Privacy Policy for Kuriorama
1. Controller and principle
This policy applies to the Kuriorama app, the website kuriorama.punktdev.com and these legal pages on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany (legal notice). Contact: [email protected].
Kuriorama works without an account. The app contains no ads and no third-party analytics, tracking or crash reporting services. We do not create usage profiles and make no automated decisions within the meaning of Art. 22 GDPR. The game is suitable for all ages but is not specifically directed at children under 13.
2. Your progress stays on your device
The app stores your codex with all rules you have figured out, your recent results, the daily rule history (up to the last 60 days on which you played), lives, diamonds and the identifiers of your last 100 purchases at most (section 5) only on your device. If this progress data is ever corrupted, the app keeps a copy of it on the device so that it can be recovered. The app keeps no usage or crash log.
This storage is necessary for the game (Section 25(2) No. 2 TDDDG; where personal data is involved, Art. 6(1)(b) GDPR). The data remains until you clear the app data or uninstall the app. Depending on your device settings, operating system backups (iCloud or Google) may contain a copy; these are managed by Apple or Google, not by us.
3. Internet connection
For the daily rule and hit rates the app talks to our server at api.kuriorama.punktdev.com, which we run on Cloudflare. Only the following is sent to us:
- when you open the daily rule: a request for today's rule, without further data;
- after the daily rule: the date, the rule, whether you solved it and how many items you needed. After you solve the daily rule, we compare your move count with successful results submitted for the same day and rule. The comparison counts result entries, not individual people;
- after each free round: which rule was played and whether it was solved;
- at startup: a request for the worldwide hit rates per rule, without further data.
The app does not send any account, device or advertising identifier, and there is no account. The results database stores no names, accounts, IP addresses or device identifiers. We store daily results individually with their submission time and delete them after 90 days; free rounds are only counted as totals per rule. The database's restore history (Cloudflare D1) goes back up to 30 days. We use the data for the comparison in the daily rule, the hit rates and to improve the difficulty of the rules.
For technical reasons, Cloudflare processes your IP address and request data with every request in order to establish the connection and protect the service. Our application code stores IP addresses neither in the results database nor in its own access logs, and we have not enabled access logging (Workers Logs) for the server. The legal basis is Art. 6(1)(b) GDPR for the daily rule and hit rates and Art. 6(1)(f) GDPR for secure operation and improving the game. Free rounds and the daily rule also work offline. Without a server connection, the app uses locally calculated rules and a rough estimate for the comparison. Measured worldwide hit rates and the comparison with submitted daily results need a connection.
4. Sharing
If you share your daily rule result, the app opens your device's share menu with a ready-made text (rule number and a grid of ticks and crosses). You decide what you send and to whom.
5. App Store, Google Play and purchases
You get Kuriorama from Apple's App Store or Google Play. Apple and Google process account, download and, where applicable, payment data as independent controllers under their privacy policy (Apple) and privacy policy (Google). For users in the EU these are Apple Distribution International Ltd. and Google Ireland Ltd., both in Ireland. The stores provide us with aggregated usage and sales figures. For purchases, individual order and transaction information may also be available. Depending on your permissions and settings, the platforms may provide technical crash reports. This does not give us full card or bank details.
We use personal order, transaction and crash information from the stores solely to handle purchase and support questions. The legal basis is Art. 6(1)(b) GDPR for contract-related matters and otherwise Art. 6(1)(f) GDPR; our legitimate interest is handling support requests. We delete our copies after the case is closed, once they are no longer needed to establish or defend legal claims. Where statutory retention obligations apply, we retain the required data under Art. 6(1)(c) GDPR until those obligations expire.
You buy diamond packs directly in the respective store. We do not receive any card, bank or account data. The app receives the product ID, a transaction ID and the purchase status from the store. Once the store reports the purchase as successful, it credits the diamonds and then confirms the purchase with the store. It stores the transaction ID with your game progress on your device so that no purchase is credited twice. Pending payments or purchases awaiting approval are only credited once the store confirms them. Nothing is sent to a server of ours. The legal basis is Art. 6(1)(b) GDPR.
6. Website
The website kuriorama.punktdev.com is delivered via Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. With every request, Cloudflare processes your IP address and technical request data such as time, requested address, browser information and response status in order to deliver the page and protect it against disruption and abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. We have not enabled access logging (Workers Logs) for this website, and we do not analyse access logs. Cloudflare also processes technical operating data under its privacy policy.
The website kuriorama.punktdev.com sets no cookies, stores nothing in your browser and uses no analytics, tracking or advertising services. Fonts and images are served from our own server. Links to Google Play include the source tag utm_source=kuriorama.punktdev.com so that Google can show us in aggregate how many visits come from this website. If you open an external link, for example to a store, the privacy policy of that provider applies there.
These legal pages are hosted on punktdev.com, which is also delivered via Cloudflare. There the page reads any light/dark preference stored in your browser's local storage so that your chosen appearance is kept (Section 25(2) No. 2 TDDDG). Nothing is transmitted to us.
7. Contact by email
If you email us, for example at [email protected], the message arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email including content and attachments as our processor under a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. For transfers to Microsoft Corporation in the USA, for example for support or security, Microsoft relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
We process your address, the content and any information you choose to provide in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. We delete the message once it is no longer needed for follow-up questions, legal defence or statutory retention obligations. Providing data is voluntary; without a reply address we cannot answer.
8. Recipients and processing outside the EU
We use these service providers for the purposes described:
- Cloudflare, Inc. (USA): hosting of the website and of our server for the daily rule as our processor under a data processing agreement (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply in addition. Details are in the Cloudflare DPA.
- Microsoft Ireland Operations Ltd. (Ireland): Microsoft 365, our email mailbox, as our processor under a data processing agreement (Art. 28 GDPR). Data is generally stored in the EU; transfers to Microsoft Corporation (USA) are covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Apple and Google are independently responsible for the App Store and Google Play (section 5). You can request a copy of the safeguards at [email protected].
9. Your rights
Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw any consent with effect for the future.
Objection: Where we process personal data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.
You have the right to lodge a complaint with a data protection supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
Because your game progress is stored only on your device, we cannot view it, delete it for you or hand it over. You can do that yourself in the app or on your device.
10. Changes and language versions
We update this policy when the app, the website or the law changes. The version published here applies. This is a translation of the German version, which prevails in case of discrepancies.