1. Who We Are
Data Controller: Ostoya Interactive sp. z o.o.
Address: ul. Świeradowska 47, 02-662 Warszawa, Poland
Business Registration: KRS 0001256202 · NIP 5214174125
Contact: hello@ostoya.games
This policy applies to KOŁO on every supported platform and version distributed by us. References to a platform service apply only where that service is actually included and available. KOŁO is available on Apple iOS and on Android through Google Play; the same canonical documents govern both, without treating Apple-only services as cross-platform or Google-only services as applying on iOS.
2. Information Stored on Your Device
KOŁO stores limited information locally so the game and its settings can work. Depending on the platform and release, this may include:
- best score and completed-run information;
- sound, haptic or vibration, accessibility and gameplay preferences;
- first-run and onboarding state;
- a versioned record showing acceptance of the Terms of Service and acknowledgement of this Privacy Policy;
- your age answer (Under 16 / 16 or older / Prefer not to say) and how it was given;
- consent and privacy-choice state needed to respect the player’s decisions;
- the Share Usage Stats choice and the Music, sound and haptics settings;
- Daily reminder (optional): if you turn it on in Settings → About → Notifications, KOŁO schedules local notifications on your device at the time you pick (morning, lunch, evening or late) — at most one a day, none on a day you already played, and they stop after a week without play. There is no push server and nothing about reminders is collected;
- Share card: the score card is drawn on your device. It leaves the device only if you pick a destination in the share sheet. “Save Image” adds the card to your photo library. On iPhone, iOS asks for permission the first time. On Android 10 and later, it is saved to Pictures/KOŁO without any storage permission. “Save Image” isn’t offered on Android 9 and earlier;
- a local cache showing whether Remove Ads is currently recognised, while the applicable Platform Store remains authoritative.
Ordinary gameplay progress is not uploaded to a KOŁO account because KOŁO has no game account or cross-platform cloud profile. Local storage technology may differ between iOS and Android, but the purpose is the same.
Apple Watch. The KOŁO Apple Watch app collects no data of its own: it has no analytics, no crash reporting, no advertising and no tracking, makes no network connections, and keeps your best score and settings only on the watch. Its sounds and haptics are generated on the watch.
3. Age Information and Protected Mode
Before playing, you choose Under 16, 16 or older, or Prefer not to say. KOŁO never asks for your exact age or date of birth and stores only that answer and how it was given, on your device. Players who answered in an earlier version are asked once more. An answer of 16 or older can be changed to Under 16 or Prefer not to say in Settings → About → Age; it cannot be changed back there. Answering 16 or older is not consent by itself — consent is asked separately where the law requires it.
Under 16 and Prefer not to say get the protected experience: only non-personalised, child-directed ads with a general-audience content rating; no tracking request; no advertising identifier; no analytics or crash reporting.
On a platform that supplies a privacy-preserving declared-age-range service, KOŁO may use that result as an additional or preferred source. KOŁO does not request an exact date of birth, government identification, school information or payment information for age screening.
4. Purchases and Platform Store Information
Where offered, Remove Ads is a one-time digital entitlement:
- on Apple platforms, a non-consumable In-App Purchase through the Apple App Store and StoreKit;
- on Android, distributed through Google Play, a non-consumable one-time product through Google Play Billing.
Remove Ads disables all third-party advertising displayed inside KOŁO on the platform where the entitlement was purchased. It does not remove Platform Store content, legal notices, support information or advertising on external websites.
To display, complete, verify, restore and maintain the purchase, KOŁO may process limited store information supplied by the applicable Platform Store, such as:
- platform and product identifier;
- purchase state, including pending, purchased, cancelled, failed, refunded or revoked status;
- transaction identifiers on Apple platforms, or purchase tokens and order identifiers where supplied by Google Play;
- purchase date, verification or acknowledgement status, storefront and current entitlement status;
- test or production environment where needed for correct processing.
Apple or Google processes the payment method and store account. KOŁO does not receive the full card number, bank credentials, Apple Account password or Google Account password.
Because KOŁO has no cross-platform game account, Apple and Google Play entitlements are separate. A purchase restores only within the ecosystem in which it was made unless a future cross-platform entitlement service is expressly introduced and disclosed.
5. Advertising, Consent, Analytics and Tracking
In a release where monetisation is enabled, KOŁO uses or may use the following named Google services:
- Google Mobile Ads SDK (AdMob) to request and display advertising;
- Google User Messaging Platform (UMP) to obtain and manage consent and privacy choices where required;
- Google Analytics for Firebase for product analytics, only for players who answered 16 or older and as described under Analytics and crash reporting below;
- Firebase Crashlytics for crash reporting, on the same terms.
These services do not operate in a version where they are not included or enabled. The advertising design is AdMob interstitial advertising only, without mediation, banners, rewarded ads or app-open ads. Ads appear only between runs, after a game over — never during play and never from the Settings or Pause menu. A new player sees no ads in their first 8 completed runs and first 5 minutes of play. After that there are at least 6 runs and 4 minutes between ads, at most 4 in one session, and never right after a new best or after a run shorter than 12 seconds. Players who bought Remove Ads never see these ads. An unloaded ad is skipped rather than shown late.
KOŁO’s AdMob request configuration uses a maximum ad-content rating of G for players who answered Under 16 or Prefer not to say, and no higher than ParentalGuidance (PG) for players who answered 16 or older. Advertising must not appear during active gameplay, at launch, over legal, age, consent, tracking or purchase interfaces, or in a way designed to cause accidental taps.
Age and consent controls
- Before you answer the age question: no AdMob, UMP, Firebase Analytics, Firebase Crashlytics, ATT request or advertising identifier access.
- Under 16 or Prefer not to say: only non-personalised, child-directed ads with a general-audience content rating; no UMP consent form, no ATT request, no advertising identifier, no analytics or crash reporting and no cross-app tracking.
- 16 or older: UMP may collect and store the privacy choices required for the current region; ads may be requested only when the current consent status permits them.
- On Apple devices, App Tracking Transparency is requested only if KOŁO intends to access IDFA or perform tracking as Apple defines it. Refusal does not block gameplay and must not be treated as consent.
- On Android, the same advertising-identifier and consent controls apply through Google AdMob and Google User Messaging Platform (UMP).
Where UMP requires an entry point, KOŁO provides an in-app Privacy choices control (Settings → About) so a player can revisit the available choices.
Information the providers may process
Depending on configuration and consent, Google Mobile Ads may process an IP address used to estimate general location, non-user-related crash logs, performance information, device or app identifiers, advertising data and interactions with the app or ads. IDFA may be available on Apple only after the required ATT permission.
Analytics and crash reporting. To improve KOŁO and fix crashes, KOŁO uses Google Analytics for Firebase and Firebase Crashlytics, provided by Google. They run only for players who answered 16 or older. In the EEA, the UK and Switzerland they run only if you agree in the consent form. In Turkey they stay off until you answer YES, SHARE to a one-time “Help improve KOŁO?” question in the game (asked in the iPhone and iPad version from KOŁO 1.1.7; the Android version keeps them off in Turkey) or turn on Share Usage Stats. Elsewhere they are on by default. You can turn both off at any time in Settings → About → Share Usage Stats; turning them off also resets the analytics identifier on your device. They never run for players who answered Under 16 or Prefer not to say.
What is collected. Analytics uses an app-instance identifier — not the advertising identifier, not the identifier for vendors, and no KOŁO user ID, name or email. It records: screens viewed; runs (start and end, duration, score, how far the run got, how it ended, Perfects and new bests); milestones, settings changes and the first-run hint; use of the share card, Rate KOŁO and the reminder prompt; when the app goes to the background; Remove Ads and restore outcomes, including the store’s price, currency and purchase record; Google’s standard first-open, session and engagement events; and an approximate location derived from your IP address. Crashlytics receives crash reports and errors inside the game’s own code with their code location, plus device model, operating system and a few coarse details (the app version and build, the screen, whether a run is active, the run number, the stage of the privacy flow and of the result screen, whether you answered 16 or older, whether Analytics is on, the consent and ad-request status, whether an ad is loaded and whether Remove Ads is owned — never free-form text). Crash reports recorded while crash reporting was off are deleted from your device and never sent. KOŁO does not intentionally send Crashlytics your exact age or birthdate, name or email, a KOŁO account identifier (KOŁO has no user account), your exact gameplay score, a StoreKit transaction identifier, a purchase token or free-form user content.
What we never do with it. Analytics and crash data are used only to improve the game. We never sell them, never use them for advertising and never combine them with advertising identifiers.
Retention. Analytics data is kept for 14 months after your last activity. To ask about access or deletion, email hello@ostoya.games.
KOŁO does not sell analytics or crash data. Ads are covered by Google AdMob’s own terms, described in the Advertising section. Personalised or cross-app behavioural advertising is not shown without the permissions and consent required by applicable law and the platform. Users can report inappropriate or age-inappropriate advertising through Settings → About → Support (it opens a pre-filled email) or the support page.
6. Information You Provide to Support or an Ad Report
If you contact support or report an advertisement, we receive your email address, message and any screenshot, recording, device details, platform, approximate time, purchase information or other material you choose to send.
An ad report may include why the ad was inappropriate or age-inappropriate and where it appeared. You are not required to provide an advertising identifier, and you should not tap an ad merely to obtain information for a report.
Please provide only what is needed to resolve the request. Never send payment-card details, an Apple Account or Google Account password, government identification, an exact date of birth or information about another person without permission.
7. Website Hosting
These support and legal pages are static and govern KOŁO across supported platforms. They do not include advertising pixels, third-party analytics, fingerprinting scripts or marketing cookies.
The canonical pages are hosted at ostoya.games/kolo/ through our hosting provider, Namecheap. Namecheap may process technical information required to deliver and secure the service, including IP address, browser information, requested page, request time and security logs, under its own terms and privacy statement.
External links, including Apple, Google and refund-support pages, are governed by the external provider’s terms.
8. How We Use Information
| Purpose | Information | Legal basis where GDPR applies |
|---|---|---|
| Operate the game and remember choices | Local score, settings, age answer and compliance data | Performance of the user agreement and legitimate interests |
| Apply protected-mode rules | Age answer and how it was given | Legal obligations, protection of minors and legitimate interests |
| Manage privacy choices | UMP consent state and, on Apple where applicable, ATT status | Consent, legal obligations and legitimate interests in recording choices |
| Serve ads | AdMob request, device, advertising, interaction and diagnostic information | Consent where required; legitimate interests only for limited delivery, security and fraud prevention where permitted |
| Understand product use and fix crashes | Firebase Analytics events and Crashlytics crash reports for players who answered 16 or older | Consent where required |
| Offer, deliver and restore Remove Ads | Platform-store product, transaction and entitlement information | Performance of the purchase agreement, legal obligation and legitimate interests |
| Respond to support or ad reports | Email and information you provide | Performance of the user agreement and legitimate interests |
| Prevent fraud and protect legal rights | Relevant store, support, advertising and technical records | Legal obligation and legitimate interests |
10. Retention and Deletion
- Local game and compliance data: remains on the device until removed through app or device controls, cleared with app data or deleted with the app, subject to operating-system behaviour and backups.
- Age information: KOŁO never asks for an exact age or date of birth; your answer and how it was given remain until changed or local data is removed.
- Consent state: may remain locally or through UMP as needed to honour the choice until it is changed, reset or no longer required.
- Firebase Analytics: where enabled for a player who answered 16 or older, event data is kept for 14 months after the player’s last activity, under Google’s service terms. KOŁO uses data minimisation and reviews the setting before release.
- Firebase Crashlytics: where enabled for a player who answered 16 or older, crash and diagnostic data (crash stack traces, minidump data and the identifiers attached to them) is kept for 90 days, as stated in Firebase’s privacy documentation, before Google starts removing it from live and backup systems. KOŁO does not enable BigQuery export or any extended retention beyond Firebase’s own defaults.
- Advertising and diagnostics: Google may retain information according to the applicable AdMob, fraud-prevention and privacy terms.
- Local entitlement cache: remains only as needed to reflect Remove Ads and can be rebuilt from the applicable Platform Store.
- Store transaction records: are controlled by Apple or Google under their own retention rules and may remain available so a valid non-consumable purchase can be verified or restored.
- Support and ad-report correspondence: is normally retained for up to two years after resolution, unless a longer period is required for security, accounting, legal or dispute purposes.
- Website hosting logs: are retained by Namecheap according to its own policies and operational requirements.
- Legal and accounting records: are retained for the period required by applicable law.
KOŁO has no user account to delete. We normally cannot access or restore local gameplay data remotely. Deleting KOŁO does not delete transaction, consent or advertising records controlled independently by Apple, Google or another provider.
11. Your Privacy Rights
Depending on your location and applicable law, you may have rights of access, correction, deletion, restriction, objection and portability, and the right to withdraw consent where processing relies on consent.
Players who answered 16 or older can revisit Google consent choices through Privacy choices (Settings → About) when the entry point is required. On Apple devices, tracking permission can also be changed through iOS Settings. Withdrawing consent does not affect processing already carried out lawfully before withdrawal and may result in non-personalised advertising or no advertising, depending on the active configuration.
Send a request to hello@ostoya.games. We may need enough information to verify the request and locate relevant support or transaction-related correspondence. You may also complain to the competent data-protection authority; in Poland, this is the President of the Personal Data Protection Office (UODO).
12. Security and International Processing
We apply data minimisation, HTTPS, local storage for ordinary game progress and reasonable technical and organisational safeguards. No storage or transmission method can be guaranteed completely secure.
Apple, Google, Namecheap and email infrastructure may process information outside your country, including outside the European Economic Area. Where GDPR applies, transfers rely on the mechanisms described by the relevant provider and applicable law, such as adequacy decisions or contractual safeguards. We do not promise a server location that the provider does not guarantee.
13. Changes to This Policy
We may update this Privacy Policy when KOŁO, its SDK inventory, advertising configuration, purchase functionality, supported platforms, hosting or applicable law changes. Material changes may require a new in-app acknowledgement.
Before each release, the public policy, embedded in-app text, SDK inventory, Apple App Privacy answers and Google Play Data safety answers must be checked against the shipping binary.
14. How to Delete Your Data
- Turn off Settings → About → Share Usage Stats. This stops analytics and crash reporting and resets the analytics identifier on your device.
- Delete KOŁO to remove the data stored on your device (subject to operating-system behaviour and backups).
- Email hello@ostoya.games for anything else.
15. Contact
Privacy or advertising question?
Contact the data controller directly.