Joybox Privacy Policy

Effective Date: 【2026/11/06】

ARTICLE 1 — INTRODUCTION AND SCOPE

1.1 HUYA LIMITED (the “Operator” or “we”) operates the Joybox mini-game aggregation platform (the “Platform”), through which Users may play a variety of aggregated Mini-Games. This Privacy Policy (this “Policy”) explains how the Operator collects, uses, stores, discloses, transfers, and protects your personal data when you use the Platform.

1.2 This Policy is an integral part of the Joybox User Agreement (the “User Agreement”) and should be read together with it. Terms used in this Policy that are also defined in the User Agreement — including the Platform, Guest Mode, Account, In-App Purchase (“IAP”), Virtual Items, and Paid Features — have the same meanings as in the User Agreement. The User Agreement governs your use of the Platform (including the non-refundable nature of in-platform paid features); this Policy governs the processing of your personal data.

1.3 This Policy applies to all Users of the Platform, including Users who play Mini-Games in Guest Mode without registering an Account and Users who have registered and logged in to an Account. If you do not agree with this Policy, please stop using the Platform; where applicable law so requires, you may also withdraw your consent as described in Article 12.

1.4 This Policy uses examples to illustrate the data we collect; the data actually collected depends on the version of the Platform, the Mini-Games you play, and the functions you use. We do not collect categories of personal data other than those described in this Policy; where we intend to collect new categories, we will update this Policy and notify you in advance.

ARTICLE 2 — DEFINITIONS

2.1 In this Policy, unless the context otherwise requires:

(a) “Personal Data” means any information relating to an identified or identifiable natural person, including information that can identify a person when combined with other information;

(b) “SDK” means a software development kit or similar code library integrated into the Platform client to provide specific functions (such as statistics, crash reporting, push notifications, login, payment, or advertising);

(c) “Device Identifier” means an identifier associated with your device, such as Android ID, OAID, GAID, QIMEI, or (where accessible) IMEI; and

(d) “Processing” means any operation performed on personal data, such as collection, storage, use, disclosure, transfer, or deletion.

2.2 Interpretation. Headings are for convenience only and do not affect interpretation. The words “include” and “including” mean “including without limitation”. References to Articles are to the articles of this Policy.

ARTICLE 3 — OVERVIEW: GUEST MODE AND LOGGED-IN MODE

3.1 Guest Mode. You may play certain Mini-Games without registering or logging in. In Guest Mode, we do not collect Account information (such as your email address or password), but we do collect Device and Network Information and Behavioural and Usage Data (described in Article 4), which are associated with your Device Identifiers rather than an Account. Guest Mode data may be lost when you clear application data or change devices, and we may be unable to locate or delete server-side Guest Mode data without the information described in Article 12.3.

3.2 Logged-in Mode. To use functions that involve IAP, you must register an Account (using your email address or an available third-party login) and log in. When you are logged in, we associate the data described in Article 4 with your Account so that, for example, Virtual Items purchased through IAP can be credited to your Account and your “recently played” history can be synchronised.

3.3 Summary of Data Collected. The following table summarises the categories of personal data collected by the Platform. Details of each category, including the specific data fields, purposes, and collection methods, are set out in Article 4.

Table 1 — Summary of Personal Data Collected by the Platform

ARTICLE 4 — INFORMATION WE COLLECT AND HOW

4.1 Account and Authentication Information (provided by you; logged-in mode only):

(a) Email Address. Collected when you register or log in using email; used for registration, login, password recovery, and delivery of email verification codes, and displayed on your account page;

(b) Username / Nickname. The display name of your Account, shown on your account card and in settings (in-app editing of the nickname may not be available in all versions);

(c) Account ID. An internal unique identifier assigned to your Account, used to attribute orders, points, and push notifications, and included in statistics and diagnostic parameters;

(d) Password (Hashed). Your login password is submitted through our login SDK and stored only in hashed, encrypted form. We do not store your password in plain text; your device stores only a session token (not your password); and our logs record only the length of the password entered, never the password itself; and

(e) Third-party OAuth Identifiers. If you log in through a third-party provider (such as Google, Apple, Telegram, VK, or Meta, where offered), we receive the authorization identifiers and login credential issued by that provider (for example, a user identifier or identity token) and use them to establish your login session. The login process is completed in your device browser; we do not receive your third-party account password.

4.2 Device and Network Information (collected automatically when you use the Platform, in both Guest Mode and logged-in mode):

(a) device model and brand, operating system and version (including recognition of the HarmonyOS system), and screen resolution, used for statistics, compatibility analysis, and crash attribution;

(b) Device Identifiers — including Android ID, OAID, GAID, and QIMEI, and (where accessible on the device) IMEI — used for device de-duplication, statistics, risk control, crash and performance diagnosis, and advertising attribution and measurement;

(c) MAC address, collected where accessible (on Android 6.0 and above this value is typically unavailable) and used as a supplementary device identifier for statistics;

(d) IP address, recorded by our servers in request logs when you access the Platform (our client does not actively report your IP address), used for country/region determination, risk control, and fault diagnosis;

(e) network type (such as WiFi, 4G, or 5G), used for statistics and weak-network and failure analysis;

(f) SIM operator name, used for statistics by carrier. We do not collect IMSI or ICCID, and the Platform does not request the READ_PHONE_STATE permission; and

(g) IP-based coarse location — a country- or city-level location derived by our servers from your IP address (we do not use GPS or other precise positioning technologies), used for country/region statistics, content delivery, and push notification targeting.

4.3 Behavioural and Usage Data (collected automatically, in both Guest Mode and logged-in mode):

(a) Browsing History. Records of the pages and content you view and the Mini-Games you open; your “recently played” history is stored on our servers and can be cleared by you in the Platform settings;

(b) Click and Interaction Records. Your clicks on buttons, elements, and Mini-Games, used for feature usage analysis and conversion funnel analysis;

(c) Dwell Time. The time you spend on pages and features, measured through application heartbeat and page entry/exit events;

(d) Usage Frequency. The frequency with which you use the Platform and its features, derived from page, click, and launch events (including first-open and version-first-open events); and

(e) Crash and Performance Logs. Crash, ANR (application not responding), and lag records, and interface call duration and failure records, associated with a Device Identifier and device model, used to locate and fix faults.

4.4 Transaction-related Data (logged-in mode, IAP only). When you make an In-App Purchase, we create and retain transaction records associated with your Account ID (including order information, amounts, and timestamps) in order to credit Virtual Items to your Account, attribute orders and points, handle billing enquiries, and meet accounting, dispute-handling, and legal record-keeping requirements. Payment instruments (such as your bank card number) are processed by third-party payment channels; the Platform does not collect or store your payment card details. Payment pages may use the system WebView, which may save session cookies. The User Agreement provides that in-platform paid features are non-refundable; transaction records relating to such features are retained as described in Article 9.

4.5 Cookies and Local Storage. The Platform client itself does not use browser cookies. It uses local storage on your device to store your session token and your preference settings. Where you use functions that rely on WebView (such as payment or policy pages), the system WebView may store cookies necessary for those sessions. Third-party login is completed in your device browser. Some SDKs use local identifiers (such as OAID, GAID, or QIMEI) and similar technologies. You may clear local data through your device settings, and you may manage advertising identifiers as described in Article 7.3.

4.6 Collection Methods. We collect personal data (a) directly from you (for example, information you enter in registration and login forms) and (b) automatically (through the Platform client, SDKs, and server logs) when you use the Platform. We do not collect data categories not listed in this Policy.

ARTICLE 5 — HOW WE USE YOUR PERSONAL DATA

5.1 We use your personal data for the following purposes:

(a) to provide, operate, and maintain the Platform and its functions, including registration and login, verification of your identity, crediting Virtual Items purchased through IAP to your Account, maintaining your recently played history, and delivering push notifications you have not disabled;

(b) to understand how the Platform is used and to improve our products and services, including analysing page browsing, clicks, dwell time, usage frequency, conversion funnels, and crash and performance data;

(c) to measure and attribute advertising and to deliver advertising, including personalised advertising where permitted, using Device Identifiers and IP-based coarse location, as described in Article 7;

(d) to ensure the security and stability of the Platform, including device de-duplication, risk control, fraud and cheating prevention, and the diagnosis of faults;

(e) to communicate with you, including service notices, verification codes, and notices of changes to this Policy or the User Agreement;

(f) to comply with applicable laws, regulations, and the requests of competent authorities; and

(g) to enforce the User Agreement, including detecting conduct that the User Agreement prohibits (such as cheating, attacking the Platform, or exploiting vulnerabilities).

5.2 We do not use your personal data for purposes unrelated to those described in this Policy without obtaining your separate consent. Where we use data for statistics, we may use aggregated or de-identified data that can no longer identify you.

ARTICLE 6 — LEGAL BASES FOR PROCESSING

6.1 We process personal data on one or more of the following bases: (a) your consent; (b) the necessity of performing our contract with you (the User Agreement) or of taking steps at your request prior to entering into it (for example, registering an Account); (c) our legitimate interests in operating, securing, and improving the Platform (for example, risk control and product analytics), balanced against your rights and interests; and (d) compliance with legal obligations to which we are subject.

6.2 Where processing is based on your consent, consent is obtained through your acceptance of this Policy and the User Agreement when you first use the Platform (and, where applicable, through in-product prompts). You may withdraw your consent at any time as described in Article 12. Withdrawal does not affect the lawfulness of processing carried out before withdrawal; however, if you withdraw consent to processing that is necessary for a function (for example, login credentials), you may no longer be able to use that function.

ARTICLE 7 — THIRD-PARTY SDKs AND ADVERTISING

7.1 The Platform integrates a number of third-party SDKs, which provide statistics, crash reporting, push notification, login, payment, game engine, and advertising functions. These SDKs may collect personal data (such as Device Identifiers and usage data) as independent controllers or processors under their own privacy policies.

7.2 The main SDKs currently integrated include:

(a) statistics and analytics: Beacon, Datong (DT), BlueWhale, and Firebase Analytics;

(b) crash and performance diagnosis: Bugly, TDDiag, and Firebase Crashlytics;

(c) marketing attribution: Adjust;

(d) push notifications: Firebase Cloud Messaging (FCM);

(e) device identification: QIMEI/Qsea and HyDevice;

(f) account login: UDB;

(g) mini-game engines: WeApp and SUD;

(h) payment: ASDK; and

(i) advertising aggregation and ad networks: TopOn, and ad sources including SDM, Mintegral, Vungle, Unity Ads, Yandex, Pangle, Bigo, Meta, InMobi, and Fyber.

7.3 Advertising. Advertising SDKs and networks may use Device Identifiers (such as OAID and GAID), IP-based coarse location, and usage data to deliver, measure, and attribute advertising, including personalised advertising where permitted by applicable law.

ARTICLE 8 — HOW WE SHARE AND DISCLOSE PERSONAL DATA

8.1 We may share your personal data with:

(a) the third-party SDK providers and advertising partners described in Article 7, for the purposes described in this Policy;

(b) third-party payment channels, to process payments for IAP (they receive the transaction information necessary to process the payment);

(c) service providers we engage to operate the Platform (such as hosting, cloud storage, and analytics providers), who process data on our instructions and under confidentiality and data protection obligations; and

(d) competent authorities, courts, or other governmental bodies, where required by applicable law or legal process.

8.2 We may also disclose or transfer personal data in connection with a merger, acquisition, restructuring, or sale of assets, in which case we will require the recipient to continue to process your personal data in accordance with this Policy and will notify you of the change where required by applicable law.

8.3 We do not sell your personal data, and we do not share it for purposes other than those described in this Policy without your separate consent or another valid legal basis. Where we share personal data, we disclose only what is necessary for the relevant purpose and, where required by applicable law, we enter into appropriate data protection agreements.

ARTICLE 9 — DATA RETENTION

9.1 We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to comply with legal obligations, to resolve disputes, and to establish or defend legal claims.

9.2 Indicative retention periods:

(a) Account and authentication data (including your hashed password): until your Account is deleted in accordance with the User Agreement, after which it is deleted or anonymised;

(b) session token stored on your device: until you log out, clear application data, or uninstall the Platform;

(c) your “recently played” history: until you clear it in the Platform settings or delete your Account;

(d) transaction records relating to IAP: 12 months;

(e) log data (including server logs and crash and performance logs): 12 months; and

(f) behavioural and usage data used for statistics: retained in identifiable form for 12 months and thereafter in aggregated, de-identified form.

9.3 When retention is no longer necessary, we delete the personal data or anonymise it so that it can no longer identify you.

ARTICLE 10 — DATA SECURITY

10.1 We adopt technical and organisational measures designed to protect your personal data, including: (a) storing passwords only in hashed form; (b) storing only a session token (not your password) on your device; (c) encrypting data in transit using industry-standard protocols; (d) restricting internal access to personal data on a need-to-know basis; and (e) recording only the length (not the content) of passwords in logs.

10.2 Please safeguard your Account credentials and do not share them with others. If you suspect unauthorised use of your Account, notify us immediately.

10.3 No method of transmission or storage is completely secure. If a data breach occurs that, under applicable law, requires notification, we will notify you and the competent authorities in accordance with the applicable time limits.

ARTICLE 11 — CHILDREN'S PRIVACY

11.1 The Platform is a general-audience product and is not directed at children under 15. We do not knowingly collect personal data from children below that age. If we learn that we have collected personal data from such a child, we will delete it promptly.

11.2 If you are a minor, you may use the Platform and make In-App Purchases only with the consent of your parent or legal guardian, as required by the User Agreement and applicable law.

11.3 Parents and guardians who believe that their child has provided us with personal data, or who have questions about children's privacy, may contact us at joybox-global@huya.com. We also encourage parents to use the parental control and restriction features available on their devices.

ARTICLE 12 — YOUR RIGHTS AND CHOICES

12.1 Subject to applicable law, you may have the right to: (a) access and obtain a copy of your personal data; (b) correct or update it; (c) delete it; (d) obtain a portable copy of data you have provided to us; (e) withdraw your consent to processing based on consent; (f) object to or restrict certain processing, including direct marketing and personalised advertising; and (g) lodge a complaint with a supervisory authority.

12.2 To exercise these rights, contact us at joybox-global@huya.com with the information necessary to verify your identity (such as your Account email address or Account ID). We will respond within 30 days and may request additional information where necessary.

12.3 The following choices are available to you directly:delete your Account through the account settings(deletion of your Account does not affect processing carried out before deletion or data we must retain under applicable law);

12.4 We may decline or limit a request where permitted by applicable law (for example, where the data must be retained for legal reasons) and will explain the reasons.

ARTICLE 13 — INTERNATIONAL DATA TRANSFERS

13.1 Your personal data may be transferred to and stored or processed in countries or regions other than the one in which you reside, including the countries or regions where the third-party SDK providers and service providers referred to in Articles 7 and 8 are located in Singapore.

13.2 Where applicable law imposes conditions on cross-border data transfers, we will implement appropriate safeguards.

ARTICLE 14 — CHANGES TO THIS POLICY

14.1 We may update this Policy from time to time. The latest version, with its version number and effective date, will be published on the Platform. Where a material change may affect your rights, we will notify you through announcements on the Platform, push notifications, or other reasonable means at least 10 days before the change takes effect where required by applicable law.

14.2 If you continue to use the Platform after the effective date of an updated Policy, you will be deemed to have accepted the updated Policy, except where applicable law provides otherwise. If you disagree with an update, you must stop using the Platform and may delete your Account as described in the User Agreement.

ARTICLE 15 — CONTACT US

15.1 If you have any questions, requests, or complaints about this Policy or our processing of your personal data, please contact us at:

15.2 This Policy is drafted in English. Any translated version is provided for convenience only; in case of any discrepancy, the English version prevails, unless otherwise required by applicable law.

END OF PRIVACY POLICY