Privacy Policy

The controller of the personal data described here is:

We are not required to appoint a Data Protection Officer and have not appointed one; privacy questions go to the address above and are answered by us directly.

This policy applies to the Kumiko mobile application (Android package and iOS bundle identifier cz.l5l3.kumiko) distributed through Google Play and the Apple App Store, in every version and on every platform.

It does not cover our other applications, or the stores this app can link out to — those have their own policies.

Kumiko keeps everything you build up while playing in the app's own private storage area on your phone or tablet. This includes:

• Puzzle progress — which nodes on each of the four campaign maps you have completed, and your saved position on an unfinished board.
• Economy — your Sakura balance, your seals and when the next one is due, and how many rewarded ads you have watched in the current window.
• Streak and daily challenge — the current day streak, which day you last played, and the history of completed daily challenges.
• Settings — sound, music, vibration, notification and statistics preferences, plus flags recording which how-to tours you have already seen.
• Reminder scheduling data — see §7.
• Region check — the country code your device reports, read from your SIM or mobile network (on iOS, from your region setting), so the app knows whether advertising may lawfully be offered at all. It is used on the device, in that moment, and is never sent to us.

None of this is sent to us. It is not associated with any identity, because there is no identity to associate it with. It is deleted when you uninstall the app or clear its data from your device settings.

One caveat outside our control: if your device's own backup service is enabled (Android Backup, or iCloud Backup), the operating system may include the app's files in that backup. That copy is governed by Google's or Apple's policy, not ours, and we cannot read it.

What it is for

We measure how the puzzles play, so we can tune difficulty and the in-game economy. It answers questions like “is Hard KenKen finished as often as Hard Kakuro” — never “what is this person doing”.

What we use

Google Analytics for Firebase, provided by Google Ireland Limited and Google LLC, acting as our processor.

What is recorded

Eight events, and nothing else that we send ourselves:

Google's SDK additionally records a small set of standard app events: first open, session start, engagement time, app update, app removal and OS update.

What it is tied to

A randomly generated app-instance identifier created by the SDK, together with your device model, operating system version, app version and language, and a coarse country or region that Google derives from your IP address. It is not tied to your name, email, phone number or advertising ID, and we have disabled ad-personalisation signals in the analytics SDK, so this data is never used to build advertising audiences.

How to switch it off

Measurement starts with the app, so the first launch is already counted. Settings → About → Privacy → “Anonymous statistics” turns it off: the app stops building events and the Firebase SDK stops collecting its own — both halves. It takes effect immediately, applies everywhere, and stays where you leave it.

The switch governs statistics alone. It is deliberately separate from the advertising consent screen in §5, so that answering one never quietly answers the other.

How long it is kept

Event data is retained in Google Analytics for 14 months, after which only aggregated reports remain.

Kumiko is free, and advertising is how it pays for itself. Advertising in Kumiko is always rewarded and optional: an ad appears only when you choose to watch one in exchange for seals or a hint. There are no interstitials interrupting a puzzle and no banner on the board.

What Appodeal and its networks receive

The advertising SDK communicates directly with its own servers and those of the bidding networks. Between them they receive:

• your device's resettable advertising identifier (the Android Advertising ID, or Apple's IDFA where you have permitted tracking);
• your IP address, and a coarse location — usually country or city — derived from it;
• device and software information: model, operating system version, screen size, language, network type, app version;
• interaction with the ad itself: that it was requested, shown, completed, skipped or clicked;
• signals used to detect invalid traffic and ad fraud.

This data reaches them directly. It does not pass through us, and we never receive it: we see only aggregate earnings reports.

Personalised advertising and your consent

Ads are served non-personalised by default. Personalised (interest-based) advertising is used only where you have consented to it:

• In the EEA, the UK and Switzerland, Appodeal's consent screen (an IAB Transparency & Consent Framework dialog) appears when you first reach the home screen, before any ad is requested and never on a loading frame. It lists the purposes and the individual vendors, and it is where you accept or refuse. If you refuse, ads still work; they are simply untargeted, and nothing about the game changes. Consent is re-requested by the SDK when it grows stale, which the framework sets at 13 months.
• On iOS, personalised advertising additionally requires you to allow tracking in Apple's App Tracking Transparency prompt. If you decline, the IDFA is not available to any party.

Withdrawing consent

Where the consent screen applies, Settings carries a Privacy options entry that reopens it, so refusing later is exactly as easy as accepting was. This is the primary route; the device-level controls below work in addition to it, not instead of it.

Device-level controls

You can limit ad tracking regardless of what you told the app:

• Android: Settings → Privacy → Ads → Delete advertising ID (or Reset).
• iOS: Settings → Privacy & Security → Tracking, and Apple Advertising.

Declining consent or deleting your advertising ID does not remove ads — it makes them less relevant, and it reduces what partners can learn about you.

Kumiko currently sells nothing for real money. Seals and hints are bought with Sakura, the in-game currency, which is earned by playing or by watching a rewarded ad.

If paid purchases (for example an ad-free option, or a Sakura pack) are added later, they are processed entirely by Google Play or the Apple App Store. Your payment card, billing address and store account details go to them, never to us — we receive only a confirmation that a purchase succeeded, and the entitlement it unlocks is stored on your device. This policy will be updated before any such purchase is offered.

If you enable daily reminders, they are generated entirely on your device. There is no push service, no notification token and no server involved — the app schedules a local alarm with the operating system, and the text is composed on the device.

To pick a sensible hour, the app notes on the device the times of day you tend to play, and your device's time zone name. That observation stays on the device and is deleted with the app.

Reminders can be switched off in Settings, or in your operating system's notification settings for Kumiko.

The More games screen opens listings for our other apps in Google Play or the App Store. Following such a link hands you over to Google or Apple, whose own policies then apply. We receive no personal data from the tap, and no identifier is passed along with it.

Where the GDPR applies, we rely on the following bases:

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

• Google Ireland Limited / Google LLC — as our processor for analytics.
• Appodeal, and the ad networks whose bids it mediates — as independent controllers, as described in §5. The vendors are listed individually in the consent screen.
• Google Play and Apple — as the stores that distribute the app and would process any future purchase.

That is the entire list. We do not sell personal data, we do not share it with data brokers, and we run no marketing of our own on it. We disclose data only where the law compels us to.

Google, Appodeal and the ad networks Appodeal mediates process data on servers inside and outside the European Economic Area, including in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, where the recipient is certified, on the EU–US Data Privacy Framework. Copies of the relevant safeguards can be requested from privacy@l5l3.cz.

If you are in the EEA, the UK or Switzerland, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time.

To exercise any of them, write to privacy@l5l3.cz. We answer within one month.

One honest limitation: the statistics we receive carry no identifier we can trace back to a person, and we hold nothing else about you. In most cases we will therefore be genuinely unable to find “your” records in order to hand them over or delete them individually (Art. 11 GDPR). If your goal is to remove everything, the reliable route is immediate and in your own hands: turn off Anonymous statistics, delete your advertising ID in your device settings, and uninstall the app.

If you believe we have handled your data wrongly, you may complain to your local supervisory authority. Ours is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic — uoou.gov.cz.

We do not sell personal information, and we do not share it for cross-context behavioural advertising unless you have consented to personalised ads; withdrawing that consent, or deleting your advertising ID in your device settings, stops it.

Residents of California and of other US states with comparable laws may request access to, correction of, or deletion of personal information, and may opt out of its sale or sharing, by writing to privacy@l5l3.cz. We will not discriminate against you for exercising these rights. The limitation described in §13 applies equally here: we usually hold nothing that can be linked to you individually.

Kumiko is not directed to children under 13 (or under the higher age set by local law, such as 16 in some EU member states), and it is not part of Google Play's Families programme.

We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, write to privacy@l5l3.cz and we will delete whatever we can identify.

Data on your device is stored in the application's private storage area, which other applications cannot read. Everything the app sends — analytics events and ad requests — travels over encrypted HTTPS connections managed by the respective SDKs. We operate no server of our own holding player data, which removes an entire category of risk. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We update this policy when the app changes — most likely when an advertising partner is added, or if purchases are introduced. The “last updated” date at the top always reflects the current version, and material changes are announced inside the app before they take effect.