Privacy Policy

This Privacy Policy describes how Joshua Kuttler, doing business as Kapp Studios ("Kapp Studios," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with the kappstudios.com website and every application, game, plugin, extension, and service we publish on any platform, marketplace, or distribution channel, including, without limitation, the Apple App Store, Google Play, the web, and any other app marketplace or distribution channel, whether existing now or created in the future, whether or not it offers account registration or email login (collectively, the "Services"). This is our single, unified privacy policy: it applies to every Kapp Studios product on every platform, whether you access it at kappstudios.com/privacy or kappstudios.com/privacypolicy, and it covers any current or future Kapp Studios product that links to either address.

By downloading, accessing, or using any of the Services, you acknowledge this Privacy Policy. If you do not agree with it, please do not use the Services.

1. Information We Collect

The information we collect depends on which app you use and how you use it. We aim to collect only what is needed to run and improve the Services. It may include:

• Account information (products with login). If a product offers registration or sign-in, we collect the information you provide when creating an account, such as your email address, display name, password (where we use a third-party authentication provider, the password is stored in hashed form by that provider and we do not see or store the plaintext password), account preferences, and, if you use a third-party sign-in option such as Sign in with Apple or Google, the identifier and basic profile information that provider shares with us. We use your email address to verify your account, deliver password resets and security alerts, and send service notices about your account. We associate your account identifier with the content and settings you save so we can provide the Services to you across devices.
• Content you create or upload. Such as photos, videos, messages, product data, CRM records, store orders, game scores, or other content you choose to store in a website or app. In many products this content stays on your device; in products with cloud features it is stored on our backend infrastructure (see Section 3).
• Usage and device information. Collected automatically, such as device model, operating system and version, app version, language, region, IP address, unique device or installation identifiers, session and interaction data (screens viewed, features used, session length), and performance data.
• Crash and diagnostics data. Crash traces, error logs, and device state at the time of a crash, used to find and fix bugs.
• Purchase information.If you make an in-app purchase or subscribe, the platform's billing system (for example, Apple or Google Play Billing) processes the transaction and shares with us limited, non-financial information such as the product purchased and transaction status. We never receive or store your payment card details.
• Information you enter about other people. Some products let you enter information about others, for example, contacts and leads in CRM apps, or customer details in e-commerce sites. We process that information solely to provide the feature to you, on your behalf; we do not use it for our own purposes and do not contact those individuals. You are responsible for having the right to enter it, and if someone whose information you entered contacts us, we will assist with or direct correction and deletion requests as appropriate.
• Website contact and analytics. If you use kappstudios.com, we collect the name, email, and message you submit through the contact form, and we use Cloudflare Turnstile to reduce spam. If you accept cookies, we also use Google Analytics, which may collect device, browser, IP, and usage data (see Section 5).
• Communications. If you email us (for example, at josh@kappstudios.com) or submit feedback, we collect your contact details and the contents of your message.
• Advertising identifiers.If an app shows third-party ads, ad networks may collect device advertising identifiers (such as Apple's IDFA or the Android Advertising ID), subject to your device settings and permissions (see Section 5).

We do not knowingly collect sensitive personal information such as government identification numbers, precise geolocation, biometric identifiers, financial account numbers, or health records, and we ask that you do not submit such information through the Services.

2. How We Use Information

• To create and manage your account, authenticate you, and sync your content across devices;
• To provide, operate, maintain, personalize, and improve the Services;
• To diagnose crashes, fix bugs, monitor performance, and keep the Services secure, including detecting fraud and abuse;
• To send service communications, such as verification emails, password resets, and important notices about your account or changes to the Services;
• To send push notifications, where you have allowed them (you can turn these off in your device settings at any time);
• To understand how the Services are used in aggregate so we can decide what to build and improve;
• To respond to your questions and support requests;
• To comply with legal obligations, enforce our Terms of Use, and protect our rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under California law.

Aggregated and de-identified data. We may create aggregated or de-identified data from information we collect (for example, overall usage statistics that cannot reasonably be linked to you). We may use and disclose such data for any lawful purpose, and we commit to maintaining it in de-identified form and not attempting to re-identify it.

3. Our Service Providers and Partners

Depending on the product, we may use some or all of the following providers. A product does not use a provider unless that product is built with it:

• Firebase Authentication: to manage account registration, email login, and third-party sign-in;
• Cloud Firestore / Realtime Database / Cloud Storage: to store account data and content you save to the cloud;
• Google Analytics for Firebase: to collect anonymous usage statistics;
• Firebase Crashlytics: to collect crash reports and diagnostics;
• Firebase Cloud Messaging: to deliver push notifications;
• Firebase Remote Config and App Check: to configure app behavior and protect our backend from abuse.
• Google Cloud hosting: to run application servers, APIs, and related infrastructure. Depending on the product, we may host these servers in the United States, Europe, or Israel.
• Vercel: to host websites and web applications, including kappstudios.com. Vercel may process request logs, IP addresses, and deployment data in the countries where it operates.
• Bit.cloud: as a development and component-hosting platform for some products. When we use Bit.cloud, it may process account, project, and source-related data needed to host and deliver those components.
• MongoDB Atlas:to store application data, such as account records and content you save to the cloud. We choose one Atlas region per product, typically in the United States, Europe, or Israel, and do not move that product's database to another region without a reason related to operating or improving that product.
• Cloudflare: to provide CDN, security, DNS, and bot protection, including Turnstile on our website. Requests to our websites and apps may pass through Cloudflare.
• Google Analytics: to measure how our websites and apps are used.
• Google Ads and Google AdMob: if a product shows ads, to serve, measure, and improve those advertisements.
• Unity: in some games or apps built with Unity, Unity may process device, usage, and advertising data through Unity Ads, Unity Analytics, or related Unity services.

Information processed through Firebase and Google Cloud is handled by Google on our behalf under Google's terms and safeguards. You can learn more at firebase.google.com/support/privacy and policies.google.com/privacy. Information stored in MongoDB Atlas is handled by MongoDB on our behalf under MongoDB's terms and safeguards. You can learn more at mongodb.com/legal/privacy/privacy-policy. Websites and apps hosted on Vercel are processed by Vercel on our behalf; see vercel.com/legal/privacy-policy. When we use Bit.cloud, Bit processes related data under its privacy policy at bit.cloud/legals/privacy.

Data may also pass through or be processed by Cloudflare, Vercel, Bit.cloud, Google (Analytics, Ads, and AdMob), and Unity when a product uses that service. These companies process information under their own terms and privacy policies, and they may process it in the United States and other countries where they operate. You can learn more at cloudflare.com/privacypolicy, Google AdMob privacy, and unity.com/legal/privacy-policy.

In addition, the platforms our products run on process certain data independently, as separate data controllers under their own privacy policies, for example: Apple (App Store and iOS) and Google (Google Play, Google Play Services, and Google Play Billing on Android). The same applies to any other marketplace or platform we distribute through in the future. We receive from these platforms only the limited data they make available to developers, and we encourage you to review their privacy policies and privacy settings.

Opting out of Firebase and Google data collection

You can limit or opt out of the data collection performed by Firebase and related Google services in the following ways:

• Analytics and tracking (iOS):decline the App Tracking Transparency prompt, and enable Settings → Privacy & Security → Tracking → turn off "Allow Apps to Request to Track";
• Analytics and ads (Android): go to Settings → Google → Ads to delete or reset your Advertising ID and opt out of ads personalization;
• Google ad personalization (any device): adjust your choices at adssettings.google.com and myadcenter.google.com;
• How Google uses data:see "How Google uses information from sites or apps that use our services" and Firebase's privacy documentation at firebase.google.com/support/privacy, which describe Google's practices and the controls Google offers; you can contact Google directly through those pages;
• Through us: email josh@kappstudios.com and we will delete the personal information and analytics identifiers associated with you that are under our control, as described in Sections 8 and 12.

We may also use other service providers (such as hosting, email delivery, and customer support tools) that process information only on our instructions and under confidentiality obligations. We do not permit those service providers to use your personal information for their own marketing. Advertising and analytics partners such as Google and Unity process data under their own policies, as described in Section 5.

4. Camera, Photos, Microphone, and Other Permissions

Some apps request access to device features, for example, the camera and photo library (photo and video apps), the microphone (video recording and speech features), or notifications. Each permission is requested only to deliver the feature you asked for, is controlled by you through your device settings, and can be revoked at any time. Media you capture or edit remains on your device unless you choose to save, export, share, or upload it to a cloud feature.

5. Advertising, Analytics, and Website Cookies

Some of our websites and apps use Google Analytics. If a product shows ads, those ads may be served by Google AdMob, Google Ads, or, in Unity-based products, Unity Ads. Those companies may then receive device identifiers, IP address, approximate location, and usage data to serve and measure ads or analytics. Data can also pass through Cloudflare when you visit our websites or use our apps. Where platform rules apply (such as Apple's App Tracking Transparency), tracking occurs only if you grant permission, and you may decline or change your choice at any time in your device settings (on iOS: Settings → Privacy & Security → Tracking; on Android: Settings → Google → Ads). You can also limit, reset, or delete your advertising identifier in your device settings.

Website cookies on kappstudios.com

kappstudios.com uses a cookie-consent banner. Google Analytics is loaded only if you click Accept. If you click Decline, we do not load Google Analytics. You can change your choice at any time with the Cookie settings link in the footer. We also use a strictly necessary cookie or similar local storage value to remember your choice, and Cloudflare Turnstile on the contact form to help prevent spam. Cloudflare may set cookies needed for that security check.

6. How We Share Information

We share personal information only:

• With the service providers described in Section 3, to operate the Services;
• With advertising partners as described in Section 5, subject to your permissions;
• To comply with law, regulation, legal process, or an enforceable governmental request, or to protect the rights, property, or safety of Kapp Studios, our users, or the public;
• In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case we will require the successor to honor this Privacy Policy or notify you of changes;
• With your direction or consent (for example, when you choose to share content from an app).

7. Data Retention

We keep personal information only as long as needed for the purposes described in this policy. In general: account data is retained while your account is active; analytics and crash data are retained for limited periods set in our analytics tools; support emails are retained as long as needed to assist you; and residual copies may persist in encrypted backups for a limited time before being purged. When information is no longer needed, we delete it or irreversibly de-identify it.

8. Account Deletion

If you created an account in one of our apps, you can delete it at any time:

• In the app:use the account deletion option in the app's settings, where available; or
• By email: contact us at josh@kappstudios.com from the email address associated with your account and request deletion.

Deleting your account removes your account record and associated cloud content from our production systems, subject to short backup-retention windows and any records we are legally required to keep. For any product, you may also email us and we will delete the personal information we hold about you, as described in Section 12.

9. Data Security

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect information, including encryption in transit (HTTPS/TLS), encryption at rest on our backend infrastructure, hashed credential storage where we use a third-party authentication provider, access controls, and backend protections such as Firebase security rules and App Check when a product uses Firebase, and MongoDB Atlas access controls when a product uses Atlas. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security; you use the Services at your own risk to that extent. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

10. Children's Privacy

The Services are intended for a general audience and are not directed to children under 13 (or the equivalent minimum age in your jurisdiction). Certain apps, such as children's games and family-friendly learning apps, are designed to be family friendly and can be used without an account; they are intended to be used by children only together with, and under the supervision of, a parent or guardian. Our other platform products are likewise not directed to children under 13, and children under 13 are not permitted to create accounts in any of our products. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at josh@kappstudios.com and we will promptly delete it.

11. International Data Transfers

We are based in Israel. Depending on the product, we may host servers and store information on Google Cloud in the United States, Europe, or Israel, host websites and apps on Vercel, use Bit.cloud for component hosting, and store application data on MongoDB Atlas in one chosen region per product, typically the United States, Europe, or Israel. Analytics, ads, and traffic may also be processed by Google, Cloudflare, Vercel, Bit.cloud, and Unity in the countries where they operate. Information may also be processed in other countries where our service providers operate. These countries may have data protection laws different from those in your country. Where required, transfers are protected by appropriate safeguards such as standard contractual clauses and our providers' certified transfer mechanisms.

12. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access / right to know: request a copy of the personal information we hold about you and information about how it is processed;
• Correction: request that inaccurate information be corrected;
• Deletion: request that your personal information be deleted (see also Section 8);
• Portability: request your information in a portable format;
• Objection / restriction: object to or ask us to restrict certain processing;
• Withdraw consent: where processing is based on consent, withdraw it at any time (this does not affect processing that happened before withdrawal);
• Non-discrimination: we will never discriminate against you for exercising your rights.

For residents of Israel (Privacy Protection Law, 5741-1981, as amended, including Amendment 13): we are based in Israel and process personal information as a database owner under Israeli law. You may request access to, correction of, and deletion of personal information we hold about you, subject to the exceptions in that law. You also have the right to lodge a complaint with the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות). See gov.il/en/departments/the_privacy_protection_authority or email ppa@justice.gov.il.

For residents of the EEA, UK, and Switzerland (GDPR): our legal bases for processing are performance of a contract (providing the Services you request), our legitimate interests (improving and securing the Services), your consent (for example, for tracking or push notifications), and compliance with legal obligations. You also have the right to lodge a complaint with your local supervisory authority.

For California residents (CCPA/CPRA):we collect the categories of information described in Section 1 for the purposes described in Section 2, and we disclose them only as described in Section 6. We do not sell personal information and have not done so in the preceding 12 months, and we do not use or disclose sensitive personal information for purposes that would trigger a right to limit. You may exercise your rights to know, delete, and correct through the contact below, and you may designate an authorized agent to act for you. California "Shine the Light": we do not share personal information with third parties for their own direct marketing.

To exercise any right, email josh@kappstudios.com. We will verify your request (for account holders, by confirming control of the account email) and respond within the time required by applicable law. Our Services do not respond to browser "Do Not Track" signals, as no consistent industry standard exists.

13. Push Notifications and Marketing Choices

You can disable push notifications at any time in your device settings. If we send marketing emails, each one will include an unsubscribe link; service and transactional messages (such as password resets) are sent as needed to operate your account.

14. Third-Party Links and Services

The Services may contain links to third-party websites, stores, and services, for example, the Apple App Store, Google Play, or partner websites. This Privacy Policy does not apply to those third parties, and we are not responsible for their practices. We encourage you to review their privacy policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page, and for material changes we will provide additional notice where required (for example, an in-app notice). Your continued use of the Services after changes become effective constitutes acceptance of the revised policy.

16. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, contact us and we will do our best to resolve them promptly.