Contracts ensuring GDPR-level protection

10.1 Security Measures

We implement:

• AES-256 encryption (data at rest)
• TLS encryption (data in transit)
• Access control (least privilege)

10.2 Data Retention

We retain data only as necessary:

• Account data → while account is active or until deletion request
• Inactive accounts → deleted after 12 months
• Analytics data → up to 14 months
• Email data → until unsubscribe or 24 months inactivity (users can unsubscribe at any time via the unsubscribe page: https://sxzuniverse.com/unsubscribe)
• Legal data → as required by law

10.3 Account & Data Deletion Request

Users can request the permanent deletion of their account and all associated personal data at any time:

• Request method -> directly in the companion app via Profile → Settings → Delete Account, or by sending an email to info@sxzuniverse.com with the subject "Delete My Account" from your registered email address.
• Deletion scope -> email address, user ID, earned reward points/coins, settings, and activity history
• Deletion timeline -> permanently and irreversibly deleted from our database within 30 days.

In case of a data breach:

• Immediate investigation
• Risk assessment
• Containment

Notifications:

• Authorities within 72 hours (if required)
• Users via email or app (if necessary)

You may request:

• Access
• Correction
• Deletion
• Restriction
• Data portability
• Withdrawal of consent

How to Submit a Request

Send request to:

📩 info@sxzuniverse.com

Include:

• Email used in the app
• Description of request

Response time: up to 30 days

Our services are not intended for:

• Children under 13
• Children under 16 in EEA

We do not knowingly allow children to create accounts or submit data.

If detected → data is deleted immediately.

We apply:

• Data minimization
• Purpose limitation
• Secure defaults

Any disputes arising out of or relating to this Privacy Policy shall first be attempted to be resolved through amicable negotiations by contacting our Data Protection contact.

If a resolution cannot be reached, all legal disputes shall be subject to the exclusive jurisdiction of the courts of the Republic of Armenia, and governed by the laws of Armenia.

📩 support@sxzuniverse.com

We may update this Policy.

Users will be notified if significant changes occur.

Entity: IP Vladimir Stepani Atasyan (SXZ UNIVERSE)

Address: Nairyan 16/37, Abovyan, Armenia
Registration No: 43101053

📩 Support: support@sxzuniverse.com
📩 Privacy: support@sxzuniverse.com

🌐 https://sxzuniverse.com/contacts