Privacy Policy

Last updated: March 25, 2026

Nightmares Within and its subsidiaries and affiliates (also referred to as “Company,” “we,” “us,” or “our””) take your privacy very seriously. This Privacy Policy(the “Policy”) is designed with your needs in mind, and it is important that you have a comprehensive understanding of our personal information collection and usage practices, while ensuring that ultimately, you have control of your personal information provided to us when you use our mobile applications that hyperlink to this Policy and are available for download in the or any app store, including but not limited to Apple App Store, or any other content owned or operated by us (collectively, the “Services”).

Please read this carefully before you use our Services. Ultimately, what we want is the best for all our users. Should you have any questions with our data handling practices as summarized in this Privacy Policy, please contact Nightmares Within to address your specific concerns. If you disagree with anything in this Policy, you must not use or access the Services.

If you are located in the European Economic Area, United Kingdom and/or Switzerland, please also read Exhibit A carefully before you use our Services.

If you are California Residents, we provide a separate <Privacy Notice for California Consumers> https://www.nightmareswithin.net/ which addresses how we respect California's users' privacy. Please also read carefully before you use our services.

Part I: How We Collect and Use Your Personal Information

1.Types of personal information we use

This section describes the different types of personal information we collect and how we collect it. We will collect and use the following information about you:

1.1. Information you provide to us.

a) When you register for the game (including the nickname you specify, or a custom account, and information we import from your linked social media accounts (Apple ID, Facebook, etc.) to set up your profile, including your name and profile picture displayed on your social media profile);

b) When you link your account to your social media accounts (Facebook, etc.) or other external accounts, or use other social media features in accordance with the provider's policies.

c) When you use our services or interact with other users and/or us through our services. This includes but is not limited to Cookies that may be generated when you interact with us.

1.2. Information we collect about you.

a) Generated open id

b) Address, email address, phone number ("Contact Information")

c) Transaction information

d) Usage data and transaction data

e) Location-related information, including geographic location and IP address

f) Advertising ID

g) Customer support ticket ID and user communication with the support department

h) Game statistics

i) Device information (such as application version, network type, operating system)

j) Marketing and communication data, such as your preferences for receiving marketing materials, your communication preferences, and your communication history with us and our service providers

k) And security-related information

1.3. Data we collect from partners.

a) Data we receive when you link third-party tools (such as Facebook, etc.) to this service. If you register as a user of our service using your social media account (such as Apple ID, Facebook, etc.) and link your account to your social media account. We may access information about you that you voluntarily provide to the provider in accordance with the social media account provider's policies, and we will manage and use such personal data in accordance with this Policy.

b) Demographic data (such as determining the approximate location of your IP address)

c) Data used to combat fraud (such as refund abuse in games or click fraud in advertising)

d) Data used for advertising and analytical purposes to enable us to provide you with better services

1.4. Cookies.

We use Cookies and other similar technologies (e.g., web beacons, log files, scripts, and electronic tags) ("Cookies") to enhance your experience using Nightmares Within services. Cookies are small files that, when placed on your device, enable us to provide certain features and functions. You can choose to allow the installation of such Cookies or disable them later. You can accept all Cookies, or instruct your device (in the case of games) to notify you when Cookies are installed, or refuse to accept all Cookies by adjusting the relevant Cookie retention functions in your device. However, if you refuse to install Cookies, the game may not function as expected.

2.How we use your personal information

2.1 We will use the information in the following ways:

2.1.1 Create your game account at your request;

2.1.2 Generated username and open ID: used to store your game data (including level and progress) together with your profile;

2.1.3 Contact or communicate with you by phone, SMS and/or fax, email and/or mail or other means to manage and/or administer your relationship with us or your use of our services;

2.1.4 Save your transaction history;

2.1.5 Manage, operate, provide and/or administer your use and/or access to our services (including but not limited to your preferences), and your relationship and account with us;

2.1.6 For identification and/or verification; (if applicable)

2.1.7 Conduct research, analysis and development activities (including but not limited to data analysis, surveys, product and service development and/or analysis), analyze how you use our services, improve our services or products and/or enhance your customer experience;

2.1.8 For security and verification purposes; identify and resolve errors and evaluate game functions for optimized operation; resolve game crashes and optimize device compatibility with the game; and combat users registering multiple accounts;

2.1.9 Store, host, back up (whether for disaster recovery or other purposes) your personal data, whether within or outside your jurisdiction;

2.1.10 Conduct due diligence or other screening activities (including but not limited to background checks) in accordance with legal or regulatory obligations or risk management procedures that may be required by law or that we may have implemented;

2.1.11 Respond to legal processes or comply with or make disclosures required by any applicable laws, government or regulatory requirements in any relevant jurisdiction, including but not limited to meeting the requirements of any laws binding on us or related companies or affiliates;

2.1.12 Other purposes permitted by applicable laws, and we will notify you when we obtain your consent.

The above purposes may not be exhaustive, as the purposes for which we collect/may collect, use, disclose or process your personal data depend on the specific circumstances. However, unless privacy laws allow the processing of applicable data without your consent, we will inform you of other purposes when we obtain your consent.

2.2 Analysis, summaries and segmentation.

In all of the above situations and purposes, we may analyze, parse and segment all collected data.

2.3 Legal basis for processing

If you are a resident of the European Union, we will process your information based on a number of legal bases. For example, we will process your information when: we have your consent; we have a legitimate interest in doing so; processing is necessary to perform a contract with you; and we have a legal obligation to process your information. For example, we conduct targeted marketing based on our legitimate interests; and process information based on contractual necessity when you create an account. For further information on the legal basis for our processing of your information for any specific purpose, please contact us through the options in "Contact and Complaints" below.

3.How we share your personal information

3.1 Sharing. We value the protection of your personal information, which is an important basis and component of our provision of products and services to you. We will only collect and use your personal information within the purposes and scope agreed in this Policy or as required by laws and regulations, and will strictly keep it confidential. In general, we will not share your personal information with any company, organization or individual, except in the following cases:

a) With your prior consent;

b) Sharing your personal information in accordance with applicable laws, regulations, legal procedures, government coercion or judicial decisions;

c) To the extent required or permitted by law, it is necessary to provide your personal information to third parties to protect the interests, property or safety of us, our users or the public from harm;

d) Your personal information may be shared among our affiliates. We will only share necessary personal information, and such sharing will be for the purposes described in this Policy. If an affiliate needs to change the purpose of processing personal information, it will seek your authorization and consent again;

e) In order to provide you with more complete and high-quality products and services, some of our services will be provided by authorized partners. To provide better customer service and user experience, we may share some of your personal information with partners. We will only share your personal information for legal, legitimate, necessary, specific and clear purposes, and only share the personal information necessary to provide the services. We also require partners to process your personal information in accordance with our requirements, this Policy and any other relevant confidentiality and security measures. Our partners are not entitled to use shared personal information for any other purpose. If you refuse to allow our partners to collect the personal information necessary to provide the services, you may not be able to use the third-party services on our platform.

Third-Party Service Providers: To provide a better gaming experience, we may integrate third-party SDKs (such as analytics or advertising tools). These third parties may collect anonymous device data. You can find the full list of our third-party partners and their privacy policies on our official website: https://www.nightmareswithin.net/.

The collection and processing of information by our partners is subject to their respective privacy policies or related statements, which do not apply to this Policy. To maximize the security of your information, we recommend that you carefully review the privacy policy of any third-party service before using it. To protect your legitimate rights and interests, if you find that the relevant third-party service is risky, we recommend that you immediately terminate the relevant operations and contact us in a timely manner.

Below is a list of our primary advertising and mediation partners:

3.2 Transfer. We will not transfer your personal information to any company, organization or individual, except in the following cases:

a) Transfer with explicit consent: After obtaining your explicit consent, we will transfer your personal information to other parties;

b) Necessary provision in accordance with applicable laws and regulations, legal procedures, and mandatory administrative or judicial requirements;

c) In the event of mergers, acquisitions, asset transfers, bankruptcy liquidation or similar transactions involving the transfer of personal information, we will require the new company or organization that holds your personal information to continue to be bound by this Policy before we request them to seek your authorization and consent again.

3.3 Disclosure. We will only publicly disclose your personal information in the following cases:

a) After obtaining your explicit consent;

b) Disclosure based on law: We may publicly disclose your personal information if required by law, legal procedures, litigation or government authorities.

3.4 No prior authorization or consent is required. In accordance with relevant laws, regulations and national standards, in the following circumstances, we may share, transfer or publicly disclose personal information without your prior authorization and consent:

a) Related to our fulfillment of obligations stipulated by laws and regulations;

b) Directly related to national security and national defense security;

c) Directly related to public security, public health and major public interests;

d) Directly related to criminal investigation, prosecution, trial and execution of judgments;

e) For the protection of the major legitimate rights and interests of the subject of personal information or other individuals, but it is difficult to obtain the consent of the person;

f) Personal information publicly disclosed by the subject of personal information to the public;

g) Personal information collected from legally publicly disclosed information, such as legal news reports, government information disclosure and other channels.

According to legal provisions, sharing, transferring or publicly disclosing de-identified personal information, and the data receiver cannot restore and re-identify the information subject, is not regarded as sharing, transferring or publicly disclosing personal information, and the storage and processing of such data does not require notification to you or your consent.

4.Data retention

4.1 We will retain your personal information as described below (unless applicable law requires otherwise).

Nicknames will be stored throughout your use of the game (i.e., until the account is deleted at your request) and then deleted within 30 days.

Social connection information: WeChat is stored throughout your use of the game (i.e., until the account is deleted at your request or you revoke access to the social media account), and then deleted within 30 days.

Social connection information: Facebook is stored throughout your use of the game until the account is deleted at your request, after which it will be deleted within 15 days. If you do not request account deletion, such data will be retained for 1 year after the game is closed before deletion.

Game statistics will be retained throughout your use of the game until you request account deletion. After account deletion, this data will be deleted within 30 days. If you do not request account deletion, such data will be retained for 1 year after the game is closed before deletion.

OpenID data will be retained throughout your use of the game until you request account deletion. After account deletion, OpenID data will be deleted within 15 days. If you do not request account deletion, such data will be retained for 1 year after the game is closed before deletion.

IP addresses will be stored throughout your use of the game until you request account deletion. After account deletion, IP addresses will be deleted within 15 days. If you do not request account deletion, such data will be retained for 1 year after the game is closed before deletion.

Device ID and device information are stored throughout your use of the game until the account is deleted at your request, after which they will be deleted within 30 days. If you do not request account deletion, such data will be retained for 1 year after the game is closed before being deleted.

Advertising IDs will be retained throughout your use of the game until you request account deletion. After account deletion, advertising IDs will be deleted within 15 days. If you do not request account deletion, such data will be retained for 1 year after the game is closed before deletion.

Transaction records will be stored throughout your use of the game (i.e., until the account is deleted at your request) and then stored for any retention period necessary to comply with our legal obligations to retain such data.

Customer support ticket IDs and user support communication data will be deleted within 30 days of your legitimate request to delete such data (see the "Deletion" section of this Privacy Policy).

Security-related information will be stored throughout your use of the game until the account is deleted at your request, after which it will be deleted within 30 days.

4.2 Personal information will be retained until the end of its life cycle (see the retention policy above for details). When destroying personal information, we will take measures to make personal information unrecoverable or uncopyable, and use technical means to permanently delete electronic files containing personal information so that the files cannot be copied.

4.3 If the processing and retention period has expired, but personal information still needs to be retained for other reasons (including purposes stipulated by applicable laws), the relevant personal information will be stored and maintained separately from other types of personal information. If you request us to destroy your personal information before the end of its life cycle (as described in the retention policy above), we will destroy your personal information in accordance with local laws.

Part II: Your Rights

5.1 Access

You have the right to access your personal information held by us, how we use it and with whom we share it. You can access the personal information you provided in your account by logging into your game account and contacting us.

5.2 Portability

You have the right to obtain a copy of certain personal information about you that we process. This includes any personal information we process based on your consent (such as certain survey information) or pursuant to a contract we have with you, as described in the "How we use your personal information" section. You have the right to receive such information in a structured, commonly used and machine-readable format. You also have the right to request us to transfer this personal information to another party.

If you wish us to transfer such personal information to a third party, please be sure to specify the third party in your request. Please note that we can only do so if technically feasible. Please note that we may not be able to provide you with personal information if doing so would infringe the rights of others (for example, providing personal information we hold about you would disclose others' information or our trade secrets or intellectual property).

5.3 Correction

You have the right to correct any inaccurate personal information about you. You can log into your game account to access the personal information you provided in your account. If you believe any other personal information we hold about you is inaccurate, please contact us by email.

5.4 Deletion

You can delete your account or remove certain personal information by logging into your game account. If you believe any other personal information we process needs to be deleted, please contact us by email.

You can request us to delete the personal information we hold about you in the following cases:

a) You believe we no longer need to hold such personal information;

b) You believe that the personal information we hold about you is being processed illegally by us.

While we are considering your request, you may also exercise your right to restrict our processing of your personal information (as described below).

If data protection laws give us a legitimate reason (for example, to maintain legitimate interests or freedom of expression), we may need to retain personal information, but we will inform you. If you ask us to delete personal information that has been made public on the game service and there is a reason for deletion, we will take reasonable steps to try to inform other organizations that display the personal information or provide links to it to also delete it.

6.Restriction of processing to storage only

In certain circumstances, you have the right to ask us to stop processing the personal information we hold about you (except for storage purposes). However, please note that if we stop processing personal information, we may use it again under data protection laws (for example, to maintain legitimate interests or protect others). As mentioned above, if we agree to stop processing personal information, we will try to inform any third parties to whom we have disclosed the relevant personal information so that they can also stop processing.

You can ask us to stop processing and only store the personal information we hold about you:

a) You believe the personal information is inaccurate, and we need time to verify whether it is accurate

b) You want to delete personal information because the processing we are carrying out is illegal, but you want us to retain the personal information, but only store it;

c) You want to delete personal information because it is no longer necessary for our purposes, but you need it to be stored to establish, exercise or defend legal claims.

7.Announcements

We may send you announcements from time to time as necessary (for example, when we suspend game access for maintenance or security, privacy or administrative communications). You cannot opt out of these service-related announcements, which are not promotional in nature.

Part III: Other

8.Information security

We have implemented administrative, physical and technical security measures designed to protect your information from loss, theft, misuse, unauthorized access, disclosure, alteration and destruction. However, you should understand that despite our best efforts, no security measure can be guaranteed to be impenetrable.

9.Disclaimer

In addition to the circumstances agreed in this Policy, we shall not be liable in the following cases:

9.1 Any leakage of personal information caused by the user informing others of the user's account and password, the user conducting virtual item transactions through trading platforms not approved by us, the user failing to keep his/her password properly or sharing our game account, game character with others, the user using third-party software or any other reasons not attributable to us;

9.2 Any leakage, loss, theft or tampering of user's personal information caused by hacker attacks, computer virus intrusion or outbreak, impact caused by technical adjustments of telecommunications departments, temporary shutdown due to government control, third-party reasons (including force majeure, such as failures of international export trunk links and international export telecommunications providers, fires, floods, lightning strikes, earthquakes, floods, typhoons, tornadoes, volcanic eruptions, plagues and epidemic diseases, strikes, wars or violent acts or similar events) and other reasons not attributable to us, and any losses caused to users and third parties thereby;

9.3 Any leakage of user's personal information caused by other websites linked to us and/or our affiliates and any legal disputes and consequences arising therefrom;

9.4 Any individual user providing wrong, incomplete or false information resulting in failure to pass authentication, inability to normally use our products and services or suffering any other losses.

10.Links to websites and services operated by other parties

Our services may contain links to other websites, applications and services. Since we do not operate these other websites, applications and services, we cannot be responsible for the privacy policies of the entities that operate them. We recommend that you review the privacy policy regularly to understand the practices of the operators.

11.Data We Collect

We collect information necessary for game functionality and security, including: (1) Device Information: Device model, OS version, and unique identifiers (IDFV/IDFA). (2) Game Activity: Level progress, in-game currency spent, and log data. We only access your IDFA (Identifier for Advertisers) if you provide explicit consent via the iOS App Tracking Transparency (ATT) prompt.

12.Changes

We may update this privacy policy. If we make material changes to how we collect, use, retain or share your personal information, we will notify you by sending an email to the last email address you provided, or by posting a notice of the change on the services covered by this privacy policy. By continuing to access or use our services after we post modifications to this Policy or provide you with notice of modifications, you agree to be bound by the modified terms. If you do not accept the modified terms, your only option is to stop using our services.

13.Contact and complaints

Welcome to put forward any questions, opinions and requests regarding this Policy. Please contact us via email at [email protected].

If you wish to complain about the way we process your personal information, please first contact us at [email protected], and we will handle your request as soon as possible.

14.Governing Law and Dispute Resolution

This Privacy Policy and any dispute arising out of or relating to it shall be governed by the laws of the People's Republic of China, without regard to its conflict-of-laws provisions, except where mandatory laws of your country or region (including consumer protection laws) provide otherwise.

The place of performance of this Privacy Policy is Zhengzhou City, Henan Province, where we are located.

Any dispute arising out of or in connection with this Privacy Policy (including disputes regarding its existence, validity, termination, or breach) shall, to the extent not prohibited by mandatory applicable law, be submitted to the people's court with jurisdiction located at our principal place of business after friendly consultation fails, consistent with the dispute resolution mechanism described in our Terms of Service. If mandatory law in your jurisdiction requires a different forum or process for consumers, that mandatory law shall prevail to the extent required.

Nothing in this Section limits your right to lodge a complaint with a competent data protection authority where such right exists under applicable law.

Part IV

Exhibit A — Additional Information for Users in the EEA, the United Kingdom, and Switzerland

This Exhibit supplements our Privacy Policy for users located in the European Economic Area (EEA), the United Kingdom, and Switzerland, where applicable data protection laws (including the GDPR and UK GDPR) apply.

Controller. The controller responsible for your personal data is Nightmares Within, Zhengzhou City, Henan Province, China.

Legal bases. We process personal data on the bases described in our Privacy Policy, including: performance of a contract, legitimate interests (where not overridden by your rights), consent where required, and legal obligations.

International transfers. Where we transfer personal data outside the EEA/UK/Switzerland, we implement appropriate safeguards such as Standard Contractual Clauses or other mechanisms permitted by applicable law.

Your rights. Subject to applicable law, you may have the right to access, rectify, erase, restrict processing, object, and data portability, and to withdraw consent where processing is based on consent. You may lodge a complaint with a supervisory authority.

Contact. For privacy requests, contact us at [email protected].

If there is any conflict between this Exhibit and the general Privacy Policy, the provision that provides stronger protection for you shall prevail to the extent required by applicable law.