Age Rating, COPPA, and GDPR-K Policy

This document records the age-rating decision for AlcheMagic and RoundDeck, the US COPPA compliance stance, the EU GDPR-K (Art. 8) compliance stance, and the pre-filled answers for Apple's App Store Connect age questionnaire. Both games ship the same 4+ rating and the same no-ads, no-UGC posture, so one stance covers both.

Related legal docs in this directory:

• AlcheMagic Privacy Policy §10 — children section.
• RoundDeck Privacy Policy §10 — children section.

1. Age rating decision

No GDPR-K parental-consent prompt is required, because neither Service is directed at children under 16 nor marketed to them, but the rating allows children to play.

We have not designed either Service as a "kids app" in the Apple sense (Kids Category). We do not enroll in the Kids Category, because that category prohibits behavioral analytics entirely and both Services use opt-in analytics for adult users.

2. App Store Connect age questionnaire — pre-filled answers

Copy these answers into the App Information → Age Rating questionnaire in App Store Connect.

Sign and date the questionnaire on submission.

3. COPPA (US Children's Online Privacy Protection Act) — applies to children under 13

Compliance stance: neither Service is directed at children under 13. Our marketing copy targets a general audience. We do not use child-attractive characters, child-actor voiceovers, animated content tailored to children, or other COPPA "directed-to-children" signals.

However, the 4+ rating means we may have incidental child users. To satisfy COPPA's "actual knowledge" prong:

• No data collection from users we know are under 13. AlcheMagic's Settings → Privacy → Share analytics defaults to OFF; only the data required to deliver that Service (cloud save, hashed Game Center id, purchase records) is collected, and it is pseudonymous. RoundDeck has no accounts and no backend — its GameAnalytics telemetry is anonymous and unlinked to any identity.
• No advertising. Neither Service runs ads at launch. If we add ads, they will be contextual (non-personalized) on accounts flagged as under-13 by Apple Game Center where account data exists.
• No social or chat features. No user-to-user communication that could expose a child to strangers.
• Parental contact channel: privacy@arcaneduck.com — parents can request deletion of any account (AlcheMagic) or telemetry record (RoundDeck) they identify as belonging to their child.
• Deletion within 30 days of receiving a verified parental request. See the Account Deletion Policy (AlcheMagic) or the RoundDeck Privacy Policy §9 (RoundDeck).

If FTC enforcement priorities require more aggressive measures (e.g., Verifiable Parental Consent / VPC), we will gate analytics opt-in on the age-screen mechanism Apple provides in the App Store Connect age questionnaire.

4. GDPR-K (EU GDPR Art. 8) — applies to children under 16

Compliance stance: neither Service is marketed at children, but the 4+ rating allows minors to play.

GDPR Art. 8(1) sets the digital-consent threshold at 16, lowered by some Member States (e.g., Spain 14, Italy 14, Sweden 13). Where a Service relies on consent (AlcheMagic's analytics opt-in — see the AlcheMagic Privacy Policy §9; RoundDeck's telemetry runs on Legitimate Interest, not consent — see the RoundDeck Privacy Policy §4), we default AlcheMagic's consent toggle to OFF in the EU and require an affirmative tap from the user to enable analytics. This works regardless of age:

• A child user who never enables analytics never has their data sent to a processor.
• An adult user who enables analytics provides valid GDPR Art. 6(1)(a) consent.

We do not rely on consent for the data needed to deliver the Service (Art. 6(1)(b) — contract performance applies to cloud save, Game Center auth, and IAP).

Verifiable parental consent (VPC): Because we do not process children's data on a consent basis, GDPR Art. 8 VPC is not required. We monitor regulator guidance (especially Datenschutzkonferenz Germany, CNIL France, ICO UK) and will add a parental-consent gate if any of them issue binding guidance to that effect for tower-defense titles.

5. Operational safeguards

These apply across COPPA + GDPR-K + Apple Kids Category alternatives:

• No personal data fields: AlcheMagic's in-game profile screen exposes display name only; RoundDeck asks for nothing at all. Neither Service asks for real name, email, phone, address, or photo.
• Account deletion always available (AlcheMagic): Settings → Account → Delete. Cascade described in the Account Deletion Policy. RoundDeck has no accounts to delete; uninstalling removes all on-device data.
• Purchases require Apple's Ask-to-Buy on Family Sharing accounts (AlcheMagic only — RoundDeck has no purchases) — Apple, not us, gates the parent approval.
• No third-party SDK that triggers ATT — both Services' App Privacy manifests declare NSPrivacyTracking=false.
• AlcheMagic analytics consent default OFF in EU. RoundDeck's GameAnalytics telemetry runs on Legitimate Interest (no consent gate) but is fully anonymous and unlinked to identity.
• AlcheMagic crash reporting consent default OFF in EU (same gate as analytics).
• All processors (GameAnalytics, Firebase Crashlytics, Firebase Remote Config, Sentry) have signed DPAs (2026-07-09) that allow child users' data handling per their published documentation.

6. If the age rating changes

If we add features that bump the rating (PvP chat, blood/gore VFX, in-app web browser, real-money gambling mechanics, etc.) we will:

1. Re-run the App Store Connect age questionnaire for the affected game.
2. Update this document.
3. Update that game's privacy policy §10.
4. Update marketing copy.
5. Submit a new build with the updated rating.

7. Contact for child-account questions

• privacy@arcaneduck.com (subject: "Child account — COPPA" or "Child account — GDPR-K").
• Response within 14 days; deletion within 30 days of verified parental request.