sudokan.bloombyte.dev

Privacy Policy for Sudokan

Last Updated: November 9, 2025
Effective Date: November 9, 2025

Introduction

Thank you for choosing Sudokan (“we,” “us,” or “our”). We are committed to protecting your privacy and being transparent about how we handle your information.

This Privacy Policy explains:

Important: Sudokan is designed with privacy in mind. Most of your data stays on your device, and all data collection that leaves your device requires your explicit consent.

Compliance: This Privacy Policy complies with:

Who We Are

App Name: Sudokan
Developer: Bloom Byte SRL
Contact Email: contact@bloombyte.dev
Website: bloombyte.dev

Scope of This Policy

This Privacy Policy applies to:

By using Sudokan, you agree to this Privacy Policy. If you do not agree, please do not use the app.

You control what data we collect: On first launch, we ask for your consent to collect analytics, crash reports, and show personalized ads. You can change these preferences at any time in the app’s Privacy Settings.

Table of Contents

  1. Information We Collect
  2. How We Use Your Information
  3. Legal Basis for Processing (GDPR)
  4. Data Sharing and Third Parties
  5. Data Retention
  6. Data Security
  7. Your Rights and Choices
  8. Children’s Privacy
  9. International Data Transfers
  10. Changes to This Policy
  11. Contact Us
  12. Regional-Specific Information

1. Information We Collect

We believe in transparency. Here’s exactly what information Sudokan collects, broken down by category.

1.1 Information Stored Locally (On Your Device Only)

The following data never leaves your device and is stored using secure device storage:

Game Data

Storage Method: Hive database (encrypted local storage)
Retention: Until you delete the app or clear the data manually
Your Control: You can clear game history via the “Clear History” button in Game History screen

Settings and Preferences

Storage Method: SharedPreferences (secure device storage)
Retention: Until you change settings or uninstall the app
Your Control: Editable anytime in Settings and Privacy Settings screens

Important: This local data is NOT considered “data collection” under privacy laws because it never leaves your device. However, we disclose it for full transparency.

1.2 Analytics Data (Optional - Requires Your Consent)

If you consent to analytics on the Privacy Consent screen, we collect usage data to improve the app.

Service Used: Firebase Analytics (provided by Google LLC)

What We Collect Automatically (When Analytics Enabled)

Device Information:

App Usage Information:

Custom Events We Track (When Analytics Enabled)

We log specific gameplay and user interactions to understand how the app is used:

Game Flow Events (Examples):

Tutorial Events:

Progression Events:

Settings Events:

Advertising Events:

Total Events: We track various event types throughout the app to understand user interactions and improve your experience.

User Properties We Set (When Analytics Enabled)

To segment users and understand patterns, we set the following properties:

Total User Properties: Approximately 25 properties.

What Analytics Does NOT Collect

❌ Your name, email, phone number, or any personal identifiers
❌ The specific puzzle solutions you enter
❌ Your exact geolocation (only country-level)
❌ Your IP address (Firebase automatically strips it)
❌ Device identifiers (IDFA/AAID) unless personalized ads are enabled
❌ Data from other apps on your device
❌ Your contacts, photos, or other personal files

Your Control: Disable analytics anytime in Privacy Settings → “Improve the Game” toggle.

1.3 Crash Reporting Data (Optional - Requires Your Consent)

If you consent to crash reporting, we collect technical data when the app crashes to help us fix bugs.

Service Used: Firebase Crashlytics (provided by Google LLC)

What We Collect When App Crashes (When Crash Reporting Enabled)

Crash Information:

Device State at Crash:

Device Information:

Debug Logs (Non-Personal):

Crash Identifiers:

What Crash Reporting Does NOT Collect

❌ Your personal information
❌ Your IP address (stripped by Firebase)
❌ Device identifiers (IDFA/AAID)
❌ Your precise location
❌ User-entered data (puzzle solutions, feedback text)

Data Retention: Crash reports are automatically deleted after 90 days.

Your Control: Disable crash reporting anytime in Privacy Settings → “Help Us Fix Issues” toggle.

1.4 Advertising Data (Collected When Ads Are Shown)

Sudokan displays advertisements to support free access to the app. Ad data collection differs based on whether you consent to personalized ads.

Service Used: Google AdMob (provided by Google LLC)

Non-Personalized Ads (Default - No Consent Required)

If you do NOT consent to personalized ads, we show non-personalized ads based only on:

What is NOT collected in non-personalized mode: ❌ Advertising ID (IDFA/AAID)
❌ Cross-app tracking
❌ Interest-based targeting
❌ Behavioral data

Personalized Ads (Optional - Requires Your Consent)

If you consent to personalized ads on the Privacy Consent screen, AdMob may collect:

Advertising Identifiers:

These are device-specific IDs used to show you relevant ads based on your interests.

Cross-App Tracking:

Interest-Based Data:

Google Account Data (if you’re signed into Google on your device):

Location Data (if device permissions granted):

Ad Network Partners

Google AdMob works with 100+ third-party ad networks to serve ads. Each partner may collect data according to their own privacy policy.

Full list of ad partners: Google’s Authorized Buyers List

Common partners include:

Important: When you consent to personalized ads, these partners may also collect data.

Rewarded Ads

When you watch an ad to earn rewards (extra hints or mistake limit increase):

Your Control:

Learn More:

1.5 Feedback Data (Optional - Submitted Voluntarily)

When you submit feedback via the in-app feedback form, we collect:

Service Used: Cloud Firestore (provided by Google LLC)

What We Collect When You Submit Feedback

Your Input:

Automatically Attached Context (to help us understand your feedback):

What Feedback Does NOT Collect: ❌ Your name, email, or contact information
❌ Device identifiers (IDFA/AAID)
❌ IP address
❌ Precise location
❌ Your puzzle progress or game data

Data Storage:

Data Retention: Feedback is retained for 12 months unless you request deletion earlier.

Your Control:

1.6 What We Do NOT Collect (Ever)

To be absolutely clear, Sudokan never collects:

❌ Personal identifiers: Name, email, phone number, postal address
❌ Account credentials: No login required, no passwords
❌ Social media data: No Facebook/Google sign-in
❌ Contacts: We don’t access your contact list
❌ Photos/Videos: We don’t access your camera roll
❌ Microphone/Camera: No audio or video recording
❌ Precise location: Only country-level for ads (when consented)
❌ Biometrics: No fingerprint, Face ID, or biometric data
❌ Financial information: No payment processing (app is free)
❌ Health data: We’re a puzzle game, not a health app
❌ Browsing history: No web tracking
❌ Other app data: We only access Sudokan’s data

2. How We Use Your Information

We only use your information for the purposes described below. We do not use your data for any other purposes without your consent.

2.1 To Provide and Improve the App (Essential Functions)

Legal Basis: Legitimate interest (GDPR Art. 6(1)(f))

Locally stored data (game state, preferences) is used to:

No internet connection required for these functions.

2.2 To Analyze Usage and Improve Features (Analytics)

Legal Basis: Consent (GDPR Art. 6(1)(a))
Requires: Your consent on Privacy Consent screen

If you enable analytics, we use the collected data to:

Understand User Behavior:

Optimize Game Balance:

Fix User Experience Issues:

Prioritize Development:

Examples of Analytics Insights:

We do NOT use analytics for: ❌ Selling your data to third parties
❌ Targeting you with personalized ads (that’s separate consent)
❌ Discriminating or profiling you
❌ Making automated decisions that affect you legally

2.3 To Fix Bugs and Crashes (Crash Reporting)

Legal Basis: Consent (GDPR Art. 6(1)(a))
Requires: Your consent on Privacy Consent screen

If you enable crash reporting, we use the collected data to:

Identify and Fix Crashes:

Improve App Stability:

Example:

We do NOT use crash data for: ❌ Marketing or advertising
❌ Tracking your behavior
❌ Identifying you personally

2.4 To Show Advertisements (Ad Serving)

Legal Basis:

We display advertisements to support free access to Sudokan.

Non-Personalized Ads (default):

Personalized Ads (if you consent):

Rewarded Ads:

We do NOT: ❌ Sell your data to advertisers (Google serves the ads)
❌ Share your personal information with ad networks
❌ Control which specific ads are shown (Google’s automated system)
❌ Require watching ads to play (entirely optional for rewards)

2.5 To Respond to Feedback (User Support)

Legal Basis: Consent (GDPR Art. 6(1)(a)) - implicit by submitting feedback
Requires: Voluntary feedback submission

When you submit feedback, we use it to:

We may:

We do NOT: ❌ Respond to individual feedback (no contact info collected)
❌ Share feedback publicly
❌ Use feedback for marketing
❌ Link feedback to your identity (it’s anonymous)

Note: If you want a response to your feedback, please email us directly at contact@bloombyte.dev instead of using the in-app form.

2.6 To Deliver Daily Challenges (Content Delivery)

Legal Basis: Legitimate interest (GDPR Art. 6(1)(f))

We use a server to:

No tracking occurs: Daily challenge API calls do not collect user data, analytics events, or device identifiers.

2.7 Purposes We Do NOT Use Your Data For

To be transparent, here’s what we do NOT do with your data:

❌ Sell your data: We never sell user data to third parties
❌ Spam you: We don’t have your email, so we can’t
❌ Share with social media: No Facebook/Twitter/Instagram integration
❌ Credit scoring: We’re not a financial service
❌ Employment decisions: We’re not a background check service
❌ Insurance underwriting: We’re a puzzle game
❌ Discriminate: We don’t use data to discriminate based on race, religion, gender, etc.
❌ Automated decision-making: No AI/ML making decisions that affect you legally

If you’re in the European Union (EU) or European Economic Area (EEA), GDPR requires us to explain our legal basis for processing your data.

3.1 Consent (GDPR Article 6(1)(a))

What it means: You explicitly agree to data collection.

We rely on consent for:

Your rights:

3.2 Legitimate Interests (GDPR Article 6(1)(f))

What it means: Processing is necessary for our legitimate business interests, balanced against your rights.

We rely on legitimate interests for:

Our balancing test:

Your rights: You can object to processing based on legitimate interests (see Section 7).

3.3 Contract (GDPR Article 6(1)(b))

What it means: Processing is necessary to fulfill our agreement with you.

We do NOT rely on contract because:

3.4 Legal Obligation (GDPR Article 6(1)(c))

What it means: We must process data to comply with laws.

We may rely on legal obligation for:

Currently not applicable: We have no data we’re legally required to collect.

3.5 Vital Interests (GDPR Article 6(1)(d))

What it means: Processing is necessary to protect someone’s life.

Not applicable: Sudokan is a puzzle game, not a health/safety app.

3.6 Public Interest (GDPR Article 6(1)(e))

What it means: Processing is necessary for a task in the public interest.

Not applicable: We’re a private company, not a public authority.

Summary: We primarily rely on consent (for analytics, crash reporting, personalized ads) and legitimate interests (for core app functions). You control all consent-based processing through Privacy Settings.

4. Data Sharing and Third Parties

We do not sell your personal data. However, we work with trusted third-party service providers to deliver app functionality. This section explains who we share data with and why.

4.1 Google LLC (Our Primary Service Provider)

We use several Google services to power Sudokan. Here’s the breakdown:

Firebase Analytics

Firebase Crashlytics

Google AdMob

Cloud Firestore

Google’s Role: Google is a data processor, meaning they process data on our behalf according to our instructions. We have a Data Processing Agreement (DPA) with Google that includes:

Learn More:

4.2 Ad Network Partners (100+ Third Parties)

When you consent to personalized ads, Google AdMob shares data with 100+ ad network partners to serve targeted advertisements.

Common Partners (non-exhaustive list):

What They May Collect (when personalized ads enabled):

Their Role: These partners are independent data controllers, meaning they process data according to their own privacy policies, not just ours.

Full List: Google’s Authorized Buyers

Your Control:

Important: If you disable personalized ads in Sudokan, these partners will NOT receive your Advertising ID from our app. However, other apps on your device may still share data with them.

4.3 Daily Challenge API (Minimal Data Sharing)

Our Daily Challenge feature fetches daily puzzles from a server we control.

Data Shared:

Data NOT Shared: ❌ Device identifiers
❌ User behavior or analytics
❌ Your game progress
❌ Personal information

Server Location: Hosted in the cloud (specific provider subject to change)

Purpose: Ensure all users worldwide get the same daily challenge puzzle.

4.4 What We Do NOT Share

To be absolutely clear, we never share:

❌ Your puzzle solutions or game progress: This stays on your device
❌ Your local settings or preferences: Never leaves your device
❌ Your personal identifiers: We don’t collect them, so we can’t share them
❌ Your feedback text: Only stored in our private database, not shared with third parties
❌ Data for unrelated purposes: We don’t share data with unrelated third parties (e.g., data brokers, marketers)

We may disclose your information if required by law:

When We May Disclose:

What We Do:

Important: Because we collect minimal data and most stays on your device, we have very little data to disclose even if legally required.

4.6 Data Processing Agreement (DPA) Summary

For GDPR compliance, we have Data Processing Agreements with all processors:

Service Processor DPA/SCCs Data Location
Firebase Analytics Google LLC ✅ Yes USA (Iowa)
Firebase Crashlytics Google LLC ✅ Yes USA
Google AdMob Google LLC ✅ Yes Global
Cloud Firestore Google LLC ✅ Yes Belgium (EU)

Standard Contractual Clauses (SCCs): Google uses EU-approved SCCs for international data transfers (see Section 9 for details).

5. Data Retention

We retain your data only as long as necessary for the purposes described in this policy.

5.1 Local Data (On Your Device)

Game State, History, Statistics, Settings:

Important: We cannot remotely delete local data because it never leaves your device.

5.2 Analytics Data (Firebase Analytics)

Retention Period: 2 months (60 days) - automatically deleted by Firebase

What This Means:

Your Control:

After Deletion:

5.3 Crash Reporting Data (Firebase Crashlytics)

Retention Period: 90 days - automatically deleted by Firebase

What This Means:

Your Control:

After Deletion:

5.4 Advertising Data (Google AdMob)

Retention Period: Varies by ad network partner

Google AdMob Data:

Your Control:

After Opt-Out:

5.5 Feedback Data (Cloud Firestore)

Retention Period: 12 months - automatically deleted after 1 year

What This Means:

Your Control:

After Deletion:

5.6 Inactive Users

If you stop using Sudokan:

We do NOT have a concept of “user accounts”, so we can’t detect inactivity. Automatic retention periods apply regardless of usage.

5.7 Data Deletion Summary Table

Data Type Retention Period Auto-Delete? Manual Deletion
Local data (game state, settings) Until app uninstall ❌ No (your device) Clear data in app or uninstall
Analytics data 60 days ✅ Yes Email contact@bloombyte.dev
Crash reports 90 days ✅ Yes Email contact@bloombyte.dev
Ad data (non-personalized) ~30 days ✅ Yes N/A (automatic)
Ad data (personalized) Until opt-out/ID reset ❌ No Reset Advertising ID + opt out
Feedback 12 months ✅ Yes Email contact@bloombyte.dev

6. Data Security

We take reasonable measures to protect your data from unauthorized access, loss, or misuse.

6.1 Data Stored Locally (On Your Device)

Security Measures:

Your Responsibility:

What We Cannot Control:

6.2 Data in Transit (Network Communication)

Encryption:

What This Means:

6.3 Data at Rest (Third-Party Servers)

Google’s Security (Firebase, AdMob, Firestore):

Learn More:

6.4 Our Security Practices

As the app developer, we:

Access Controls:

Incident Response:

6.5 Limitations and Risks

No System is 100% Secure:

Third-Party Risks:

Your Role:

6.6 Security Contact

If you discover a security vulnerability:

Please do NOT:

We appreciate responsible disclosure and will credit security researchers (with permission).

7. Your Rights and Choices

Depending on your location, you have rights regarding your personal data. We respect all rights, regardless of where you live.

7.1 Universal Rights (Everyone, Worldwide)

You can always:

2. Clear Local Data

3. Uninstall the App

4. Contact Us

7.2 GDPR Rights (EU/EEA/UK Residents)

If you’re in the European Union, European Economic Area, or United Kingdom, you have additional rights under GDPR:

Right to Access (Article 15)

What: Request a copy of your personal data we hold

How to Exercise:

What You’ll Receive:

Timeline: Within 30 days (may extend to 60 days for complex requests)

Right to Rectification (Article 16)

What: Correct inaccurate personal data

How to Exercise:

Important: Most data we collect is technical (device model, app events), so rectification may not be applicable. If you believe data is inaccurate, we’ll investigate.

Timeline: Within 30 days

Right to Erasure / “Right to Be Forgotten” (Article 17)

What: Request deletion of your personal data

How to Exercise:

What We’ll Delete:

What We Cannot Delete:

Timeline: Within 30 days

After Deletion:

Right to Restrict Processing (Article 18)

What: Limit how we use your data while we verify a request (e.g., accuracy dispute)

How to Exercise:

Effect:

Timeline: Within 30 days

Right to Data Portability (Article 20)

What: Receive your data in a portable format to transfer to another service

How to Exercise:

What You’ll Receive:

Format: JSON (machine-readable)

Timeline: Within 30 days

Right to Object (Article 21)

What: Object to processing based on legitimate interests

How to Exercise:

Effect:

Timeline: Within 30 days

Right to Object to Automated Decision-Making (Article 22)

What: Object to decisions made solely by automated systems that significantly affect you

Sudokan’s Status: ❌ Not applicable - we don’t make automated decisions that legally or significantly affect you. Examples of what we DON’T do:

Dynamic Difficulty Adjustment (DDA): The DDA system adjusts puzzle difficulty recommendations, but:

Right to Lodge a Complaint

What: File a complaint with a data protection authority

How:

Common Authorities:

When to Complain:

No Penalty: Lodging a complaint doesn’t prevent you from seeking legal remedies.

7.3 CCPA/CPRA Rights (California Residents)

If you’re a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know (CCPA § 1798.100)

What: Request disclosure of:

How to Exercise:

What You’ll Receive:

Timeline: Within 45 days (may extend to 90 days with notice)

Right to Delete (CCPA § 1798.105)

What: Request deletion of personal information

How to Exercise: Same as GDPR erasure (see Section 7.2)

Exceptions: We may retain data if necessary for:

Timeline: Within 45 days

Right to Opt-Out of Sale (CCPA § 1798.120)

What: Opt out of “sale” of personal information

Sudokan’s Status: ❌ We do NOT sell personal information

However: Under CCPA’s broad definition, personalized ads may be considered “sale” in some interpretations.

Your Control:

No “Do Not Sell My Personal Information” Link: We don’t display this because:

Right to Opt-Out of Sharing for Cross-Context Behavioral Advertising (CPRA § 1798.135)

What: Opt out of sharing data for targeted advertising across different contexts (apps, websites)

How to Exercise:

Timeline: Immediate

Right to Correct Inaccurate Information (CPRA § 1798.106)

What: Request correction of inaccurate personal information

How to Exercise: Same as GDPR rectification (see Section 7.2)

Timeline: Within 45 days

Right to Limit Use of Sensitive Personal Information (CPRA § 1798.121)

What: Limit use of sensitive personal information for certain purposes

Sudokan’s Status: ❌ We do NOT collect sensitive personal information as defined by CCPA:

Right to Non-Discrimination (CCPA § 1798.125)

What: We cannot discriminate against you for exercising CCPA rights

Sudokan’s Commitment:

Financial Incentive Disclosure: ❌ We offer no financial incentives for data collection (e.g., discounts for opting in), so this is not applicable.

7.4 Other Regional Rights

Brazil (LGPD)

Law: Lei Geral de Proteção de Dados (LGPD)
Rights: Similar to GDPR (access, correction, deletion, portability, consent withdrawal)
How to Exercise: Email contact@bloombyte.dev with subject “LGPD Data Request”
Timeline: Within 15 days

Supervisory Authority: Autoridade Nacional de Proteção de Dados (ANPD)

Japan (APPI)

Law: Act on the Protection of Personal Information (APPI)
Rights: Disclosure, correction, suspension of use, deletion
How to Exercise: Email contact@bloombyte.dev with subject “APPI Data Request”
Timeline: Without delay

Supervisory Authority: Personal Information Protection Commission (PPC)

Other Countries

If your country has data protection laws, we’ll honor equivalent rights:

How to Exercise: Email contact@bloombyte.dev with subject “[Country] Data Protection Request”

7.5 How to Exercise Your Rights

To make any data request:

  1. Email us: contact@bloombyte.dev
  2. Subject line: Specify the type of request (e.g., “GDPR Data Deletion Request”)
  3. Include:
    • Your device model (e.g., “iPhone 14”, “Samsung Galaxy S23”)
    • Your country/region
    • Approximate dates of app usage (helps us locate your data)
    • Specific request details
  4. We’ll respond within the legal timeline (typically 30-45 days)

Verification:

No Cost: Exercising your rights is free. We may charge a reasonable fee for excessive or repetitive requests.

8. Children’s Privacy

Sudokan is designed for players 13 years of age and older. We comply with the Children’s Online Privacy Protection Act (COPPA) and other child privacy laws.

8.1 Age Restriction

Minimum Age: 13+

Why: Data collection (analytics, crash reporting, ads) requires parental consent for children under 13 in many jurisdictions (COPPA in the US, GDPR in EU).

Enforcement:

8.2 COPPA Compliance (United States)

COPPA Requirements: Websites/apps directed at children under 13 must:

  1. Obtain verifiable parental consent before collecting personal information
  2. Disclose data collection practices
  3. Offer parents the ability to review, delete, and control data

Sudokan’s Status: ❌ Not directed at children under 13

If a Child Under 13 Uses Sudokan:

How to Report: If you believe your child under 13 used Sudokan and consented to data collection, email contact@bloombyte.dev with subject “COPPA Data Deletion Request”. We’ll delete data within 30 days.

8.3 GDPR-K (EU Children’s Privacy)

EU Age of Consent for Data Processing: Varies by country (13-16 years)

Parental Consent: If a child below the age of consent uses Sudokan:

Recommendation: Parents should:

8.4 Parents: How to Protect Your Child

To ensure child safety:

  1. Disable Data Collection:
    • Go to Privacy Settings
    • Disable “Improve the Game” (analytics)
    • Disable “Help Us Fix Issues” (crash reporting)
    • Disable “Personalized Ads” (ad targeting)
  2. Use Device Parental Controls:
    • iOS: Settings → Screen Time → Content & Privacy Restrictions
    • Android: Google Family Link app
  3. Monitor Usage:
    • Check Screen Time reports
    • Review app permissions periodically
  4. Restrict In-App Purchases (if we add them in the future):
    • iOS: Settings → Screen Time → Content & Privacy Restrictions → iTunes & App Store Purchases → In-App Purchases → Don’t Allow
    • Android: Google Play Store → Settings → Require authentication for purchases

Contact Us: If you have concerns about your child’s privacy, email contact@bloombyte.dev.

8.5 Third-Party Responsibility

Google AdMob and ad network partners have their own child privacy policies:

We cannot control third-party practices, but we choose reputable partners committed to child safety.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your own. This section explains how we protect your data during international transfers.

9.1 Where Your Data Is Processed

Data Storage Locations:

Data Type Primary Location Processor Legal Basis for Transfer
Local data (game state, settings) Your device (your country) N/A No transfer (stays local)
Analytics data United States (Iowa) Google LLC (Firebase) Standard Contractual Clauses (SCCs)
Crash reports United States Google LLC (Crashlytics) Standard Contractual Clauses (SCCs)
Ad data Global (multiple countries) Google LLC + ad networks Standard Contractual Clauses (SCCs) / Adequacy Decisions
Feedback Belgium (EU) Google LLC (Firestore) Within EU (no transfer if you’re in EU)

Why Data Leaves Your Country:

If you’re in the EU/EEA/UK, transferring your data outside these regions requires legal safeguards under GDPR Articles 44-50.

Standard Contractual Clauses (SCCs)

What: EU Commission-approved contract templates that legally protect data transferred outside the EU

Our Implementation:

Your Rights Under SCCs:

Learn More:

Adequacy Decisions

What: EU Commission’s determination that a country provides adequate data protection

Applicable Countries:

Firestore EU Region:

EU-U.S. Data Privacy Framework (DPF)

Status as of November 2025: The EU-U.S. Data Privacy Framework provides a legal basis for transatlantic data transfers.

Google’s Certification:

Your Rights:

Learn More: Data Privacy Framework List

Important: Even without DPF, our SCCs with Google ensure legal compliance.

9.3 Third-Party Ad Network Transfers

Challenge: 100+ ad networks may transfer data globally

Our Approach:

  1. Non-personalized ads (default): Minimal data shared, country-level only
  2. Personalized ads (if you consent):
    • Google AdMob uses SCCs with ad partners
    • Many ad networks are EU-U.S. DPF certified
    • Some may rely on other legal bases (e.g., adequacy decisions, local processing)

Your Control:

Transparency: We cannot guarantee all 100+ ad networks comply perfectly with GDPR. We choose reputable partners and rely on Google’s vetting process.

9.4 Data Transfers to Romania (Our Location)

Developer Location: Bloom Byte SRL is based in Romania (EU member state)

Transfers to Romania:

Exception: If you email us (contact@bloombyte.dev), your email is processed in Romania. This is a direct transfer you initiate voluntarily.

9.5 Government Access to Data (Surveillance Concerns)

Concern: U.S. government surveillance laws (FISA Section 702, Executive Order 12333) may allow access to data stored in the U.S.

Our Position:

What We Do If We Receive a Legal Request:

  1. Review for legal validity
  2. Challenge overbroad or unlawful requests
  3. Notify affected users (if legally allowed)
  4. Disclose only minimum necessary data

Transparency Report: Google publishes government data requests: Google Transparency Report

9.6 Your Rights Regarding International Transfers

If you’re in the EU/EEA/UK:

If we cannot provide adequate safeguards, we’ll stop processing your data (and you can use the app offline with all consents disabled).

9.7 Future Changes to Data Locations

If we change service providers or data locations:

Current commitment: Firestore will remain in EU (Belgium) for feedback storage.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or app features.

10.1 How We Notify You of Changes

Material Changes (e.g., new data collection, changed purposes, new third parties):

Non-Material Changes (e.g., clarifications, typos, formatting, contact info updates):

Where to Find the Latest Version:

10.2 Your Rights When Policy Changes

If you disagree with changes:

If we require re-consent:

10.3 Version History

Current Version: November 9, 2025

Major Updates:

Future updates will be listed here with brief descriptions.

10.4 Review Frequency

We review this Privacy Policy:

Last Review Date: November 9, 2025

11. Contact Us

We’re committed to transparency and answering your privacy questions.

11.1 Privacy Inquiries

For privacy-related questions, requests, or complaints:

Email: contact@bloombyte.dev
Subject Line Suggestions:

Response Time: Within 30 days (may extend to 60 days for complex requests with notice)

What to Include:

11.2 Developer Information

Company Name: Bloom Byte SRL
Registered Address: Bucharest, Romania
Website: bloombyte.dev
Email: contact@bloombyte.dev

App Store Presence:

11.3 Data Protection Officer (DPO)

GDPR Requirement: Companies processing large-scale EU personal data must appoint a DPO.

Sudokan’s Status: ❌ Not required

However: We treat privacy inquiries with DPO-level seriousness. All privacy requests go directly to the developer/founder.

11.4 EU Representative (GDPR Article 27)

GDPR Requirement: Non-EU companies processing EU data must appoint an EU representative.

Sudokan’s Status: ✅ Not required - Bloom Byte SRL is based in Romania (EU member state)

If you’re an EU resident, you can contact us directly at contact@bloombyte.dev (we’re already in the EU).

11.5 Supervisory Authorities (Data Protection Agencies)

If you’re unsatisfied with our response, you can lodge a complaint with a data protection authority:

European Union (GDPR)

Your country’s supervisory authority:

Developer’s Authority (Romania):

United States (CCPA/CPRA)

California Attorney General:

Brazil (LGPD)

Autoridade Nacional de Proteção de Dados (ANPD):

Other Countries

Search “[Your Country] data protection authority” or “privacy regulator” to find your local authority.

11.6 Security Vulnerability Reporting

If you discover a security issue:

We’ll respond within 7 days and work to fix the issue promptly.

Responsible Disclosure: Please don’t publicly disclose vulnerabilities before we fix them. We appreciate security researchers and will credit you (with permission).

12. Regional-Specific Information

This section provides additional details for users in specific regions.

12.1 European Union (EU) / European Economic Area (EEA)

Applicable Law: General Data Protection Regulation (GDPR)

Key Points for EU Residents:

Firestore EU Storage: Feedback data stored in Belgium (europe-west1) stays within the EU.

GDPR Rights Summary (see Section 7.2 for full details):

  1. Right to access (Article 15)
  2. Right to rectification (Article 16)
  3. Right to erasure (Article 17)
  4. Right to restrict processing (Article 18)
  5. Right to data portability (Article 20)
  6. Right to object (Article 21)
  7. Right not to be subject to automated decision-making (Article 22)
  8. Right to lodge a complaint (Article 77)

Supervisory Authority: Contact your country’s data protection authority or Romania’s ANSPDCP (our location).

12.2 United Kingdom (UK)

Applicable Law: UK GDPR + Data Protection Act 2018

Key Points for UK Residents:

Supervisory Authority:

Your Rights: Identical to EU GDPR (see Section 7.2).

12.3 California, United States (CCPA/CPRA)

Applicable Law: California Consumer Privacy Act (CCPA) + California Privacy Rights Act (CPRA)

Key Points for California Residents:

“Sale” of Personal Information:

Do Not Sell or Share My Personal Information:

CCPA Rights Summary (see Section 7.3 for full details):

  1. Right to Know (§ 1798.100)
  2. Right to Delete (§ 1798.105)
  3. Right to Opt-Out of Sale (§ 1798.120) - N/A (we don’t sell)
  4. Right to Opt-Out of Sharing for Cross-Context Behavioral Advertising (CPRA § 1798.135)
  5. Right to Correct Inaccurate Information (CPRA § 1798.106)
  6. Right to Limit Use of Sensitive Personal Information (CPRA § 1798.121) - N/A (we don’t collect)
  7. Right to Non-Discrimination (§ 1798.125)

Authorized Agent: You may designate an authorized agent to submit requests on your behalf. The agent must provide proof of authorization.

Contact for CCPA Requests: contact@bloombyte.dev (subject: “CCPA Data Request”)

12.4 Brazil (LGPD)

Applicable Law: Lei Geral de Proteção de Dados (LGPD)

Key Points for Brazilian Residents:

Legal Basis (LGPD Article 7):

Data Controller: Bloom Byte SRL (contact@bloombyte.dev)

Supervisory Authority:

Contact for LGPD Requests: contact@bloombyte.dev (subject: “LGPD Data Request”)

Response Time: Within 15 days (may extend to 30 days for complex requests)

12.5 Other Regions

Canada (PIPEDA)

Law: Personal Information Protection and Electronic Documents Act
Rights: Access, correction, withdrawal of consent
Contact: contact@bloombyte.dev (subject: “PIPEDA Data Request”)

Australia (Privacy Act)

Law: Privacy Act 1988 + Australian Privacy Principles (APPs)
Rights: Access, correction, complaint to OAIC
Contact: contact@bloombyte.dev (subject: “Privacy Act Request”)

Japan (APPI)

Law: Act on the Protection of Personal Information
Rights: Disclosure, correction, suspension of use
Supervisory Authority: Personal Information Protection Commission (PPC)
Contact: contact@bloombyte.dev (subject: “APPI Data Request”)

South Korea (PIPA)

Law: Personal Information Protection Act
Rights: Access, correction, deletion, suspension
Supervisory Authority: Personal Information Protection Commission (PIPC)
Contact: contact@bloombyte.dev (subject: “PIPA Data Request”)

India (DPDPA)

Law: Digital Personal Data Protection Act 2023 (when enforced)
Rights: Similar to GDPR (access, correction, erasure)
Contact: contact@bloombyte.dev (subject: “DPDPA Data Request”)

General Policy: If your country has data protection laws not listed here, we’ll honor equivalent rights. Contact us at contact@bloombyte.dev with your country’s law name.

13. Additional Information

13.1 California “Shine the Light” Law (Civil Code § 1798.83)

Law: Requires disclosure of personal information shared with third parties for direct marketing.

Sudokan’s Status: ❌ Not applicable

If this changes: We’ll update this policy and provide opt-out mechanisms.

13.2 Nevada Privacy Rights (SB 220)

Law: Nevada residents can opt out of the “sale” of covered information.

Sudokan’s Status: ❌ We do NOT sell personal information (no financial exchange)

Your Control: Disable personalized ads in Privacy Settings if concerned about data sharing with ad networks.

13.3 Do Not Track (DNT) Signals

What: Web browsers can send “Do Not Track” signals to websites.

Sudokan’s Status: ❌ Not applicable - we’re a mobile app, not a website

Equivalent Control: Privacy Settings → Disable “Personalized Ads” (stops cross-app tracking)

In-app links (e.g., to Google’s privacy policies, app store listings):

Links in this Privacy Policy:

13.5 Accessibility

We’re committed to making this Privacy Policy accessible:

If you need this policy in an alternative format (e.g., large print, audio), email contact@bloombyte.dev.

13.6 Language and Translations

Original Language: English (this version is authoritative)

Translations: We may provide translations in the future for:

In case of conflict: The English version prevails for legal interpretation.

14. Definitions (Glossary)

To help you understand this policy, here are definitions of key terms:

Personal Data / Personal Information: Information that identifies you or can be used to identify you (e.g., device identifiers, IP address). Under privacy laws, this includes pseudonymous data.

Processing: Any operation on personal data (collection, storage, use, sharing, deletion).

Data Controller: The entity that decides why and how personal data is processed. Sudokan (Bloom Byte SRL) is the data controller.

Data Processor: An entity that processes data on behalf of the controller. Google LLC is our data processor.

Consent: Your freely given, specific, informed, and unambiguous agreement to data processing.

Legitimate Interests: A legal basis for processing when necessary for the controller’s interests, balanced against your rights.

Pseudonymization: Processing data so it can’t identify you without additional information (e.g., replacing names with random IDs).

Anonymization: Irreversibly removing all identifiers so data can never identify you (not personal data anymore).

Standard Contractual Clauses (SCCs): EU-approved contract terms that protect data transferred outside the EU.

Adequacy Decision: EU Commission’s determination that a country provides adequate data protection.

Supervisory Authority: Government agency that enforces data protection laws (e.g., ICO in UK, ANSPDCP in Romania).

Data Subject: You, the individual whose data is being processed.

Third Party: An entity other than you and us (e.g., Google, ad networks).

Advertising ID: A device-specific identifier for advertising (IDFA on iOS, AAID on Android). Resettable by users.

Cross-App Tracking: Tracking your activity across multiple apps to build a profile.

GDPR: General Data Protection Regulation (EU law).

CCPA/CPRA: California Consumer Privacy Act / California Privacy Rights Act (California law).

COPPA: Children’s Online Privacy Protection Act (US law for children under 13).

LGPD: Lei Geral de Proteção de Dados (Brazil’s data protection law).

15. Acknowledgments

This Privacy Policy was drafted with care to comply with:

Resources consulted:

Legal Review: This policy was created by the developer. We recommend users review it carefully. If you have legal concerns, consult a privacy attorney in your jurisdiction.

16. Effective Date and Acceptance

Effective Date: November 9, 2025

By using Sudokan after this date, you acknowledge that you have read, understood, and agree to this Privacy Policy.

If you do not agree:

Your continued use of the app after policy updates constitutes acceptance of the revised policy.

Summary

Thank you for reading Sudokan’s Privacy Policy. Here’s a quick recap:

What We Collect

What We DON’T Collect

Your Control

Our Commitment

Questions? Email contact@bloombyte.dev - we respond within 30 days.

Enjoy playing Sudokan! 🎉

END OF PRIVACY POLICY

Document Information: