1. Who We Are
Data Controller: Stanisław Pawluczuk, operating as a sole proprietorship (Jednoosobowa Działalność Gospodarcza) under Polish law.
Address: ul. Świeradowska 47, 02-662 Warszawa, Poland
Business Registration: NIP 1231476789 · REGON 387249521
Contact: hello@ostoya.games
This policy applies to KOŁO on every supported platform and version distributed by us. References to a platform service apply only where that service is actually included and available. KOŁO is available on Apple iOS and on Android through Google Play; the same canonical documents govern both, without treating Apple-only services as cross-platform or Google-only services as applying on iOS.
2. Information Stored on Your Device
KOŁO stores limited information locally so the game and its settings can work. Depending on the platform and release, this may include:
- best score and completed-run information;
- sound, haptic or vibration, accessibility and gameplay preferences;
- first-run and onboarding state;
- a versioned record showing acceptance of the Terms of Service and acknowledgement of this Privacy Policy;
- the derived age band and the source of that band;
- consent and privacy-choice state needed to respect the player’s decisions;
- a local cache showing whether Remove Ads is currently recognised, while the applicable Platform Store remains authoritative.
Ordinary gameplay progress is not uploaded to a KOŁO account because KOŁO has no game account or cross-platform cloud profile. Local storage technology may differ between iOS and Android, but the purpose is the same.
3. Age Information and Protected Mode
KOŁO uses a neutral age selector before play. No adult age is preselected. The exact age selected is used in memory only to determine an age band and is not retained. KOŁO stores only the resulting band — Under 13, 13–15, 16–17 or 18+ — together with the source of that band.
Players aged four or younger cannot continue. Players under 18 enter a protected mode in which KOŁO does not initialise Google Mobile Ads, Google User Messaging Platform, Firebase Analytics, Firebase Crashlytics or an advertising-tracking permission flow; does not request an advertising identifier; and does not show advertising or market Remove Ads.
An 18+ age band establishes eligibility only. It is not consent. Adult advertising, Analytics and tracking-related features remain subject to the applicable privacy choices and platform permissions.
On a platform that supplies a privacy-preserving declared-age-range service, KOŁO may use that result as an additional or preferred source. KOŁO does not request an exact date of birth, government identification, school information or payment information for age screening.
4. Purchases and Platform Store Information
Where offered to an eligible adult, Remove Ads is a one-time digital entitlement:
- on Apple platforms, a non-consumable In-App Purchase through the Apple App Store and StoreKit;
- on Android, distributed through Google Play, a non-consumable one-time product through Google Play Billing.
Remove Ads disables all third-party advertising displayed inside KOŁO on the platform where the entitlement was purchased. It does not remove Platform Store content, legal notices, support information or advertising on external websites.
To display, complete, verify, restore and maintain the purchase, KOŁO may process limited store information supplied by the applicable Platform Store, such as:
- platform and product identifier;
- purchase state, including pending, purchased, cancelled, failed, refunded or revoked status;
- transaction identifiers on Apple platforms, or purchase tokens and order identifiers where supplied by Google Play;
- purchase date, verification or acknowledgement status, storefront and current entitlement status;
- test or production environment where needed for correct processing.
Apple or Google processes the payment method and store account. KOŁO does not receive the full card number, bank credentials, Apple Account password or Google Account password.
Because KOŁO has no cross-platform game account, Apple and Google Play entitlements are separate. A purchase restores only within the ecosystem in which it was made unless a future cross-platform entitlement service is expressly introduced and disclosed.
5. Advertising, Consent, Analytics and Tracking
In a release where monetisation is enabled, KOŁO uses or may use the following named Google services:
- Google Mobile Ads SDK (AdMob) to request and display advertising;
- Google User Messaging Platform (UMP) to obtain and manage consent and privacy choices where required;
- Google Analytics for Firebase for limited product analytics after an eligible adult’s applicable consent choices permit collection;
- Firebase Crashlytics for crash and diagnostic information after the same eligible adult’s applicable consent choices permit collection.
These services do not operate in a version where they are not included or enabled. The initial advertising design is adult-only AdMob interstitial advertising, without mediation, banners, rewarded ads or app-open ads. Interstitials are limited to natural breaks after a completed run: none during the first five completed lifetime runs, then only after at least five additional completed runs and at least five minutes since the previous ad, with no more than three shown in one session. An unloaded ad is skipped rather than shown late.
KOŁO’s initial AdMob request configuration is intended to use a maximum ad-content rating of G. Advertising must not appear during active gameplay, at launch, over legal, age, consent, tracking or purchase interfaces, or in a way designed to cause accidental taps.
Age and consent controls
- Before the age band is known: no AdMob, UMP, Firebase Analytics, Firebase Crashlytics, ATT request or advertising identifier access.
- Under 18: no ads, no advertising Analytics, no UMP flow and no cross-app tracking.
- 18+: UMP may collect and store the privacy choices required for the current region; ads may be requested only when the current consent status permits them.
- On Apple devices, App Tracking Transparency is requested only if KOŁO intends to access IDFA or perform tracking as Apple defines it. Refusal does not block gameplay and must not be treated as consent.
- On Android, the same advertising-identifier and consent controls apply through Google AdMob and Google User Messaging Platform (UMP).
Where UMP requires an entry point, KOŁO provides an in-app Ad Choices control so an eligible adult can revisit the available choices.
Information the providers may process
Depending on configuration and consent, Google Mobile Ads may process an IP address used to estimate general location, non-user-related crash logs, performance information, device or app identifiers, advertising data and interactions with the app or ads. IDFA may be available on Apple only after the required ATT permission.
Firebase Analytics may process app-instance and device information, operating-system information, general location derived from an IP address, permitted app events, product interactions and diagnostics. KOŁO does not intentionally send Firebase an exact age, birthdate, name, email address, StoreKit transaction identifier, purchase token, exact score history or free-form support text. Analytics collection starts disabled and is never enabled for a protected under-18 user.
Firebase Crashlytics, provided by Google/Firebase, follows the identical default-off, adult-and-consent-gated policy as Firebase Analytics above: it remains off for every user under 18, for unknown age, and until the applicable consent is granted. When active, Crashlytics may process crash reports and stack traces; app version and build; device model and operating-system information; app/process and diagnostic state; the Crashlytics Installation UUID; the Firebase installation ID; and a small set of explicitly permitted coarse custom keys (for example whether Analytics is currently enabled, the current privacy-flow phase, and whether Remove Ads is owned — never free-form text) — to help identify and fix defects. KOŁO does not intentionally send Crashlytics your exact age or birthdate, name or email, a KOŁO account identifier (KOŁO has no user account), your exact gameplay score, a StoreKit transaction identifier or free-form user content.
KOŁO does not sell personal information. Personalised or cross-app behavioural advertising is not shown without the permissions and consent required by applicable law and the platform. Users can report inappropriate or age-inappropriate advertising through Support in Settings or the support page.
6. Information You Provide to Support or an Ad Report
If you contact support or report an advertisement, we receive your email address, message and any screenshot, recording, device details, platform, approximate time, purchase information or other material you choose to send.
An ad report may include why the ad was inappropriate or age-inappropriate and where it appeared. You are not required to provide an advertising identifier, and you should not tap an ad merely to obtain information for a report.
Please provide only what is needed to resolve the request. Never send payment-card details, an Apple Account or Google Account password, government identification, an exact date of birth or information about another person without permission.
7. Website and GitHub Pages Hosting
These support and legal pages are static and govern KOŁO across supported platforms. They do not include advertising pixels, third-party analytics, fingerprinting scripts or marketing cookies.
The pages are hosted through GitHub Pages. GitHub may process technical information required to deliver and secure the service, including IP address, browser information, requested page, request time and security logs, under GitHub’s own terms and privacy statement.
External links, including Apple, Google and refund-support pages, are governed by the external provider’s terms.
8. How We Use Information
| Purpose | Information | Legal basis where GDPR applies |
|---|---|---|
| Operate the game and remember choices | Local score, settings, age band and compliance data | Performance of the user agreement and legitimate interests |
| Apply protected-mode rules | Derived age band and source | Legal obligations, protection of minors and legitimate interests |
| Manage privacy choices | UMP consent state and, on Apple where applicable, ATT status | Consent, legal obligations and legitimate interests in recording choices |
| Serve ads to eligible adults | AdMob request, device, advertising, interaction and diagnostic information | Consent where required; legitimate interests only for limited delivery, security and fraud prevention where permitted |
| Understand product use | Limited Firebase Analytics events and diagnostics for consenting eligible adults | Consent where required |
| Offer, deliver and restore Remove Ads | Platform-store product, transaction and entitlement information | Performance of the purchase agreement, legal obligation and legitimate interests |
| Respond to support or ad reports | Email and information you provide | Performance of the user agreement and legitimate interests |
| Prevent fraud and protect legal rights | Relevant store, support, advertising and technical records | Legal obligation and legitimate interests |
10. Retention and Deletion
- Local game and compliance data: remains on the device until removed through app or device controls, cleared with app data or deleted with the app, subject to operating-system behaviour and backups.
- Age information: the exact selected age is not retained; the derived band and source remain until changed or local data is removed.
- Consent state: may remain locally or through UMP as needed to honour the choice until it is changed, reset or no longer required.
- Firebase Analytics: where enabled for a consenting eligible adult, event data is retained according to the project’s configured retention controls and Google’s service terms. KOŁO uses data minimisation and reviews the setting before release.
- Firebase Crashlytics: where enabled for a consenting eligible adult, crash and diagnostic data is retained according to Google’s Crashlytics service terms. KOŁO does not enable BigQuery export or any extended retention beyond Firebase’s own defaults.
- Advertising and diagnostics: Google may retain information according to the applicable AdMob, fraud-prevention and privacy terms.
- Local entitlement cache: remains only as needed to reflect Remove Ads and can be rebuilt from the applicable Platform Store.
- Store transaction records: are controlled by Apple or Google under their own retention rules and may remain available so a valid non-consumable purchase can be verified or restored.
- Support and ad-report correspondence: is normally retained for up to two years after resolution, unless a longer period is required for security, accounting, legal or dispute purposes.
- Website hosting logs: are retained by GitHub according to GitHub’s own policies and operational requirements.
- Legal and accounting records: are retained for the period required by applicable law.
KOŁO has no user account to delete. We normally cannot access or restore local gameplay data remotely. Deleting KOŁO does not delete transaction, consent or advertising records controlled independently by Apple, Google or another provider.
11. Your Privacy Rights
Depending on your location and applicable law, you may have rights of access, correction, deletion, restriction, objection and portability, and the right to withdraw consent where processing relies on consent.
Eligible adults can revisit Google consent choices through Ad Choices when the entry point is required. On Apple devices, tracking permission can also be changed through iOS Settings. Withdrawing consent does not affect processing already carried out lawfully before withdrawal and may result in non-personalised advertising or no advertising, depending on the active configuration.
Send a request to hello@ostoya.games. We may need enough information to verify the request and locate relevant support or transaction-related correspondence. You may also complain to the competent data-protection authority; in Poland, this is the President of the Personal Data Protection Office (UODO).
12. Security and International Processing
We apply data minimisation, HTTPS, local storage for ordinary game progress and reasonable technical and organisational safeguards. No storage or transmission method can be guaranteed completely secure.
Apple, Google, GitHub and email infrastructure may process information outside your country, including outside the European Economic Area. Where GDPR applies, transfers rely on the mechanisms described by the relevant provider and applicable law, such as adequacy decisions or contractual safeguards. We do not promise a server location that the provider does not guarantee.
13. Changes to This Policy
We may update this Privacy Policy when KOŁO, its SDK inventory, advertising configuration, purchase functionality, supported platforms, hosting or applicable law changes. Material changes may require a new in-app acknowledgement.
Before each release, the public policy, embedded in-app text, SDK inventory, Apple App Privacy answers and Google Play Data safety answers must be checked against the shipping binary.
14. Contact
Privacy or advertising question?
Contact the data controller directly.