Kachiban privacy policy

1. Data controller and contact

The controller of this policy and of the app is Nettle Studios (trade name), an independent studio based in Colombia.

Because the data is processed from Colombia, Colombian Law 1581 of 2012 on personal data protection and its implementing rules apply. The prior, express and informed authorization that law requires is requested on the age and terms card the app shows the first time it opens (section 5).

For any privacy question, write to nettledoingitagain@gmail.com.

2. What the game stores on your phone

This data is stored in the app's private storage on your phone. This section says what stays only there; what leaves the phone to play online is in section 3.

Preferences and ad counters are not sent to any Nettle server. Of the rest, what is played online and your age are copied to your account, as section 3 explains.

3. Online play: your guest account and the matches

“Play” is Kachiban’s online mode: you sit at a table with other players. For that, after you answer the age question and accept the terms and this notice, the game creates an anonymous guest account with Unity Gaming Services (“UGS”), a Unity Technologies service. It does not ask for an email or a password. Until you accept, the app does not connect to Unity Gaming Services. You can play against the artificial intelligence offline.

What data leaves your phone, why and for how long

Who processes it and where

Nettle is responsible for this data. Unity Technologies, through Unity Gaming Services, processes it on Nettle’s behalf: Authentication (your anonymous ID), Cloud Code (the server that referees matches), Cloud Save (your profile, matches, blocks and reports) and Sessions (the waiting room). As far as Unity reports, these services run on servers located in the United States, outside Colombia (section 17). Unity’s privacy policy is at unity.com/legal/privacy-policy.

What other players see

• In the waiting room and in the match: your name with the tag, your avatar, your frame, your level, your rank badge (if you have one) and the cosmetics you have equipped, such as the card back.
• In the match: your moves on the board and the reactions or quick phrases you send. Your cards in hand are not shown to the others during the match.
• Your country, if you decide to show it: the flag.
• Images to share: any player at the table can share an image of the final board with the names at the table. The image is generated on the phone of whoever shares it and leaves through the system share sheet; Kachiban does not upload it. You can hide your name in other people’s images in Settings: it appears as “Player 1”, “Player 2”…
• What they do not see: your player ID, your age, your language, your estimated skill level, your blocks, your purchases or your cards.

Mute, block and report. On each player’s card you can mute, block or report them. If several people report a name as offensive, the name is hidden until Nettle reviews it.

Nettle does not sell this data.

4. Information we do not collect

• We do not ask for your real name, email, phone number, address or date of birth.
• The app does not access precise location, camera, microphone, contacts, photos or files on the phone.
• There is no free chat or voice: in a match only predefined reactions and quick phrases are sent (section 3).
• Nettle does not receive your settings, payment data or the data that AdMob collects. What is played online does reach your account (section 3).
• Crash reports do not carry your player name, your progress, your purchases or anything you type (section 10).
• Nettle does not use the advertising ID for any purpose of its own. Only Google AdMob uses it (section 9).
• This page uses no cookies, tracking scripts or analytics tools.

5. Age and privacy when you open the app

The first time you open the app, and before any ad is requested or your guest account is created, you are shown the following:

1. A single card with the age question, a slider “My age is…” that does not say what the answer is used for, and one line: “By continuing to play, you accept our terms of service, our privacy policy and ads tailored to you”, which opens the pages of the terms and of this policy.
2. By tapping “I agree”, you accept the terms and this notice. The processing needed to play is accepted together with them.
3. If you are an adult, accepting turns on personalized ads (section 9) and the measurement of how the game is used, which this version does not do yet (section 12). You can turn them off at any time in Settings → Privacy: the change applies from that moment and is kept. If you are under 18, both stay off, and personalized ads cannot be turned on (section 13).

What is stored about age. The age you enter and any date of birth are not stored. The app stores, on your phone and, to apply protected mode, also in your online account (section 3): the band (under 13, 13 to 17 or adult), the moment you were asked and, if you are a minor, the earliest date on which you could turn 18, which is calculated from your answer. The age you entered can be deduced from those dates, so we treat them as age data. When that date arrives, the app asks your age again.

Where the law requires it, Google also shows its own consent form for ads, after this notice (section 9).

6. Android permissions

The app does not ask for any permission that needs your approval on screen. Android grants at install the ones the app declares:

7. Android backup

If Google backup is turned on on your phone, Android may include the data the app stores (section 2) in it, so you can recover it when you change phones. That backup is made by the operating system, not by the app: it is stored in your Google account and Nettle has no access to it. It is governed by Google's privacy policy. You can turn it off or delete it from your phone's backup settings.

8. Google Play and purchases

The app is downloaded and updated through Google Play. Google processes the data of its own service, such as your account and downloads, under its privacy policy: policies.google.com/privacy. Google Play gives developers aggregated statistics, such as the number of installs, and the crash reports that Android sends to Google if you allowed it on your phone. That information does not let Nettle identify anyone.

In-app purchases. Gem packs and the “No ads” option are paid for through Google Play billing. Google processes the payment and your payment method data under its privacy policy; Nettle does not receive your name, email or card data. Google Play tells the app which product was bought and the transaction identifier, which the app uses to deliver the purchase only once and stores on your phone (section 2). Refunds are handled by Google Play under its rules.

To connect to Google Play billing, the app uses Unity In-App Purchasing, a component by Unity Technologies. That component may send Unity technical information about each purchase: the product, the amount and currency, the transaction identifier, the language, the phone model, the Android and app versions, and an installation identifier.

In this version, people under 18 cannot make purchases (section 13).

9. Advertising: Google AdMob

The app shows ads through Google AdMob, a service of Google LLC: video ads that you can choose to watch in exchange for a reward (for example, doubling the Coins from a match) and full-screen ads when you leave a match's results screen, with frequency caps. There are no banners and no ads during a match. To select ads, limit their frequency, measure their performance and prevent fraud, the Google Mobile Ads SDK collects the following data from the phone and sends it to Google:

Nettle does not receive this data; it only accesses aggregated reports on ads shown and revenue. Google processes it under its privacy policy (policies.google.com/privacy) and explains how it uses information from apps that use its services at policies.google.com/technologies/partner-sites. Other networks and advertisers that take part in AdMob's ad auction receive from Google the information needed to serve an ad.

Which ads each person gets

• Adults: personalized ads from the moment they accept the terms, unless they turn them off in Settings → Privacy.
• Adults who turned them off: non-personalized ads.
• People under 18 (protected mode): only non-personalized ads, with the request marked as coming from a minor, and no full-screen ads. For people under 13 the mark is the child-directed treatment one.
• All accounts: ad content is limited to the all-audiences rating.

How to manage this data

• In Android settings (Google → Ads or Privacy → Ads, depending on the phone) you can reset or delete the advertising ID and turn off ad personalization.
• Where the law requires it (for example in the European Economic Area, the United Kingdom and Switzerland, and under the signal of some US states), Google shows its consent form. Where it is shown, your choice in it governs, and you can reopen it in Settings → Privacy → Ad options.
• If you are an adult, you can turn personalized ads off or back on in Settings → Privacy. The change applies from the next ad and is kept.

Except as described in this section and in section 8, and except for the providers that process data on Nettle’s behalf (sections 3 and 10), Nettle does not sell, rent or hand over information to third parties.

10. Crash reports: Firebase Crashlytics

When the app crashes and closes, it sends a report of the crash to Firebase Crashlytics, a service of Google LLC. Nettle uses it to find and fix the errors that throw people out of a match. It is part of the processing needed for the app to work and is accepted together with the terms (section 5): it is not a separate choice.

When it starts. The app does not start Crashlytics when it opens. It starts it only after you answer the age question and accept the terms and this notice, and until then it sends no report. It is the same for every age, protected mode included (section 13): the same is collected and nothing more.

A report can contain:

The app does not send Crashlytics your player name, your progress, your purchases or anything you type, and it does not assign any user identifier or custom keys. Reports travel encrypted. Nettle does not share them with anyone or use them for advertising. Google processes them under its privacy policy (policies.google.com/privacy) and Firebase's (firebase.google.com/support/privacy), which states that it keeps crash stack traces and their identifiers for 90 days.

Crashlytics needs the phone's Google Play services: without them, there are no reports. It brings the Firebase Analytics library with it, but the app keeps it switched off: it does not measure how you play with it and does not give it access to the advertising ID.

11. Unity: the engine and its online services

Kachiban is made with Unity, by Unity Technologies. The engine and the purchasing component (section 8) are part of the app. Their privacy policy is at unity.com/legal/privacy-policy. Nettle configures the engine so that it does not send device or usage statistics to Unity.

For online play, this version uses Unity Gaming Services (section 3). It does not use Unity Analytics: it does not measure how you play (section 12).

12. Features that are not in this version yet

These features are planned, but this version of the app neither includes nor uses them:

• Private rooms with a code and the League, with their leaderboards.
• Connecting a Google account, if you decide, to recover your account on another phone. Today a guest account cannot be recovered outside this phone.
• Game analytics, to improve the game, with Unity Analytics. Today the choice “Measure how the game is used” exists in Settings → Privacy, but it does not turn on any measurement.
• Notifications, with Firebase Cloud Messaging.

Before turning on any of them we will update this policy (section 18), tell you inside the app and, where applicable, ask for the relevant choice again. Until then, the app does not use them.

13. Minors and protected mode

Kachiban is designed for adults and is not directed at children. Since a minor may still arrive, the app asks for age (section 5) and, if the person is under 18, turns on protected mode:

• ads are always non-personalized, marked as coming from a minor, and do not include full-screen ads; for people under 13 the child-directed treatment of ads is used;
• purchases are not available: in this version a person under 18 cannot buy;
• notifications, when they exist, start off;
• the data of your online account is limited to what is needed to play, and there is no advertising profiling;
• the player name is free-form, but the game asks you not to use your real name or personal details, and you can mute, block and report other players.

A minor’s online account stores the same data as an adult’s (section 3), with the limits of protected mode; Nettle does not use it for advertising.

The data Google AdMob collects for a minor is handled as described in section 9, and crash reports are the same for every age (section 10). If you are a parent or guardian and believe a minor sent us personal data (for example, a real name typed as a player name, or by email), write to us and we will delete it; you can also delete the minor’s account from the app.

14. Retention and deletion

The data that is only on your phone stays until you delete it or uninstall the app. The data of your online account is kept for the periods in the table of section 3 and, if you ask to delete it, it is deleted as explained below. The page Delete my data has the detail, how to manage the Android backup and how to reset the advertising ID that AdMob uses.

Deleting your online account

• Inside the app: Settings → Account → Delete account. A screen explains what you lose and asks you to confirm, with no waiting and no questions. Minors can do it too.
• Outside the app: by email to nettledoingitagain@gmail.com, with your account’s support code (the page Delete my data explains how to get it).
• Deadline: the deletion is completed within 30 days at most.

What is deleted and what is kept

Your guest account, profile, progress, estimated skill level, age, blocks and the rest of your account’s data are deleted, and the app deletes the session and the local data from your phone. Kept, without your player ID (an anonymous marker takes its place): the matches you played, until they reach 90 days; the reports you made or received, up to 12 months; and the record of your purchases and the proof of what you accepted, for as long as accounting, tax and data protection rules require. Those exceptions serve security, fraud prevention and compliance with the law.

An account with no purchases that goes 24 months without being opened is deleted automatically. The data Google collects is kept under Google’s policy. Crash reports are kept for 90 days in Firebase Crashlytics, and the installation identifiers are deleted from the phone when you uninstall the app. If you write to us, we use your address and message only to reply, and we keep them for up to 24 months.

15. Security

The game data that stays on the phone is stored in the private storage Android assigns to the app, which other apps cannot access. The data that travels to the services of Unity, AdMob, Crashlytics and Google Play is transmitted encrypted. In online matches the server rules: it validates every move with the rules of the game, and hidden information (the others’ cards and the order of the deck) never leaves the server toward another player. To protect the game from modified copies, the server checks with Google Play Integrity that the app is the original one (section 3).

16. Your rights

Depending on where you live, the law gives you rights over your personal data:

• Colombia, Law 1581 of 2012: to know, update, correct and delete your data, and to revoke authorization. You may file a complaint with the Superintendencia de Industria y Comercio.
• United States, COPPA: for children under 13, parents may review the data and ask for its deletion.
• Other countries: those recognized by the law of your country.

Your data is in two places. The data on the phone is under your control (section 14). The data of your online account is stored by Nettle in Unity Gaming Services: you can see and update it from the app (for example, by changing your name), delete it with Settings → Account → Delete account or revoke your authorization by writing to the email below. The data AdMob and Crashlytics collect is processed by Google, to whom the corresponding rights can be exercised. To exercise any right or ask a question, write to nettledoingitagain@gmail.com.

17. International transfers

The data of your online account is processed by Unity on servers located outside Colombia, mainly in the United States (section 3). The data AdMob and Crashlytics collect is processed by Google on servers that may be located outside your country, including in the United States, with the safeguards described in its privacy policy. The same may happen with the technical purchase information that Unity receives (section 8). If you write to us by email, the message stays in the email service Nettle uses, which may also host it outside your country. By tapping “I agree” on the app’s age and terms card, you expressly authorize these transfers (Colombian Law 1581 of 2012, art. 26).

18. Changes to this policy

If what the app does with data changes, or a third-party service is added, we will update this policy before publishing that version, with the new date at the top and the change explained in the history. The app will tell you about the change and will ask for the relevant optional choice again. The current version is always the one published at this address.

19. Contact

Nettle Studios · Colombia · nettledoingitagain@gmail.com. You can also write to us from Kachiban's Google Play listing.