Notice at Collection and Privacy Policy

Last Updated: September 2026

At DT One App Store Inc. (“DT,” “we,” “us,” or “our”), we make a concerted effort to ensure that we secure personal information and use it responsibly.

This notice at collection (the “Notice at Collection”) and Privacy Policy (the “Policy,” and collectively, the “Notice”) explain to you (“User” or “you”) our privacy practices for processing personal information related to your use of our mobile applications discovery and distribution platform and related services (the “Store”). The Store means both the application on your device through which you find, browse and install apps, and the systems we operate behind it to make that work. It allows you to view, find, browse, and install mobile applications directly on your device, and to organize them - including arranging the gaming apps already installed on your device into one place inside it. On your device, the Store may appear under a name chosen by your device manufacturer or your mobile operator, and it comes already installed on your device rather than downloaded by you. Whatever name the app carries and whichever operator supplied your device, the Store is provided and operated by DT One App Store Inc., and we are responsible for the personal information described in this Notice. The Store is free to use: we do not charge you for it, or for the apps you install through it.

In this Notice, the term “personal information” refers to information that identifies an individual or relates to an identifiable individual and includes equivalent terms such as “personal data” as defined under the applicable data protection and privacy laws of the United States (“US Privacy Laws”) or under the EU General Data Protection Regulation (“GDPR”) and the UK GDPR (collectively with the US Privacy Laws, “Privacy Laws”). The Notice also explains certain rights that Users have under Privacy Laws and how they may exercise them.

The general part of this Policy applies to all Users of the Store. The ANNEX to this Policy includes supplemental terms regarding processing personal information under the GDPR and the UK GDPR.

We operate the Store as a controller/business (within the meaning of Privacy Laws).

How the Store works. The Store helps you find, organize, and install mobile apps directly on your device. To install the apps you choose, the installation is performed by Ignite (where available), another Digital Turbine company acting as our service provider under an intercompany data processing agreement, which may process limited personal information on our behalf to perform the installation of your chosen mobile app and report it to the app developer, directly or via its mobile measurement partner (MMP) for attribution and invoicing. In this version of the Store, we do not use your personal information for personalized recommendations, targeted advertising, cross-context behavioral advertising, or marketing communications. If we introduce such features in the future, we will update this Notice and, where required, obtain your consent first.

When we process personal information. If you opt in, the Store arranges the gaming apps already installed on your device into the Store. To do that, the Store checks which apps are already on your device. That arrangement takes place entirely on your device, does not involve our processing of personal information about you, and none of that information is sent to us. Separately, the Store enables you to discover mobile apps and make available to you the apps that are eligible and available for download in your region and lets you search within them. Showing you those apps, and returning your search results, does involve limited processing by us: our servers receive your request and process the device and session information described below, so that the apps we show can run on your device, are available where you are, and match what you are searching for. We process further information when you choose to install an app and tap “Install” as described above. At that point, we process information for the purposes described in this Notice - such as delivering the app you selected and measuring (i.e., attribution) and invoicing the app developer for the app installation.

The summary below gives you a quick and clear view of our practices and serves as our Notice at Collection under US state privacy laws. Please, however, take the time to read our full Notice. If you disagree with its terms, please do not access or use the Store.

The Store Privacy Policy

Categories of personal information

When we show you the apps you can download, when you search within them, and when you choose to install an app, we collect the following categories of personal information about you (if you opt in, arranging the gaming apps already installed on your device into the Store takes place on your device and does not involve our processing of personal information related to you):

• Your mobile device Advertising ID (e.g., AAID, IDFA), in pseudonymized form (user-resettable);
• Your IP address, which our backend server receives as part of standard network (HTTP) requests. We use it at that moment to derive your approximate location - your country and region; we do not store it, and we do not share it with MMPs;
• Device information, such as device manufacturer, model, firmware version, operating system version, and which versions of an app your device is able to run (the technical term is “supported ABIs” - different phones need differently built versions of the same app);
• Network and carrier information, such as network connection and type, SIM operator name, and mobile country/network codes (MCC/MNC);
• Approximate location derived from your IP address, which is never stored - country and region (for example the EU or the US). We use it to work out which apps are available to you where you are (many apps only operate in certain countries), to apply region-appropriate policies and age ratings, so that we show you apps that actually work where you are - developers tell us where their app operates, and we do not show you apps that do not;
• Language (two-letter ISO code);
• App and install information, such as the package names of apps installed via the Store and related install transaction records;

We obtain these categories from the following categories of sources:

• Directly and indirectly from you and your use of the Store and your mobile device;
• Third parties such as Google and your mobile carrier / device manufacturer.

Categories of sensitive personal information

The Store does not collect sensitive personal information (within the meaning of applicable Privacy Laws). We do not collect precise geolocation: the location we derive from your IP address is your country and region at their most specific, which is far above the threshold at which location becomes precise geolocation under those laws. We do not store your IP Address after your country and region have been derived. We do not knowingly collect sensitive personal information and require you not to provide us with any such information. We do not process sensitive personal information to infer characteristics about you, and we do not sell or share sensitive personal information for cross-context behavioral advertising/targeted ads.

Carrier telemetry. On carrier-enabled devices, certain device telemetry (for example, granular network type) may be obtained under a privileged operator permission. We use this only for operational purposes described below. 

What do we do with personal information?

To let you explore and install apps through the Store, we need to process some information about you and your device. The table below sets out what we do, when we do it, what we use, and how long we keep it.

We obey the law and expect you to do the same. If necessary, we will use personal information to enforce our terms, policies, and legal agreements, to comply with court orders and warrants and assist law enforcement, to collect debts, to prevent fraud, infringement, identity theft, and other misuse of the Store, and to take action in any legal dispute or proceeding. We commit to only processing personal information for the purposes described in this Policy.

Who do we disclose, share, or sell personal information with?

Personal information related to you is disclosed to certain members of our staff who receive appropriate information security and privacy training, external consultants, and our affiliates, all of whom are governed by this Policy.

We also disclose personal information to third-party service providers and processors that process it on our behalf and under contract, only for the purposes we specify; they are contractually bound to keep it confidential and appropriately secure.

We share your mobile device Advertising ID in pseudonymized form (hashed), and certain device information, with Mobile Measurement Platforms (MMPs) solely for measurement and attribution purposes, which is an integral part of the Store. 

On-device installer (Ignite). Whenever you choose to install an app via theStore, the installation is performed by Ignite, another Digital Turbine company acting as our service provider (processor) under an intercompany data processing agreement. To carry out the installation, Ignite may process limited personal information (such as your mobile device Advertising ID in hashed form) on our behalf to perform the install and to measure and report it to the app developer for attribution and invoicing. Ignite does not process this information for its own independent purposes.

We do not sell personal information related to you, and we do not “share” it for cross-context behavioral advertising/targeted ads, within the meaning of US Privacy Laws (including the California Consumer Privacy Act, as amended by the CPRA). We do not engage in cross-context behavioral advertising or targeted advertising through the Store. The promoted apps we show are not behaviorally targeted: they are selected on your approximate location (country and region), your device information and your activity in the current session, and are not based on profiling you or tracking you across other apps or services.

A merger, acquisition, or other structural change may require us to transfer personal information related to you to another entity as part of the change, provided that the receiving entity complies with this Notice. We will also disclose personal information related to you in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

How long do we retain personal information?

We retain the Advertising ID in pseudonymized form associated with your mobile device for up to 30 days for measurement, attribution and invoicing, after which we anonymize/de-identify it so it no longer constitutes personal information related to you. The other information described in this Notice is retained for up to 2 years, after which it is deleted or further de-identified, unless a longer period is required by law. The information about which app versions your device can run, and the name of your SIM operator are not stored at all. The on-device app inventory used to organize your gaming apps in the Store is processed on your device and is not stored on our servers.

We will keep aggregated, non-identifiable information without limitation. 

Children

The Store is not directed to children, and we do not knowingly process, sell, or share personal information related to children, as such term is defined under the applicable Privacy Laws of your country, such as the Children’s Online Privacy Protection Act (COPPA) and the General Data Protection Regulation (GDPR). If your device has parental controls enabled, we will not display any apps to that user, will not process any personal data about that user or device, and will allow that user only to arrange the apps already installed on their device in the Store, as described in this Policy. We apply region-appropriate age ratings and policy controls on all apps available for download via the Store.

Age verification. Some US states require app stores to establish that a user is an adult. Where this applies to you, we will ask you to confirm the state you are in and to complete an age check carried out by a specialist provider. We receive only a confirmation that you are an adult; the provider carries out the check itself under its own terms, which we will show you before it begins. This does not apply to users in the EEA or the UK.

Your choices and rights

Subject to applicable Privacy Laws and certain exceptions, you have the following rights:

• Access. You may request confirmation of whether we process personal information about you and to access it, including to know:
  
  • the categories and specific pieces of personal information we have collected about you;
  • the categories of personal information we have disclosed, shared, or sold (we do not sell or share);
  • the categories of sources from which it is collected;
  • the business or commercial purpose for collecting it;
  • the categories of third parties to whom we disclose it.
• Correction. You may request that we correct inaccurate personal information we maintain about you.
• Deletion. You may request that we delete personal information we collected from you, subject to exceptions. When we delete it, it is removed from our active databases, though we may retain certain information for legitimate business or legal purposes.
• Portability. When exercising your access right, you may request the information in a portable, readily usable format, subject to trade-secret and legal limitations.
• Opt-out. You can stop using the Store at any time and revoke device permissions, as described below. Because we do not sell or share personal information or use it for targeted advertising, there is no such opt-out to exercise.
• Non-discrimination. We will not discriminate against you for exercising your privacy rights.
• Appeal. Where provided by your state’s law, you may appeal our decision on your request.

‍

How to stop using the Store and delete your data on the device:

• To remove the Store from your device: go to Settings → Apps, tap the Store — you can recognize it by its icon, whatever name it is shown under, and tap “Uninstall.” You can also press and hold the app’s icon on your home screen or in your app list, tap “App info”, and tap “Uninstall”.
• To reset or delete your Advertising ID and limit ad personalization: Android Settings → Google → Ads.
• To revoke individual permissions (such as package usage stats) or turn off notifications: use your device settings (long-press a notification → “Turn off notifications”).
• If you are an EEA or UK resident, you have additional rights - please read the Supplemental Terms in the ANNEX.

Exercising your choices and rights

We give you choices about how we use and share personal information and will respect your choices. You can stop using the Store at any time; thereafter, we will stop collecting personal information related to you, although we may continue to store or use certain information as described above.

If you want us to delete personal information related to you, or you wish to receive a copy, you can follow the following easy steps:

Your device Advertising ID is shared with Mobile Measurement Platforms for install attribution, and the simplest way to limit its use is to reset or delete it. Once you reset or delete the identifier, the previously collected Advertising ID can no longer be linked back to you or your device. We will not process your pseudonymized (hashed) Advertising ID for more than 30 days from collection. Other data we hold is retained as described under “How long do we retain personal information”. You can reset or delete your device Advertising ID from the Android Settings menu > Google > Ads

If you prefer, you can also email us at  appagent_privacy@digitalturbine.com with a request to delete or access your personal information. Only you or a person authorized to act on your behalf may make a request. Your request must provide sufficient information to allow us to reasonably verify your identity (or authority) and describe your request with enough detail for us to evaluate and respond. We will only use the information provided to verify your identity. If we cannot verify your identity or authority, we may be unable to respond.

We will do our best to respond within 45 days of receipt (or as otherwise mandated by applicable law). If we require more time (up to an additional 45 days), we will inform you of the reason and extension in writing. Any disclosures we provide will cover the 12-month period preceding receipt of your request. We do not charge a fee unless the request is excessive, repetitive, or manifestly unfounded, in which case we will inform you first. We will not require you to create an account to exercise your rights and will not discriminate against you for doing so.

After receiving our reply, you may appeal our decision by contacting us. We will respond to your appeal within the period required by applicable law and, where available, provide a link to submit a complaint with the relevant Attorney General under applicable US State privacy laws.

Transfer of personal information outside your territory

We store and process information, including personal information, in the United States, the EU, and Asia, directly or using processors and sub-processors such as cloud hosting providers. We ensure our third-party service providers make adequate confidentiality and security commitments and take steps reasonably necessary to ensure your personal information is treated securely and in accordance with this Policy.

Aggregated and analytical information

We use anonymous, statistical, or aggregated information and may share it with our partners for legitimate business purposes. This has no effect on your privacy because there is no reasonable way to associate the aggregated information specifically with you.

Information security

We are committed to ensuring the security of personal information. We and our hosting services implement systems, applications, and procedures - including hashing, salting, masking, and truncation of identifiers, access controls, and secure cloud storage - to secure personal information and minimize the risks of theft, damage, loss, or unauthorized access or use. These measures provide sound industry-standard security. However, no security system is impenetrable, and we cannot guarantee that the Store will be immune from misuse.

Dispute resolution

We periodically assess our data processing and privacy practices to ensure compliance with this Policy and update it when necessary. If you have any concerns about how we process personal information, please contact our privacy team at appagent_privacy@digitalturbine.com or write to us. We will look into your query and make good-faith efforts to resolve any existing or potential dispute.

Changes to this Policy

We may update this Policy from time to time. Minor changes will take effect 14 days after we post a notice through the Store; substantial changes will take effect 30 days after we post the notice. Until a new policy takes effect, if it materially reduces the protection of your privacy, you can choose to opt out of the Store. If we need to adapt the Policy to legal requirements, the new policy will become effective immediately or as required by law.

Contact us

Please contact us at appagent_privacy@digitalturbine.com or write to DT One App Store Inc. for further information.

ANNEX - Supplemental Terms for Processing Personal Data Under the GDPR and UK GDPR

We describe our privacy practices and the Store in our Notice at Collection and Privacy Policy above (the “General Policy”). Please take the time to read it. These terms supplement, and are not a substitute for, our General Policy. They add terms specifically related to our processing of personal data under the EU General Data Protection Regulation (“GDPR”) and the UK GDPR. You should read both documents to understand the full scope of our practices. If there are overlapping provisions, these supplemental terms prevail for our processing under the GDPR and UK GDPR.

These terms use defined terms under the GDPR/UK GDPR, such as “personal data,” “processing,” “consent,” “data controller,” and “lawful grounds of processing.” If you are not familiar with these terms, please contact our privacy team at appagent_privacy@digitalturbine.com.

Lawful grounds of processing

We process personal data related to you as a data controller when you use the Store based on the following lawful grounds:

• Performance of a contract (Art. 6(1)(b)). We process the personal data necessary to perform our contract with you: to present you with apps that will run on your device, are available where you are and can be shown in a language you read; to decide the order in which those apps are shown to you, using your activity in the current session; to show you promoted apps, drawn from those available to you and shown in a separate section labelled as promoted or sponsored apps; to install the app you select when you tap “Install”; to measure and report that install so that we can invoice the developer, which is how we are able to provide the Store to you free of charge; and to handle a support request you make to us about the Store.
• Compliance with legal obligations and protection of vital interests (Art 6 (1) (c)). To comply with our legal obligations and, where necessary, to protect your or others’ vital interests.
• Legitimate interests (Art. 6(1)(f)), where not overridden by your rights and freedoms. We rely on legitimate interests for the following purposes: to protect the Store, networks and systems, including detecting and stopping attacks on the Store; to detect, prevent and handle specific types of fraud and misuse, namely fake or automated installs and false attribution of installs, abuse of promotions or offers, distribution of malicious or policy-violating apps and manipulation of app listings such as fake reviews and ratings, and automated abuse of the store such as bot traffic and scraping; to handle contacts from people we have no contract with, and to keep a record of a support contact after it closes; to debug, maintain and improve the operational performance of the Store, including reviewing support contacts in aggregate to identify error patterns; and to enforce our terms and legal agreements, to recover sums owed to us, and to establish, exercise or defend legal claims. You can object to any of these at any time; we will consider your objection and will stop unless we have compelling legitimate grounds to continue or we need the data to establish, exercise or defend legal claims. 

Your rights under the GDPR and UK GDPR

In addition to the rights described in our General Policy, you have the rights to access personal data we hold about you and receive further information as described under the GDPR/UK GDPR; have inaccurate or incomplete data corrected; request erasure or restriction of processing; object to processing based on our legitimate interests; and data portability. You also have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (we do not carry out such processing through the Store).

We share your device Advertising ID in pseudonymized (hashed) form with mobile measurement partners when you tap an app and when you install one, so that the install can be attributed to the app’s developer and invoiced. Outside the EEA and the UK it is also sent when an app is shown to you (an impression); in the EEA and the UK it is not. Once you reset or delete your device Advertising ID, the previously collected Advertising ID can no longer be linked back to  your device. We will not process your pseudonymized (hashed) Advertising ID for more than 30 days from collection. Other data we hold is retained as described under “How long do we retain personal information”. You can reset or delete your device Advertising ID from the Android Settings menu > Google > Ads

If you prefer, you can also email us at  appagent_privacy@digitalturbine.com with a request to delete or access your personal information. When you send us a request, we will need to reasonably authenticate your identity and location and may ask further questions to understand the nature and scope of your request. You have the right to lodge a complaint with a data protection supervisory authority in your country of habitual residence, your place of work, or the place of an alleged infringement (in the UK, the Information Commissioner’s Office).

Our DPO and representatives

Data Protection Officer (DPO): appagent_privacy@digitalturbine.com

EEA representative (GDPR Art. 27): art-27-rep-digitalturbine@rickert.law 

UK representative (UK GDPR Art. 27): art-27-rep-digitalturbine@rickert.law

Transfer of personal data outside the EEA and the UK

We store and process personal data in the United States, the EU, and Asia. Where we transfer personal data outside the EEA or the UK to countries not recognized as providing adequate protection, we use appropriate safeguards - in particular the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum - or another lawful transfer mechanism. You may contact our privacy team to receive more information about our data transfer practices and to request a copy of the relevant safeguards.

U.S. Data Privacy Framework. The entity controlling the Store is a certified DT entity under the EU-US Data Privacy Framework (“EU-US DPF”), the UK Extension to the EU-US DPF (“UK Extension”), and the Swiss-US Data Privacy Framework (“Swiss-US DPF”), as set forth by the US Department of Commerce. 

You can review our Data Privacy Framework registration at: https://www.dataprivacyframework.gov/s/participant-search.

We have certified to the US Department of Commerce that we adhere to the EU-US Data Privacy Framework Principles (“EU-US DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-US DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-US DPF.

We have certified to the US Department of Commerce that we adhere to the Swiss-US Data Privacy Framework Principles (“Swiss-US DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-US DPF.

If there is any conflict between the terms in this notice or our policy with the EU-US DPF Principles (including the UK Extension) or the Swiss-US DPF Principles, the Principles will govern. To learn more about the Data Privacy Framework (“DPF”) program, visit the data privacy framework website here.

In accordance with the EU-US DPF, we commit to resolve DPF Principles-related complaints about our collection and use of personal data related to you. If you have any inquiries or complaints about our handling of personal data received in reliance on the EU-US DPF, the UK Extension to the EU-US DPF, and the Swiss-US DPF (as applicable), please contact us at: privacy@digitalturbine.com. We will do our best to respond to your inquiry as soon as we can.

In accordance with the EU-US DPF, the UK Extension to the EU-US DPF, and the Swiss-US DPF, we commit to cooperate (respectively) with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA), and the Swiss Federal Data Protection and Information Commissioner (FDPIC), as applicable, with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-US DPF, the UK Extension to the EU-US DPF, and the Swiss-US DPF.

You may also decide to invoke the arbitration option under the DPF, under certain conditions detailed here.

We share personal data with third parties to perform services on our behalf.

When we share personal data received under the Data Privacy Framework with a third party, the third party’s access to, and use and disclosure of such personal data, must also comply with our obligations under the Data Privacy Framework. We will remain liable under the Data Privacy Framework for any failure to do so by such a third party, unless we can demonstrate that we are not responsible for the event giving rise to the damage.

We are subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

Note that, as detailed above, we may be required to disclose personal data related to you in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

We already adhere to the required commitments under the UK Extension to the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. We will rely on the UK Extension and the Swiss-US Data Privacy framework for applicable data transfers as of the date that they take effect.

‍