Legal

Privacy Policy

Last updated: 3 August 2026

This policy explains how Youniverse Games Sdn. Bhd. ("Youniverse", "we", "us", "our") collects and handles personal data. It covers this website, youniverse.game, the player sign-in pages on this domain, and the Yooca: Your Life player account those pages create. It is written in line with the Malaysian Personal Data Protection Act 2010 (PDPA). Sections 12 and 13 add rights for people in the EEA, the UK and California.

1. Who we are

The data controller is Youniverse Games Sdn. Bhd. (202201024266 / 1469963-K), G-3A-2 Encorp Strand Garden Office, 12 Jalan PJU 5/1, Kota Damansara, Petaling Jaya, 47810 Selangor, Malaysia. Telephone +603-8679 1946. For anything about your personal data, write to [email protected].

Our other properties. yooca.com is a separate website for players and publishes its own privacy policy for what happens there. This policy governs sign-in, your player account and your game data wherever we handle them, including on yooca.com. The brand partner panel at brands.youniverse.game is covered by this policy and may carry additional contract terms for partner staff.

2. What we collect

2.1 Everyone who visits

Our web servers record standard technical information in their logs: your IP address, browser type and version, the pages you request, referring page and the date and time. We use this to keep the site running, to diagnose faults and to detect abuse.

2.2 When you contact us

If you submit the contact form or email us, we collect:

• your name;
• your email address;
• your organisation, if you give it;
• the type of enquiry you select;
• a work portfolio link, if you give one;
• the content of your message.

2.3 When you sign in as a player

Yooca: Your Life uses Google and Facebook to sign you in. We do not run our own password system, so we never see, receive or store your Google or Facebook password.

Sign in with Google. We ask Google for your basic profile and email address. Google sends us:

• your Google account identifier;
• your name;
• your email address, and whether Google has verified it;
• your Google profile picture.

Sign in with Facebook. We request the email and public_profile permissions. Facebook sends us:

• your Facebook user identifier for our app;
• your name;
• your profile picture;
• your email address, where you have shared it with Facebook and allow it.

We do not ask for your friends list, your posts, your photos or permission to post anything on your behalf. You can review and remove our access at any time in your Google account settings or your Facebook app settings.

2.4 Your player account and gameplay

Once you have an account, we hold:

• your account identifier, display name and character or avatar setup;
• game progress, such as skills, roles, your home, your Yooca Pet and mini-game results;
• your in-game currency balance and transaction history inside the game;
• coupons and rewards you claim, and whether they were redeemed;
• in-game chat and social activity, where the game provides it;
• technical and device information from the game client, such as device type, operating system, crash reports and performance data;
• any support correspondence you send us.

2.5 Purchases

If you buy in-game currency or items, a third-party payment provider processes the payment. We receive a record of the transaction, such as the amount, the date and a reference. We do not receive or store your full card number.

2.6 Job applicants

If you apply for a role, we collect what you send us: your name, contact details, CV or portfolio, and anything else in your application. We use it to assess your application and to contact you about it.

3. Cookies and similar technologies

A cookie is a small file a website stores in your browser. Local storage does a similar job with more room. We use both, and different pages on this domain behave differently.

The company pages (Home, Platform, Yooca, For Brands, Studio, Media, Careers, Contact and these legal pages) set no analytics or advertising cookies. They load no tracking scripts.

The player sign-in pages need more. They use:

• Essential cookies and local storage, to keep you signed in and to hold your session. Without these you cannot log in.
• Google and Facebook sign-in scripts, loaded from accounts.google.com and connect.facebook.net. These set their own cookies and receive your IP address so that sign-in works.
• A Google Ads conversion tag. This measures how many people who arrive from one of our adverts go on to create an account, and it lets Google build remarketing audiences so we can show our adverts to people who have visited us. It sets Google advertising cookies.
• Google-hosted fonts and scripts, which means Google receives your IP address when the page loads.

You can block or delete cookies in your browser settings, and you can usually block third-party cookies on their own. Blocking essential cookies will stop you signing in. Blocking alone does not remove cookies already stored, so delete them as well if you want them gone. To limit how Google personalises adverts to you, use Google My Ad Center.

4. How we use your data

• To create and run your player account, and to sign you in.
• To run the game: save your progress, deliver rewards and coupons, operate in-game currency and support social features.
• To answer your enquiry and route it to the right team.
• To assess job applications.
• To provide customer and player support.
• To keep the service secure, prevent fraud and cheating, and enforce our terms.
• To measure and improve the game and the website, including fixing crashes.
• To measure the effectiveness of our advertising, and to show our adverts to people who have visited us.
• To report to brand partners on how their in-game presence performed. This reporting is aggregated. See section 6.
• To meet legal, tax and regulatory obligations.

5. Our legal basis

Under the PDPA we rely on your consent, which you give when you sign in, submit a form or continue to use the service, and on our legitimate interest in running, securing and improving what we offer. Where we need consent for a specific purpose, such as advertising cookies, we rely on that consent and you may withdraw it.

6. Who we share data with

We do not sell your personal data. We share it only as set out here.

• Google and Facebook, as our sign-in providers, and Google for advertising measurement. Their own policies apply to what they do with it. See the Google Privacy Policy, the Meta Privacy Policy and how Google uses data from sites that use its services.
• Service providers who help us operate, including hosting, email delivery, payment processing, customer support tools and fraud prevention. They may use your data only for the purpose we specify.
• Brand partners, in aggregate only. We tell a brand how many players visited their in-game store, played their mini-game or claimed and redeemed a coupon. When you redeem a coupon in the real world, the merchant sees the coupon code, not your account details. We do not give brand partners your name, email address or account identifier unless you ask us to.
• Authorities and advisers, where the law requires it, or to establish or defend legal claims, or to protect the safety of our users.
• A buyer or successor, if the business or a substantial part of it is sold, merged or reorganised. Any buyer must continue to honour this policy.

7. International transfers

We are based in Malaysia. Some of our service providers, including Google and Facebook, process data outside Malaysia. Where that happens we take steps to make sure your data keeps an adequate level of protection, through contract terms and by checking how the provider handles it.

8. How long we keep your data

• We keep personal data for no longer than we need it, and in any case for no more than six years.
• If you delete your player account, we delete or anonymise your personal data within 60 days.
• Enquiry and application data is kept only as long as needed to deal with it, plus a reasonable period for our records.
• Backups are overwritten on a rolling cycle, so a copy may survive a little longer in a backup before it is cycled out.
• We keep data longer where the law requires it, for example for tax records.

9. Security

We take reasonable physical, technical and organisational steps to protect personal data against loss, misuse and unauthorised access. Traffic to this site is encrypted in transit. Access to player data is limited to staff who need it, and they are under a duty of confidence. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your data and the law requires us to tell you, we will.

10. Your rights

Under the PDPA you may:

• ask what personal data we hold about you and get a copy;
• ask us to correct it if it is wrong or out of date;
• withdraw your consent;
• ask us to limit how we process it;
• ask us to delete your account and your data.

Email [email protected], or use the contact form and choose "Privacy and data requests". We may need to verify who you are before we act, so that nobody else can make a request in your name. We aim to respond within 21 days and will not take longer than one month.

11. Children

Yooca: Your Life and this website are not directed at children under 13, and we do not knowingly collect personal data from them. If you are a parent or guardian and believe your child has given us personal data, email [email protected] and we will delete it. Where a jurisdiction sets a higher age for consent to data processing, we apply that age instead.

12. If you are in the EEA or the UK

The General Data Protection Regulation gives you further rights: access, rectification, erasure, restriction of processing, objection to processing, and data portability. You may also lodge a complaint with your national supervisory authority. To exercise any of these, contact us at [email protected]. We apply the same handling standards to everyone, wherever you are.

13. If you are in California

Under the California Consumer Privacy Act you may ask what categories of personal information we collect, where it comes from, why we collect it and who we share it with. You may ask for a copy, ask us to delete it, and ask us not to sell it. We do not sell personal information. We will not treat you differently for exercising these rights. Contact us at [email protected] and we will respond within the time the law allows.

14. Other websites

This site links to other places, including yooca.com, brands.youniverse.game and our social media channels. Once you follow a link to a site we do not run, this policy stops applying. We are not responsible for how those sites handle your data, so please read their own policies.

15. Changes to this policy

We may update this policy. The current version is always on this page with its date at the top. If a change materially affects how we handle your personal data, we will give notice before it takes effect, through the service or by email, so you can review it. If you do not agree with an update, you may delete your account.

16. Contact us

For anything about this policy or your personal data, email [email protected] or use our contact form. You can also write to us at Youniverse Games Sdn. Bhd., G-3A-2 Encorp Strand Garden Office, 12 Jalan PJU 5/1, Kota Damansara, Petaling Jaya, 47810 Selangor, Malaysia, or call +603-8679 1946.

This policy is governed by the laws of Malaysia, and the Malaysian courts have jurisdiction over any dispute about it.