Kanumy · App privacy

Kanumy app privacy policy

Updated: 20 October 2026

This policy concerns the Kanumy game, including its Android app, browser version, accounts and connected services. The separate Scopebloom website privacy policy explains visits to our general website. Collection differs between platforms and versions; the differences below matter.

1. Who is responsible

Michael Kretschmer, Scopebloom Studio
Köpenicker Straße 95B
12355 Berlin, Germany

Privacy and deletion requests: kontakt.kanumy@scopebloom.com
Telephone: +49 152 320 122 07
Full provider information

2. Accounts, sign-in and profiles

Firebase Authentication provides guest accounts, email/password sign-in and Google sign-in. We process an account ID, your chosen or generated player name, account/provider status, registration and activity timestamps, and an email address when you use a sign-in method that supplies one. Password authentication is handled by Firebase Authentication; passwords are not saved in the Kanumy player profile.

If you choose Google sign-in, Google and Firebase process the sign-in identity and authentication tokens. This is used to sign you in or link a sign-in method to your existing game account. It does not give Kanumy access to your Google address book, Gmail contents or Drive files. Google's own processing is described in the Google privacy policy.

Your country flag starts with a country suggested by the device's locale and can be changed in your profile. This is not a GPS reading or proof of where you live. Your player name, avatar, flag, level, achievements and relevant statistics may appear in profiles, player search, games, leagues and leaderboards. Account email addresses and authentication credentials are not displayed as public profile details.

Optional avatar photos

You may use a supplied avatar or select/take a photo and crop it. The selected, cropped image is uploaded to Firebase Storage and linked to your account. We do not upload your entire photo library. Other players can see the resulting avatar, and someone with its image link may also access it. Do not upload a photo you are not entitled to share.

Before sharing a custom name, avatar or public club text, accept the Content Terms and Community Rules. Acceptance is saved with your account ID and version of the rules. Declining keeps your current or generated identity and ordinary gameplay. New photos are decoded, resized and stripped of image metadata before immediate publication; publication is not moderator approval.

3. Games, progress and social features

We store game participants, boards, tile/rack state, moves, results, scores, timestamps, match history, statistics, puzzle results and resumable progress, achievements, experience, levels and league/leaderboard entries. This lets us run matches, check results, resume play and calculate progress. Some recorded games or winning moves against Compy may also be used to investigate gameplay and improve game rules or puzzle content.

Social data includes friend links and requests, opponents, invitations and shared invitation codes, club membership and roles, club activity, league participation, feed items and reactions. This is used for the social feature you use. It does not involve reading the contacts stored on your phone.

Players involved in a game, invitation or social interaction receive the information needed for it. Rankings and player profiles expose the relevant player identity and results to other players. Club members can see club activity and whether members are currently online. Some club information is discoverable by other players. Your private rack is handled separately from the board visible to opponents.

Opponent discovery and invitations

Open to invitations makes eligible accounts discoverable to other players. Current versions initially enable it after profile completion when no preference has been saved, including for guest accounts. A saved opt-out is preserved. You can turn it off in Find opponent or through the explanation of a discovery invitation.

We store your preference, a random sorting key and, while enabled, an activity timestamp updated during foreground use at most once an hour. Other players receive only the required public player identity and coarse labels such as Active today or Active recently, not an exact activity time. Blocks and other exclusions limit suggestions. Turning it off stops new discovery invitations and further activity recording; already delivered invitations keep their normal 24-hour expiry. The preference and technical discovery data remain until account deletion.

For random Classic matches, we also keep both account identifiers, a game reference, the league week and timestamps to prevent repeat pairings within the same week. Other players cannot read these pairing records. Expiry is set to the next Monday at 00:00 UTC; expired records are physically cleaned up asynchronously. Account cleanup removes associated pairings.

Reports, blocks and moderation

Safety settings store players you block and individual activity you hide. Blocked players cannot make new social requests or shared matches with you; existing games and club membership remain. Reports are optional and include your account ID, a target reference, category, submission time, the content revision and private evidence, and an optional comment of up to 500 characters. Failed report drafts remain on your device for retry. Please avoid unrelated personal information in comments.

Reports, reporter identities, evidence and internal notes are restricted to authorised platform moderators. New reports can trigger a general email notice to kontakt.kanumy@scopebloom.com without player identifiers, categories, comments or images. Details are reviewed in the protected moderation inbox. A report alone does not sanction an account. A moderator can remove content, warn or restrict social and publishing features. Affected players receive the reason, duration and appeal contact. Decisions and cleanup failures are recorded for review and security.

4. Notifications

Firebase Cloud Messaging delivers device notifications. The SDK can create installation identifiers and messaging tokens automatically, including before you allow notifications to be displayed. Kanumy registers a delivery token with your account when notification permission and registration allow it, together with platform, language, timestamps and delivery settings. Delivery receipts and message/game reference IDs help avoid duplicates and open the right screen.

You can choose device permission and notification categories in Settings → Notifications. Notification content can include player names and game or club information and may appear on a lock screen, depending on your device settings. News/event notifications are a separate optional category; they are not enabled by default. Blocking display does not necessarily stop the underlying SDK's technical installation processing.

5. Feedback and support

Feedback is sent when you press Send. A report can include your comment, mood, category, app version, platform, language, theme, orientation, timestamp and the screen/feature you are reporting. Drafts are kept on the device until you discard them or submission is confirmed. Opening the form alone does not submit a report.

“Send anonymously” is selected by default. In that mode the stored feedback report omits your account ID, email address and game ID. Turning it off includes your account ID, available email and relevant game reference. The connection is still authenticated by Firebase, and free text or timing can identify someone even in an anonymous report. Please avoid personal or sensitive information in comments.

If you contact us by email or telephone, we process your contact details and request to answer you. Feedback is reviewed by the developer and people authorised to support the app; it is not a public social post.

6. Optional crash and error reports

Eligible Android release versions offer Settings → Preferences → Help improve Kanumy → Send crash and error reports. The setting is off by default and saved on that device. Firebase Crashlytics can transmit crash traces, exception types, app/build and device/OS information, timestamps and installation/session identifiers when this option is enabled.

App-authored error reports filter out error messages and request contents and use a limited error code and stack trace. Native SDK crash reports can contain additional diagnostic details; these reports are not guaranteed anonymous. Analytics events may appear as breadcrumbs when Analytics is active.

Enabling reporting requires a restart; the first restart clears reports from before the choice. Later eligible restarts can upload reports from opted-in sessions. Turning it off stops new app-authored reports immediately and clears unsent reports at the next launch. It cannot recall an upload already queued or received. The native SDK can keep crash information locally while uploading is off. This integration does not upload Crashlytics reports from the browser or Apple versions.

7. Technical operation and local storage

Google/Firebase processes technical information such as IP addresses, app/device metadata, account and installation identifiers, authentication tokens and security material to provide sign-in, databases, storage and server functions. Firebase App Check uses Google Play Integrity on Android to check app/device integrity and help protect the service from abuse. It can process app version/signing information, integrity tokens and device attestation information. Browser App Check uses reCAPTCHA only in builds where it is configured; Apple builds use Apple's attestation services where configured.

The app also stores local settings, sign-in state, tutorial checkpoints, cached data, puzzle progress pending upload and feedback drafts. Necessary local storage supports the feature you request. Local feedback drafts are not separately encrypted by Kanumy. App fonts and game audio are bundled; they are not fetched from a Google Fonts tracking service.

The included browser version uses Google reCAPTCHA Enterprise for Firebase App Check. Browser/device and security information needed for attestation is sent to Google; App Check tokens accompany supported service requests. This service-security check is separate from usage analytics and advertising. See Firebase privacy and security for provider details.

To protect against excessive requests, we store pseudonymous keys derived from identifiers, minute/day counters and an expiry time. These application counters do not contain IP addresses or request contents; providers can separately process technical connection data. The code sets expiry after 48 hours without new counted activity, with asynchronous cleanup. Avatar uploads also keep account association, operation identifier, file type, size and authorization state. Technical records of used upload authorizations remain until account deletion to prevent reuse of stale authorizations.

8. Usage analytics

Optional usage analytics are disabled in the current Kanumy release. Without a configured consent provider, Cookiebot is not loaded and Firebase Analytics is not started. Usage events are discarded and are not sent later. Saving your game progress and account statistics is separate from analytics.

The app includes prepared consent controls for Cookiebot in browsers and Google's UMP on Android. Neither service is currently configured or required for ordinary play. Enabling optional collection later requires a separate affirmative choice, verified provider settings and an updated notice. Refusing consent must not remove your account or progress.

9. Advertising

The current Android release does not initialise Google Mobile Ads or request advertisements. The browser version may show local advertisement previews, which do not contact the mobile advertising SDK. Advertising would require the appropriate disclosure and consent controls before activation. Permission to request ads would not be blanket consent to analytics.

10. Membership offers

No RevenueCat key or purchase checkout is enabled in the currently published configuration. In this configuration Kanumy sends no catalog or customer requests to RevenueCat and does not ask for payment card details. Enabling purchases later requires a fresh privacy and store-disclosure review.

11. Recipients and international processing

The developer and authorised support/administration personnel may access information needed to operate and support Kanumy. Google/Firebase provides authentication, Firestore, Storage, Realtime Database, server functions, Cloud Messaging, App Check and optional Android crash reports. For customers in the European Economic Area, the contracting entity is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC and other subprocessors may participate. Google's sign-in service is also subject to Google's own privacy terms.

The website and support mailbox are hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Website requests and email traffic produce necessary connection, security and communication data. The general website privacy policy provides additional details.

Firebase terms include data-processing terms, while the relevant Google Cloud services are covered by the Cloud Data Processing Addendum. International processing, including in the United States, may rely on contractual standard clauses and an applicable adequacy decision, including the EU-US Data Privacy Framework. Firestore is configured in the European eur3 multi-region, the server functions used here in europe-west3 and the Storage bucket in EU. This does not guarantee that all Google services process information exclusively in Europe. See Firebase privacy, the Google Cloud data-processing terms and ALL-INKL privacy information.

12. Purposes and legal bases

Accounts, requested games and social features use Article 6(1)(b) GDPR. Service security, abuse prevention and necessary operational logs rely on Article 6(1)(f); our interest is a secure, reliable and fair game service. Support uses Article 6(1)(b) or (f), depending on the request. Optional crash uploads rely on consent under Article 6(1)(a). Applicable legal obligations use Article 6(1)(c).

Essential local storage and device access serve the expressly requested app function under § 25(2) TDDDG. Optional analytics or advertising access would require separate consent under § 25(1) TDDDG and Article 6(1)(a) GDPR; these remain disabled.

13. Retention and deletion

Settings → Account Management → Delete account permanently removes your account and associated data. You can also use our web deletion request page without the app. The service removes the sign-in account, profile, account progress, social associations, ranking entries, private racks, uploaded avatars including older object versions, identified feedback and private safety data. A necessary cleanup failure prevents a successful complete-deletion response; cleanup can be retried.

Other players retain their results and structured moves from shared matches. The original account identifier and references are replaced with a random placeholder unique to each match. Names, avatars and other profile attributes are removed, and name-bearing move messages for the deleted player are cleared. No cross-match account mapping is retained afterwards. This reduced match record has no fixed deletion deadline while it serves the remaining players' history. Other players may still recognise a match from memory or their own saved copies; we do not promise complete anonymity from other participants.

• Feedback: A daily service removes submitted reports, including reports without account identifiers, after 90 days. Identified reports are removed sooner on account deletion. A targeted request for unlinked feedback needs its approximate date and enough comment text to locate it.
• Moderation: Closed reports and evidence are removed after 90 days; minimal action audits after one year. Account deletion removes reports made by or about the account and their evidence, while retained action audits lose the account identifier, target reference and reason text. Current email notices contain no player identifiers or report details. A daily service removes notices after 90 days from all mailbox folders including Trash, and removes older identifying notices whose underlying report has already been deleted.
• Support and deletion requests: Requests are normally handled within one month. Correspondence is removed within 90 days after resolution unless a specific legal retention or legal-defence need requires limited evidence. We explain such exceptions on request.
• Security and operations: Application counters become eligible for asynchronous deletion after 48 hours without newly counted activity. Weekly pairing records expire the following Monday at 00:00 UTC. Ordinary Google Cloud logs remain for 30 days; mandatory administrative audit logs for 400 days. Account deletion does not immediately erase these limited security logs.
• Recovery and providers: Deleted object copies in the configured Storage bucket expire after seven days. Firestore has no additional scheduled backups or extended point-in-time recovery enabled. Google states that removal of deleted authentication information from live and backup systems may take up to 180 days. Installation, security and diagnostic records also follow the relevant provider periods; Firebase Crashlytics retains crash reports for 90 days. We help with identification and necessary provider-deletion requests. Protected rotating backups at the mail provider are overwritten on its backup cycle; deleted correspondence is not restored to ordinary support use.
• Earlier analytics data: The existing Analytics property is configured for two months of event data and 14 months of user data; the user period can reset with new activity. Aggregate standard reports are outside these individual limits. The current app sends no new analytics events. Targeted provider requests may require additional installation information.

Account and progress data remain while needed to provide the account and its history, until deletion is requested or they are no longer required. Uninstalling alone does not delete a server account. Server deletion cannot fully recall local caches, drafts or copies saved by you or other people; your device or browser storage settings can remove your own local data. Do not send passwords or sign-in tokens with a request.

14. Your choices and rights

Under the applicable GDPR conditions you can request access, correction, deletion, restriction and portability of your data, and object to processing based on legitimate interests. You can withdraw consent at any time with effect for the future, without affecting processing that was lawful before withdrawal. Use available app controls or contact kontakt.kanumy@scopebloom.com. We may need proportionate information to verify that a request concerns your account.

You can complain to a data protection authority. Our local authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit. You may also contact the authority responsible for your habitual residence or workplace.

15. Security and updates

Production communications use encrypted connections. Account access controls and service rules restrict access to data, but they do not make all information anonymous or prevent other players from seeing information you share with them. This policy will be reviewed when features, providers or collection practices change. The date above identifies the current version.