Privacy Policy

Last updated: 7 October 2026

1. Introduction and Scope

This Privacy Policy describes how Aditis Innosolutions Pvt Ltd ("Aditis", "the Company", "we", "us" or "our") collects, uses, stores, shares and protects information about you when you access or use the zen2play website at zen2play.com, its sign-in pages at id.zen2play.com and the advertisements served on it (collectively, the "Platform"), and the online board and puzzle games made available through the Platform, including Lucky Moves®, T3rminator® Chess and a2Towers puzzles (the "Services").

zen2play is a free-to-play online social gaming Platform. The Company does not charge any fee, does not sell anything on the Platform, and never asks for, accepts or holds money from Users. Accordingly, the Company does not collect payment, bank or card information of any kind. Your privacy is important to us, and we have designed the Services to collect only what they need and to protect your information from unauthorised disclosure.

This Privacy Policy is published in accordance with: (i) the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), which are being brought into force in a phased manner; (ii) the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"); and (iii) the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. The Company aligns its practices with the DPDP Rules ahead of the statutory deadlines.

This Privacy Policy should be read together with the zen2play Terms and Conditions, which are incorporated by reference. Capitalised terms not defined here have the meanings given in the Terms and Conditions. As this Privacy Policy may be updated from time to time (see Section 14), we encourage you to review this page periodically.

By creating an account on, accessing or using the Platform, you confirm that you have read and understood this Privacy Policy and that you provide your free, specific, informed, unconditional and unambiguous consent — by way of clear affirmative action — to the collection, storage, use, processing and disclosure of your personal data in accordance with this Privacy Policy and applicable law, and you agree to abide by the Terms and Conditions.

You may withdraw your consent at any time, with the same ease with which it was given (see Section 11.2). Withdrawal of consent will not affect the lawfulness of processing carried out before such withdrawal, and the Company will not be able to continue providing the Services to you.

For certain legitimate uses permitted under the DPDP Act (including complying with legal obligations), the Company may process your personal data without your express consent, in the manner permitted by law.

3. Information We Collect

We collect only the information needed to run your account and your games, keep the Platform secure and fair, and comply with the law.

3.1 Types of Information

Personal Information: information that can be used to identify you as an individual — on zen2play, your name, email address, IP address and the identifiers linked to your account.
Sensitive Personal Data or Information ("SPDI"): the categories so defined under the SPDI Rules, such as passwords and financial information (see Section 3.6).
Non-Personal Information: information that does not by itself identify you, such as your browser type, operating system and the page that referred you to the Platform.
Usage Information: information generated as you use the Platform — the pages and features you use, the date and time of each visit, and your games, ratings and records.

Personal Information, SPDI, Non-Personal Information and Usage Information are together referred to as "Information".

3.2 Information You Provide to Us

Account data: your email address and name when you create an account.
Password: if you sign up with an email address and password (see Section 3.6).
Support and feedback data: the messages you send to us, including bug reports and grievances, and your email address so that we can reply.

3.3 Information Generated as You Play

Handle: the public name shown on the board. The Platform assigns one derived from your account number (for example p_1a2b3c4d5e6f); it contains no personal information.
Game records: the moves, the dice rolls where a game has them, results, clocks, time controls, the start and end times of each game, and your opponent — another User, or Zen, the Platform's computer opponent.
Ratings and records: your rating and your number of games, wins, draws and losses in each game, kept separately for games against people and against Zen.
Live game state: while a game is in progress it is held on the Company's servers so that both players see the same position and the clocks are applied fairly.

Your actions in a game against another User — your moves, your result and your handle — are visible to that User and, once the game is finished, form part of both players' game histories.

3.4 Information Collected Automatically

Sign-in records: each time you sign in, the date and time, your Internet Protocol (IP) address, your device type (for example mobile or desktop), your browser details (user agent) and the sign-in method used.
Technical logs: for each request to the Platform, the IP address, the page or feature requested, the referring page, the date and time, the browser and operating system (as reported by your browser) and the response status.
Abuse-prevention data: counts of requests per IP address and per account, used to limit abuse, and the result of automated bot checks on the sign-in pages, used to tell people from automated bots.
Sign-up location: when you create your account, the approximate location of the IP address you sign up from — the country, state or region, city and nearest postal (PIN) code area — as estimated by our network service provider. It is recorded once, is not updated when you sign in later and is not shown on the Platform. It is an estimate of an area, not your address or your precise location. We use it to understand, in aggregate, where our players come from and to help protect the Platform against misuse; it is never used to refuse an account or to choose the advertisements you see.
Cookies and browser storage: see Section 6.

3.5 Information Received from Third Parties

Google: if you choose "Sign in with Google", the name, email address and profile picture link that Google shares with us in accordance with the permissions you approve. The Company never receives your Google password.

The Company does not gather information about you from any other source, such as social networks, public websites, news or blogs, or other Users.

3.6 Sensitive Personal Data or Information

The only SPDI the Platform handles is your password, if you sign up with one. It is stored only as a one-way cryptographic hash by our authentication provider; the Company never sees it or stores it in readable form. The Company does not collect financial information of any kind — no bank account, card or UPI details — because nothing on zen2play is ever paid for.

3.7 Information We Do Not Collect

The Company does not collect government identifiers, your postal address or phone number, precise (GPS-level) location, your contacts or address book, or access to your camera or microphone, and does not use third-party analytics or advertising trackers. We do not knowingly collect biometric, health, sexual-orientation or political-belief data, and you should not submit such information to us.

4. How We Use Your Information

We use the information described in Section 3 for the following purposes:

Provide and operate the Services: to create and authenticate your account, keep you signed in, pair you with other players, run game clocks and move timers, apply each game's rules, record results, calculate ratings and show your game history.
Protect fair play and the Platform: to detect, investigate and prevent cheating, the use of multiple accounts, arranged results, abuse and security incidents, and to enforce the Terms and Conditions.
Communicate with you: to send service and security emails, such as email confirmation, password resets and notices of material changes, and to respond to your queries and grievances. The Company does not send marketing emails, SMS or push notifications.
Improve the Platform: to operate, troubleshoot and improve the Services using aggregated statistics (for example, the number of games played), not individual profiles.
Comply with law: to meet legal obligations and respond to lawful requests from courts, regulators and law enforcement authorities.

We do not sell or rent your personal data to anyone, and we do not use it to build advertising profiles.

4A. Advertising on zen2play

The Platform is free to use because certain pages display advertisements. Advertising revenue supports the operation of the Platform: running and maintaining it, enhancing and promoting it, and delivering the Services to Users efficiently, so that zen2play can become the go-to platform for social games, traditional games and innovative new games — at no cost to its Users.

Advertising on zen2play is contextual only: an advertisement is selected by the page and the game beside which it appears, and never by your profile, your game history, your account or your personal data. The Company does not use interest-based or behavioural advertising, third-party advertising networks, advertising cookies or tracking pixels.

The Company does not provide your name, email address or account to any advertiser. To deliver advertisements and count their views fairly, the Company's own advertising service processes technical information about each view — the IP address, device and browser type, an approximate location derived from the IP address (city or region level, never precise location), and which advertisement was shown and for how long. This information is not linked to your account. You never earn points or rewards for viewing or clicking advertisements. The presence of an advertisement on the Platform does not constitute an endorsement by the Company.

We do not sell your personal data. We share personal data only as described below.

5.1 With Other Users

Other Users can see your handle, your ratings and records, and the finished games you have played (moves, result and date). Your email address and the name on your account are never shown to other Users.

5.2 With Data Processors and Service Providers

We engage authorised third-party Data Processors to perform functions on our behalf, including:

Our platform and cloud service providers, for hosting, databases, authentication, secure content delivery, protection against attacks and automated bots, and data storage.
Email service providers, for account and service emails.
Google, only where you choose "Sign in with Google".
Professional advisers (legal, accounting, tax, audit and information-security advisers), under appropriate confidentiality obligations.

The providers we use may change from time to time in line with our operational and strategic requirements. Whichever providers we use, each Data Processor is engaged under a written contract that limits the use of personal data to the purposes notified by the Company and requires appropriate security safeguards, and none of them is given an independent right to use or share your personal data.

5.3 Legal, Regulatory and Safety Disclosures

We may access, preserve and disclose personal data to courts, government authorities, regulators (including the Data Protection Board of India and the Indian Computer Emergency Response Team — CERT-In) and law enforcement agencies, where required by applicable law, court order or other valid legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of the Company, our Users or others, to act on a breach of the Terms and Conditions, or to investigate fraud or respond to a security incident.

5.4 Business Transfers

In the event of a merger, acquisition, reorganisation, insolvency or sale of all or part of our business or assets, personal data may be transferred to the successor or acquirer, subject to this Privacy Policy and applicable law. We will notify you of any such transfer where required.

6. Cookies and Similar Technologies

Cookies are small text files placed on your device by a website. Session cookies are deleted when you close your browser; persistent cookies remain for a limited period and then expire on their own. The Platform uses only the cookies and browser storage it needs to work; it uses no advertising or analytics cookies. We use cookies for the following purposes:

Keeping you signed in: a securely signed sign-in token, which scripts running on the page cannot read.
Remembering your sign-in: renewing your session so that you are not asked for your password again each time you return.
Your display theme: remembering the look you have chosen for the Platform.
Security: protecting your sign-in and the Platform against misuse and automated bots.

Your browser's local storage also keeps your theme choice, game preferences and puzzle progress. This information stays on your device and is not sent to the Company; clearing your browser's site data removes it.

You can view, block or delete cookies through your browser settings. If you decline or delete these cookies, you will be signed out and will not be able to sign in or play.

7. Anonymous and Aggregated Information

We may convert personal data into anonymous or aggregated form, by removing identifiers so that the result cannot reasonably be used to identify any individual, and use it to understand how the Services are used, to improve our games and Zen, and to report statistics about the Platform. Anonymous and aggregated information is not subject to the consent and rights provisions applicable to personal data.

8. Children's Data

The Services are intended only for users aged 18 years and above, and accounts may be created only by such users. If you are under 18, please do not register or send us any information about yourself. The Company does not knowingly collect personal data of any individual under 18 years of age, and does not undertake tracking, behavioural monitoring or targeted advertising directed at children. If the Company learns that an account belongs to a person under 18, it will delete that account and its information as quickly as possible. If you believe that a child has provided personal data to us, please contact the Grievance Officer (see Section 13).

9. Data Storage, Transfer and Retention

9.1 Storage and Cross-Border Transfers

Your account data, game records and logs are stored on servers located in India. Our content-delivery and security network, which carries requests to the Platform, and our archive of finished games may process or store data outside India. Any such transfer is carried out in accordance with Section 16 of the DPDP Act and the DPDP Rules, which permit transfers to any country or territory other than those restricted by the Central Government by notification, and is subject to appropriate contractual, technical and organisational safeguards. Your personal data continues to be protected by this Privacy Policy wherever it is processed.

9.2 Retention and Erasure

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. In particular:

Account data: for as long as your account exists. When you ask us to delete your account, your account data is deleted within 30 days, except where retention is required by law.
Game records: for as long as your account exists. As each finished game is also part of your opponent's history, on deletion of your account the game is kept with your handle replaced by an anonymous label, so that nothing in it identifies you.
Sign-in records: for 30 days, after which they are deleted.
Sign-up location: for as long as your account exists; it is deleted with your account data.
Traffic and security logs: for at least one year, as required under the DPDP Rules, and thereafter deleted.
Inactive accounts: an account not used for three (3) years may be deleted, after at least 48 hours' prior notice to its email address.
Advertising view records: only for as long as needed to count views, bill advertisers and detect fraud, after which they are deleted or retained only in aggregated form.

Where your account has been suspended or terminated under the Terms and Conditions, we may retain associated information for such period as is required to enforce the Terms and Conditions or by applicable law. Upon expiry of the applicable retention period, personal data is deleted or anonymised.

10. Data Security

The Company implements reasonable security safeguards in line with the DPDP Rules, commensurate with the nature of the Platform, including:

Encryption of all data in transit using industry-standard TLS.
Passwords held only as one-way hashes by our authentication provider.
Short-lived, cryptographically signed sign-in tokens in cookies that page scripts cannot read.
Servers that are not directly reachable from the internet, network firewalls, and database access only through restricted roles.
Access to personal data limited to personnel who need it to operate the Platform, and logging of access to our systems.

Despite reasonable safeguards, no security system is impenetrable, and the Company cannot guarantee that information sent over the internet will never be intercepted in transit. You are responsible for keeping your password confidential and must notify us immediately if you become aware of any unauthorised use of your account.

In the event of a personal data breach, the Company shall, in accordance with the DPDP Rules, intimate each affected Data Principal without undue delay and notify the Data Protection Board of India within the prescribed timelines, and shall report cyber incidents to CERT-In where required by law.

11. Your Rights and Controlling Your Personal Information

11.1 Your Rights as a Data Principal

Subject to the DPDP Act and other applicable laws, you have the following rights in respect of your personal data:

Right to access: to obtain a summary of the personal data being processed about you, the processing activities undertaken and the identities of the Data Processors with whom it has been shared.
Right to correction and erasure: to have inaccurate or misleading personal data corrected, incomplete data completed, and personal data that is no longer necessary erased, including by deleting your account.
Right to withdraw consent: to withdraw, at any time, any consent previously provided to the Company.
Right to grievance redressal: to raise grievances about any act or omission of the Company in relation to your personal data (see Section 13).
Right to nominate: to nominate another individual to exercise your rights in the event of your death or incapacity.

11.2 Withdrawing Consent and Deleting Your Account

You may withdraw your consent, or ask us to delete your account, at any time by writing to [email protected] from the email address registered to your account. Once consent is withdrawn, the Company will stop processing your personal data, except what the law requires it to keep, and will close your account, as the Services cannot be provided without it. Your account data is then handled as described in Section 9.2.

11.3 Correcting Your Information

If any personal data we hold about you is inaccurate or incomplete, write to [email protected] stating what should be corrected and why. We will make the correction within a reasonable time. We may require you to verify your identity before acting on any request, and we may decline or limit a request where it would affect another person's rights or is not permitted by applicable law; in that case we will explain the reason.

12. Third-Party Links and Services

The Platform may contain links to third-party websites and services, including advertisers' websites and "Sign in with Google". When you follow such a link or use such a service, you leave the Platform, and any personal data you provide to the third party is governed by its own privacy policy and terms. The Company does not control and is not responsible for the privacy practices or content of such third parties; please review their policies before sharing any personal data with them.

13. Grievance Redressal and Contacting Us

In accordance with the DPDP Act, the Information Technology Act, 2000 and the rules made thereunder (including the Intermediary Rules), the name and contact details of the Grievance Officer designated by the Company are set out below. The Grievance Officer is responsible for addressing questions and complaints regarding this Privacy Policy, the processing of your personal data and the operation of the Services.

The Grievance Officer, zen2play
Company: Aditis Innosolutions Pvt Ltd
Email: [email protected]
Registered office: 15/4B, Periyar St, Dharmapuri, Tamil Nadu, India - 636701

Any query or complaint should include, at least: your name, the email address registered to your account, and a brief description of your query or complaint. Grievances will be acknowledged within 24 hours of receipt and resolved within 15 (fifteen) days, or such shorter period as may be required by applicable law. If you are not satisfied with the resolution provided, or if your grievance is not addressed within the prescribed period, you may approach the Data Protection Board of India established under the DPDP Act.

14. Changes to This Privacy Policy

The Company may amend or update this Privacy Policy from time to time to reflect changes in our practices, the Services or applicable law. The most current version is always available on the Platform, with the "Last updated" date shown at the top. Material changes will be notified to you through the Platform or by email before they take effect. Your continued use of the Platform after the effective date of any change constitutes your acceptance of the updated Privacy Policy.

15. Users Outside India and Governing Law

The Platform is operated from India by Aditis Innosolutions Pvt Ltd and is primarily designed for, and directed at, individuals located in India. If you choose to access or use the Platform from outside India, you do so on your own initiative and are responsible for compliance with the local laws of your jurisdiction. The Company reserves the right to limit or block access to the Platform from any jurisdiction at its discretion.

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any and all disputes, controversies or claims arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts located in the State of Tamil Nadu, India, and the parties hereby submit to such exclusive jurisdiction.

16. Additional Questions

You are welcome to write to [email protected] at any time with further questions about zen2play or this Privacy Policy. All correspondence we receive from you is treated as confidential: it is used only to respond to you and is not disclosed without your consent, except as required by law.

17. Definitions

"Anonymous Information" — information that does not directly or indirectly identify, and cannot reasonably be used to identify, an individual user.

"Data Fiduciary" — any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data, as defined under the DPDP Act.

"Data Principal" — the individual to whom personal data relates, as defined under the DPDP Act.

"Data Processor" — any person who processes personal data on behalf of a Data Fiduciary, as defined under the DPDP Act.

"Handle" — the public name under which a User appears to other Users on the Platform.

"Internet Protocol (IP) address" — a numerical label assigned to a device participating in a computer network that uses the Internet Protocol for communication.

"Personal Data" — any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act, and includes "Personal Information" as defined under the SPDI Rules.

"Sensitive Personal Data or Information" — has the meaning given under the SPDI Rules and includes passwords and financial information such as bank account or payment instrument details.

"Zen" — the Platform's computer opponent, which is always identified to Users as a bot.