The Curiolo app stores all progress, profiles and settings on your device only. There is no server that receives this data. The app contains no advertising, no analytics or crash reporting services of its own and no advertising ID. No user account is required. Multiplayer works only on the local Wi-Fi; the game connection is encrypted. What I learn through Google Play is described in section 4.3.
This site is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages). When you open a page, Cloudflare processes technically necessary data such as your IP address, date and time, the page requested, browser type and the amount of data transferred, in order to deliver the page and protect it from attacks.
The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and reliable operation of the site. Cloudflare also processes data in the USA, based on standard contractual clauses and its certification under the EU-US Data Privacy Framework.
This site sets no cookies, loads no fonts or content from third-party servers and uses no visitor analytics.
The app stores the following in its private directory on your device:
This data never leaves your device and is not transmitted to me. The player name does not have to be a real name. You can delete everything by clearing the app's data in the Android settings or by uninstalling the app.
If you open a game on Wi-Fi, your device broadcasts an unencrypted announcement to all devices on the same network. It contains the room name, the game settings and whether the room is locked, so that others can find the room. The room name is a neutral default such as “Room 4831”; you can change it freely in the lobby. Your player name is not part of the announcement. Any device on the Wi-Fi can read it.
The game connection itself between the devices is end-to-end encrypted (Noise protocol with ChaCha20-Poly1305). Only this connection carries the player name, language, answers, scores and game state. A verification code in the lobby and an optional PIN prevent strangers from sneaking in. Neither the code nor the PIN is sent over the network. The device hosting a room keeps the network addresses of devices that knock in memory for at most 60 seconds to fend off troublemakers; after that the information is gone.
The exchange takes place directly between the players' devices. No internet server is involved and I do not receive this data. The legal basis is Art. 6(1)(b) GDPR, as this transmission is necessary for the multiplayer mode you requested. If you do not use that mode, nothing is sent.
Purchases are handled entirely by Google Play, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the payment data; I do not receive it. The app verifies the purchase on the device and only stores locally that the full version is unlocked.
The legal basis is Art. 6(1)(b) GDPR. Google's own privacy policy applies in addition.
What I learn through Google Play: Google shows me aggregated figures in the Play Console about installs, countries and Android versions. If you have allowed “Usage & diagnostics” in your Android settings, Android reports crashes of the app to Google and I see them there in anonymised form. For a purchase I see an order number, the country and the amount, but neither your name, e-mail address nor payment details. The app itself sends none of this.
Android may back up the app's data to your Google account or transfer it to a new device, using the backup function of the operating system. Google is responsible for this; you can switch the backup off in the Android settings.
If you wish, the app reminds you once a day about your daily mission. The reminder is created on the device itself; there are no push messages from a server. You can switch it off at any time in the app or in Android. The reminder exists only if you turn it on (Art. 6(1)(a) GDPR); no data leaves the device.
For speech, the app uses the text-to-speech engine of your device, which you select in the Android settings. If that engine works online, the text to be spoken is transmitted to its provider. I have no influence on this.
The app requests these permissions:
It does not request access to location, camera, microphone, contacts or files.
If you write to the address above, I process your e-mail address and the content of your message in order to answer your request. The mailbox is hosted by Google (Gmail), provided by Google Ireland Limited; Google may also process data in the USA, based on standard contractual clauses and the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR where the request concerns the app or a purchase, otherwise Art. 6(1)(f) GDPR. I delete the message once your request is settled, at the latest after twelve months, unless a statutory retention period applies.
Data in the app remains until you delete it or uninstall the app. Access data for this website is stored by Cloudflare for a short period only.
The app is not directed at children under 13.
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You may withdraw consent at any time with effect for the future. Please use the e-mail address above.
Because I receive no data about you, I cannot provide information about your game progress. That data exists only on your device.
You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority where you live or the one of the German federal state in which I am based.